chore: release v1.14.2 (#263)

* fix: auto-mark intakes at due time and show robot marker

* test: add taken_source to integration schema

* test: align e2e route schema with taken_source

.env.example

@@ -12,6 +12,13 @@ PGID=1000
 PORT=3000
 CORS_ORIGINS=http://localhost:4174
 LOG_LEVEL=info
+# Levels: debug, info, warn, error, silent
+# Controls: backend Fastify logging, frontend nginx access logs (Docker),
+#           and frontend browser console (via build-time injection)
+
+# Rate limit: max requests per minute per IP (default: 100)
+# Increase for development/testing environments
+# RATE_LIMIT_MAX=100
 
 # Timezone for scheduled reminders (e.g., Europe/Berlin, America/New_York)
 TZ=Europe/Berlin
@@ -118,4 +125,5 @@ EXPIRY_WARNING_DAYS=30            # Days before expiry to show yellow warning
 
 # UI defaults
 # DEFAULT_LANGUAGE=en              # en or de
-# DEFAULT_STOCK_CALCULATION_MODE=automatic  # automatic or manual
+# DEFAULT_STOCK_CALCULATION_MODE=automatic  # automatic or manual
+# DEFAULT_SHARE_STOCK_STATUS=true  # Show stock status on shared schedule links

.github/agents/release-manager.agent.md

@@ -15,22 +15,111 @@ You are the release manager for **MedAssist-ng**. Your job is to guide code from
 - **NEVER release, tag, push, or create PRs without explicit user confirmation at each step.** Always present your plan and wait for approval.
 - **NEVER push directly to `main`** — GitHub will reject it (`GH013: Repository rule violations`). All changes go through Pull Requests.
 - **NEVER skip CI checks.** Wait for all status checks to pass before merging.
+- **Testing ownership belongs to `@testing-manager`**. Do not plan or implement tests in this agent; request/hand off to testing-manager when testing work is required.
+- **Track all work in the GitHub Project board.** Every PR should reference an issue. Move issues through the board as work progresses.
+- **ALWAYS verify Project board status after merge.** The `project-auto-done.yml` workflow moves items to "Done" automatically when issues close or PRs merge. Verify it ran successfully; if it didn't, move items manually via GraphQL (see Task 6).
+
+## CI/CD Ownership (Authoritative)
+
+This repository intentionally uses only two operational agents for CI/CD handoff clarity.
+
+- **No separate CI/CD agent is used.**
+- **`@release-manager` owns orchestration and monitoring** of all GitHub workflow runs for PRs, merges, releases, and post-release status.
+- **`@testing-manager` owns root-cause analysis and fixes** for testing-related workflow failures.
+
+### Current Workflow Assignment
+
+| Workflow | Primary Owner | Responsibility |
+|---------|----------------|----------------|
+| `.github/workflows/test.yml` | `@testing-manager` | Diagnose/fix backend/frontend test/lint/build test failures |
+| `.github/workflows/e2e.yml` | `@testing-manager` | Diagnose/fix Playwright E2E failures and flakiness |
+| `.github/workflows/codeql.yml` | `@release-manager` | Track required security check state and block merge until green |
+| `.github/workflows/docker-build.yml` | `@release-manager` | Monitor build/publish pipeline on main/tags and release readiness |
+| `.github/workflows/update-test-badges.yml` | `@release-manager` | Monitor post-build badge update workflow completion |
+| `.github/workflows/add-to-project.yml` | `@release-manager` | Ensure issue/project automation is functioning for delivery flow |
+| `.github/workflows/project-auto-done.yml` | `@release-manager` | Auto-move project items to "Done" when issues close or PRs merge |
+
+### Monitoring Rule (Must Follow)
+
+- During active PR/release work, `@release-manager` must keep all relevant current workflows in view until completion.
+- If a failing workflow is testing-related (`test.yml` or `e2e.yml`), immediately hand off diagnosis/fix to `@testing-manager`.
+
+## GitHub CLI Safety (Non-Interactive Only)
+
+- Never use `gh` commands that can open an interactive pager and block execution (requiring `q`).
+- Always run `gh` commands in non-interactive mode using `GH_PAGER=cat` (or `--no-pager` where supported).
+- Do not use these commands in agent flows:
+   - `gh pr view 155 --json statusCheckRollup --jq '.statusCheckRollup[] | {name:.name,conclusion:.conclusion,detailsUrl:.detailsUrl,workflowName:.workflowName}'`
+   - `SHA=$(gh pr view 155 --json headRefOid --jq .headRefOid) && gh api repos/DanielVolz/medassist-ng/commits/$SHA/check-runs --jq '.check_runs[] | {name,conclusion,details_url,html_url,app:.app.name}'`
+- Use safe variants instead:
+   - `GH_PAGER=cat gh pr view <PR_NUMBER> --json statusCheckRollup --jq '<jq-filter>'`
+   - `GH_PAGER=cat gh api repos/<owner>/<repo>/commits/<sha>/check-runs --jq '<jq-filter>'`
+
+---
+
+## PR Strategy: One PR per Feature/Fix
+
+**Each feature or bug fix MUST be submitted as its own separate PR.** Do NOT bundle multiple unrelated changes into a single PR.
+
+**Why:**
+- Each change keeps a traceable PR workflow, but release notes must reference merged commit hashes
+- CI checks each change in isolation — failures are easy to trace
+- Git blame and rollbacks are precise
+- Code review stays focused
+
+**Rules:**
+- One logical change = one branch = one PR
+- If a bug fix is discovered while working on a feature, create a **separate branch and PR** for the fix
+- Related changes (e.g., feature + implementation refinements) belong in the **same** PR
+- Squash-merge is still used — keeps `main` history clean with one commit per PR
+- Branch naming reflects the change: `fix/bottle-stock-calc`, `feat/theme-dropdown`, etc.
+
+**Example — bad (bundled):**
+```
+PR #138: "feat: theme dropdown, fix bottle bugs, fix planner, fix reminders"
+```
+
+**Example — good (separate):**
+```
+PR #138: "fix: bottle-type stock calculations across all subsystems"
+PR #139: "fix: intake reminder past-intake seeding"
+PR #140: "feat: theme dropdown with Light/Dark/System options"
+PR #141: "fix: planner checkbox layout on single line"
+```
+
+---
+
+## PR Metadata (MANDATORY)
+
+Every Pull Request MUST have the following sidebar fields populated at creation time:
+
+| Field | Value | How |
+|-------|-------|-----|
+| **Assignee** | `DanielVolz` (repo owner) | `--assignee DanielVolz` |
+| **Label** | Match the change type: `enhancement` (feat), `bug` (fix), `documentation` (docs) | `--label <label>` |
+| **Project** | `@DanielVolz's MedAssist-ng project` | `--project "@DanielVolz's MedAssist-ng project"` |
+
+**Label mapping for PRs:**
+| Branch prefix / commit type | Label |
+|---|---|
+| `feat/` | `enhancement` |
+| `fix/` | `bug` |
+| `docs/` | `documentation` |
+| `chore/` (non-release) | `enhancement` or `bug` depending on content |
+| `chore/release-*` | No label needed (release PRs are automated) |
+
+These fields provide traceability, filtering, and project board integration. **Never leave them empty.**
 
 ---
 
 ## Task 1: Branch, PR, and Merge Workflow
 
-When code changes (features or bug fixes) are complete and tested locally:
+When code changes (features or bug fixes) are complete:
 
 ### Step 1: Verify Readiness
 
 1. Check for uncommitted changes: `git status`
-2. Ensure all tests pass locally:
-   ```bash
-   cd backend && CI=true npm test
-   cd frontend && CI=true npm test
-   ```
-3. If tests fail, stop and fix them first.
+2. Confirm testing has been completed by `@testing-manager` and CI is expected to pass.
 
 ### Step 2: Create Feature Branch
 
@@ -55,10 +144,20 @@ When code changes (features or bug fixes) are complete and tested locally:
    ```bash
    git push -u origin feat/short-description
    ```
-2. Create a Pull Request via GitHub CLI:
+2. Create a Pull Request via GitHub CLI with **all metadata fields populated**:
    ```bash
-   gh pr create --title "fix: short description" --body "Description of charges"
+   gh pr create \
+     --title "fix: short description" \
+     --body "Closes #<ISSUE_NUMBER>
+
+   Description of changes" \
+     --assignee DanielVolz \
+     --label bug \
+     --project "@DanielVolz's MedAssist-ng project"
    ```
+   - Use `--label enhancement` for `feat/` branches, `--label bug` for `fix/` branches, `--label documentation` for `docs/` branches.
+   - Using `Closes #N` in the PR body ensures the issue is automatically closed on merge.
+   - The `--project` flag links the PR to the Project board.
 3. **Present the PR URL to the user and wait for confirmation.**
 
 ### Step 4: Wait for CI and Merge
@@ -67,9 +166,7 @@ When code changes (features or bug fixes) are complete and tested locally:
    ```bash
    gh pr checks <PR_NUMBER> --watch
    ```
-   Required checks:
-   - ✅ `backend-test` (TypeScript type-check + vitest coverage)
-   - ✅ `frontend-build` (npm build)
+   Required checks: all repository-required checks must pass.
 2. If CI fails: analyze the failure, fix it, push again, and re-check.
 3. Once CI is green, **ask the user for merge confirmation**, then:
    ```bash
@@ -179,8 +276,8 @@ The version number is displayed in the **About modal** (Settings → About) as a
 
 ### After Tagging
 
-- The `docker-build.yml` workflow automatically builds and pushes Docker images to GHCR.
-- The `version-bump.yml` workflow automatically updates `package.json` versions if needed.
+- The `docker-build.yml` workflow automatically builds and pushes Docker images to GHCR with both versioned tags (`1.8.7`, `1.8`) and `latest`.
+- The `update-test-badges.yml` workflow runs automatically after a successful Docker build to update README badges.
 - Track progress: `https://github.com/DanielVolz/medassist-ng/actions`
 
 ---
@@ -212,19 +309,20 @@ Read the actual code changes (not just commit messages) to understand what was a
 - Use `### Heading` for sections
 - Use **bold** for feature names in bullet points
 - Keep descriptions on the same line as the feature name
-- Minimal emoji usage (sparingly, not on every line)
+- **No emojis** — do not use emoji in headings or bullet points
+- **Include commit references** — each bullet point must end with a short commit hash (e.g., `(ab12cd3)`) that links to the commit URL.
+- **Do not use PR references** in release notes (no `#123` or PR URLs in bullet references).
 - Always end with "Where to Find It" section
 - End with: `**Full Changelog**: https://github.com/DanielVolz/medassist-ng/compare/vPREV...vNEW`
 
 **ONLY include user-relevant changes.** DO NOT include:
-- ❌ Technical implementation details (new columns, endpoints, database changes)
-- ❌ Number of tests added
-- ❌ Internal API changes (unless breaking)
-- ❌ Excessive emoji on every bullet point
-- ❌ .gitignore changes or other developer-only file changes
-- ❌ AI/Copilot instruction updates
-- ❌ CI/CD workflow changes (unless affecting users)
-- ❌ Code refactoring without user-visible changes
+- Technical implementation details (new columns, endpoints, database changes)
+- Internal API changes (unless breaking)
+- Emojis anywhere in the release notes
+- .gitignore changes or other developer-only file changes
+- AI/Copilot instruction updates
+- CI/CD workflow changes (unless affecting users)
+- Code refactoring without user-visible changes
 
 ### Example: Good Release Notes
 
@@ -235,14 +333,14 @@ This release introduces a medication refill tracking feature and improves the mo
 
 ### New Features
 
-- **Medication Refill**: Track when you refill your medications with a single click. Add full packs or individual pills and view complete refill history.
-- **Automatic Stock Updates**: Stock levels are automatically recalculated after each refill.
-- **Refill History**: Each medication shows a complete history of all refills with timestamps.
+- **Medication Refill**: Track when you refill your medications with a single click. Add full packs or individual pills and view complete refill history. (ab12cd3)
+- **Automatic Stock Updates**: Stock levels are automatically recalculated after each refill. (ab12cd3)
+- **Refill History**: Each medication shows a complete history of all refills with timestamps. (de34f56)
 
-### Mobile Improvements
+### Improvements
 
-- **Centered Tooltips**: Info tooltips now display centered on screen for better readability.
-- **Touch-friendly**: Tooltips close automatically when scrolling on touch devices.
+- **Centered Tooltips**: Info tooltips now display centered on screen for better readability. (f7890ab)
+- **Touch-friendly**: Tooltips close automatically when scrolling on touch devices. (f7890ab)
 
 ### Where to Find It
 
@@ -294,25 +392,121 @@ gh release create vX.Y.Z --title "vX.Y.Z" --notes "RELEASE_NOTES_HERE"
 
 ---
 
+## Task 5: README Update Check (MANDATORY for new features)
+
+When the release includes **new features** (minor or major version bump), you MUST check whether the `README.md` needs to be updated **before** executing the release.
+
+### What to check
+
+- New ENV variables or changed defaults
+- New API endpoints or changed routes
+- New UI features, pages, or settings
+- Changed setup/install steps or Docker configuration
+- New dependencies or changed architecture
+- New screenshots needed for new UI features
+
+### Workflow
+
+1. Review the changes included in the release
+2. If any README-relevant changes are found, **present the proposed README updates to the user and wait for approval** before proceeding
+3. If the README update is approved, commit it to the feature branch (or create a separate `docs/update-readme` branch) **before** running the release script
+4. Do NOT silently update the README — always ask first
+
+> **Note:** For patch releases (bug fixes only), a README check is not required unless the fix changes documented behavior.
+
+---
+
+## Task 6: GitHub Project Management
+
+All work is tracked in the [GitHub Project board](https://github.com/users/DanielVolz/projects/1) (Project ID: `PVT_kwHOADH82s4BO2OT`).
+
+### Board Columns (Status)
+| Column | Color | Description |
+|--------|-------|-------------|
+| Triage | Purple | New issues needing review |
+| Backlog | Green | Accepted, not yet started |
+| Ready | Blue | Ready to be picked up |
+| In progress | Yellow | Currently being worked on |
+| Done | Orange | Completed |
+
+### Custom Fields
+| Field | Options | Usage |
+|-------|---------|-------|
+| **Type** | Bug (red), Feature (green), Chore (gray), Documentation (blue) | Categorize the work |
+| **Priority** | High (red), Medium (orange), Low (yellow) | Set urgency |
+| **Size** | XS, S, M, L, XL | Estimate effort |
+
+### Workflow During PRs
+
+1. **Before creating a PR**: Check if a corresponding issue exists on the Project board. If not, create one:
+   ```bash
+   gh issue create --title "fix: description" --label bug
+   ```
+   Issues with `enhancement`, `bug`, or `triage` labels are **automatically added** to the board.
+
+2. **When creating a PR**: Always reference the issue with `Closes #N` in the PR body so the issue is automatically **closed** on merge. Note: this does NOT move the Project board status — that must be done manually (see step 3).
+
+3. **After merge — verify automation**: The `project-auto-done.yml` workflow automatically moves project items to "Done" when issues close or PRs merge. After merge, verify it ran:
+   ```bash
+   GH_PAGER=cat gh issue view <ISSUE_NUMBER> --json state,projectItems --jq '{state, projects: [.projectItems[] | {title: .title, status: .status.name}]}'
+   ```
+
+   **Manual fallback** — if the workflow fails or the item wasn't moved, use GraphQL:
+   ```bash
+   GH_PAGER=cat gh api graphql -f query='mutation {
+     updateProjectV2ItemFieldValue(input: {
+       projectId: "PVT_kwHOADH82s4BO2OT"
+       itemId: "<ITEM_ID>"
+       fieldId: "PVTSSF_lAHOADH82s4BO2OTzg9bdkE"
+       value: { singleSelectOptionId: "ca45af98" }
+     }) { projectV2Item { id } }
+   }'
+   ```
+
+   **Known Project field IDs (Status):**
+   | Status | Option ID |
+   |--------|-----------|
+   | Triage | `826183f5` |
+   | Backlog | `c7cb819e` |
+   | Ready | `13307944` |
+   | In progress | `732e285e` |
+   | Done | `ca45af98` |
+
+   Status field ID: `PVTSSF_lAHOADH82s4BO2OTzg9bdkE`
+
+### Issue Labels
+| Label | Applied by | Purpose |
+|-------|-----------|--------|
+| `enhancement` | Feature request template | New features |
+| `bug` | Bug report template | Bug fixes |
+| `triage` | Both templates | Needs review |
+
+All three labels trigger the `add-to-project.yml` workflow, which automatically adds the issue to the Project board.
+
+---
+
 ## Complete Workflow Summary
 
 ```
-Code complete & tests pass locally
+Code complete & validated by testing-manager
         ↓
-1. Create feature branch (fix/... or feat/...)
-2. Commit, push, create PR
-3. Wait for CI (backend-test + frontend-build)
-4. Merge PR to main (squash + delete branch)
+1. Ensure a GitHub issue exists (create if not)
+2. Create feature branch (fix/... or feat/...)
+3. Commit, push, create PR (with "Closes #N" in body, assignee, label, project)
+4. Wait for CI (all required checks)
+5. Merge PR to main (squash + delete branch)
+6. Verify issue moved to "Done" on Project board (automated by `project-auto-done.yml`; fallback: GraphQL, see Task 6)
         ↓
 Ready for release?
         ↓
-5. Check current version (git tag + package.json)
-6. Analyze changes → determine SemVer level
-7. Run ./scripts/release.sh <patch|minor|major>
-   (or manually: branch → version bump → PR → CI → merge → tag)
+7. Check current version (git tag + package.json)
+8. Analyze changes → determine SemVer level
+9. If minor/major: check README.md for needed updates (Task 5)
+10. Run ./scripts/release.sh <patch|minor|major>
+    (or manually: branch → version bump → PR → CI → merge → tag)
         ↓
-8. Write release notes (mandatory for minor/major)
-9. Publish GitHub release
+11. Write release notes (mandatory for minor/major)
+12. Publish GitHub release
         ↓
 Docker images built automatically via CI
 ```

.github/agents/testing-manager.agent.md

@@ -0,0 +1,120 @@
+---
+name: testing-manager
+description: Owns testing strategy, test implementation, local validation, and CI test triage for backend, frontend, and Playwright E2E.
+argument-hint: Describe what to test, e.g., "add tests for stock warning fix" or "analyze failing Playwright checks"
+---
+
+# Testing Manager Agent
+
+You are the testing manager for **MedAssist-ng**. Your job is to ensure every feature and bug fix is validated with the right tests, that CI test failures are diagnosed and fixed at the root cause, and that test coverage quality does not regress.
+
+**All output (test code, comments, notes) MUST be in English**, even if the user communicates in German.
+
+## Critical Testing Rules
+
+- **Tests are mandatory**: Every new feature and every bug fix MUST have corresponding tests.
+- **Fix bugs, don't test around them**: If behavior is incorrect, fix the implementation first, then write tests for correct behavior.
+- **Run tests non-interactively**: Use `CI=true` where required to avoid watch-mode hangs.
+- **Never start interactive report servers**: Do not run commands that wait for manual input (for example Playwright HTML report server: `Serving HTML report ... Press Ctrl+C to quit`). Always use finite, non-interactive commands and reporters.
+- **No remote git operations**: Do not push, merge, create PRs, tags, or releases. Hand over to `@release-manager` when ready.
+- **Keep scope focused**: Do not fix unrelated failures unless explicitly requested.
+
+## CI/CD Ownership Boundary
+
+- **`@testing-manager` owns testing workflows only**: `.github/workflows/test.yml` and `.github/workflows/e2e.yml`.
+- **`@release-manager` owns orchestration/monitoring** of full workflow lifecycle and all non-testing workflows.
+- If a failure is outside testing scope (`codeql`, `docker-build`, `update-test-badges`, `add-to-project`), report and hand off to `@release-manager`.
+
+## Test Stack & Locations
+
+- **Backend**: Vitest 2.1 + v8 coverage
+- **Frontend unit/integration**: Vitest
+- **E2E**: Playwright
+
+Primary locations:
+
+- Backend tests: `backend/src/test/*.test.ts`
+- Frontend tests: `frontend/src/test/**`
+- Playwright E2E: `frontend/e2e/**`
+
+## Required Test Workflow
+
+1. Identify changed behavior and expected outcomes.
+2. Add/update tests near the affected feature.
+3. Run the smallest relevant subset first.
+4. Expand to broader suites if subset passes.
+5. Report what was run, what passed, and any remaining known failures.
+
+## Commands
+
+### Backend
+
+```bash
+cd backend && CI=true npm test
+cd backend && CI=true npm run test:coverage
+cd backend && CI=true npm test -- -t "test name"
+```
+
+### Frontend
+
+```bash
+cd frontend && CI=true npm test
+cd frontend && npm run lint
+cd frontend && npm run build
+```
+
+### Playwright E2E
+
+```bash
+cd frontend && npm run test:e2e
+cd frontend && npm run test:e2e -- --project=chromium
+# Never use interactive UI/headed/report-server commands in agent runs.
+# Do not use: npm run test:e2e:ui, npm run test:e2e:headed, npx playwright show-report
+```
+
+## Backend Test Patterns
+
+- Prefer using test utilities from backend test setup (e.g. `buildTestApp`, helper factories).
+- Validate both status codes and response payloads.
+- Add regression tests for every fixed bug.
+- Keep tests deterministic and isolated.
+
+## E2E Test Patterns
+
+- Use stable selectors and explicit assertions.
+- Avoid flaky timing assumptions; prefer waiting for concrete UI states.
+- For auth-sensitive flows, handle both auth-enabled and auth-disabled environments when applicable.
+- For CI triage, inspect failed run logs first, then reproduce locally with targeted specs.
+
+## CI Failure Triage
+
+When test checks fail:
+
+1. Retrieve exact failed jobs and logs.
+2. Categorize failure: lint/format, environment/proxy, flaky selectors, app bug.
+3. Fix root cause.
+4. Re-run focused tests locally.
+5. Re-run broader checks if needed.
+6. Hand off for PR/merge via `@release-manager`.
+
+## CI/CD Testing Context
+
+- PR validation includes backend tests and frontend build/lint checks.
+- E2E runs in GitHub Actions through `.github/workflows/e2e.yml`.
+- Docker build and badge update workflows run after merge/tag and may include test-related verification.
+
+### Testing Workflow Focus (Current)
+
+| Workflow | Testing-Manager Action |
+|---------|------------------------|
+| `.github/workflows/test.yml` | Investigate failures, implement fixes, revalidate locally |
+| `.github/workflows/e2e.yml` | Investigate failures/flakes, stabilize tests, revalidate locally |
+
+## Done Criteria
+
+Testing work is complete when:
+
+- Required tests exist and validate intended behavior.
+- Relevant local test commands pass.
+- CI test failures are resolved or clearly documented with rationale.
+- No temporary debugging files remain in the workspace.

.github/copilot-instructions.md

@@ -1,459 +1,77 @@
 # MedAssist-ng - AI Coding Instructions
 
-## General Rules
+## Purpose
 
-- **English is the primary language**: All code, comments, documentation, commit messages, PR descriptions, and GitHub releases MUST be written in English. The user may communicate in German, but all project artifacts must be in English.
-- **NEVER release without explicit permission**: Do NOT create tags, releases, or version bumps unless the user explicitly asks for it. Always wait for explicit confirmation before any release action.
-- **NEVER create PRs, push, or merge**: Only the **release-manager agent** (`@release-manager`) is allowed to create Pull Requests, push branches to the remote, or merge code. Regular agents and Copilot MUST NOT perform any git operations that affect the remote repository (no `git push`, no `gh pr create`, no `gh pr merge`). Present your local changes and tell the user to invoke `@release-manager` when ready to ship.
-- **No temporary files**: Delete temporary scripts/files immediately after use. Do not commit temporary debug scripts, test files, or one-off utilities to the repository.
-- **Clean workspace**: Always clean up after yourself. If you create a file for a specific task, delete it once done.
-- **Remove old code when re-implementing**: When fixing a bug or re-implementing a feature that didn't work, ALWAYS remove the old/broken code completely. Never leave dead code, unused functions, or obsolete implementations in the codebase.
-- **Tests are mandatory**: Every new feature and every bug fix MUST have corresponding tests. When modifying existing features, update or add tests accordingly. If old tests become obsolete due to code changes, remove or update them.
-- **Fix bugs, don't test around them**: If you discover incorrect behavior in the code while writing tests, ALWAYS fix the buggy code first, then write tests that verify the correct behavior. NEVER write tests that mimic or assert broken behavior. The user's time is finite and irreplaceable — every bug left unfixed wastes it.
-- **Keep README.md up to date**: After implementing code changes, check whether the `README.md` needs to be updated (e.g., new features, changed ENV variables, new commands, changed architecture, new endpoints, updated screenshots). If changes are relevant to the README, **ask the user for confirmation** before updating it. Do NOT silently update the README — always present the proposed README changes and wait for approval. Examples of README-relevant changes: new ENV variables, new API endpoints, new UI features, changed setup/install steps, new dependencies, changed Docker configuration.
+Use `AGENTS.md` as the canonical governance source. Read the referenced skill files before starting any task.
 
-## Architecture Overview
+## Project Orientation (Read First)
 
-MedAssist-ng is a **medication tracking and planning app** with a monorepo structure:
+- **Product**: MedAssist-ng is a medication planner with stock tracking, reminders (email/push), refill history, and schedule sharing.
+- **Tech stack**: React + TypeScript + Vite (`frontend/`), Fastify + TypeScript + Drizzle + SQLite (`backend/`).
+- **Request path**: Frontend uses `/api/*` only; backend route handlers live in `backend/src/routes/`.
+- **Primary backend modules**:
+	- Auth/SSO: `backend/src/routes/auth.ts`, `backend/src/routes/oidc.ts`, `backend/src/plugins/auth.ts`
+	- Medications/data: `backend/src/routes/medications.ts`, `backend/src/db/schema.ts`
+	- Reminders: `backend/src/services/reminder-scheduler.ts`, `backend/src/routes/planner.ts`, `backend/src/routes/settings.ts`
+- **Primary frontend modules**:
+	- Pages: `frontend/src/pages/`
+	- Shared app state: `frontend/src/context/AppContext.tsx`
+	- Domain hooks: `frontend/src/hooks/`
+	- Translations: `frontend/src/i18n/en.json`, `frontend/src/i18n/de.json`
 
-- **Backend**: Fastify 5 + TypeScript + SQLite (Drizzle ORM) at `backend/`
-- **Frontend**: React 18 + Vite + TypeScript at `frontend/`
-- **Database**: SQLite with migrations in `backend/src/db/migrations/`
-- **Deployment**: Docker Compose with separate dev containers
-- **i18n**: English (en) and German (de) via react-i18next
+Use this orientation for quick navigation before applying the rules below.
 
-### Data Flow
-```
-Frontend (React) → /api/* proxy → Backend (Fastify) → SQLite
-                   ↓ (Vite rewrites /api to /)
-```
+## Always-On Rules
 
-The Vite proxy at `frontend/vite.config.ts` rewrites `/api/*` to `/` - so frontend calls `/api/medications` but backend route is just `/medications`.
+- English only for project artifacts.
+- **NEVER run remote git commands** — no `git push`, no `gh pr create/merge`, no `gh release`, no `git tag`. Prepare locally, then hand off to `@release-manager`.
+- Testing work belongs to `@testing-manager`.
+- PR/release/CI orchestration belongs to `@release-manager`.
+- Keep changes local, focused, and consistent with existing UI/API patterns.
+- **Hard PR scope + size rule**: one cohesive objective per PR; if scope drifts or diff becomes large (target <= 500 changed lines, hard split at ~800+), split into logical follow-up PRs instead of bundling.
+- Remove obsolete code when re-implementing — never leave dead code behind.
+- **Document behavioral discoveries**: When you discover or clarify how a feature works (e.g., what triggers notifications, how thresholds interact, which code paths exist), **always** add or update the relevant section in `doku/APP_BEHAVIOR.md`. This is mandatory — do not rely on conversation context alone.
 
-## Development Commands
+## MedAssist Essentials
 
-```bash
-# Start dev environment (preferred)
-docker compose -f docker-compose.dev.yml up
+- Frontend calls backend through `/api/*`.
+- DB changes must stay backward-compatible (schema default + alter migration + null-safe reads).
 
-# Or run services separately:
-cd backend && npm run dev      # tsx watch on port 3000
-cd frontend && npm run dev     # Vite on port 5173
+---
 
-# Production
-docker compose up -d
+## Skills (MANDATORY — read before every task)
 
-# Database migrations
-cd backend && npm run migrate
+Before starting any task, identify which skills apply and **read their full SKILL.md file** for detailed rules.
 
-# Run tests
-cd backend && npm test              # Run all tests
-cd backend && npm run test:coverage # Run with coverage report
-```
+| Skill | Trigger | File |
+|---|---|---|
+| **Architecture Guard** | API endpoints, frontend API calls, routing, code placement | `.github/skills/medassist-architecture-guard/SKILL.md` |
+| **DB Compatibility** | Persisted data, schema changes, migrations | `.github/skills/medassist-db-compat-check/SKILL.md` |
+| **i18n Enforcer** ⚠️ | Any user-facing text in frontend or backend | `.github/skills/medassist-i18n-enforcer/SKILL.md` |
+| **UI Consistency** | UI flows, modals, buttons, forms, settings | `.github/skills/medassist-ui-consistency/SKILL.md` |
+| **Frontend Polish** | Visual quality improvements | `.github/skills/medassist-frontend-polish/SKILL.md` |
+| **Security Sanity** | Backend routes, auth, file handling, external input | `.github/skills/medassist-security-sanity/SKILL.md` |
+| **Observability Guard** | Services, schedulers, startup, failure handling | `.github/skills/medassist-observability-guard/SKILL.md` |
+| **Config Change Guard** | `.env`, Docker, Vite proxy, runtime defaults | `.github/skills/medassist-config-change-guard/SKILL.md` |
+| **Doc Sync Guard** | Behavior changes, setup, env vars, workflows | `.github/skills/medassist-doc-sync-guard/SKILL.md` |
+| **Testing Handoff** | Writing/running tests, CI test failures | `.github/skills/medassist-testing-handoff/SKILL.md` |
+| **Release Handoff** | Branch push, PR, merge, tagging, release | `.github/skills/medassist-release-handoff/SKILL.md` |
+| **Skill Quality Review** | Creating/modifying skills | `.github/skills/medassist-skill-quality-review/SKILL.md` |
 
-## Testing (MANDATORY)
+### Non-negotiable parity rules (always apply)
 
-> ⚠️ **IMPORTANT**: Every new feature MUST be covered by tests!
-> Pull Requests without tests for new features will not be accepted.
+1. **Desktop + Mobile Parity**: Medication edit has two paths — `MedicationsPage.tsx` (desktop) and `MobileEditModal` (mobile). **Always update BOTH**.
+2. **Notification Dual Code Paths**: Notifications have two code paths — `backend/src/services/reminder-scheduler.ts` (scheduler) and `backend/src/routes/planner.ts` (manual). **Always update BOTH**.
 
-### Test Framework
-- **Vitest 2.1** with v8 Coverage
-- Tests in `backend/src/test/*.test.ts`
-- Coverage goal: At least equal or better coverage after changes
+---
 
-### Test Structure
-| File | Tests |
-|------|-------|
-| `routes.test.ts` | API endpoints (Auth, Medications, Doses, Settings, Share, Planner) |
-| `services.test.ts` | Scheduler utilities (Timezone, Blisters, Usage calculation) |
-| `db.test.ts` | Database schema and operations |
+## Delegation
 
-### Writing Tests
+- **Testing handoff → `@testing-manager`**: test planning, writing, execution, CI test triage.
+- **Release handoff → `@release-manager`**: PR/release orchestration, merge flow, workflow monitoring.
 
-```typescript
-// Backend Test Example (backend/src/test/example.test.ts)
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import { createTestApp, createTestUser } from './routes.test'; // Test-Utilities
+## Key References
 
-describe('Feature Name', () => {
-  let app: FastifyInstance;
-  let authToken: string;
-
-  beforeAll(async () => {
-    app = await createTestApp();
-    const user = await createTestUser(app);
-    authToken = user.token;
-  });
-
-  afterAll(async () => {
-    await app.close();
-  });
-
-  it('should do something specific', async () => {
-    const response = await app.inject({
-      method: 'GET',
-      url: '/endpoint',
-      headers: { Authorization: `Bearer ${authToken}` }
-    });
-    
-    expect(response.statusCode).toBe(200);
-    expect(response.json()).toHaveProperty('expectedField');
-  });
-});
-```
-
-### Test Commands
-```bash
-cd backend
-CI=true npm test            # Run tests once (ALWAYS run this way!)
-CI=true npm run test:coverage  # With coverage report
-npm test -- --watch         # Watch mode for manual development
-npm test -- -t "test name"  # Run single test
-```
-
-> ⚠️ **IMPORTANT for AI agents**: ALWAYS run tests with `CI=true`!
-> Without `CI=true`, Vitest runs in watch mode and waits for input.
-
-## CI/CD Pipeline (GitHub Actions)
-
-### Workflow Overview
-
-```
-Pull Request created
-        ↓
-┌─────────────────────────────────────┐
-│  test.yml                           │
-│  ├─ backend-test (parallel)         │
-│  │   ├─ npm ci                      │
-│  │   ├─ tsc --noEmit (Type-Check)   │
-│  │   └─ npm run test:coverage       │
-│  └─ frontend-build (parallel)       │
-│      ├─ npm ci                      │
-│      └─ npm run build               │
-└─────────────────────────────────────┘
-        ↓ Tests must pass
-    PR can be merged
-        ↓
-Push to main / Tag created
-        ↓
-┌─────────────────────────────────────┐
-│  docker-build.yml                   │
-│  ├─ backend-test (parallel)         │
-│  ├─ frontend-build (parallel)       │
-│  └─ build-and-push (after tests)    │
-│      ├─ Build Docker images         │
-│      └─ Push to GHCR                │
-└─────────────────────────────────────┘
-```
-
-### Branch Protection
-
-> ⚠️ **IMPORTANT**: The `main` branch is protected!  
-> Direct pushing to `main` is **not possible** - GitHub will reject the push.  
-> All changes must go through Pull Requests.
-
-- **main** branch is protected (Repository Rules)
-- Direct pushing is rejected by GitHub with: `GH013: Repository rule violations`
-- PRs require:
-  - ✅ `backend-test` Status Check passed
-  - ✅ `frontend-build` Status Check passed
-- After successful merge, the feature branch is automatically deleted
-
-**Workflow for changes:**
-```bash
-# 1. Create feature branch
-git checkout -b feat/my-feature
-
-# 2. Commit and push changes
-git add . && git commit -m "feat: Description"
-git push -u origin feat/my-feature
-
-# 3. Create PR (via GitHub CLI or Web)
-gh pr create --title "My Feature" --body "Description"
-
-# 4. Wait until CI is green, then merge
-gh pr merge --squash --delete-branch
-```
-
-### Workflow Files
-| File | Trigger | Purpose |
-|------|---------|--------|
-| `.github/workflows/test.yml` | Pull Requests | Run tests, block PR on failures |
-| `.github/workflows/docker-build.yml` | Push to main, Tags | Tests + Build and push Docker images |
-
-## Key Patterns
-
-### Backend Routes (`backend/src/routes/`)
-| Route File | Endpoints |
-|------------|-----------|
-| `auth.ts` | `/auth/login`, `/auth/register`, `/auth/logout`, `/auth/refresh`, `/auth/me` |
-| `medications.ts` | CRUD `/medications`, `/medications/:id/image` |
-| `doses.ts` | `/doses/taken` - track dose intake |
-| `planner.ts` | `/medications/usage` - calculate usage for date range |
-| `settings.ts` | `/settings` - user settings CRUD |
-| `share.ts` | `/share` - create share tokens, `/share/:token` - public access |
-| `health.ts` | `/health` - health check endpoint |
-
-### Backend Services (`backend/src/services/`)
-| Service | Description |
-|---------|-------------|
-| `reminder-scheduler.ts` | Stock reminder emails/push notifications |
-| `intake-reminder-scheduler.ts` | Intake reminder notifications |
-
-### Frontend (`frontend/src/App.tsx`)
-- Single-file React app with all components and state
-- Uses React Router for navigation
-- API calls use `/api/` prefix (proxied by Vite)
-- Medication scheduling logic with intake schedules (multiple time entries per medication)
-
-## Frontend Components & Views
-
-### Routes / Pages
-| Route | Description |
-|-------|-------------|
-| `/dashboard` | Main view with Coverage Cards + Upcoming Schedules timeline |
-| `/medications` | Medications list + New/Edit form with all fields |
-| `/planner` | Usage planner - calculate needed pills for date range |
-| `/settings` | App settings: notifications, email, thresholds, language |
-| `/schedule` | Full schedule view (simplified, no coverage cards) |
-| `/share/:token` | Public share link for "taken by" user schedule |
-
-### Key React Components (in App.tsx)
-| Component | Description |
-|-----------|-------------|
-| `App` | Root component with BrowserRouter |
-| `AppRouter` | Handles auth check, renders AppContent or Auth |
-| `AppContent` | Main app shell with navigation, header, all routes |
-| `SharedSchedule` | Public share page for medication schedules by person |
-| `MedicationAvatar` | Round avatar with medication image or colored initial |
-
-### Dashboard Sections
-| Section | Description |
-|---------|-------------|
-| **Coverage Cards** | Stock status cards per medication: days left, blisters, status (Normal/Warning/Critical) |
-| **Upcoming Schedules** | Timeline grouped by day, collapsible days, dose tracking |
-
-### Schedule/Timeline Elements
-| Element | CSS Class | Description |
-|---------|-----------|-------------|
-| Past days toggle | `.past-days-toggle` | Click to show/hide past days |
-| Day container | `.day-block` | Container for one day, collapsible |
-| Today highlight | `.day-block.today` | Blue border/background for current day |
-| Past day | `.day-block.past` | Dashed border, reduced opacity |
-| All taken | `.day-block.all-taken` | Green styling when all doses taken |
-| Day header | `.day-divider` | Date header with collapse toggle arrow |
-| Collapse icon | `.day-collapse-icon` | ▶/▼ arrow for expand/collapse |
-| Day summary | `.day-summary` | Shows "X/Y" doses taken or "✓ All taken" |
-| Medication row | `.time-row` | One medication's doses for that day |
-| Dose item | `.dose-item` | Individual dose with time, amount, take/undo button |
-| Dose taken | `.dose-item.taken` | Green background when dose is marked taken |
-| Dose overdue | `.dose-item.overdue` | Styling for past untaken doses |
-| Dose future | `.dose-item.future` | Disabled button for future days |
-
-### Medication Form (New/Edit)
-| Field | Description |
-|-------|-------------|
-| Commercial Name | Main medication name (required) |
-| Generic Name | Scientific/generic name (optional) |
-| Taken By | Person taking the medication (optional, enables filtering/sharing) |
-| Packs | Number of full packs |
-| Blisters per Pack | Strips/blisters in each pack |
-| Pills per Blister | Tablets per strip |
-| Loose Pills | Extra pills not in blisters |
-| Pill Weight (mg) | Weight per pill for dose calculation display |
-| Expiry Date | Medication expiration |
-| Notes | Free text notes |
-| Image Upload | Medication photo (preview for new, direct upload for edit) |
-| **Intake Schedule** | One or more intake entries defining usage pattern |
-
-### Intake Schedule
-Each blister defines a recurring intake:
-- **Usage (Pills)**: How many pills per dose
-- **Every (Days)**: Interval (1 = daily, 7 = weekly)
-- **Start (Date/Time)**: When the schedule starts (determines past/future doses)
-- **Remind checkbox**: Enable intake reminders (🔔)
-
-### Modals
-| Modal | Trigger | Content |
-|-------|---------|---------|
-| Medication Detail | Click on coverage card or medication row | Full medication info, stock, schedule preview, edit/delete/ICS buttons |
-| Image Lightbox | Click medication image | Full-size medication image |
-| Share Dialog | "Share" button on schedules | Generate share link for specific "taken by" person |
-| User Schedule Filter | Click on "taken by" badge | Filter schedule by person |
-
-### Settings Sections
-| Section | Settings |
-|---------|----------|
-| General | Language toggle (EN/DE) |
-| Stock Thresholds | Warning days, critical days, expiry warning days |
-| Email Notifications | Enable, email address, stock/intake toggles |
-| Push Notifications (Shoutrrr) | Enable, URL (ntfy/gotify/etc), stock/intake toggles |
-| Reminder Settings | Days before, repeat daily, skip for taken, repeat/nagging |
-| SMTP | Email config (read-only from .env) |
-
-### Settings ENV Defaults
-All user settings can be pre-configured via ENV variables (see `.env.example`).
-These are only used as **defaults when a new user is created**.
-Once a user saves settings in the app, their saved values take precedence over ENV.
-
-| ENV Variable | Setting | Default |
-|--------------|---------|---------|
-| `DEFAULT_EMAIL_ENABLED` | Email notifications | false |
-| `DEFAULT_SHOUTRRR_ENABLED` | Push notifications | false |
-| `DEFAULT_SHOUTRRR_URL` | ntfy/gotify URL | (empty) |
-| `DEFAULT_REPEAT_REMINDERS_ENABLED` | Nagging reminders | false |
-| `DEFAULT_REMINDER_REPEAT_INTERVAL_MINUTES` | Nag interval | 30 |
-| `DEFAULT_MAX_NAGGING_REMINDERS` | Max nags | 5 |
-| `DEFAULT_LOW_STOCK_DAYS` | Low stock threshold | 30 |
-| `DEFAULT_LANGUAGE` | UI language | en |
-
-## Database Schema (`backend/src/db/schema.ts`)
-
-| Table | Description |
-|-------|-------------|
-| `users` | User accounts with password hash, auth provider, timestamps |
-| `medications` | Per-user medications with inventory, schedules as JSON arrays |
-| `userSettings` | Per-user settings: notifications, thresholds, language |
-| `refreshTokens` | JWT refresh tokens for auth rotation |
-| `shareTokens` | Public share links by takenBy person |
-| `doseTracking` | Tracks when doses are marked as taken |
-
-### Key Medication Fields
-```typescript
-{
-  name, genericName, takenByJson,        // Identity (takenByJson is JSON array)
-  packCount, blistersPerPack, pillsPerBlister, looseTablets,  // Inventory
-  pillWeightMg,                          // For mg display
-  usageJson, everyJson, startJson,       // Intake schedules as JSON arrays
-  imageUrl, expiryDate, notes,           // Optional metadata
-  intakeRemindersEnabled                 // Per-med reminder toggle
-}
-```
-
-### Dose ID Format
-Dose IDs follow the pattern: `{medicationId}-{blisterIndex}-{timestampMs}`
-Example: `5-0-1735344000000` = Medication 5, Blister 0, timestamp
-
-## State Management (AppContent)
-
-### Key State Variables
-| State | Purpose |
-|-------|---------|
-| `meds` | Array of all user's medications |
-| `form` | Current medication form data |
-| `editingId` | ID of medication being edited (null for new) |
-| `pendingImage` / `pendingImagePreview` | Image upload for new medications |
-| `settings` / `savedSettings` | User settings current vs saved |
-| `scheduleDays` | How many days to show (30/90/180) |
-| `showPastDays` | Toggle for past days visibility |
-| `takenDoses` | Set of dose IDs that are marked taken |
-| `manuallyCollapsedDays` / `manuallyExpandedDays` | Day collapse state |
-| `selectedMed` | Medication shown in detail modal |
-| `selectedUser` | Filter schedule by "taken by" person |
-
-### Key Computed Values (useMemo)
-| Value | Purpose |
-|-------|---------|
-| `schedule` | All scheduled events from `buildSchedulePreview()` |
-| `groupedSchedule` | Events grouped by day |
-| `pastDays` / `futureDays` | Split groupedSchedule by today |
-| `coverage` | Stock coverage calculations |
-| `coverageByMed` / `depletionByMed` | Coverage lookups |
-
-## Conventions
-
-- **TypeScript**: Strict mode, ESM modules (`"type": "module"`)
-- **Styling**: CSS custom properties in `frontend/src/styles.css`, dark/light theme via `data-theme`
-- **API responses**: Return objects directly, Fastify serializes to JSON
-- **Environment**: Copy `.env.example` → `.env`, secrets must be 10+ chars
-- **i18n**: All UI text via `t('key')` function, translations in `frontend/src/i18n/*.json`
-- **UI Consistency**: Always use existing components for modals, buttons, and forms. For confirmation dialogs, use `ConfirmModal` component. Never create inline modals with custom button styling - all UI elements must match the existing design system. When adding new sections to existing components, ensure font sizes, spacing, margins, and button styles match exactly with other sections. Check existing CSS classes before creating new ones.
-
-## Database Schema Changes (IMPORTANT: Backward Compatibility!)
-
-> ⚠️ **CRITICAL**: The app MUST remain backward compatible with older databases!
-> Users upgrade their Docker containers but keep their existing DB.
-> The app must NOT crash if old columns are missing.
-
-### ⚠️ MANDATORY for EVERY New Feature
-
-**Before implementing ANY feature that touches user data or settings:**
-
-1. **Check if new DB columns are needed** - Does the feature require storing new data?
-2. **If YES → Follow ALL steps below** - Schema.ts + Drizzle migration + ALTER migration + NULL-safe code
-3. **NEVER skip the ALTER migration** - This is the #1 cause of production 500 errors!
-
-**Common mistake:** Adding a column to `schema.ts` and forgetting the ALTER migration in `client.ts`.
-The Drizzle migration only works for NEW databases. Existing production databases need the ALTER migration!
-
-### Schema Management with Drizzle Kit
-
-The database schema uses **Drizzle Kit** for migrations. There is a **single source of truth**:
-
-- **`backend/src/db/schema.ts`** - Drizzle ORM schema definitions (TypeScript)
-- **`backend/drizzle/`** - Generated SQL migrations (auto-generated from schema.ts)
-
-**DO NOT manually edit migration files!** They are generated from schema.ts.
-
-### Adding New Columns
-
-1. **Add to schema.ts** with DEFAULT value:
-   ```typescript
-   maxNaggingReminders: integer("max_nagging_reminders").notNull().default(5),
-   ```
-
-2. **Generate migration**:
-   ```bash
-   cd backend && npx drizzle-kit generate --name add_column_name
-   ```
-
-3. **Add backward-compatible ALTER migration** in `client.ts` `runAlterMigrations()`:
-   ```typescript
-   `ALTER TABLE user_settings ADD COLUMN max_nagging_reminders integer NOT NULL DEFAULT 5`,
-   ```
-
-4. **NULL-safe reading** in routes:
-   ```typescript
-   maxNaggingReminders: settings.maxNaggingReminders ?? 5,
-   ```
-
-### Rules for New Columns
-
-1. **ALWAYS with DEFAULT value**: New columns must have `NOT NULL DEFAULT <value>`
-2. **NULL-safe in code**: All queries must use `?? defaultValue` or `?? false`
-3. **Generate migration**: Run `npx drizzle-kit generate` after schema changes
-4. **Add ALTER migration**: For backward compatibility with existing DBs
-
-### What is NOT Allowed
-
-- ❌ Deleting or renaming columns (breaks old DBs)
-- ❌ `NOT NULL` without `DEFAULT` (INSERT fails)
-- ❌ Reading columns without fallback in code
-- ❌ Manually editing migration SQL files
-- ❌ Documenting "delete DB" as a solution
-
-### When Backward Compatibility is NOT Possible
-
-If a breaking change is unavoidable:
-1. **Explicitly communicate**: Document in release notes
-2. **Migration script**: Provide automatic upgrade script
-3. **Version check**: App should check DB version and warn
-
-## File Locations
-
-| Purpose | Location |
-|---------|----------|
-| Backend entry | `backend/src/index.ts` |
-| Database schema | `backend/src/db/schema.ts` |
-| Drizzle migrations | `backend/drizzle/*.sql` |
-| Drizzle config | `backend/drizzle.config.ts` |
-| Backend routes | `backend/src/routes/*.ts` |
-| Backend services | `backend/src/services/*.ts` |
-| Frontend app | `frontend/src/App.tsx` |
-| Frontend auth | `frontend/src/components/Auth.tsx` |
-| Styles | `frontend/src/styles.css` |
-| i18n English | `frontend/src/i18n/en.json` |
-| i18n German | `frontend/src/i18n/de.json` |
-| Docker prod | `docker-compose.yml` |
-| Docker dev | `docker-compose.dev.yml` |
-| Env template | `.env.example` |
+- Canonical governance: `AGENTS.md`
+- Skill files: `.github/skills/*/SKILL.md`
+- Specialist agents: `.github/agents/testing-manager.agent.md`, `.github/agents/release-manager.agent.md`

.github/dependabot.yml

@@ -0,0 +1,53 @@
+version: 2
+
+updates:
+  # Backend dependencies
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Frontend dependencies
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Root dev dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "ci"

.github/skills/README.md

@@ -0,0 +1,28 @@
+# MedAssist Agent Skills
+
+This directory contains project skills for VS Code Copilot.
+
+Each skill lives in its own folder and must include a `SKILL.md` file.
+
+## Global Rule Reminder
+
+When re-implementing a feature or fix path, remove obsolete/unused code immediately.
+Do not leave dead code behind.
+Also follow the canonical global engineering rules in `AGENTS.md`.
+Use one governance source to avoid duplicated or conflicting policy text.
+
+## Skills
+
+- `medassist-karpathy-core` — enforce assumption clarity, simplicity, surgical diffs, and verifiable execution.
+- `medassist-architecture-guard` — enforce frontend/backend boundary and `/api/*` data-flow conventions.
+- `medassist-db-compat-check` — enforce backward-compatible SQLite/Drizzle schema changes.
+- `medassist-i18n-enforcer` — enforce translation-key-only UI copy with EN/DE parity.
+- `medassist-ui-consistency` — enforce non-negotiable UI guardrails and component/style reuse.
+- `medassist-frontend-polish` — apply tasteful visual refinement after consistency guardrails are met.
+- `medassist-security-sanity` — apply baseline security checks for backend and input/auth-sensitive changes.
+- `medassist-config-change-guard` — validate env, Docker, proxy, and runtime-config compatibility.
+- `medassist-doc-sync-guard` — ensure docs stay aligned with behavior/setup/config changes.
+- `medassist-observability-guard` — preserve actionable logging, health checks, and failure visibility.
+- `medassist-skill-quality-review` — review skill quality, trigger clarity, and governance alignment.
+- `medassist-testing-handoff` — delegate testing and CI test-failure triage to `@testing-manager`.
+- `medassist-release-handoff` — delegate PR/merge/release actions to `@release-manager`.

.github/skills/medassist-architecture-guard/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: medassist-architecture-guard
+description: Guard MedAssist architectural boundaries and route/data-flow conventions when changing backend or frontend code, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when a task touches API endpoints, frontend API calls, routing, or code placement.
+
+## Goals
+
+- Keep responsibilities in the correct layer.
+- Preserve MedAssist proxy and routing conventions.
+- Prevent architecture drift and cross-layer anti-patterns.
+
+## Required Checks
+
+1. Frontend network calls use `/api/*` paths.
+2. Backend routes are implemented under `backend/src/routes/` with matching service logic in `backend/src/services/` when needed.
+3. No frontend-only logic is moved into backend and no backend-only logic is embedded in UI components.
+4. Type definitions are shared through existing project structure (`types/`, route DTO patterns) without creating duplicate source-of-truth models.
+
+## MedAssist-Specific Guardrails
+
+- Respect Vite proxy behavior: frontend calls `/api/*`, backend exposes `/...` routes.
+- Keep app shell and routing patterns aligned with existing frontend pages/components.
+- Prefer minimal, local changes over broad restructures.
+
+## Response Format
+
+When this skill is used, summarize:
+
+- Which architectural checks were applied
+- Which files are affected
+- Any boundary risks found and how they were resolved

.github/skills/medassist-config-change-guard/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: medassist-config-change-guard
+description: Validate MedAssist configuration changes across env vars, Docker compose, proxy settings, and runtime defaults, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when changes touch `.env`, Docker files, Vite proxy settings, runtime defaults, or app startup behavior.
+
+## Objective
+
+Prevent configuration drift and broken local/CI environments.
+
+## Required Checks
+
+1. New/changed config has safe defaults.
+2. Env changes are backward-compatible where feasible.
+3. Docker/dev runtime changes remain consistent across services.
+4. Frontend/backend URL/proxy conventions remain valid (`/api/*`).
+5. Documentation reflects configuration changes.
+
+## Files to Prioritize
+
+- `.env.example`
+- `docker-compose.yml`
+- `docker-compose.dev.yml`
+- `frontend/vite.config.ts`
+- Relevant package scripts and startup files
+
+## Anti-Patterns
+
+- Hidden required env vars with no defaults.
+- Inconsistent host/port/proxy settings across environments.
+- Config changes without doc updates.
+
+## Response Format
+
+Report:
+
+- Config files reviewed
+- Compatibility impact (none/low/high)
+- Required follow-up updates
+- Final readiness recommendation

.github/skills/medassist-db-compat-check/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: medassist-db-compat-check
+description: Enforce backward-compatible database changes for MedAssist SQLite and Drizzle migrations, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill for any feature or fix that adds or reads persisted data.
+
+## Mandatory Sequence
+
+For every new persisted field/column:
+
+1. Add the column in `backend/src/db/schema.ts` with `NOT NULL DEFAULT <value>`.
+2. Generate migration with Drizzle Kit.
+3. Add matching `ALTER TABLE` logic in `backend/src/db/client.ts` inside `runAlterMigrations()`.
+4. Read values null-safe in routes/services (`?? defaultValue`).
+
+## Hard Rules
+
+- Never remove or rename existing columns.
+- Never add non-null columns without defaults.
+- Never read newly added fields without fallback.
+- Never manually edit generated Drizzle SQL migrations.
+
+## Verification Checklist
+
+- Schema update exists.
+- Generated migration exists.
+- Alter migration for existing DBs exists.
+- Runtime reads are fallback-safe.
+
+## Response Format
+
+Report these items explicitly:
+
+- New/changed columns
+- Added alter-migration statements
+- Null-safe read locations
+- Remaining migration risk (if any)

.github/skills/medassist-doc-sync-guard/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: medassist-doc-sync-guard
+description: Ensure MedAssist documentation stays aligned with behavior changes in APIs, configuration, setup, and operations, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when code changes alter behavior, setup steps, environment variables, user workflows, or operational commands.
+
+## Objective
+
+Keep docs consistent with actual product behavior and avoid stale setup/run guidance.
+
+## Required Checks
+
+1. If API behavior changed, verify relevant docs are updated.
+2. If ENV/config changed, update documented variables/defaults.
+3. If workflow/commands changed, update setup/run instructions.
+4. If user-facing behavior changed, update user-facing description.
+
+## Candidate Documentation Files
+
+- `README.md`
+- `docs/PROJECT_SETUP.md`
+- `docs/TECH_STACK.md`
+
+## Anti-Patterns
+
+- Shipping behavior changes without docs updates.
+- Updating docs with speculative/unverified commands.
+- Duplicating conflicting instructions across files.
+
+## Response Format
+
+Return:
+
+- Doc files that should change
+- Proposed update summary per file
+- Any intentionally skipped docs and reason

.github/skills/medassist-frontend-polish/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: medassist-frontend-polish
+description: Improve frontend visual quality within the existing MedAssist design system, without introducing new themes, font stacks, or disruptive UI patterns, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when the user wants UI improvements, better styling, or a more polished frontend, but the feature must stay consistent with MedAssist product UX.
+
+## Scope
+
+This is the **visual enhancement skill**.
+It refines quality *within* existing product conventions.
+
+Apply `medassist-ui-consistency` rules first, then use this skill for tasteful polish.
+
+## Do Not Use This Skill For
+
+- Replacing base UI patterns/components with new ones.
+- New design-system direction, visual identity, or broad layout language changes.
+- Marketing/brand-experiment pages that intentionally break product conventions.
+
+## Objective
+
+Deliver production-grade visual refinement that feels intentionally designed while remaining fully consistent with existing MedAssist components, spacing, typography, and interaction patterns.
+
+## Strict Constraints
+
+- Reuse existing components and patterns first (`ConfirmModal`, `MedicationAvatar`, existing form/button/layout patterns).
+- Do not introduce new global theme systems, font families, or visual identity changes.
+- Do not invent new UX flows, pages, or interaction models unless explicitly requested.
+- Keep frontend text i18n-safe: use `t("...")` and EN/DE keys.
+- Respect accessibility and readability over decorative effects.
+
+## Allowed Enhancements
+
+- Better spacing rhythm and visual hierarchy.
+- Cleaner grouping, alignment, and density adjustments.
+- Improved states (hover, focus, disabled, loading) using existing style language.
+- Subtle transitions/micro-interactions that do not distract and do not change behavior.
+- Consistent empty/error/success presentation using existing UI conventions.
+
+## Not Allowed
+
+- Random aesthetic overhauls.
+- New color systems or hardcoded ad-hoc colors that break current theme tokens.
+- Heavy animation, parallax, or attention-stealing motion.
+- Typography experiments that diverge from current product style.
+- "Creative" layout changes that reduce usability or consistency.
+
+## Implementation Workflow
+
+1. Confirm `medassist-ui-consistency` guardrails are satisfied.
+2. Identify existing components and CSS patterns to reuse.
+3. Define the smallest visual changes that improve clarity and quality.
+4. Apply refinements in-place without changing core behavior.
+5. Validate consistency across neighboring views/components.
+6. Ensure i18n and accessibility are preserved.
+
+## Response Format
+
+When using this skill, report:
+
+- Reused components and style primitives
+- Specific polish improvements applied
+- Any trade-offs/constraints respected
+- Confirmation that no new design system or disruptive UX pattern was introduced

.github/skills/medassist-i18n-enforcer/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: medassist-i18n-enforcer
+description: Enforce MedAssist i18n rules so UI copy is always translation-key based for English and German, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when changing frontend UI text, form labels, alerts, dialogs, or page content.
+
+## Rules
+
+- Do not hardcode new user-facing strings in React components.
+- Use translation keys via `t("...")`.
+- Add or update matching keys in:
+  - `frontend/src/i18n/en.json`
+  - `frontend/src/i18n/de.json`
+- Keep semantic key naming consistent with existing namespaces.
+
+## Validation
+
+1. Every new UI string has a key.
+2. English and German entries are both present.
+3. No fallback-to-English hardcoded text remains in JSX.
+
+## Response Format
+
+List:
+
+- New keys added
+- Files where keys were used
+- Any intentionally unchanged text and reason

.github/skills/medassist-observability-guard/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: medassist-observability-guard
+description: Ensure MedAssist changes preserve actionable logging, health checks, and clear operational error visibility, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when changes affect backend services, schedulers, integrations, startup flow, or failure handling.
+
+## Objective
+
+Maintain operational visibility so failures are detectable, diagnosable, and actionable.
+
+## Required Checks
+
+1. Critical paths keep clear error reporting.
+2. Health-check behavior remains intact and meaningful.
+3. Logs contain actionable context without leaking secrets.
+4. Errors are surfaced with enough detail for debugging.
+5. Silent failure paths are avoided.
+
+## MedAssist Focus Areas
+
+- `backend/src/index.ts`
+- `backend/src/routes/health.ts`
+- `backend/src/services/*`
+- Scheduler and notification flows
+
+## Anti-Patterns
+
+- Swallowed exceptions.
+- Generic logs with no context.
+- Missing visibility for background failures.
+
+## Response Format
+
+Return:
+
+- Observability touchpoints reviewed
+- Gaps found and suggested fixes
+- Operational risk level

.github/skills/medassist-release-handoff/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: medassist-release-handoff
+description: Enforce MedAssist release ownership by preventing remote git/release actions by normal agents and delegating to release-manager, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when a request includes branch push, PR creation, merge, tagging, release notes publishing, or release orchestration.
+
+## Ownership Rules
+
+- Remote git/release actions are owned by `@release-manager`.
+- Normal agent/Copilot must not perform:
+  - `git push`
+  - PR creation/merge
+  - tag/release creation
+
+## Required Behavior
+
+1. Perform local code edits only.
+2. Summarize local changes clearly.
+3. Provide handoff instruction to `@release-manager` for shipping steps.
+
+## Response Format
+
+When this skill applies, return:
+
+- "Release handoff required"
+- Delegate target: `@release-manager`
+- Shipping checklist (branch, PR, CI, merge, release)

.github/skills/medassist-security-sanity/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: medassist-security-sanity
+description: Apply baseline security checks to MedAssist code changes, especially for backend routes, auth flows, and input handling, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when a change touches backend routes, auth/session logic, file handling, imports/exports, or external input.
+
+## Objective
+
+Prevent common security regressions with fast, practical checks during implementation.
+
+## Required Checks
+
+1. Validate and sanitize external input at API boundaries.
+2. Enforce auth/authz server-side for protected actions.
+3. Ensure secrets/tokens are never hardcoded or logged.
+4. Avoid information leakage in error responses.
+5. Keep permission-sensitive operations explicit and auditable.
+
+## MedAssist Focus Areas
+
+- Route handlers in `backend/src/routes/`.
+- Auth-related code in `backend/src/plugins/` and auth routes.
+- Data import/export and sharing endpoints.
+- File/image upload and serving paths.
+
+## Anti-Patterns
+
+- Trusting frontend-only checks.
+- Accepting unchecked query/body/path input.
+- Returning raw internal errors to clients.
+- Weak defaults for sensitive operations.
+
+## Response Format
+
+Report:
+
+- Security-sensitive files reviewed
+- Findings by severity (critical/major/minor)
+- Concrete remediation actions
+- Residual risk (if any)

.github/skills/medassist-skill-quality-review/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: medassist-skill-quality-review
+description: Review MedAssist skills for trigger quality, scope boundaries, and conflicts with AGENTS governance, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when creating or modifying any skill under `.github/skills/`.
+
+## Objective
+
+Keep skills discoverable, non-overlapping, and aligned with canonical governance in `AGENTS.md`.
+
+## Required Checks
+
+1. Frontmatter has clear `name` and specific `description` trigger language.
+2. Scope boundaries are explicit (`when to use` / `do not use`).
+3. No conflicts with `AGENTS.md` ownership rules.
+4. No policy duplication that can drift from canonical governance.
+5. References to related skills are explicit where workflows chain.
+
+## Quality Signals
+
+- Trigger phrases are concrete and task-shaped.
+- Instructions are concise, actionable, and deterministic.
+- Response format is clear and useful for downstream handoff.
+
+## Anti-Patterns
+
+- Vague descriptions that match everything.
+- Duplicate skills with overlapping responsibilities.
+- Contradictory ownership guidance.
+- Long policy blocks copied from other files.
+
+## Response Format
+
+Return:
+
+- Scope/trigger issues found
+- Overlap/conflict findings
+- Suggested minimal edits
+- Final pass/fail recommendation

.github/skills/medassist-testing-handoff/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: medassist-testing-handoff
+description: Enforce MedAssist testing ownership by delegating test planning, execution, and CI test failure triage to testing-manager, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill whenever a task includes writing tests, running tests, or diagnosing test-related CI failures.
+
+## Ownership Rules
+
+- Test planning, implementation, and execution are owned by `@testing-manager`.
+- CI test-failure triage (`test.yml`, `e2e.yml`) is owned by `@testing-manager`.
+- Normal coding agent should hand off testing tasks instead of executing testing workflows directly.
+
+## Handoff Template
+
+Use this structure for delegation:
+
+1. Scope: feature/fix and affected files
+2. Expected behavior
+3. Suggested test layers (unit/integration/e2e)
+4. CI failure context (if applicable)
+
+## Response Format
+
+When triggered, output:
+
+- "Testing handoff required"
+- Delegate target: `@testing-manager`
+- Minimal handoff brief (scope + expected behavior)

.github/skills/medassist-ui-consistency/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: medassist-ui-consistency
+description: Enforce non-negotiable MedAssist UI guardrails by reusing existing components, styles, and interaction patterns, including equivalent requests phrased in German.
+---
+
+# Skill Instructions
+
+Use this skill when implementing or editing UI flows, modals, buttons, forms, schedule views, or settings screens.
+
+## Scope
+
+This is the **guardrail skill** for UI work.
+Use it to enforce consistency and prevent design drift.
+
+Use `medassist-frontend-polish` only after these guardrails are satisfied.
+
+## Do Not Use This Skill For
+
+- Creative visual redesign requests where no product consistency constraints apply.
+- Marketing-style one-off pages outside MedAssist product UI conventions.
+
+## Rules
+
+- Reuse existing components (for example `ConfirmModal`, `MedicationAvatar`) before creating new primitives.
+- Keep spacing, typography, and button styles aligned with existing patterns.
+- Avoid custom inline modal/button patterns that diverge from project design.
+- Prefer extending existing CSS classes/styles instead of introducing parallel styling systems.
+
+## Decision Heuristics
+
+1. If an equivalent component exists, reuse it.
+2. If small variant is needed, extend existing styles minimally.
+3. If a new component is unavoidable, match existing naming and structure conventions.
+
+## Response Format
+
+Provide:
+
+- Reused components/styles
+- Any new UI element and why reuse was not possible
+- Consistency risks reviewed
+- Confirmation that `medassist-frontend-polish` constraints remain compatible (if polish work is also requested)

.github/workflows/add-to-project.yml

@@ -0,0 +1,19 @@
+name: Add to Project
+
+on:
+  issues:
+    types: [opened, labeled]
+
+permissions: {}
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v1.0.2
+        with:
+          project-url: ${{ vars.PROJECT_URL }}
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
+          labeled: enhancement, bug, triage
+          label-operator: OR

.github/workflows/codeql.yml

@@ -47,18 +47,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/docker-build.yml

@@ -3,11 +3,6 @@ name: Build and Push Docker Images
 on:
   push:
     branches: [main]
-    paths:
-      - 'backend/**'
-      - 'frontend/**'
-      - 'docker-compose*.yml'
-      - '.github/workflows/docker-build.yml'
     tags: ['v*']
   workflow_dispatch:
     inputs:
@@ -26,9 +21,13 @@ env:
 jobs:
   # =============================================================================
   # Build and Push Docker Images
+  # Triggered on pushes to main (tagged as "main") and version tags (v*).
   # Tests are NOT run here — branch protection on main requires all PR checks
   # (backend-test + frontend-build from test.yml) to pass before merge.
   # Tags are created from main, so code is already tested.
+  #
+  # main push  → "main" tag only (for testing before release)
+  # Tag builds → semver tags (e.g., 1.9.0, 1.9) plus "latest"
   # =============================================================================
   build-and-push:
     runs-on: ubuntu-latest
@@ -46,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -68,10 +67,10 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=${{ github.event.inputs.tag || 'latest' }},enable=${{ github.event_name == 'workflow_dispatch' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.context }}
           push: true
@@ -95,7 +94,7 @@ jobs:
     
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0  # Fetch all history for changelog generation
 

.github/workflows/e2e.yml

@@ -0,0 +1,70 @@
+name: E2E Tests
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'frontend/**'
+      - 'backend/**'
+      - '.github/workflows/e2e.yml'
+
+# Minimal permissions for security
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    name: Playwright E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: |
+            backend/package-lock.json
+            frontend/package-lock.json
+
+      - name: Install backend dependencies
+        working-directory: backend
+        run: npm ci
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Install Playwright browsers
+        working-directory: frontend
+        run: npx playwright install --with-deps chromium
+
+      - name: Run E2E tests (Chromium only)
+        working-directory: frontend
+        run: npx playwright test --project=chromium
+        env:
+          CI: true
+          JWT_SECRET: e2e-test-secret-that-is-long-enough
+          SESSION_SECRET: e2e-test-session-secret-long-enough
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: playwright-report
+          path: frontend/playwright-report/
+          retention-days: 7
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: playwright-results
+          path: frontend/test-results/
+          retention-days: 7

.github/workflows/project-auto-done.yml

@@ -0,0 +1,105 @@
+name: Move Done in Project
+
+on:
+  issues:
+    types: [closed]
+  pull_request:
+    types: [closed]
+
+permissions: {}
+
+jobs:
+  move-to-done:
+    name: Move to Done
+    runs-on: ubuntu-latest
+    if: >-
+      (github.event_name == 'issues' && github.event.issue.state_reason == 'completed') ||
+      (github.event_name == 'pull_request' && github.event.pull_request.merged == true)
+    steps:
+      - name: Move project item to Done
+        uses: actions/github-script@v8
+        with:
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
+          script: |
+            const projectId = 'PVT_kwHOADH82s4BO2OT';
+            const statusFieldId = 'PVTSSF_lAHOADH82s4BO2OTzg9bdkE';
+            const doneOptionId = 'ca45af98';
+
+            // Determine content ID (issue or PR node ID)
+            const nodeId = context.payload.issue?.node_id || context.payload.pull_request?.node_id;
+            const number = context.payload.issue?.number || context.payload.pull_request?.number;
+            const type = context.payload.issue ? 'issue' : 'pull_request';
+
+            console.log(`Processing ${type} #${number} (${nodeId})`);
+
+            // Find the project item by content node ID
+            const result = await github.graphql(`
+              query($nodeId: ID!) {
+                node(id: $nodeId) {
+                  ... on Issue {
+                    projectItems(first: 10) {
+                      nodes {
+                        id
+                        project { id }
+                        fieldValueByName(name: "Status") {
+                          ... on ProjectV2ItemFieldSingleSelectValue {
+                            name
+                            optionId
+                          }
+                        }
+                      }
+                    }
+                  }
+                  ... on PullRequest {
+                    projectItems(first: 10) {
+                      nodes {
+                        id
+                        project { id }
+                        fieldValueByName(name: "Status") {
+                          ... on ProjectV2ItemFieldSingleSelectValue {
+                            name
+                            optionId
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            `, { nodeId });
+
+            const items = result.node?.projectItems?.nodes || [];
+            const projectItem = items.find(item => item.project.id === projectId);
+
+            if (!projectItem) {
+              console.log(`${type} #${number} is not in the project board — skipping.`);
+              return;
+            }
+
+            const currentStatus = projectItem.fieldValueByName?.name || 'unknown';
+            if (currentStatus === 'Done') {
+              console.log(`${type} #${number} is already "Done" — skipping.`);
+              return;
+            }
+
+            console.log(`Moving ${type} #${number} from "${currentStatus}" to "Done"...`);
+
+            await github.graphql(`
+              mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+                updateProjectV2ItemFieldValue(input: {
+                  projectId: $projectId
+                  itemId: $itemId
+                  fieldId: $fieldId
+                  value: { singleSelectOptionId: $optionId }
+                }) {
+                  projectV2Item { id }
+                }
+              }
+            `, {
+              projectId,
+              itemId: projectItem.id,
+              fieldId: statusFieldId,
+              optionId: doneOptionId
+            });
+
+            console.log(`Successfully moved ${type} #${number} to "Done".`);

.github/workflows/release.yml

@@ -1,78 +0,0 @@
-name: Create Release
-
-on:
-  push:
-    tags: ['v*']
-
-permissions:
-  contents: write
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Get version info
-        id: version
-        run: |
-          CURRENT_TAG=${GITHUB_REF#refs/tags/}
-          VERSION=${CURRENT_TAG#v}
-          echo "tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          
-          # Get previous tag
-          PREV_TAG=$(git tag --sort=-v:refname | grep -A1 "^${CURRENT_TAG}$" | tail -1)
-          if [ "$PREV_TAG" = "$CURRENT_TAG" ]; then
-            PREV_TAG=""
-          fi
-          echo "previous_tag=$PREV_TAG" >> $GITHUB_OUTPUT
-
-      - name: Generate release template
-        run: |
-          cat > release_notes.md << 'EOF'
-          ## What's New
-          
-          <!-- 
-          Write 1-2 sentences describing the main changes in this release.
-          Example: This release introduces a medication refill tracking feature and improves the mobile user experience.
-          -->
-          
-          ### New Features
-          
-          <!-- List new features with **bold** names and descriptions -->
-          - **Feature Name**: Description of the feature
-          
-          ### Improvements
-          
-          <!-- List improvements and fixes -->
-          - **Improvement**: Description
-          
-          ### Where to Find It
-          
-          <!-- Tell users where they can access new features -->
-          
-          ---
-          
-          ## Docker Images
-          
-          ```bash
-          docker pull ghcr.io/danielvolz/medassist-ng-backend:${{ steps.version.outputs.version }}
-          docker pull ghcr.io/danielvolz/medassist-ng-frontend:${{ steps.version.outputs.version }}
-          ```
-          
-          **Full Changelog**: https://github.com/DanielVolz/medassist-ng/compare/${{ steps.version.outputs.previous_tag }}...${{ steps.version.outputs.tag }}
-          EOF
-
-      - name: Create Draft Release
-        uses: softprops/action-gh-release@v1
-        with:
-          body_path: release_notes.md
-          draft: true
-          generate_release_notes: false
-          name: "Release ${{ steps.version.outputs.tag }}"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -51,10 +51,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: 'npm'
@@ -73,7 +73,7 @@ jobs:
         run: npm run test:coverage
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: backend-coverage
@@ -81,7 +81,7 @@ jobs:
           retention-days: 7
 
   # =============================================================================
-  # Frontend Build Validation (skipped if no frontend-related files changed)
+  # Frontend Tests & Build (skipped if no frontend-related files changed)
   # =============================================================================
   frontend-build:
     name: Frontend Build
@@ -96,10 +96,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: 'npm'
@@ -111,5 +111,16 @@ jobs:
       - name: Lint
         run: npm run lint
 
+      - name: Run tests with coverage
+        run: npm run test:coverage
+
       - name: TypeScript type check & build
         run: npm run build
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: frontend-coverage
+          path: frontend/coverage/
+          retention-days: 7

.github/workflows/update-test-badges.yml

@@ -2,30 +2,34 @@ name: Update Test Badges
 
 on:
   workflow_dispatch:
-  push:
+  workflow_run:
+    workflows: ["Build and Push Docker Images"]
+    types: [completed]
     branches: [main]
-    paths:
-      - 'backend/src/**'
-      - 'frontend/src/**'
-      - 'backend/package.json'
-      - 'frontend/package.json'
 
 permissions:
   contents: write
 
+# Prevent parallel badge workflows from racing each other
+concurrency:
+  group: update-test-badges
+  cancel-in-progress: true
+
 jobs:
   update-badges:
     name: Update Test Count Badges
     runs-on: ubuntu-latest
+    # Only run after successful docker builds, not failed ones
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ secrets.BADGE_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
           cache: 'npm'
@@ -100,5 +104,8 @@ jobs:
             echo "No badge changes to commit"
           else
             git commit -m "chore: update test count badges [skip ci]"
+            # Rebase on latest main to avoid push rejection when concurrent
+            # badge workflows or other [skip ci] commits land between checkout and push
+            git pull --rebase origin main
             git push
           fi

.github/workflows/version-bump.yml

@@ -1,57 +0,0 @@
-name: Version Bump on Release
-
-on:
-  release:
-    types: [published]
-
-permissions:
-  contents: write
-
-jobs:
-  version-bump:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: main
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Get version from tag
-        id: version
-        run: |
-          # Extract version from tag (e.g., v1.6.0 -> 1.6.0)
-          VERSION="${GITHUB_REF_NAME#v}"
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Extracted version: $VERSION"
-
-      - name: Update package.json versions
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          
-          # Update backend/package.json
-          jq --arg v "$VERSION" '.version = $v' backend/package.json > backend/package.json.tmp
-          mv backend/package.json.tmp backend/package.json
-          
-          # Update frontend/package.json
-          jq --arg v "$VERSION" '.version = $v' frontend/package.json > frontend/package.json.tmp
-          mv frontend/package.json.tmp frontend/package.json
-          
-          echo "Updated versions to $VERSION"
-          cat backend/package.json | head -5
-          cat frontend/package.json | head -5
-
-      - name: Commit and push
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          
-          git add backend/package.json frontend/package.json
-          
-          # Only commit if there are changes
-          if git diff --staged --quiet; then
-            echo "No version changes needed"
-          else
-            git commit -m "chore: bump version to ${{ steps.version.outputs.version }} [skip ci]"
-            git push origin main
-          fi

.gitignore

@@ -80,4 +80,5 @@ Thumbs.db
 .roo/
 .roomodes
 AGENTS.md
-docs/TECH_STACK.md
+docs/TECH_STACK.md
+doku

.vscode/settings.json

@@ -1,5 +1,8 @@
 {
   "vitest.root": "backend",
   "vitest.enable": true,
-  "vitest.commandLine": "npm test --"
+  "vitest.commandLine": "npm test --",
+  "chat.tools.terminal.autoApprove": {
+    "test": true
+  }
 }

.vscode/tasks.json

@@ -0,0 +1,49 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "E2E stable",
+      "type": "shell",
+      "command": "npm",
+      "args": ["run", "test:e2e"],
+      "options": {
+        "cwd": "${workspaceFolder}/frontend"
+      },
+      "group": "test",
+      "problemMatcher": []
+    },
+    {
+      "label": "E2E stable + merged video",
+      "type": "shell",
+      "command": "npm",
+      "args": ["run", "test:e2e:with-video"],
+      "options": {
+        "cwd": "${workspaceFolder}/frontend"
+      },
+      "group": "test",
+      "problemMatcher": []
+    },
+    {
+      "label": "E2E all browsers",
+      "type": "shell",
+      "command": "npm",
+      "args": ["run", "test:e2e:all"],
+      "options": {
+        "cwd": "${workspaceFolder}/frontend"
+      },
+      "group": "test",
+      "problemMatcher": []
+    },
+    {
+      "label": "E2E all browsers + merged video",
+      "type": "shell",
+      "command": "npm",
+      "args": ["run", "test:e2e:all:with-video"],
+      "options": {
+        "cwd": "${workspaceFolder}/frontend"
+      },
+      "group": "test",
+      "problemMatcher": []
+    }
+  ]
+}

README.md

@@ -18,8 +18,8 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/Backend_Tests-494%2F494-brightgreen?logo=vitest" alt="Backend Tests 454/454" />
-  <img src="https://img.shields.io/badge/Frontend_Tests-639%2F639-brightgreen?logo=vitest" alt="Frontend Tests 611/611" />
+  <img src="https://img.shields.io/badge/Backend_Tests-564%2F564-brightgreen?logo=vitest" alt="Backend Tests 454/454" />
+  <img src="https://img.shields.io/badge/Frontend_Tests-777%2F777-brightgreen?logo=vitest" alt="Frontend Tests 611/611" />
 </p>
 
 ### 🤖 AI-Generated Code
@@ -120,9 +120,10 @@ Share your medication schedule with others via a public link.
 </details>
 
 ### Smart Inventory
-- Track exact stock: packs, blisters, and loose pills
+- Track exact stock: packs, blisters, bottles, and loose pills
 - Display remaining days of supply
 - Automatic calculation based on intake schedule
+- Manual stock correction supports partial blisters and loose pills
 
 ### Medication Refill
 - One-click refill with pack or loose pill options
@@ -132,6 +133,7 @@ Share your medication schedule with others via a public link.
 ### Flexible Schedules
 - Daily, weekly, or custom intervals per medication
 - Independent schedules for each medication
+- Optional timeline filters for dashboard and shared schedule views
 
 ### Stock Alerts & Reminders
 - Notifications before stock runs out
@@ -141,6 +143,11 @@ Share your medication schedule with others via a public link.
 ### Trip Planner
 - Calculate how many pills you need for a trip or date range
 - Plan ahead for vacations, business trips, or hospital stays
+- Send demand reports via email or push notification
+
+### Reports
+- Generate medication reports as PDF, Markdown, or plain text
+- Include intake history, refill history, and prescription details
 
 ### Multi-Person Support
 - Manage medications for multiple people
@@ -212,7 +219,7 @@ Generate secrets with: `openssl rand -hex 32`
 | `OIDC_ISSUER_URL` | — | OIDC provider URL |
 | `OIDC_CLIENT_ID` | — | Client ID from OIDC provider |
 | `OIDC_CLIENT_SECRET` | — | Client secret from OIDC provider |
-| `OIDC_REDIRECT_URI` | — | Callback URL |
+| `OIDC_REDIRECT_URI` | — | Full callback URL (e.g., `https://your-domain.com/api/auth/oidc/callback`) |
 | `OIDC_SCOPES` | `openid profile email` | Scopes to request |
 | `OIDC_USERNAME_CLAIM` | `preferred_username` | Claim for username |
 | `OIDC_AUTO_CREATE_USERS` | `true` | Auto-create users on first SSO login |
@@ -254,6 +261,14 @@ Configure push notifications in Settings → Push, or set defaults via environme
 | `DEFAULT_SHOUTRRR_STOCK_REMINDERS` | `true` | Send stock warnings via push |
 | `DEFAULT_SHOUTRRR_INTAKE_REMINDERS` | `true` | Send intake reminders via push |
 
+### Default User Settings
+
+These defaults are applied when a new user is created. Once a user saves settings in the app, their values take precedence.
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `DEFAULT_SHARE_STOCK_STATUS` | `true` | Show stock status (Normal/Low/Critical) on shared schedule links |
+
 #### URL Examples
 
 **ntfy** (free, self-hostable):

backend/drizzle.config.ts

@@ -5,6 +5,6 @@ export default defineConfig({
   out: "./drizzle",
   dialect: "sqlite",
   dbCredentials: {
-    url: process.env.DATABASE_URL || "./data/medassist.db",
+    url: process.env.DATABASE_URL || "./data/medassist-ng.db",
   },
 });

backend/drizzle/0006_add_stock_reminder_tracking.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `user_settings` ADD `last_stock_reminder_sent` text;--> statement-breakpoint
+ALTER TABLE `user_settings` ADD `last_stock_reminder_channel` text;--> statement-breakpoint
+ALTER TABLE `user_settings` ADD `last_stock_reminder_med_names` text;

backend/drizzle/0007_add_share_stock_status.sql

@@ -0,0 +1 @@
+ALTER TABLE `user_settings` ADD `share_stock_status` integer DEFAULT true NOT NULL;

backend/drizzle/0008_add_obsolete_medications.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `medications` ADD `is_obsolete` integer DEFAULT false NOT NULL;
+ALTER TABLE `medications` ADD `obsolete_at` integer;

backend/drizzle/0008_add_prescription_tracking.sql

@@ -0,0 +1,8 @@
+ALTER TABLE `medications` ADD `prescription_enabled` integer NOT NULL DEFAULT 0;
+ALTER TABLE `medications` ADD `prescription_authorized_refills` integer;
+ALTER TABLE `medications` ADD `prescription_remaining_refills` integer;
+ALTER TABLE `medications` ADD `prescription_low_refill_threshold` integer NOT NULL DEFAULT 1;
+ALTER TABLE `medications` ADD `prescription_expiry_date` text;
+
+ALTER TABLE `user_settings` ADD `email_prescription_reminders` integer NOT NULL DEFAULT 1;
+ALTER TABLE `user_settings` ADD `shoutrrr_prescription_reminders` integer NOT NULL DEFAULT 1;

backend/drizzle/0009_add_medication_start_date.sql

@@ -0,0 +1 @@
+ALTER TABLE `medications` ADD `medication_start_date` text DEFAULT '' NOT NULL;

backend/drizzle/0010_mean_spot.sql

@@ -0,0 +1 @@
+ALTER TABLE `dose_tracking` ADD `taken_source` text DEFAULT 'manual' NOT NULL;

backend/drizzle/meta/0006_snapshot.json

@@ -0,0 +1,907 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "7cd75e33-b3d8-4930-a60b-2a0a9f644c6d",
+  "prevId": "fb61e5fd-152d-4e61-8836-e2fd1d28e3f0",
+  "tables": {
+    "dose_tracking": {
+      "name": "dose_tracking",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "dose_id": {
+          "name": "dose_id",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "taken_at": {
+          "name": "taken_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(strftime('%s','now'))"
+        },
+        "marked_by": {
+          "name": "marked_by",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "dismissed": {
+          "name": "dismissed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "dose_tracking_user_id_users_id_fk": {
+          "name": "dose_tracking_user_id_users_id_fk",
+          "tableFrom": "dose_tracking",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "medications": {
+      "name": "medications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "generic_name": {
+          "name": "generic_name",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "taken_by_json": {
+          "name": "taken_by_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "package_type": {
+          "name": "package_type",
+          "type": "text(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'blister'"
+        },
+        "pack_count": {
+          "name": "pack_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "blisters_per_pack": {
+          "name": "blisters_per_pack",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "pills_per_blister": {
+          "name": "pills_per_blister",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "total_pills": {
+          "name": "total_pills",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "loose_tablets": {
+          "name": "loose_tablets",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "stock_adjustment": {
+          "name": "stock_adjustment",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "last_stock_correction_at": {
+          "name": "last_stock_correction_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "pill_weight_mg": {
+          "name": "pill_weight_mg",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "dose_unit": {
+          "name": "dose_unit",
+          "type": "text(20)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false,
+          "default": "'mg'"
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "every_json": {
+          "name": "every_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "start_json": {
+          "name": "start_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "intakes_json": {
+          "name": "intakes_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "image_url": {
+          "name": "image_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "expiry_date": {
+          "name": "expiry_date",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "intake_reminders_enabled": {
+          "name": "intake_reminders_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "dismissed_until": {
+          "name": "dismissed_until",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "medications_user_id_users_id_fk": {
+          "name": "medications_user_id_users_id_fk",
+          "tableFrom": "medications",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "refill_history": {
+      "name": "refill_history",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "medication_id": {
+          "name": "medication_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "packs_added": {
+          "name": "packs_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "loose_pills_added": {
+          "name": "loose_pills_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "refill_date": {
+          "name": "refill_date",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(strftime('%s','now'))"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "refill_history_medication_id_medications_id_fk": {
+          "name": "refill_history_medication_id_medications_id_fk",
+          "tableFrom": "refill_history",
+          "tableTo": "medications",
+          "columnsFrom": [
+            "medication_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "refill_history_user_id_users_id_fk": {
+          "name": "refill_history_user_id_users_id_fk",
+          "tableFrom": "refill_history",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "refresh_tokens": {
+      "name": "refresh_tokens",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token_id": {
+          "name": "token_id",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "rotated_at": {
+          "name": "rotated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "revoked": {
+          "name": "revoked",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "refresh_tokens_token_id_unique": {
+          "name": "refresh_tokens_token_id_unique",
+          "columns": [
+            "token_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "refresh_tokens_user_id_users_id_fk": {
+          "name": "refresh_tokens_user_id_users_id_fk",
+          "tableFrom": "refresh_tokens",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "share_tokens": {
+      "name": "share_tokens",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "text(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "taken_by": {
+          "name": "taken_by",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "schedule_days": {
+          "name": "schedule_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 30
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "share_tokens_token_unique": {
+          "name": "share_tokens_token_unique",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "share_tokens_user_id_users_id_fk": {
+          "name": "share_tokens_user_id_users_id_fk",
+          "tableFrom": "share_tokens",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "user_settings": {
+      "name": "user_settings",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email_enabled": {
+          "name": "email_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "notification_email": {
+          "name": "notification_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "email_stock_reminders": {
+          "name": "email_stock_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "email_intake_reminders": {
+          "name": "email_intake_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "shoutrrr_enabled": {
+          "name": "shoutrrr_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "shoutrrr_url": {
+          "name": "shoutrrr_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "shoutrrr_stock_reminders": {
+          "name": "shoutrrr_stock_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "shoutrrr_intake_reminders": {
+          "name": "shoutrrr_intake_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "reminder_days_before": {
+          "name": "reminder_days_before",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 7
+        },
+        "repeat_daily_reminders": {
+          "name": "repeat_daily_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "skip_reminders_for_taken_doses": {
+          "name": "skip_reminders_for_taken_doses",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "repeat_reminders_enabled": {
+          "name": "repeat_reminders_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "reminder_repeat_interval_minutes": {
+          "name": "reminder_repeat_interval_minutes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 30
+        },
+        "max_nagging_reminders": {
+          "name": "max_nagging_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 5
+        },
+        "low_stock_days": {
+          "name": "low_stock_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 30
+        },
+        "normal_stock_days": {
+          "name": "normal_stock_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 90
+        },
+        "high_stock_days": {
+          "name": "high_stock_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 180
+        },
+        "expiry_warning_days": {
+          "name": "expiry_warning_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 90
+        },
+        "language": {
+          "name": "language",
+          "type": "text(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'en'"
+        },
+        "stock_calculation_mode": {
+          "name": "stock_calculation_mode",
+          "type": "text(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'automatic'"
+        },
+        "last_auto_email_sent": {
+          "name": "last_auto_email_sent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_notification_type": {
+          "name": "last_notification_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_notification_channel": {
+          "name": "last_notification_channel",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_reminder_med_name": {
+          "name": "last_reminder_med_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_reminder_taken_by": {
+          "name": "last_reminder_taken_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_stock_reminder_sent": {
+          "name": "last_stock_reminder_sent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_stock_reminder_channel": {
+          "name": "last_stock_reminder_channel",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_stock_reminder_med_names": {
+          "name": "last_stock_reminder_med_names",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "user_settings_user_id_unique": {
+          "name": "user_settings_user_id_unique",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "user_settings_user_id_users_id_fk": {
+          "name": "user_settings_user_id_users_id_fk",
+          "tableFrom": "user_settings",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "username": {
+          "name": "username",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "avatar_url": {
+          "name": "avatar_url",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "auth_provider": {
+          "name": "auth_provider",
+          "type": "text(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'local'"
+        },
+        "oidc_subject": {
+          "name": "oidc_subject",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "last_login_at": {
+          "name": "last_login_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "users_username_unique": {
+          "name": "users_username_unique",
+          "columns": [
+            "username"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

backend/drizzle/meta/0007_snapshot.json

@@ -0,0 +1,915 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "b6f1ee4b-cc31-4060-a4d4-bcd4fdc5bd87",
+  "prevId": "7cd75e33-b3d8-4930-a60b-2a0a9f644c6d",
+  "tables": {
+    "dose_tracking": {
+      "name": "dose_tracking",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "dose_id": {
+          "name": "dose_id",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "taken_at": {
+          "name": "taken_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(strftime('%s','now'))"
+        },
+        "marked_by": {
+          "name": "marked_by",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "dismissed": {
+          "name": "dismissed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "dose_tracking_user_id_users_id_fk": {
+          "name": "dose_tracking_user_id_users_id_fk",
+          "tableFrom": "dose_tracking",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "medications": {
+      "name": "medications",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "generic_name": {
+          "name": "generic_name",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "taken_by_json": {
+          "name": "taken_by_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "package_type": {
+          "name": "package_type",
+          "type": "text(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'blister'"
+        },
+        "pack_count": {
+          "name": "pack_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "blisters_per_pack": {
+          "name": "blisters_per_pack",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "pills_per_blister": {
+          "name": "pills_per_blister",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 1
+        },
+        "total_pills": {
+          "name": "total_pills",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "loose_tablets": {
+          "name": "loose_tablets",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "stock_adjustment": {
+          "name": "stock_adjustment",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "last_stock_correction_at": {
+          "name": "last_stock_correction_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "pill_weight_mg": {
+          "name": "pill_weight_mg",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "dose_unit": {
+          "name": "dose_unit",
+          "type": "text(20)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false,
+          "default": "'mg'"
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "every_json": {
+          "name": "every_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "start_json": {
+          "name": "start_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "intakes_json": {
+          "name": "intakes_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'[]'"
+        },
+        "image_url": {
+          "name": "image_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "expiry_date": {
+          "name": "expiry_date",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "intake_reminders_enabled": {
+          "name": "intake_reminders_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "dismissed_until": {
+          "name": "dismissed_until",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "medications_user_id_users_id_fk": {
+          "name": "medications_user_id_users_id_fk",
+          "tableFrom": "medications",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "refill_history": {
+      "name": "refill_history",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "medication_id": {
+          "name": "medication_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "packs_added": {
+          "name": "packs_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "loose_pills_added": {
+          "name": "loose_pills_added",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 0
+        },
+        "refill_date": {
+          "name": "refill_date",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(strftime('%s','now'))"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "refill_history_medication_id_medications_id_fk": {
+          "name": "refill_history_medication_id_medications_id_fk",
+          "tableFrom": "refill_history",
+          "tableTo": "medications",
+          "columnsFrom": [
+            "medication_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "refill_history_user_id_users_id_fk": {
+          "name": "refill_history_user_id_users_id_fk",
+          "tableFrom": "refill_history",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "refresh_tokens": {
+      "name": "refresh_tokens",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token_id": {
+          "name": "token_id",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "rotated_at": {
+          "name": "rotated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "revoked": {
+          "name": "revoked",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "refresh_tokens_token_id_unique": {
+          "name": "refresh_tokens_token_id_unique",
+          "columns": [
+            "token_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "refresh_tokens_user_id_users_id_fk": {
+          "name": "refresh_tokens_user_id_users_id_fk",
+          "tableFrom": "refresh_tokens",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "share_tokens": {
+      "name": "share_tokens",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "token": {
+          "name": "token",
+          "type": "text(64)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "taken_by": {
+          "name": "taken_by",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "schedule_days": {
+          "name": "schedule_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 30
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "share_tokens_token_unique": {
+          "name": "share_tokens_token_unique",
+          "columns": [
+            "token"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "share_tokens_user_id_users_id_fk": {
+          "name": "share_tokens_user_id_users_id_fk",
+          "tableFrom": "share_tokens",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "user_settings": {
+      "name": "user_settings",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email_enabled": {
+          "name": "email_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "notification_email": {
+          "name": "notification_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "email_stock_reminders": {
+          "name": "email_stock_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "email_intake_reminders": {
+          "name": "email_intake_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "shoutrrr_enabled": {
+          "name": "shoutrrr_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "shoutrrr_url": {
+          "name": "shoutrrr_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "shoutrrr_stock_reminders": {
+          "name": "shoutrrr_stock_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "shoutrrr_intake_reminders": {
+          "name": "shoutrrr_intake_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "reminder_days_before": {
+          "name": "reminder_days_before",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 7
+        },
+        "repeat_daily_reminders": {
+          "name": "repeat_daily_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "skip_reminders_for_taken_doses": {
+          "name": "skip_reminders_for_taken_doses",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "repeat_reminders_enabled": {
+          "name": "repeat_reminders_enabled",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "reminder_repeat_interval_minutes": {
+          "name": "reminder_repeat_interval_minutes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 30
+        },
+        "max_nagging_reminders": {
+          "name": "max_nagging_reminders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 5
+        },
+        "low_stock_days": {
+          "name": "low_stock_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 30
+        },
+        "normal_stock_days": {
+          "name": "normal_stock_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 90
+        },
+        "high_stock_days": {
+          "name": "high_stock_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 180
+        },
+        "expiry_warning_days": {
+          "name": "expiry_warning_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": 90
+        },
+        "language": {
+          "name": "language",
+          "type": "text(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'en'"
+        },
+        "stock_calculation_mode": {
+          "name": "stock_calculation_mode",
+          "type": "text(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'automatic'"
+        },
+        "share_stock_status": {
+          "name": "share_stock_status",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "last_auto_email_sent": {
+          "name": "last_auto_email_sent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_notification_type": {
+          "name": "last_notification_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_notification_channel": {
+          "name": "last_notification_channel",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_reminder_med_name": {
+          "name": "last_reminder_med_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_reminder_taken_by": {
+          "name": "last_reminder_taken_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_stock_reminder_sent": {
+          "name": "last_stock_reminder_sent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_stock_reminder_channel": {
+          "name": "last_stock_reminder_channel",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "last_stock_reminder_med_names": {
+          "name": "last_stock_reminder_med_names",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "user_settings_user_id_unique": {
+          "name": "user_settings_user_id_unique",
+          "columns": [
+            "user_id"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {
+        "user_settings_user_id_users_id_fk": {
+          "name": "user_settings_user_id_users_id_fk",
+          "tableFrom": "user_settings",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "username": {
+          "name": "username",
+          "type": "text(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "avatar_url": {
+          "name": "avatar_url",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "auth_provider": {
+          "name": "auth_provider",
+          "type": "text(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'local'"
+        },
+        "oidc_subject": {
+          "name": "oidc_subject",
+          "type": "text(255)",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": true
+        },
+        "last_login_at": {
+          "name": "last_login_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "CURRENT_TIMESTAMP"
+        }
+      },
+      "indexes": {
+        "users_username_unique": {
+          "name": "users_username_unique",
+          "columns": [
+            "username"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

backend/drizzle/meta/_journal.json

@@ -43,6 +43,41 @@
       "when": 1769893708813,
       "tag": "0005_add_intakes_json",
       "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "6",
+      "when": 1770626907896,
+      "tag": "0006_add_stock_reminder_tracking",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "6",
+      "when": 1770659669121,
+      "tag": "0007_add_share_stock_status",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "6",
+      "when": 1771160400000,
+      "tag": "0008_add_obsolete_medications",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "6",
+      "when": 1771164000000,
+      "tag": "0009_add_medication_start_date",
+      "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "6",
+      "when": 1771694832866,
+      "tag": "0010_mean_spot",
+      "breakpoints": true
     }
   ]
 }

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "medassist-ng-backend",
-  "version": "1.8.6",
+  "version": "1.14.2",
   "private": true,
   "type": "module",
   "scripts": {
@@ -17,31 +17,31 @@
     "check": "npx biome check . && tsc --noEmit"
   },
   "dependencies": {
-    "@fastify/cookie": "^10.0.1",
-    "@fastify/cors": "^10.0.1",
+    "@fastify/cookie": "^11.0.2",
+    "@fastify/cors": "^11.2.0",
     "@fastify/helmet": "^13.0.2",
     "@fastify/jwt": "^10.0.0",
-    "@fastify/multipart": "^9.3.0",
+    "@fastify/multipart": "^9.4.0",
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/sensible": "^6.0.4",
-    "@fastify/static": "^8.3.0",
-    "@libsql/client": "^0.10.0",
-    "argon2": "^0.40.0",
-    "dotenv": "^16.4.5",
+    "@fastify/static": "^9.0.0",
+    "@libsql/client": "^0.17.0",
+    "argon2": "^0.44.0",
+    "dotenv": "^17.3.1",
     "drizzle-orm": "^0.45.1",
-    "fastify": "^5.7.3",
-    "nodemailer": "^7.0.11",
-    "openid-client": "^6.8.1",
+    "fastify": "^5.7.4",
+    "nodemailer": "^8.0.1",
+    "openid-client": "^6.8.2",
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.12",
-    "@types/node": "^22.7.4",
-    "@types/nodemailer": "^6.4.21",
+    "@biomejs/biome": "^2.4.1",
+    "@types/node": "^25.2.3",
+    "@types/nodemailer": "^7.0.10",
     "@types/supertest": "^6.0.2",
-    "@vitest/coverage-v8": "^4.0.16",
-    "drizzle-kit": "^0.31.8",
-    "supertest": "^7.0.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "drizzle-kit": "^0.31.9",
+    "supertest": "^7.2.2",
     "tsx": "^4.19.0",
     "typescript": "^5.5.4",
     "vitest": "^4.0.16"

backend/src/db/client.ts

@@ -1,14 +1,12 @@
 import { existsSync, statSync } from "node:fs";
-import { resolve } from "node:path";
 import { type Client, createClient } from "@libsql/client";
 import dotenv from "dotenv";
 import { drizzle } from "drizzle-orm/libsql";
-
+import { log } from "../utils/logger.js";
 // Import utilities from db-utils (side-effect-free)
 import {
 	ensureDataDirectory,
 	ensureDefaultUser,
-	getDataDir,
 	getDbPaths,
 	repairOrphanedDoseIds,
 	repairTrailingHyphenDoseIds,
@@ -40,34 +38,34 @@ dotenv.config({ path: envPath });
 // Use absolute path to ensure it works in Docker
 const { dataDir, dbPath, url } = getDbPaths();
 
-console.log(`[DB] Data directory: ${dataDir}`);
-console.log(`[DB] Database path: ${dbPath}`);
-console.log(`[DB] Database URL: ${url}`);
+log.debug(`[DB] Data directory: ${dataDir}`);
+log.debug(`[DB] Database path: ${dbPath}`);
+log.debug(`[DB] Database URL: ${url}`);
 
 // Ensure data directory exists and is writable
 const dirResult = ensureDataDirectory(dataDir);
 if (!dirResult.success) {
-	console.error(`[DB] ERROR: Cannot access data directory: ${dirResult.error}`);
-	console.error(`[DB] Please ensure the volume mount has correct permissions.`);
-	console.error(`[DB] Try running on host: sudo chown -R 1000:1000 ${dataDir}`);
+	log.error(`[DB] ERROR: Cannot access data directory: ${dirResult.error}`);
+	log.error(`[DB] Please ensure the volume mount has correct permissions.`);
+	log.error(`[DB] Try running on host: sudo chown -R 1000:1000 ${dataDir}`);
 	process.exit(1);
 } else {
-	console.log(`[DB] Data directory is writable`);
+	log.debug(`[DB] Data directory is writable`);
 
 	// Log directory stats
 	const stats = statSync(dataDir);
-	console.log(`[DB] Directory permissions: ${stats.mode.toString(8)}`);
-	console.log(`[DB] Directory UID: ${stats.uid}, GID: ${stats.gid}`);
-	console.log(`[DB] Write test successful`);
+	log.debug(`[DB] Directory permissions: ${stats.mode.toString(8)}`);
+	log.debug(`[DB] Directory UID: ${stats.uid}, GID: ${stats.gid}`);
+	log.debug(`[DB] Write test successful`);
 }
 
 let client: Client;
 try {
 	client = createClient({ url });
-	console.log(`[DB] Database client created successfully`);
-} catch (err: any) {
-	console.error(`[DB] ERROR: Failed to create database client: ${err.message}`);
-	console.error(`[DB] Database path: ${dbPath}`);
+	log.debug(`[DB] Database client created successfully`);
+} catch (err: unknown) {
+	log.error(`[DB] ERROR: Failed to create database client: ${(err as Error).message}`);
+	log.error(`[DB] Database path: ${dbPath}`);
 	process.exit(1);
 }
 
@@ -76,46 +74,46 @@ export const db = drizzle(client);
 // Auto-run migrations (self-healing database)
 async function runMigrations() {
 	// Run drizzle-kit generated migrations
-	console.log(`[DB] Running drizzle migrations...`);
+	log.info(`[DB] Running migrations...`);
 	const migrateResult = await runDrizzleMigrations(db);
 	if (!migrateResult.success) {
-		console.error(`[DB] Migration error:`, migrateResult.error);
+		log.error(`[DB] Migration error: ${migrateResult.error}`);
 	} else if (migrateResult.warning) {
-		console.log(`[DB] Migration warning:`, migrateResult.warning);
+		log.warn(`[DB] Migration warning: ${migrateResult.warning}`);
 	} else {
-		console.log(`[DB] Drizzle migrations completed`);
+		log.debug(`[DB] Drizzle migrations completed`);
 	}
 
 	// Run ALTER TABLE migrations for backward compatibility
 	const alterResult = await runAlterMigrations(client);
 	if (alterResult.errors.length > 0) {
-		alterResult.errors.forEach((err) => console.error(`[DB] ALTER migration error:`, err));
+		alterResult.errors.forEach((err) => log.error(`[DB] ALTER migration error: ${err}`));
 	}
-	console.log(`[DB] Tables verified/created`);
+	log.debug(`[DB] Tables verified/created`);
 
 	// Repair dose IDs with trailing hyphens (from frontend takenBy bug)
 	const trailingResult = await repairTrailingHyphenDoseIds(client);
 	if (trailingResult.repaired > 0) {
-		console.log(`[DB] Repaired ${trailingResult.repaired} dose IDs with trailing hyphens`);
+		log.info(`[DB] Repaired ${trailingResult.repaired} dose IDs with trailing hyphens`);
 	}
 	if (trailingResult.errors.length > 0) {
-		trailingResult.errors.forEach((err) => console.error(`[DB] Trailing-hyphen repair error:`, err));
+		trailingResult.errors.forEach((err) => log.error(`[DB] Trailing-hyphen repair error: ${err}`));
 	}
 
 	// Repair orphaned dose tracking IDs from past schedule changes
 	const repairResult = await repairOrphanedDoseIds(client);
 	if (repairResult.repaired > 0) {
-		console.log(`[DB] Repaired ${repairResult.repaired} orphaned dose tracking IDs`);
+		log.info(`[DB] Repaired ${repairResult.repaired} orphaned dose tracking IDs`);
 	}
 	if (repairResult.errors.length > 0) {
-		repairResult.errors.forEach((err) => console.error(`[DB] Dose repair error:`, err));
+		repairResult.errors.forEach((err) => log.error(`[DB] Dose repair error: ${err}`));
 	}
 
 	// If auth is disabled, ensure a default user exists (ID=1)
 	const authEnabled = process.env.AUTH_ENABLED === "true";
 	const created = await ensureDefaultUser(client, authEnabled);
 	if (created) {
-		console.log(`[DB] Created default user for auth-disabled mode`);
+		log.info(`[DB] Created default user for auth-disabled mode`);
 	}
 }
 

backend/src/db/db-utils.ts

@@ -71,8 +71,8 @@ export function ensureDataDirectory(dataDir: string): { success: boolean; error?
 		writeFileSync(testFile, "test");
 
 		return { success: true };
-	} catch (err: any) {
-		return { success: false, error: err.message };
+	} catch (err: unknown) {
+		return { success: false, error: (err as Error).message };
 	}
 }
 
@@ -87,14 +87,14 @@ export async function runDrizzleMigrations(
 	try {
 		await migrate(database, { migrationsFolder });
 		return { success: true };
-	} catch (err: any) {
-		// If the error is "duplicate column", it means the schema is already up-to-date
-		// This happens when ALTER migrations in client.ts have already added the columns
-		// We consider this a success with a warning, not a failure
-		if (err.message?.includes("duplicate column")) {
-			return { success: true, warning: `Schema already up-to-date: ${err.message}` };
+	} catch (err: unknown) {
+		// If the error is about existing schema objects, the DB is already up-to-date
+		// This happens when ALTER migrations in client.ts have already added the columns,
+		// or when tables were created before drizzle migrations were introduced
+		if ((err as Error).message?.includes("duplicate column") || (err as Error).message?.includes("already exists")) {
+			return { success: true, warning: `Schema already up-to-date: ${(err as Error).message}` };
 		}
-		return { success: false, error: err.message };
+		return { success: false, error: (err as Error).message };
 	}
 }
 
@@ -111,6 +111,8 @@ export async function runAlterMigrations(client: Client): Promise<{ success: boo
 		`ALTER TABLE user_settings ADD COLUMN max_nagging_reminders integer NOT NULL DEFAULT 5`,
 		// Added in v1.2.3 - dismiss missed doses without deducting stock
 		`ALTER TABLE dose_tracking ADD COLUMN dismissed integer NOT NULL DEFAULT 0`,
+		// Added for intake automation auditability (manual vs automatic taken)
+		`ALTER TABLE dose_tracking ADD COLUMN taken_source text NOT NULL DEFAULT 'manual'`,
 		// Added in v1.3.x - stock calculation mode (automatic/manual)
 		`ALTER TABLE user_settings ADD COLUMN stock_calculation_mode text NOT NULL DEFAULT 'automatic'`,
 		// Added for stock correction - hidden offset that doesn't affect looseTablets
@@ -119,6 +121,11 @@ export async function runAlterMigrations(client: Client): Promise<{ success: boo
 		`ALTER TABLE medications ADD COLUMN last_stock_correction_at integer`,
 		// Added in v1.5.1 - dismiss past doses until date (robust against timestamp changes)
 		`ALTER TABLE medications ADD COLUMN dismissed_until text`,
+		// Added for soft-archiving medications (without deleting history)
+		`ALTER TABLE medications ADD COLUMN is_obsolete integer NOT NULL DEFAULT 0`,
+		`ALTER TABLE medications ADD COLUMN obsolete_at integer`,
+		// Added for explicit medication lifecycle start date
+		`ALTER TABLE medications ADD COLUMN medication_start_date text NOT NULL DEFAULT ''`,
 		// Added for more detailed reminder info display
 		`ALTER TABLE user_settings ADD COLUMN last_reminder_med_name text`,
 		`ALTER TABLE user_settings ADD COLUMN last_reminder_taken_by text`,
@@ -129,15 +136,38 @@ export async function runAlterMigrations(client: Client): Promise<{ success: boo
 		`ALTER TABLE medications ADD COLUMN dose_unit text DEFAULT 'mg'`,
 		// Added for intake-level takenBy: unified intakes structure
 		`ALTER TABLE medications ADD COLUMN intakes_json text NOT NULL DEFAULT '[]'`,
+		// Added for separate stock reminder tracking
+		`ALTER TABLE user_settings ADD COLUMN last_stock_reminder_sent text`,
+		`ALTER TABLE user_settings ADD COLUMN last_stock_reminder_channel text`,
+		`ALTER TABLE user_settings ADD COLUMN last_stock_reminder_med_names text`,
+		// Added for share stock visibility toggle
+		`ALTER TABLE user_settings ADD COLUMN share_stock_status integer NOT NULL DEFAULT 1`,
+		// Added for timeline visibility toggles (dashboard + shared schedule)
+		`ALTER TABLE user_settings ADD COLUMN upcoming_today_only integer NOT NULL DEFAULT 0`,
+		`ALTER TABLE user_settings ADD COLUMN share_schedule_today_only integer NOT NULL DEFAULT 0`,
+		`ALTER TABLE user_settings ADD COLUMN swap_dashboard_main_sections integer NOT NULL DEFAULT 0`,
+		// Added for prescription refill tracking and reminders
+		`ALTER TABLE medications ADD COLUMN prescription_enabled integer NOT NULL DEFAULT 0`,
+		`ALTER TABLE medications ADD COLUMN prescription_authorized_refills integer`,
+		`ALTER TABLE medications ADD COLUMN prescription_remaining_refills integer`,
+		`ALTER TABLE medications ADD COLUMN prescription_low_refill_threshold integer NOT NULL DEFAULT 1`,
+		`ALTER TABLE medications ADD COLUMN prescription_expiry_date text`,
+		`ALTER TABLE user_settings ADD COLUMN email_prescription_reminders integer NOT NULL DEFAULT 1`,
+		`ALTER TABLE user_settings ADD COLUMN shoutrrr_prescription_reminders integer NOT NULL DEFAULT 1`,
+		`ALTER TABLE user_settings ADD COLUMN last_prescription_reminder_sent text`,
+		`ALTER TABLE user_settings ADD COLUMN last_prescription_reminder_channel text`,
+		`ALTER TABLE user_settings ADD COLUMN last_prescription_reminder_med_names text`,
+		// Added for refill history prescription tracking
+		`ALTER TABLE refill_history ADD COLUMN used_prescription integer NOT NULL DEFAULT 0`,
 	];
 
 	for (const sql of alterMigrations) {
 		try {
 			await client.execute(sql);
-		} catch (e: any) {
+		} catch (e: unknown) {
 			// Silently ignore "duplicate column" errors - column already exists
-			if (!e.message?.includes("duplicate column")) {
-				errors.push(e.message);
+			if (!(e as Error).message?.includes("duplicate column")) {
+				errors.push((e as Error).message);
 			}
 		}
 	}
@@ -158,10 +188,27 @@ export async function runAlterMigrations(client: Client): Promise<{ success: boo
 	for (const sql of createTableMigrations) {
 		try {
 			await client.execute(sql);
-		} catch (e: any) {
+		} catch (e: unknown) {
 			// Silently ignore "table already exists" errors
-			if (!e.message?.includes("already exists")) {
-				errors.push(e.message);
+			if (!(e as Error).message?.includes("already exists")) {
+				errors.push((e as Error).message);
+			}
+		}
+	}
+
+	// Create indexes that might be missing (silently fail if already exists)
+	const createIndexMigrations = [
+		// Added in v1.6.x - case-insensitive unique usernames
+		`CREATE UNIQUE INDEX IF NOT EXISTS users_username_lower_unique ON users(lower(username))`,
+	];
+
+	for (const sql of createIndexMigrations) {
+		try {
+			await client.execute(sql);
+		} catch (e: unknown) {
+			// Silently ignore "already exists" errors
+			if (!(e as Error).message?.includes("already exists")) {
+				errors.push((e as Error).message);
 			}
 		}
 	}
@@ -186,8 +233,8 @@ export async function ensureDefaultUser(client: Client, authEnabled: boolean): P
 			return true; // Created
 		}
 		return false; // Already exists
-	} catch (e: any) {
-		console.error(`[DB] Error creating default user:`, e.message);
+	} catch (e: unknown) {
+		console.error(`[DB] Error creating default user:`, (e as Error).message);
 		return false;
 	}
 }
@@ -214,8 +261,8 @@ export async function repairTrailingHyphenDoseIds(client: Client): Promise<{ rep
 			"UPDATE dose_tracking SET dose_id = RTRIM(dose_id, '-') WHERE dose_id LIKE '%-'"
 		);
 		repaired = result.rowsAffected;
-	} catch (e: any) {
-		errors.push(`Trailing-hyphen repair failed: ${e.message}`);
+	} catch (e: unknown) {
+		errors.push(`Trailing-hyphen repair failed: ${(e as Error).message}`);
 	}
 
 	return { repaired, errors };
@@ -338,14 +385,14 @@ export async function repairOrphanedDoseIds(client: Client): Promise<{ repaired:
 							args: [newDoseId, dose.id],
 						});
 						repaired++;
-					} catch (e: any) {
-						errors.push(`Failed to repair dose ${dose.id}: ${e.message}`);
+					} catch (e: unknown) {
+						errors.push(`Failed to repair dose ${dose.id}: ${(e as Error).message}`);
 					}
 				}
 			}
 		}
-	} catch (e: any) {
-		errors.push(`Repair failed: ${e.message}`);
+	} catch (e: unknown) {
+		errors.push(`Repair failed: ${(e as Error).message}`);
 	}
 
 	return { repaired, errors };

backend/src/db/migrate.ts

@@ -41,8 +41,8 @@ export async function executeMigration(
 		const executed = Number(tables.rows[0].count) || 0;
 
 		return { success: true, executed, errors };
-	} catch (err: any) {
-		errors.push(err.message);
+	} catch (err: unknown) {
+		errors.push((err as Error).message);
 		return { success: false, executed: 0, errors };
 	}
 }
@@ -63,17 +63,17 @@ export function getStatementPreview(stmt: string, maxLength: number = 50): strin
 const url = "file:./data/medassist-ng.db";
 
 async function main() {
-	console.log("Starting database setup...");
-	console.log("Database URL:", url);
-	console.log("Migrations folder:", migrationsFolder);
+	console.log("[DB] Starting database setup...");
+	console.log("[DB] Database URL:", url);
+	console.log("[DB] Migrations folder:", migrationsFolder);
 
 	const client = createClient({ url });
 	const db = drizzle(client);
 
-	console.log("Running drizzle migrations...");
+	console.log("[DB] Running drizzle migrations...");
 	await migrate(db, { migrationsFolder });
 
-	console.log("Database setup complete!");
+	console.log("[DB] Database setup complete!");
 	process.exit(0);
 }
 

backend/src/db/schema-sql.ts

@@ -65,9 +65,21 @@ export function getTableCreationSQL(): string[] {
       expiry_warning_days integer NOT NULL DEFAULT 90,
       language text NOT NULL DEFAULT 'en',
       stock_calculation_mode text NOT NULL DEFAULT 'automatic',
+      share_stock_status integer NOT NULL DEFAULT 1,
+      upcoming_today_only integer NOT NULL DEFAULT 0,
+      share_schedule_today_only integer NOT NULL DEFAULT 0,
+      swap_dashboard_main_sections integer NOT NULL DEFAULT 0,
       last_auto_email_sent text,
       last_notification_type text,
       last_notification_channel text,
+      last_reminder_med_name text,
+      last_reminder_taken_by text,
+      last_stock_reminder_sent text,
+      last_stock_reminder_channel text,
+      last_stock_reminder_med_names text,
+      last_prescription_reminder_sent text,
+      last_prescription_reminder_channel text,
+      last_prescription_reminder_med_names text,
       updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,

backend/src/db/schema.ts

@@ -47,6 +47,14 @@ export const medications = sqliteTable("medications", {
 	expiryDate: text("expiry_date"),
 	notes: text("notes"),
 	intakeRemindersEnabled: integer("intake_reminders_enabled", { mode: "boolean" }).notNull().default(false),
+	medicationStartDate: text("medication_start_date").notNull().default(""),
+	isObsolete: integer("is_obsolete", { mode: "boolean" }).notNull().default(false),
+	obsoleteAt: integer("obsolete_at", { mode: "timestamp" }),
+	prescriptionEnabled: integer("prescription_enabled", { mode: "boolean" }).notNull().default(false),
+	prescriptionAuthorizedRefills: integer("prescription_authorized_refills"),
+	prescriptionRemainingRefills: integer("prescription_remaining_refills"),
+	prescriptionLowRefillThreshold: integer("prescription_low_refill_threshold").notNull().default(1),
+	prescriptionExpiryDate: text("prescription_expiry_date"),
 	dismissedUntil: text("dismissed_until"), // ISO date string (e.g. "2026-01-23") - all past doses until this date are dismissed
 	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull().default(sql`CURRENT_TIMESTAMP`),
 });
@@ -65,11 +73,15 @@ export const userSettings = sqliteTable("user_settings", {
 	notificationEmail: text("notification_email"),
 	emailStockReminders: integer("email_stock_reminders", { mode: "boolean" }).notNull().default(true),
 	emailIntakeReminders: integer("email_intake_reminders", { mode: "boolean" }).notNull().default(true),
+	emailPrescriptionReminders: integer("email_prescription_reminders", { mode: "boolean" }).notNull().default(true),
 	// Push notifications (shoutrrr/ntfy)
 	shoutrrrEnabled: integer("shoutrrr_enabled", { mode: "boolean" }).notNull().default(false),
 	shoutrrrUrl: text("shoutrrr_url"),
 	shoutrrrStockReminders: integer("shoutrrr_stock_reminders", { mode: "boolean" }).notNull().default(true),
 	shoutrrrIntakeReminders: integer("shoutrrr_intake_reminders", { mode: "boolean" }).notNull().default(true),
+	shoutrrrPrescriptionReminders: integer("shoutrrr_prescription_reminders", { mode: "boolean" })
+		.notNull()
+		.default(true),
 	// Reminder settings
 	reminderDaysBefore: integer("reminder_days_before").notNull().default(7),
 	repeatDailyReminders: integer("repeat_daily_reminders", { mode: "boolean" }).notNull().default(false),
@@ -86,12 +98,26 @@ export const userSettings = sqliteTable("user_settings", {
 	language: text("language", { length: 10 }).notNull().default("en"),
 	// Stock calculation mode: "automatic" (schedule-based) or "manual" (only marked doses)
 	stockCalculationMode: text("stock_calculation_mode", { length: 20 }).notNull().default("automatic"),
-	// Last notification tracking
+	// Whether shared schedule links show stock status (Critical/Low/Normal) to intake users
+	shareStockStatus: integer("share_stock_status", { mode: "boolean" }).notNull().default(true),
+	// UI timeline visibility preferences
+	upcomingTodayOnly: integer("upcoming_today_only", { mode: "boolean" }).notNull().default(false),
+	shareScheduleTodayOnly: integer("share_schedule_today_only", { mode: "boolean" }).notNull().default(false),
+	swapDashboardMainSections: integer("swap_dashboard_main_sections", { mode: "boolean" }).notNull().default(false),
+	// Last notification tracking (intake reminders)
 	lastAutoEmailSent: text("last_auto_email_sent"),
 	lastNotificationType: text("last_notification_type"),
 	lastNotificationChannel: text("last_notification_channel"),
 	lastReminderMedName: text("last_reminder_med_name"),
 	lastReminderTakenBy: text("last_reminder_taken_by"),
+	// Last stock reminder tracking (separate from intake)
+	lastStockReminderSent: text("last_stock_reminder_sent"),
+	lastStockReminderChannel: text("last_stock_reminder_channel"),
+	lastStockReminderMedNames: text("last_stock_reminder_med_names"),
+	// Last prescription reminder tracking (separate from stock/intake)
+	lastPrescriptionReminderSent: text("last_prescription_reminder_sent"),
+	lastPrescriptionReminderChannel: text("last_prescription_reminder_channel"),
+	lastPrescriptionReminderMedNames: text("last_prescription_reminder_med_names"),
 	// Timestamps
 	updatedAt: integer("updated_at", { mode: "timestamp" }).notNull().default(sql`CURRENT_TIMESTAMP`),
 });
@@ -137,6 +163,7 @@ export const doseTracking = sqliteTable("dose_tracking", {
 	doseId: text("dose_id", { length: 255 }).notNull(), // e.g. "med-5-1-86400000-1735200000000"
 	takenAt: integer("taken_at", { mode: "timestamp" }).notNull().default(sql`(strftime('%s','now'))`),
 	markedBy: text("marked_by", { length: 100 }), // null = user, "Daniel" = via share link
+	takenSource: text("taken_source", { length: 20 }).notNull().default("manual"), // manual or automatic
 	dismissed: integer("dismissed", { mode: "boolean" }).notNull().default(false), // true = missed dose acknowledged without taking
 });
 
@@ -153,5 +180,6 @@ export const refillHistory = sqliteTable("refill_history", {
 		.references(() => users.id, { onDelete: "cascade" }),
 	packsAdded: integer("packs_added").notNull().default(0),
 	loosePillsAdded: integer("loose_pills_added").notNull().default(0),
+	usedPrescription: integer("used_prescription", { mode: "boolean" }).notNull().default(false),
 	refillDate: integer("refill_date", { mode: "timestamp" }).notNull().default(sql`(strftime('%s','now'))`),
 });

backend/src/i18n/translations.ts

@@ -64,20 +64,29 @@ function getRegionFromTimezone(): string | undefined {
 }
 
 type TranslationKeys = {
-	// Stock reminder email
+	// Stock reminder (shared across email + push)
 	stockReminder: {
 		subject: string;
 		title: string;
 		description: string;
+		descriptionEmpty: string;
+		descriptionMixed: string;
 		alertSingle: string;
 		alertMultiple: string;
+		alertEmptySingle: string;
+		alertEmptyMultiple: string;
+		alertLowSingle: string;
+		alertLowMultiple: string;
+		alertLowStockSingle: string;
+		alertLowStockMultiple: string;
+		descriptionLow: string;
 		tableHeaders: {
 			medication: string;
 			pills: string;
 			days: string;
 			runsOut: string;
 		};
-		footer: string;
+		now: string;
 		repeatDailyNote: string;
 	};
 	// Intake reminder email
@@ -94,7 +103,6 @@ type TranslationKeys = {
 		};
 		pills: string;
 		takenBy: string;
-		footer: string;
 	};
 	// Push notifications
 	push: {
@@ -107,35 +115,103 @@ type TranslationKeys = {
 		repeatDailyNote: string;
 		empty: string;
 		low: string;
+		critical: string;
+		lowStock: string;
 		reorderNow: string;
 		emptySection: string;
 		lowSection: string;
+		criticalSection: string;
+		lowStockSection: string;
+	};
+	// Prescription reminder (shared across email + push)
+	prescriptionReminder: {
+		subjectSingle: string;
+		subjectMultiple: string;
+		pushTitleLow: string;
+		pushTitleEmpty: string;
+		pushEmpty: string;
+		pushEmptySingle: string;
+		pushLow: string;
+		pushLowSingle: string;
+		pushRenewNow: string;
+		pushEmptySection: string;
+		pushLowSection: string;
+		pushRefillsLeft: string;
+		title: string;
+		titleEmpty: string;
+		descriptionLow: string;
+		descriptionEmpty: string;
+		alertLowSingle: string;
+		alertLowMultiple: string;
+		alertEmptySingle: string;
+		alertEmptyMultiple: string;
+		line: string;
+		lineEmpty: string;
+		expiresSuffix: string;
+		repeatDailyNote: string;
+		tableHeaders: {
+			medication: string;
+			refillsLeft: string;
+			reminderThreshold: string;
+			prescriptionExpires: string;
+		};
+	};
+	// Demand calculator email
+	demandCalculator: {
+		subject: string;
+		title: string;
+		description: string;
+		summaryOutOfStock: string;
+		summaryAllOk: string;
+		tableHeaders: {
+			medication: string;
+			usage: string;
+			needed: string;
+			prescriptionRefills: string;
+			available: string;
+			status: string;
+		};
+		statusEnough: string;
+		statusEmpty: string;
+		prescriptionNotApplicable: string;
 	};
 	// Common
 	common: {
 		pill: string;
 		pills: string;
+		blister: string;
+		blisters: string;
 		day: string;
 		days: string;
 		soon: string;
+		footer: string;
 	};
 };
 
 const translations: Record<Language, TranslationKeys> = {
 	en: {
 		stockReminder: {
-			subject: "MedAssist-ng Auto-Reminder: {count} Medication{s} Running Low",
-			title: "⚠️ MedAssist-ng - Automatic Reorder Reminder",
-			description: "The following medications are running low and need to be reordered:",
-			alertSingle: "⚠️ 1 medication running low!",
-			alertMultiple: "⚠️ {count} medications running low!",
+			subject: "MedAssist-ng: ⚠️ {count} Medication{s} Running Critically Low",
+			title: "⚠️ MedAssist-ng: Automatic Reorder Reminder",
+			description: "The following medications are running critically low and need to be reordered:",
+			descriptionEmpty: "The following medications are empty and need to be reordered immediately:",
+			descriptionMixed: "The following medications need to be reordered:",
+			alertSingle: "⚠️ 1 medication running critically low!",
+			alertMultiple: "⚠️ {count} medications running critically low!",
+			alertEmptySingle: "🚨 1 medication empty - reorder immediately!",
+			alertEmptyMultiple: "🚨 {count} medications empty - reorder immediately!",
+			alertLowSingle: "⚠️ 1 medication running critically low",
+			alertLowMultiple: "⚠️ {count} medications running critically low",
+			alertLowStockSingle: "⚠️ 1 medication running low",
+			alertLowStockMultiple: "⚠️ {count} medications running low",
+			descriptionLow: "The following medications are running low and should be reordered soon:",
 			tableHeaders: {
 				medication: "Medication",
 				pills: "Pills",
 				days: "Days",
 				runsOut: "Runs Out",
 			},
-			footer: "🤖 Automatic reminder from MedAssist-ng",
+			now: "NOW",
 			repeatDailyNote: "You are receiving this daily reminder because 'Repeat Daily' is enabled in settings.",
 		},
 		intakeReminder: {
@@ -151,44 +227,109 @@ const translations: Record<Language, TranslationKeys> = {
 			},
 			pills: "pills",
 			takenBy: "for {name}",
-			footer: "🤖 Automatic reminder from MedAssist-ng",
 		},
 		push: {
-			stockTitle: "MedAssist-ng: 1 Medication Running Low",
-			stockTitleMultiple: "MedAssist-ng: {count} Medications Running Low",
-			intakeTitle: "💊 Medication Reminder in {minutes} min",
+			stockTitle: "MedAssist-ng: 1 Medication Running Critically Low",
+			stockTitleMultiple: "MedAssist-ng: {count} Medications Running Critically Low",
+			intakeTitle: "💊 Reminder: Medication intake in {minutes} min",
 			pillsLeft: "{count} pills",
 			daysLeft: "{count} days left",
 			pillsAt: "{count} pills at {time}",
 			repeatDailyNote: "(Daily reminder enabled)",
 			empty: "Empty",
-			low: "Low",
+			low: "Critical",
+			critical: "Critical",
+			lowStock: "Low",
 			reorderNow: "Reorder Now!",
-			emptySection: "EMPTY (reorder immediately)",
-			lowSection: "RUNNING LOW (reorder soon)",
+			emptySection: "Empty (reorder immediately)",
+			lowSection: "Running critically low",
+			criticalSection: "Running critically low",
+			lowStockSection: "Running low",
+		},
+		prescriptionReminder: {
+			subjectSingle: "MedAssist-ng: 🚨 Prescription Refill Reminder",
+			subjectMultiple: "MedAssist-ng: 🚨 {count} Prescriptions Need Renewal Soon",
+			pushTitleLow: "💊 MedAssist-ng: {count} prescriptions are running low",
+			pushTitleEmpty: "💊 MedAssist-ng: {count} prescriptions need renewal now",
+			pushEmpty: "prescriptions out of refills",
+			pushEmptySingle: "prescription out of refills",
+			pushLow: "prescriptions low on refills",
+			pushLowSingle: "prescription low on refills",
+			pushRenewNow: "Renew Now!",
+			pushEmptySection: "Prescriptions with no refills left",
+			pushLowSection: "Prescriptions running low on refills",
+			pushRefillsLeft: "{count} refill(s) remaining on this prescription",
+			title: "⚠️ MedAssist-ng - Prescription Reminder",
+			titleEmpty: "🚨 MedAssist-ng - Prescription Reminder",
+			descriptionLow: "Some prescriptions are low on remaining refills.",
+			descriptionEmpty: "Some prescriptions have no refills left. Contact your doctor for renewal.",
+			alertLowSingle: "⚠️ 1 prescription is low on refills",
+			alertLowMultiple: "⚠️ {count} prescriptions are low on refills",
+			alertEmptySingle: "🚨 1 prescription needs renewal now",
+			alertEmptyMultiple: "🚨 {count} prescriptions need renewal now",
+			line: "{name}: {refills} refill(s) remaining on this prescription{expirySuffix}",
+			lineEmpty: "{name}: no refills remaining on this prescription{expirySuffix}",
+			expiresSuffix: ", expires {date}",
+			repeatDailyNote: "You are receiving this daily reminder because 'Repeat Daily' is enabled in settings.",
+			tableHeaders: {
+				medication: "Medication",
+				refillsLeft: "Prescription refills left",
+				reminderThreshold: "Reminder threshold",
+				prescriptionExpires: "Prescription expires",
+			},
+		},
+		demandCalculator: {
+			subject: "MedAssist-ng: Supply Overview ({from} - {until})",
+			title: "MedAssist-ng: Demand Calculator",
+			description: "Supply overview from {from} to {until}",
+			summaryOutOfStock: "⚠️ {count} medication{s} will be out of stock during this period.",
+			summaryAllOk: "✓ All medications have sufficient supply for this period.",
+			tableHeaders: {
+				medication: "Medication",
+				usage: "Usage",
+				needed: "Blisters needed",
+				prescriptionRefills: "Prescription refills",
+				available: "Available",
+				status: "Status",
+			},
+			statusEnough: "✓ Enough",
+			statusEmpty: "✗ Empty",
+			prescriptionNotApplicable: "–",
 		},
 		common: {
 			pill: "pill",
 			pills: "pills",
+			blister: "blister",
+			blisters: "blisters",
 			day: "day",
 			days: "days",
 			soon: "soon",
+			footer: "🤖 Sent from MedAssist-ng",
 		},
 	},
 	de: {
 		stockReminder: {
-			subject: "MedAssist-ng Auto-Erinnerung: {count} Medikament{e} wird knapp",
-			title: "⚠️ MedAssist-ng - Automatische Nachbestell-Erinnerung",
-			description: "Die folgenden Medikamente gehen zur Neige und sollten nachbestellt werden:",
-			alertSingle: "⚠️ 1 Medikament wird knapp!",
-			alertMultiple: "⚠️ {count} Medikamente werden knapp!",
+			subject: "MedAssist-ng: ⚠️ {count} Medikament{e} kritisch niedrig",
+			title: "⚠️ MedAssist-ng: Automatische Nachbestell-Erinnerung",
+			description: "Die folgenden Medikamente sind kritisch niedrig und sollten nachbestellt werden:",
+			descriptionEmpty: "Die folgenden Medikamente sind leer und müssen sofort nachbestellt werden:",
+			descriptionMixed: "Die folgenden Medikamente müssen nachbestellt werden:",
+			alertSingle: "⚠️ 1 Medikament kritisch niedrig!",
+			alertMultiple: "⚠️ {count} Medikamente kritisch niedrig!",
+			alertEmptySingle: "🚨 1 Medikament leer - sofort nachbestellen!",
+			alertEmptyMultiple: "🚨 {count} Medikamente leer - sofort nachbestellen!",
+			alertLowSingle: "⚠️ 1 Medikament kritisch niedrig",
+			alertLowMultiple: "⚠️ {count} Medikamente kritisch niedrig",
+			alertLowStockSingle: "⚠️ 1 Medikament niedrig",
+			alertLowStockMultiple: "⚠️ {count} Medikamente niedrig",
+			descriptionLow: "Die folgenden Medikamente werden knapp und sollten bald nachbestellt werden:",
 			tableHeaders: {
 				medication: "Medikament",
 				pills: "Tabletten",
 				days: "Tage",
 				runsOut: "Aufgebraucht",
 			},
-			footer: "🤖 Automatische Erinnerung von MedAssist-ng",
+			now: "JETZT",
 			repeatDailyNote:
 				"Sie erhalten diese tägliche Erinnerung, weil 'Täglich wiederholen' in den Einstellungen aktiviert ist.",
 		},
@@ -205,28 +346,86 @@ const translations: Record<Language, TranslationKeys> = {
 			},
 			pills: "Tabletten",
 			takenBy: "für {name}",
-			footer: "🤖 Automatische Erinnerung von MedAssist-ng",
 		},
 		push: {
-			stockTitle: "MedAssist-ng: 1 Medikament wird knapp",
-			stockTitleMultiple: "MedAssist-ng: {count} Medikamente werden knapp",
-			intakeTitle: "💊 Einnahme-Erinnerung in {minutes} Min.",
+			stockTitle: "MedAssist-ng: 1 Medikament kritisch niedrig",
+			stockTitleMultiple: "MedAssist-ng: {count} Medikamente kritisch niedrig",
+			intakeTitle: "💊 Erinnerung: Medikamenteneinnahme in {minutes} Min.",
 			pillsLeft: "{count} Tabletten",
 			daysLeft: "{count} Tage übrig",
 			pillsAt: "{count} Tabletten um {time}",
 			repeatDailyNote: "(Tägliche Erinnerung aktiviert)",
 			empty: "Leer",
-			low: "Knapp",
+			low: "Kritisch",
+			critical: "Kritisch",
+			lowStock: "Niedrig",
 			reorderNow: "Jetzt nachbestellen!",
-			emptySection: "LEER (sofort nachbestellen)",
-			lowSection: "WIRD KNAPP (bald nachbestellen)",
+			emptySection: "Leer (sofort nachbestellen)",
+			lowSection: "Kritisch niedrig",
+			criticalSection: "Kritisch niedrig",
+			lowStockSection: "Niedrig",
+		},
+		prescriptionReminder: {
+			subjectSingle: "MedAssist-ng: 🚨 Rezept-Nachfüll-Erinnerung",
+			subjectMultiple: "MedAssist-ng: 🚨 {count} Rezepte müssen bald erneuert werden",
+			pushTitleLow: "💊 MedAssist-ng: {count} Rezept(e) haben nur noch wenige Nachfüllungen",
+			pushTitleEmpty: "💊 MedAssist-ng: {count} Rezept(e) müssen jetzt erneuert werden",
+			pushEmpty: "Rezepte ohne verbleibende Nachfüllung",
+			pushEmptySingle: "Rezept ohne verbleibende Nachfüllung",
+			pushLow: "Rezepte mit wenigen verbleibenden Nachfüllungen",
+			pushLowSingle: "Rezept mit wenigen verbleibenden Nachfüllungen",
+			pushRenewNow: "Jetzt erneuern!",
+			pushEmptySection: "Rezepte ohne Nachfüllungen",
+			pushLowSection: "Rezepte mit bald aufgebrauchten Nachfüllungen",
+			pushRefillsLeft: "{count} Nachfüllung(en) für dieses Rezept übrig",
+			title: "⚠️ MedAssist-ng - Rezept-Erinnerung",
+			titleEmpty: "🚨 MedAssist-ng - Rezept-Erinnerung",
+			descriptionLow: "Einige Rezepte haben nur noch wenige Nachfüllungen.",
+			descriptionEmpty:
+				"Einige Rezepte haben keine Nachfüllungen mehr. Bitte kontaktieren Sie Ihren Arzt für eine Erneuerung.",
+			alertLowSingle: "⚠️ 1 Rezept ist bei den Nachfüllungen niedrig",
+			alertLowMultiple: "⚠️ {count} Rezepte sind bei den Nachfüllungen niedrig",
+			alertEmptySingle: "🚨 1 Rezept muss jetzt erneuert werden",
+			alertEmptyMultiple: "🚨 {count} Rezepte müssen jetzt erneuert werden",
+			line: "{name}: {refills} Nachfüllung(en) für dieses Rezept übrig{expirySuffix}",
+			lineEmpty: "{name}: keine Nachfüllung mehr für dieses Rezept{expirySuffix}",
+			expiresSuffix: ", läuft ab {date}",
+			repeatDailyNote:
+				"Sie erhalten diese tägliche Erinnerung, weil 'Täglich wiederholen' in den Einstellungen aktiviert ist.",
+			tableHeaders: {
+				medication: "Medikament",
+				refillsLeft: "Rezept-Nachfüllungen übrig",
+				reminderThreshold: "Erinnerungsschwelle",
+				prescriptionExpires: "Rezeptablauf",
+			},
+		},
+		demandCalculator: {
+			subject: "MedAssist-ng: Bestandsübersicht ({from} - {until})",
+			title: "MedAssist-ng: Bedarfsrechner",
+			description: "Bestandsübersicht von {from} bis {until}",
+			summaryOutOfStock: "⚠️ {count} Medikament{e} wird im Zeitraum nicht ausreichen.",
+			summaryAllOk: "✓ Alle Medikamente reichen für diesen Zeitraum.",
+			tableHeaders: {
+				medication: "Medikament",
+				usage: "Verbrauch",
+				needed: "Blister benötigt",
+				prescriptionRefills: "Rezept-Nachfüllungen",
+				available: "Verfügbar",
+				status: "Status",
+			},
+			statusEnough: "✓ Ausreichend",
+			statusEmpty: "✗ Leer",
+			prescriptionNotApplicable: "–",
 		},
 		common: {
 			pill: "Tablette",
 			pills: "Tabletten",
+			blister: "Blister",
+			blisters: "Blister",
 			day: "Tag",
 			days: "Tage",
 			soon: "bald",
+			footer: "🤖 Gesendet von MedAssist-ng",
 		},
 	},
 };
@@ -264,3 +463,38 @@ export function getDateLocale(language: Language): string {
 			return "en-US";
 	}
 }
+
+/**
+ * Get the app URL from the first CORS_ORIGINS entry.
+ * Falls back to empty string if not set.
+ */
+export function getAppUrl(): string {
+	const origins = process.env.CORS_ORIGINS || "";
+	return origins.split(",")[0]?.trim() || "";
+}
+
+/**
+ * Get the unified footer as HTML with MedAssist-ng as a link to the instance.
+ * @param variant - 'planner' uses the Medication Planner footer text
+ */
+export function getFooterHtml(language: Language): string {
+	const tr = getTranslations(language);
+	const appUrl = getAppUrl();
+	const appName = appUrl
+		? `<a href="${appUrl}" style="color: #6b7280; text-decoration: underline;">MedAssist-ng</a>`
+		: "MedAssist-ng";
+	return tr.common.footer.replace("MedAssist-ng", appName);
+}
+
+/**
+ * Get the unified footer as plain text.
+ * @param variant - 'planner' uses the Medication Planner footer text
+ */
+export function getFooterPlain(language: Language): string {
+	const tr = getTranslations(language);
+	const appUrl = getAppUrl();
+	if (appUrl) {
+		return `${tr.common.footer} (${appUrl})`;
+	}
+	return tr.common.footer;
+}

backend/src/index.ts

@@ -20,6 +20,7 @@ import { medicationRoutes } from "./routes/medications.js";
 import { oidcRoutes } from "./routes/oidc.js";
 import { plannerRoutes } from "./routes/planner.js";
 import { refillRoutes } from "./routes/refills.js";
+import { reportRoutes } from "./routes/report.js";
 import { settingsRoutes } from "./routes/settings.js";
 import { shareRoutes } from "./routes/share.js";
 import { startIntakeReminderScheduler } from "./services/intake-reminder-scheduler.js";
@@ -118,6 +119,7 @@ export async function createApp(options?: {
 	await app.register(doseRoutes);
 	await app.register(exportRoutes);
 	await app.register(refillRoutes);
+	await app.register(reportRoutes);
 
 	return app;
 }
@@ -126,9 +128,11 @@ export async function createApp(options?: {
 // Server initialization (runs on import)
 // =============================================================================
 
+import { log } from "./utils/logger.js";
+
 // Wait for database migrations before anything else
 await migrationsReady;
-console.log("[DB] Migrations complete, starting server...");
+log.info("[DB] Migrations complete, starting server...");
 
 // Ensure images directory exists
 const imagesDir = ensureImagesDirectory();
@@ -162,7 +166,7 @@ await app.register(sensible);
 await app.register(helmet);
 await app.register(cors, { origin: origins, credentials: true });
 await app.register(rateLimit, {
-	max: 100,
+	max: Number(process.env.RATE_LIMIT_MAX) || 100,
 	timeWindow: "1 minute",
 });
 await app.register(cookie, { secret: env.COOKIE_SECRET ?? "dev-cookie-secret" });
@@ -188,6 +192,7 @@ await app.register(shareRoutes);
 await app.register(doseRoutes);
 await app.register(exportRoutes);
 await app.register(refillRoutes);
+await app.register(reportRoutes);
 
 const start = async () => {
 	try {
@@ -197,12 +202,14 @@ const start = async () => {
 		// Start the automatic reminder scheduler
 		startReminderScheduler({
 			info: (msg) => app.log.info(msg),
+			debug: (msg) => app.log.debug(msg),
 			error: (msg) => app.log.error(msg),
 		});
 
 		// Start the intake reminder scheduler (checks every minute)
 		startIntakeReminderScheduler({
 			info: (msg) => app.log.info(msg),
+			debug: (msg) => app.log.debug(msg),
 			error: (msg) => app.log.error(msg),
 		});
 	} catch (err) {

backend/src/plugins/auth.ts

@@ -37,7 +37,6 @@ export async function getAnonymousUserId(): Promise<number> {
   `);
 
 	anonymousUserVerified = true;
-	console.log(`Created anonymous user with fixed ID ${ANONYMOUS_USER_ID} for no-auth mode`);
 
 	return ANONYMOUS_USER_ID;
 }
@@ -143,9 +142,12 @@ export async function requireAuth(request: FastifyRequest, reply: FastifyReply)
 			id: user.id,
 			username: user.username,
 		};
-	} catch (err: any) {
+	} catch (err: unknown) {
 		// Re-throw our own errors
-		if (err?.message === "AUTH_REQUIRED" || err?.message === "USER_NOT_FOUND" || err?.message === "ACCOUNT_DISABLED") {
+		if (
+			err instanceof Error &&
+			(err.message === "AUTH_REQUIRED" || err.message === "USER_NOT_FOUND" || err.message === "ACCOUNT_DISABLED")
+		) {
 			throw err;
 		}
 		// JWT verification failed

backend/src/routes/auth.ts

@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import argon2 from "argon2";
-import { eq } from "drizzle-orm";
+import { eq, sql } from "drizzle-orm";
 import type { FastifyInstance } from "fastify";
 import { z } from "zod";
 import { db } from "../db/client.js";
@@ -129,7 +129,7 @@ export async function authRoutes(app: FastifyInstance) {
 			const { username, password } = parsed.data;
 
 			// Check if username already exists
-			const [existingUser] = await db.select().from(users).where(eq(users.username, username));
+			const [existingUser] = await db.select().from(users).where(sql`lower(${users.username}) = lower(${username})`);
 			if (existingUser) {
 				return reply.status(409).send({ error: "Username already taken", code: "USERNAME_EXISTS" });
 			}
@@ -190,7 +190,7 @@ export async function authRoutes(app: FastifyInstance) {
 			const { username, password, rememberMe } = parsed.data;
 
 			// Find user by username
-			const [user] = await db.select().from(users).where(eq(users.username, username));
+			const [user] = await db.select().from(users).where(sql`lower(${users.username}) = lower(${username})`);
 
 			// Generic error to prevent user enumeration
 			const invalidCredentialsError = () =>

backend/src/routes/doses.ts

@@ -56,6 +56,7 @@ export async function doseRoutes(app: FastifyInstance) {
 				doseId: d.doseId,
 				takenAt: d.takenAt?.getTime() ?? Date.now(),
 				markedBy: d.markedBy,
+				takenSource: d.takenSource ?? "manual",
 				dismissed: d.dismissed ?? false,
 			})),
 		};
@@ -94,6 +95,7 @@ export async function doseRoutes(app: FastifyInstance) {
 				userId,
 				doseId,
 				markedBy: null, // Marked by the user themselves
+				takenSource: "manual",
 			});
 
 			return { success: true };
@@ -227,6 +229,7 @@ export async function doseRoutes(app: FastifyInstance) {
 				doseId: d.doseId,
 				takenAt: d.takenAt?.getTime() ?? Date.now(),
 				markedBy: d.markedBy,
+				takenSource: d.takenSource ?? "manual",
 				dismissed: d.dismissed ?? false,
 			})),
 		};
@@ -270,6 +273,7 @@ export async function doseRoutes(app: FastifyInstance) {
 				userId: share.userId,
 				doseId,
 				markedBy: share.takenBy, // e.g. "Daniel"
+				takenSource: "manual",
 			});
 
 			return { success: true };

backend/src/routes/export.ts

@@ -2,11 +2,11 @@ import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { extname, resolve } from "node:path";
 import { eq } from "drizzle-orm";
-import type { FastifyInstance } from "fastify";
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 import { db } from "../db/client.js";
 import { getDataDir } from "../db/db-utils.js";
-import { doseTracking, medications, shareTokens, userSettings } from "../db/schema.js";
+import { doseTracking, medications, refillHistory, shareTokens, userSettings } from "../db/schema.js";
 import { getAnonymousUserId, requireAuth } from "../plugins/auth.js";
 import { env } from "../plugins/env.js";
 import type { AuthUser } from "../types/fastify.js";
@@ -17,7 +17,7 @@ const IMAGES_DIR = resolve(getDataDir(), "images");
 // =============================================================================
 // Export Format Version (bump this when format changes)
 // =============================================================================
-const EXPORT_VERSION = "1.0";
+const EXPORT_VERSION = "1.1";
 
 // =============================================================================
 // Zod Schemas for Import Validation
@@ -35,8 +35,10 @@ const inventorySchema = z.object({
 	packCount: z.number().int().min(0).default(1),
 	blistersPerPack: z.number().int().min(1).default(1),
 	pillsPerBlister: z.number().int().min(1).default(1),
+	totalPills: z.number().int().nullable().optional(), // For bottle type: total capacity
 	looseTablets: z.number().int().min(0).default(0),
 	stockAdjustment: z.number().int().default(0), // Manual stock correction
+	packageType: z.enum(["blister", "bottle"]).default("blister"),
 });
 
 const medicationExportSchema = z.object({
@@ -48,9 +50,18 @@ const medicationExportSchema = z.object({
 	pillWeightMg: z.number().int().nullable().optional(),
 	doseUnit: z.enum(["mg", "g", "mcg", "ml", "IU", "units", "drops", "puffs"]).default("mg"),
 	schedules: z.array(scheduleSchema).default([]),
+	medicationStartDate: z.string().nullable().optional(),
 	expiryDate: z.string().nullable().optional(),
 	notes: z.string().nullable().optional(),
 	intakeRemindersEnabled: z.boolean().default(false),
+	isObsolete: z.boolean().default(false),
+	obsoleteAt: z.string().nullable().optional(),
+	prescriptionEnabled: z.boolean().default(false),
+	prescriptionAuthorizedRefills: z.number().int().min(0).nullable().optional(),
+	prescriptionRemainingRefills: z.number().int().min(0).nullable().optional(),
+	prescriptionLowRefillThreshold: z.number().int().min(0).default(1),
+	prescriptionExpiryDate: z.string().nullable().optional(),
+	dismissedUntil: z.string().nullable().optional(), // ISO date string for dismissed past doses
 	image: z.string().nullable().optional(), // base64 data URL or null
 	lastStockCorrectionAt: z.string().nullable().optional(), // ISO datetime of last stock correction
 });
@@ -61,10 +72,19 @@ const doseHistorySchema = z.object({
 	scheduledTime: z.string(), // ISO datetime
 	takenAt: z.string(), // ISO datetime
 	markedBy: z.string().nullable().optional(),
+	takenSource: z.enum(["manual", "automatic"]).default("manual"),
 	dismissed: z.boolean().default(false),
 	takenByPerson: z.string().nullable().optional(), // Person suffix from dose ID (e.g., "Daniel")
 });
 
+const refillHistoryExportSchema = z.object({
+	medicationRef: z.string(), // References _exportId
+	packsAdded: z.number().int().min(0).default(0),
+	loosePillsAdded: z.number().int().min(0).default(0),
+	usedPrescription: z.boolean().default(false),
+	refillDate: z.string(), // ISO datetime
+});
+
 const shareLinkSchema = z.object({
 	takenBy: z.string().min(1),
 	scheduleDays: z.number().int().min(1).default(30),
@@ -79,11 +99,13 @@ const settingsExportSchema = z
 		notificationEmail: z.string().nullable().optional(),
 		emailStockReminders: z.boolean().default(true),
 		emailIntakeReminders: z.boolean().default(true),
+		emailPrescriptionReminders: z.boolean().default(true),
 		// Push notifications
 		shoutrrrEnabled: z.boolean().optional(),
 		shoutrrrUrl: z.string().nullable().optional(),
 		shoutrrrStockReminders: z.boolean().default(true),
 		shoutrrrIntakeReminders: z.boolean().default(true),
+		shoutrrrPrescriptionReminders: z.boolean().default(true),
 		// Reminder settings
 		reminderDaysBefore: z.number().int().default(7),
 		repeatDailyReminders: z.boolean().default(false),
@@ -95,9 +117,11 @@ const settingsExportSchema = z
 		lowStockDays: z.number().int().default(30),
 		normalStockDays: z.number().int().default(90),
 		highStockDays: z.number().int().default(180),
+		expiryWarningDays: z.number().int().default(90),
 		// UI preferences
 		language: z.string().default("en"),
 		stockCalculationMode: z.enum(["automatic", "manual"]).default("automatic"),
+		shareStockStatus: z.boolean().default(true),
 	})
 	.optional();
 
@@ -107,6 +131,7 @@ const importDataSchema = z.object({
 	includeSensitiveData: z.boolean().default(false),
 	medications: z.array(medicationExportSchema).default([]),
 	doseHistory: z.array(doseHistorySchema).default([]),
+	refillHistory: z.array(refillHistoryExportSchema).default([]),
 	settings: settingsExportSchema,
 	shareLinks: z.array(shareLinkSchema).default([]),
 });
@@ -116,7 +141,7 @@ const importDataSchema = z.object({
 // =============================================================================
 
 // Helper to get user ID from request
-async function getUserId(request: any, reply: any): Promise<number> {
+async function getUserId(request: FastifyRequest, reply: FastifyReply): Promise<number> {
 	if (!env.AUTH_ENABLED) {
 		return getAnonymousUserId();
 	}
@@ -274,15 +299,26 @@ export async function exportRoutes(app: FastifyInstance) {
 					packCount: med.packCount ?? 1,
 					blistersPerPack: med.blistersPerPack ?? 1,
 					pillsPerBlister: med.pillsPerBlister ?? 1,
+					totalPills: med.totalPills ?? null,
 					looseTablets: med.looseTablets ?? 0,
 					stockAdjustment: med.stockAdjustment ?? 0,
+					packageType: med.packageType ?? "blister",
 				},
 				pillWeightMg: med.pillWeightMg,
 				doseUnit: med.doseUnit ?? "mg",
 				schedules: parseIntakesForExport(med),
+				medicationStartDate: med.medicationStartDate || null,
 				expiryDate: med.expiryDate,
 				notes: med.notes,
 				intakeRemindersEnabled: med.intakeRemindersEnabled ?? false,
+				isObsolete: med.isObsolete ?? false,
+				obsoleteAt: med.obsoleteAt?.toISOString() ?? null,
+				prescriptionEnabled: med.prescriptionEnabled ?? false,
+				prescriptionAuthorizedRefills: med.prescriptionAuthorizedRefills ?? null,
+				prescriptionRemainingRefills: med.prescriptionRemainingRefills ?? null,
+				prescriptionLowRefillThreshold: med.prescriptionLowRefillThreshold ?? 1,
+				prescriptionExpiryDate: med.prescriptionExpiryDate ?? null,
+				dismissedUntil: med.dismissedUntil ?? null,
 				image: includeImages ? imageToBase64(med.imageUrl) : null,
 				lastStockCorrectionAt: lastStockCorrectionAtIso,
 			};
@@ -329,6 +365,7 @@ export async function exportRoutes(app: FastifyInstance) {
 					scheduledTime: scheduledTimeIso,
 					takenAt: takenAtIso,
 					markedBy: dose.markedBy,
+					takenSource: dose.takenSource === "automatic" ? "automatic" : "manual",
 					dismissed: dose.dismissed ?? false,
 					takenByPerson: parsed.person,
 				};
@@ -344,11 +381,13 @@ export async function exportRoutes(app: FastifyInstance) {
 					notificationEmail: settings.notificationEmail,
 					emailStockReminders: settings.emailStockReminders,
 					emailIntakeReminders: settings.emailIntakeReminders,
+					emailPrescriptionReminders: settings.emailPrescriptionReminders ?? true,
 					// Only include sensitive data if requested
 					shoutrrrEnabled: includeSensitive ? settings.shoutrrrEnabled : undefined,
 					shoutrrrUrl: includeSensitive ? settings.shoutrrrUrl : undefined,
 					shoutrrrStockReminders: settings.shoutrrrStockReminders,
 					shoutrrrIntakeReminders: settings.shoutrrrIntakeReminders,
+					shoutrrrPrescriptionReminders: settings.shoutrrrPrescriptionReminders ?? true,
 					reminderDaysBefore: settings.reminderDaysBefore,
 					repeatDailyReminders: settings.repeatDailyReminders,
 					skipRemindersForTakenDoses: settings.skipRemindersForTakenDoses,
@@ -358,8 +397,10 @@ export async function exportRoutes(app: FastifyInstance) {
 					lowStockDays: settings.lowStockDays,
 					normalStockDays: settings.normalStockDays,
 					highStockDays: settings.highStockDays,
+					expiryWarningDays: settings.expiryWarningDays,
 					language: settings.language,
 					stockCalculationMode: settings.stockCalculationMode,
+					shareStockStatus: settings.shareStockStatus,
 				}
 			: undefined;
 
@@ -390,6 +431,39 @@ export async function exportRoutes(app: FastifyInstance) {
 			};
 		});
 
+		// 5. Load refill history
+		const refills = await db.select().from(refillHistory).where(eq(refillHistory.userId, userId));
+
+		const exportRefillHistory = refills
+			.map((refill) => {
+				const exportId = medIdToExportId.get(refill.medicationId);
+				if (!exportId) return null; // Orphaned refill, skip
+
+				// Safely convert refillDate to ISO string
+				let refillDateIso: string;
+				try {
+					if (refill.refillDate instanceof Date && !Number.isNaN(refill.refillDate.getTime())) {
+						refillDateIso = refill.refillDate.toISOString();
+					} else if (typeof refill.refillDate === "number" || typeof refill.refillDate === "string") {
+						const d = new Date(refill.refillDate);
+						refillDateIso = !Number.isNaN(d.getTime()) ? d.toISOString() : new Date().toISOString();
+					} else {
+						refillDateIso = new Date().toISOString();
+					}
+				} catch {
+					refillDateIso = new Date().toISOString();
+				}
+
+				return {
+					medicationRef: exportId,
+					packsAdded: refill.packsAdded ?? 0,
+					loosePillsAdded: refill.loosePillsAdded ?? 0,
+					usedPrescription: refill.usedPrescription ?? false,
+					refillDate: refillDateIso,
+				};
+			})
+			.filter((r): r is NonNullable<typeof r> => r !== null);
+
 		// Build export object
 		const exportData = {
 			version: EXPORT_VERSION,
@@ -397,12 +471,17 @@ export async function exportRoutes(app: FastifyInstance) {
 			includeSensitiveData: includeSensitive,
 			medications: exportMedications,
 			doseHistory: exportDoseHistory,
+			refillHistory: exportRefillHistory,
 			settings: exportSettings,
 			shareLinks: exportShareLinks,
 		};
 
 		// Set download headers
-		const filename = `medassist-export-${new Date().toISOString().split("T")[0]}.json`;
+		const now = new Date();
+		const dateStr = now.toISOString().replace(/[-:]/g, "").replace(/T/, "-").slice(0, 13);
+		const authUser = env.AUTH_ENABLED ? (request.user as unknown as AuthUser | null) : null;
+		const userPart = authUser?.username ? `-${authUser.username}` : "";
+		const filename = `medassist-export${userPart}-${dateStr}.json`;
 		reply.header("Content-Type", "application/json");
 		reply.header("Content-Disposition", `attachment; filename="${filename}"`);
 
@@ -453,7 +532,8 @@ export async function exportRoutes(app: FastifyInstance) {
 				}
 			}
 
-			// Delete in order: doses, share tokens, medications, settings
+			// Delete in order: refill history, doses, share tokens, medications, settings
+			await db.delete(refillHistory).where(eq(refillHistory.userId, userId));
 			await db.delete(doseTracking).where(eq(doseTracking.userId, userId));
 			await db.delete(shareTokens).where(eq(shareTokens.userId, userId));
 			await db.delete(medications).where(eq(medications.userId, userId));
@@ -490,14 +570,17 @@ export async function exportRoutes(app: FastifyInstance) {
 						name: med.name,
 						genericName: med.genericName || null,
 						takenByJson,
+						packageType: med.inventory.packageType ?? "blister",
 						packCount: med.inventory.packCount,
 						blistersPerPack: med.inventory.blistersPerPack,
 						pillsPerBlister: med.inventory.pillsPerBlister,
 						looseTablets: med.inventory.looseTablets,
+						totalPills: med.inventory.totalPills ?? null,
 						stockAdjustment: med.inventory.stockAdjustment ?? 0,
 						lastStockCorrectionAt: med.lastStockCorrectionAt ? new Date(med.lastStockCorrectionAt) : null,
 						pillWeightMg: med.pillWeightMg || null,
 						doseUnit: med.doseUnit ?? "mg",
+						medicationStartDate: med.medicationStartDate || "",
 						intakesJson,
 						usageJson,
 						everyJson,
@@ -505,6 +588,14 @@ export async function exportRoutes(app: FastifyInstance) {
 						expiryDate: med.expiryDate || null,
 						notes: med.notes || null,
 						intakeRemindersEnabled,
+						isObsolete: med.isObsolete ?? false,
+						obsoleteAt: med.obsoleteAt ? new Date(med.obsoleteAt) : null,
+						prescriptionEnabled: med.prescriptionEnabled ?? false,
+						prescriptionAuthorizedRefills: med.prescriptionEnabled ? (med.prescriptionAuthorizedRefills ?? null) : null,
+						prescriptionRemainingRefills: med.prescriptionEnabled ? (med.prescriptionRemainingRefills ?? null) : null,
+						prescriptionLowRefillThreshold: med.prescriptionLowRefillThreshold ?? 1,
+						prescriptionExpiryDate: med.prescriptionExpiryDate || null,
+						dismissedUntil: med.dismissedUntil || null,
 						imageUrl: null, // Will be set after image is saved
 					})
 					.returning();
@@ -536,6 +627,7 @@ export async function exportRoutes(app: FastifyInstance) {
 					doseId,
 					takenAt: new Date(dose.takenAt),
 					markedBy: dose.markedBy || null,
+					takenSource: dose.takenSource ?? "manual",
 					dismissed: dose.dismissed ?? false,
 				});
 			}
@@ -548,10 +640,12 @@ export async function exportRoutes(app: FastifyInstance) {
 					notificationEmail: importData.settings.notificationEmail || null,
 					emailStockReminders: importData.settings.emailStockReminders ?? true,
 					emailIntakeReminders: importData.settings.emailIntakeReminders ?? true,
+					emailPrescriptionReminders: importData.settings.emailPrescriptionReminders ?? true,
 					shoutrrrEnabled: importData.settings.shoutrrrEnabled ?? false,
 					shoutrrrUrl: importData.settings.shoutrrrUrl || null,
 					shoutrrrStockReminders: importData.settings.shoutrrrStockReminders ?? true,
 					shoutrrrIntakeReminders: importData.settings.shoutrrrIntakeReminders ?? true,
+					shoutrrrPrescriptionReminders: importData.settings.shoutrrrPrescriptionReminders ?? true,
 					reminderDaysBefore: importData.settings.reminderDaysBefore ?? 7,
 					repeatDailyReminders: importData.settings.repeatDailyReminders ?? false,
 					skipRemindersForTakenDoses: importData.settings.skipRemindersForTakenDoses ?? false,
@@ -561,8 +655,10 @@ export async function exportRoutes(app: FastifyInstance) {
 					lowStockDays: importData.settings.lowStockDays ?? 30,
 					normalStockDays: importData.settings.normalStockDays ?? 90,
 					highStockDays: importData.settings.highStockDays ?? 180,
+					expiryWarningDays: importData.settings.expiryWarningDays ?? 90,
 					language: importData.settings.language ?? "en",
 					stockCalculationMode: importData.settings.stockCalculationMode ?? "automatic",
+					shareStockStatus: importData.settings.shareStockStatus ?? true,
 				});
 			}
 
@@ -580,11 +676,27 @@ export async function exportRoutes(app: FastifyInstance) {
 				});
 			}
 
+			// 7. Import refill history with remapped medication IDs
+			for (const refill of importData.refillHistory) {
+				const newMedId = exportIdToNewId.get(refill.medicationRef);
+				if (!newMedId) continue; // Skip orphaned refill records
+
+				await db.insert(refillHistory).values({
+					medicationId: newMedId,
+					userId,
+					packsAdded: refill.packsAdded ?? 0,
+					loosePillsAdded: refill.loosePillsAdded ?? 0,
+					usedPrescription: refill.usedPrescription ?? false,
+					refillDate: new Date(refill.refillDate),
+				});
+			}
+
 			return {
 				success: true,
 				imported: {
 					medications: importData.medications.length,
 					doseHistory: importData.doseHistory.length,
+					refillHistory: importData.refillHistory.length,
 					settings: importData.settings ? 1 : 0,
 					shareLinks: importData.shareLinks.length,
 				},

backend/src/routes/medications.ts

@@ -6,7 +6,7 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 import { db } from "../db/client.js";
 import { getDataDir } from "../db/db-utils.js";
-import { doseTracking, medications } from "../db/schema.js";
+import { doseTracking, medications, userSettings } from "../db/schema.js";
 import { getAnonymousUserId, requireAuth } from "../plugins/auth.js";
 import { env } from "../plugins/env.js";
 import type { AuthUser } from "../types/fastify.js";
@@ -32,6 +32,9 @@ const blisterSchema = z.object({
 
 const packageTypeSchema = z.enum(["blister", "bottle"]).default("blister");
 const doseUnitSchema = z.enum(["mg", "g", "mcg", "ml", "IU", "units", "drops", "puffs"]).default("mg");
+const medicationStartDateSchema = z
+	.union([z.string().regex(/^\d{4}-\d{2}-\d{2}$/), z.literal(""), z.null()])
+	.optional();
 
 const medicationSchema = z
 	.object({
@@ -46,14 +49,55 @@ const medicationSchema = z
 		looseTablets: z.number().int().min(0).default(0),
 		pillWeightMg: z.number().nonnegative().nullable().optional(),
 		doseUnit: doseUnitSchema,
+		medicationStartDate: medicationStartDateSchema,
 		expiryDate: z.string().nullable().optional(),
 		notes: z.string().max(2000).nullable().optional(),
+		prescriptionEnabled: z.boolean().default(false),
+		prescriptionAuthorizedRefills: z.number().int().min(0).nullable().optional(),
+		prescriptionRemainingRefills: z.number().int().min(0).nullable().optional(),
+		prescriptionLowRefillThreshold: z.number().int().min(0).default(1),
+		prescriptionExpiryDate: z.string().nullable().optional(),
 		intakeRemindersEnabled: z.boolean().default(false), // Medication-level (deprecated, kept for backward compat)
 		// Accept either new intakes format or legacy blisters format
 		intakes: z.array(intakeSchema).min(1).max(12).optional(),
 		blisters: z.array(blisterSchema).min(1).max(12).optional(), // Legacy format
 	})
-	.refine((data) => data.intakes || data.blisters, { message: "Either 'intakes' or 'blisters' must be provided" });
+	.refine((data) => data.intakes || data.blisters, { message: "Either 'intakes' or 'blisters' must be provided" })
+	.refine(
+		(data) => {
+			const startDate = data.medicationStartDate ?? "";
+			if (!startDate) return true;
+
+			const scheduleStarts = data.intakes?.map((i) => i.start) ?? data.blisters?.map((b) => b.start) ?? [];
+			return scheduleStarts.every((scheduleStart) => scheduleStart.slice(0, 10) >= startDate);
+		},
+		{
+			message: "Medication start date must be on or before all intake dates",
+			path: ["medicationStartDate"],
+		}
+	)
+	.refine(
+		(data) => {
+			if (!data.prescriptionEnabled) return true;
+			if (data.prescriptionAuthorizedRefills == null || data.prescriptionRemainingRefills == null) return false;
+			return data.prescriptionRemainingRefills <= data.prescriptionAuthorizedRefills;
+		},
+		{
+			message: "When prescription is enabled, remaining refills must be <= authorized refills",
+			path: ["prescriptionRemainingRefills"],
+		}
+	)
+	.refine(
+		(data) => {
+			if (!data.prescriptionEnabled) return true;
+			if (data.prescriptionAuthorizedRefills == null) return false;
+			return data.prescriptionLowRefillThreshold <= data.prescriptionAuthorizedRefills;
+		},
+		{
+			message: "When prescription is enabled, low refill threshold must be <= authorized refills",
+			path: ["prescriptionLowRefillThreshold"],
+		}
+	);
 
 export async function medicationRoutes(app: FastifyInstance) {
 	// All medication routes require auth
@@ -76,9 +120,13 @@ export async function medicationRoutes(app: FastifyInstance) {
 		return authUser.id;
 	}
 
-	app.get("/medications", async (request, reply) => {
+	app.get<{ Querystring: { includeObsolete?: string } }>("/medications", async (request, reply) => {
 		const userId = await getUserId(request, reply);
-		const rows = await db.select().from(medications).where(eq(medications.userId, userId)).orderBy(medications.id);
+		const includeObsolete = request.query.includeObsolete === "true";
+		const whereClause = includeObsolete
+			? eq(medications.userId, userId)
+			: and(eq(medications.userId, userId), eq(medications.isObsolete, false));
+		const rows = await db.select().from(medications).where(whereClause).orderBy(medications.id);
 		return rows.map((row) => {
 			// Parse intakes from new format, falling back to legacy
 			const intakes = parseIntakesJson(
@@ -102,6 +150,7 @@ export async function medicationRoutes(app: FastifyInstance) {
 				lastStockCorrectionAt: row.lastStockCorrectionAt?.toISOString() ?? null,
 				pillWeightMg: row.pillWeightMg,
 				doseUnit: row.doseUnit ?? "mg",
+				medicationStartDate: row.medicationStartDate || null,
 				intakes, // New unified format with per-intake takenBy
 				// Legacy blisters format (for backward compat with frontend during transition)
 				blisters: intakes.map((i) => ({ usage: i.usage, every: i.every, start: i.start })),
@@ -109,6 +158,13 @@ export async function medicationRoutes(app: FastifyInstance) {
 				expiryDate: row.expiryDate,
 				notes: row.notes,
 				intakeRemindersEnabled: row.intakeRemindersEnabled ?? false,
+				isObsolete: row.isObsolete ?? false,
+				obsoleteAt: row.obsoleteAt?.toISOString() ?? null,
+				prescriptionEnabled: row.prescriptionEnabled ?? false,
+				prescriptionAuthorizedRefills: row.prescriptionAuthorizedRefills ?? null,
+				prescriptionRemainingRefills: row.prescriptionRemainingRefills ?? null,
+				prescriptionLowRefillThreshold: row.prescriptionLowRefillThreshold ?? 1,
+				prescriptionExpiryDate: row.prescriptionExpiryDate ?? null,
 				dismissedUntil: row.dismissedUntil ?? null,
 				updatedAt: row.updatedAt,
 			};
@@ -132,8 +188,14 @@ export async function medicationRoutes(app: FastifyInstance) {
 			looseTablets,
 			pillWeightMg,
 			doseUnit,
+			medicationStartDate,
 			expiryDate,
 			notes,
+			prescriptionEnabled,
+			prescriptionAuthorizedRefills,
+			prescriptionRemainingRefills,
+			prescriptionLowRefillThreshold,
+			prescriptionExpiryDate,
 			intakeRemindersEnabled,
 			intakes: inputIntakes,
 			blisters: inputBlisters,
@@ -185,8 +247,14 @@ export async function medicationRoutes(app: FastifyInstance) {
 				looseTablets,
 				pillWeightMg: pillWeightMg || null,
 				doseUnit: doseUnit ?? "mg",
+				medicationStartDate: medicationStartDate ?? "",
 				expiryDate: expiryDate || null,
 				notes: notes || null,
+				prescriptionEnabled: prescriptionEnabled ?? false,
+				prescriptionAuthorizedRefills: prescriptionEnabled ? (prescriptionAuthorizedRefills ?? null) : null,
+				prescriptionRemainingRefills: prescriptionEnabled ? (prescriptionRemainingRefills ?? null) : null,
+				prescriptionLowRefillThreshold: prescriptionLowRefillThreshold ?? 1,
+				prescriptionExpiryDate: prescriptionExpiryDate || null,
 				intakeRemindersEnabled: intakeRemindersEnabled ?? false,
 				intakesJson,
 				usageJson,
@@ -210,12 +278,20 @@ export async function medicationRoutes(app: FastifyInstance) {
 			lastStockCorrectionAt: inserted.lastStockCorrectionAt?.toISOString() ?? null,
 			pillWeightMg: inserted.pillWeightMg,
 			doseUnit: inserted.doseUnit ?? "mg",
+			medicationStartDate: inserted.medicationStartDate || null,
 			intakes,
 			blisters: intakes.map((i) => ({ usage: i.usage, every: i.every, start: i.start })),
 			imageUrl: inserted.imageUrl,
 			expiryDate: inserted.expiryDate,
 			notes: inserted.notes,
 			intakeRemindersEnabled: inserted.intakeRemindersEnabled,
+			isObsolete: inserted.isObsolete ?? false,
+			obsoleteAt: inserted.obsoleteAt?.toISOString() ?? null,
+			prescriptionEnabled: inserted.prescriptionEnabled ?? false,
+			prescriptionAuthorizedRefills: inserted.prescriptionAuthorizedRefills ?? null,
+			prescriptionRemainingRefills: inserted.prescriptionRemainingRefills ?? null,
+			prescriptionLowRefillThreshold: inserted.prescriptionLowRefillThreshold ?? 1,
+			prescriptionExpiryDate: inserted.prescriptionExpiryDate ?? null,
 			updatedAt: inserted.updatedAt,
 		};
 	});
@@ -247,8 +323,14 @@ export async function medicationRoutes(app: FastifyInstance) {
 			looseTablets,
 			pillWeightMg,
 			doseUnit,
+			medicationStartDate,
 			expiryDate,
 			notes,
+			prescriptionEnabled,
+			prescriptionAuthorizedRefills,
+			prescriptionRemainingRefills,
+			prescriptionLowRefillThreshold,
+			prescriptionExpiryDate,
 			intakeRemindersEnabled,
 			intakes: inputIntakes,
 			blisters: inputBlisters,
@@ -310,8 +392,14 @@ export async function medicationRoutes(app: FastifyInstance) {
 				looseTablets,
 				pillWeightMg: pillWeightMg || null,
 				doseUnit: doseUnit ?? "mg",
+				medicationStartDate: medicationStartDate ?? "",
 				expiryDate: expiryDate || null,
 				notes: notes || null,
+				prescriptionEnabled: prescriptionEnabled ?? false,
+				prescriptionAuthorizedRefills: prescriptionEnabled ? (prescriptionAuthorizedRefills ?? null) : null,
+				prescriptionRemainingRefills: prescriptionEnabled ? (prescriptionRemainingRefills ?? null) : null,
+				prescriptionLowRefillThreshold: prescriptionLowRefillThreshold ?? 1,
+				prescriptionExpiryDate: prescriptionExpiryDate || null,
 				intakeRemindersEnabled: intakeRemindersEnabled ?? false,
 				intakesJson,
 				usageJson,
@@ -459,19 +547,85 @@ export async function medicationRoutes(app: FastifyInstance) {
 			lastStockCorrectionAt: result[0].lastStockCorrectionAt?.toISOString() ?? null,
 			pillWeightMg: result[0].pillWeightMg,
 			doseUnit: result[0].doseUnit ?? "mg",
+			medicationStartDate: result[0].medicationStartDate || null,
 			intakes,
 			blisters: intakes.map((i) => ({ usage: i.usage, every: i.every, start: i.start })),
 			imageUrl: result[0].imageUrl,
 			expiryDate: result[0].expiryDate,
 			notes: result[0].notes,
 			intakeRemindersEnabled: result[0].intakeRemindersEnabled,
+			isObsolete: result[0].isObsolete ?? false,
+			obsoleteAt: result[0].obsoleteAt?.toISOString() ?? null,
+			prescriptionEnabled: result[0].prescriptionEnabled ?? false,
+			prescriptionAuthorizedRefills: result[0].prescriptionAuthorizedRefills ?? null,
+			prescriptionRemainingRefills: result[0].prescriptionRemainingRefills ?? null,
+			prescriptionLowRefillThreshold: result[0].prescriptionLowRefillThreshold ?? 1,
+			prescriptionExpiryDate: result[0].prescriptionExpiryDate ?? null,
 			updatedAt: result[0].updatedAt,
 		};
 	});
 
-	// Stock correction endpoint - only updates stockAdjustment, preserves looseTablets
+	app.post<{ Params: { id: string } }>("/medications/:id/obsolete", async (req, reply) => {
+		const idNum = Number(req.params.id);
+		if (Number.isNaN(idNum)) return reply.badRequest("Invalid id");
+
+		const userId = await getUserId(req, reply);
+		const [existing] = await db
+			.select()
+			.from(medications)
+			.where(and(eq(medications.id, idNum), eq(medications.userId, userId)));
+		if (!existing) return reply.notFound();
+
+		const [updated] = await db
+			.update(medications)
+			.set({
+				isObsolete: true,
+				obsoleteAt: new Date(),
+				updatedAt: new Date(),
+			})
+			.where(and(eq(medications.id, idNum), eq(medications.userId, userId)))
+			.returning();
+
+		return {
+			id: updated.id,
+			isObsolete: updated.isObsolete ?? false,
+			obsoleteAt: updated.obsoleteAt?.toISOString() ?? null,
+			updatedAt: updated.updatedAt,
+		};
+	});
+
+	app.post<{ Params: { id: string } }>("/medications/:id/reactivate", async (req, reply) => {
+		const idNum = Number(req.params.id);
+		if (Number.isNaN(idNum)) return reply.badRequest("Invalid id");
+
+		const userId = await getUserId(req, reply);
+		const [existing] = await db
+			.select()
+			.from(medications)
+			.where(and(eq(medications.id, idNum), eq(medications.userId, userId)));
+		if (!existing) return reply.notFound();
+
+		const [updated] = await db
+			.update(medications)
+			.set({
+				isObsolete: false,
+				obsoleteAt: null,
+				updatedAt: new Date(),
+			})
+			.where(and(eq(medications.id, idNum), eq(medications.userId, userId)))
+			.returning();
+
+		return {
+			id: updated.id,
+			isObsolete: updated.isObsolete ?? false,
+			obsoleteAt: updated.obsoleteAt?.toISOString() ?? null,
+			updatedAt: updated.updatedAt,
+		};
+	});
+
+	// Stock correction endpoint - updates stockAdjustment and optionally looseTablets (for blister type)
 	// Also sets lastStockCorrectionAt so consumed doses before this point don't count
-	app.patch<{ Params: { id: string }; Body: { stockAdjustment: number } }>(
+	app.patch<{ Params: { id: string }; Body: { stockAdjustment: number; looseTablets?: number } }>(
 		"/medications/:id/stock-adjustment",
 		async (req, reply) => {
 			const idNum = Number(req.params.id);
@@ -486,16 +640,32 @@ export async function medicationRoutes(app: FastifyInstance) {
 				.where(and(eq(medications.id, idNum), eq(medications.userId, userId)));
 			if (!existing) return reply.notFound();
 
-			const { stockAdjustment } = req.body as { stockAdjustment: number };
+			const { stockAdjustment, looseTablets } = req.body as { stockAdjustment: number; looseTablets?: number };
 			if (typeof stockAdjustment !== "number") return reply.badRequest("stockAdjustment must be a number");
+			if (
+				looseTablets !== undefined &&
+				(typeof looseTablets !== "number" || !Number.isInteger(looseTablets) || looseTablets < 0)
+			) {
+				return reply.badRequest("looseTablets must be a non-negative integer");
+			}
+
+			const updateFields: {
+				stockAdjustment: number;
+				lastStockCorrectionAt: Date;
+				updatedAt: Date;
+				looseTablets?: number;
+			} = {
+				stockAdjustment,
+				lastStockCorrectionAt: new Date(),
+				updatedAt: new Date(),
+			};
+			if (looseTablets !== undefined) {
+				updateFields.looseTablets = looseTablets;
+			}
 
 			const result = await db
 				.update(medications)
-				.set({
-					stockAdjustment,
-					lastStockCorrectionAt: new Date(), // Mark when correction was made
-					updatedAt: new Date(),
-				})
+				.set(updateFields)
 				.where(and(eq(medications.id, idNum), eq(medications.userId, userId)))
 				.returning();
 
@@ -616,7 +786,17 @@ export async function medicationRoutes(app: FastifyInstance) {
 		}
 
 		const userId = await getUserId(req, reply);
-		const rows = await db.select().from(medications).where(eq(medications.userId, userId)).orderBy(medications.id);
+		const rows = await db
+			.select()
+			.from(medications)
+			.where(and(eq(medications.userId, userId), eq(medications.isObsolete, false)))
+			.orderBy(medications.id);
+
+		const [settingsRow] = await db
+			.select({ stockCalculationMode: userSettings.stockCalculationMode })
+			.from(userSettings)
+			.where(eq(userSettings.userId, userId));
+		const stockCalculationMode = settingsRow?.stockCalculationMode === "manual" ? "manual" : "automatic";
 
 		// Get all taken doses for this user to calculate actual consumption
 		const takenDoses = await db
@@ -624,20 +804,25 @@ export async function medicationRoutes(app: FastifyInstance) {
 			.from(doseTracking)
 			.where(and(eq(doseTracking.userId, userId), eq(doseTracking.dismissed, false)));
 
-		// Create a map of medication ID to taken dose count
-		const takenDosesMap = new Map<number, { blisterIdx: number; usage: number }[]>();
+		const takenDoseIdsByMed = new Map<number, Set<string>>();
+		const takenDoseTimestamps = new Map<string, number>();
 		takenDoses.forEach((dose) => {
 			const parts = dose.doseId.split("-");
-			if (parts.length >= 3) {
-				const medId = parseInt(parts[0], 10);
-				const blisterIdx = parseInt(parts[1], 10);
-				if (!Number.isNaN(medId) && !Number.isNaN(blisterIdx)) {
-					if (!takenDosesMap.has(medId)) {
-						takenDosesMap.set(medId, []);
-					}
-					takenDosesMap.get(medId)!.push({ blisterIdx, usage: 0 }); // usage filled later
-				}
+			if (parts.length < 3) return;
+			const medId = parseInt(parts[0], 10);
+			if (Number.isNaN(medId)) return;
+
+			if (!takenDoseIdsByMed.has(medId)) {
+				takenDoseIdsByMed.set(medId, new Set());
 			}
+			takenDoseIdsByMed.get(medId)!.add(dose.doseId);
+			const rawTakenAt = Number(dose.takenAt);
+			const takenAtMs = Number.isFinite(rawTakenAt)
+				? rawTakenAt < 1_000_000_000_000
+					? rawTakenAt * 1000
+					: rawTakenAt
+				: new Date(dose.takenAt).getTime();
+			takenDoseTimestamps.set(dose.doseId, takenAtMs);
 		});
 
 		// Use current time as the reference point for "available" stock
@@ -656,78 +841,125 @@ export async function medicationRoutes(app: FastifyInstance) {
 			const blistersPerPack = row.blistersPerPack ?? 1;
 			const looseTablets = row.looseTablets ?? 0;
 			const stockAdjustment = row.stockAdjustment ?? 0;
-			const originalTotalPills = packCount * blistersPerPack * pillsPerBlister + looseTablets + stockAdjustment;
+			const packageType = row.packageType ?? "blister";
 
-			// Calculate consumption based on ACTUAL taken doses from dose_tracking
-			// This ensures Planner shows the same "current stock" as the Dashboard/Modal
-			// Use the same logic as frontend: generate expected doses and check which are marked
+			// For bottle type, looseTablets IS the current stock (no blister math)
+			const originalTotalPills =
+				packageType === "bottle"
+					? looseTablets + stockAdjustment
+					: packCount * blistersPerPack * pillsPerBlister + looseTablets + stockAdjustment;
+
+			// Calculate consumption with the same automatic/manual behavior as frontend coverage.
 			const stockCorrectionCutoff = row.lastStockCorrectionAt ? new Date(row.lastStockCorrectionAt).getTime() : 0;
-
-			// Build a Set of taken dose IDs for quick lookup
-			const takenDoseIds = new Set(
-				takenDoses
-					.filter((dose) => {
-						const parts = dose.doseId.split("-");
-						return parts.length >= 3 && parseInt(parts[0], 10) === row.id;
-					})
-					.map((dose) => dose.doseId)
-			);
+			const takenDoseIds = takenDoseIdsByMed.get(row.id) ?? new Set<string>();
 
 			// Count consumed pills by generating expected doses and checking if they're taken
 			let consumedUntilNow = 0;
 			const msPerDay = 86400000;
 
-			blisters.forEach((blister, blisterIdx) => {
-				const blisterStart = parseLocalDateTime(blister.start);
-				if (Number.isNaN(blisterStart.getTime())) return;
+			if (stockCalculationMode === "automatic") {
+				blisters.forEach((blister, blisterIdx) => {
+					const blisterStart = parseLocalDateTime(blister.start).getTime();
+					if (Number.isNaN(blisterStart)) return;
 
-				const period = Math.max(1, blister.every) * msPerDay;
+					const period = Math.max(1, blister.every) * msPerDay;
 
-				// After a stock correction, start counting from the NEXT scheduled
-				// dose, because the user's pill count already reflects all
-				// consumption up to the correction time.
-				let effectiveStart: number;
-				if (stockCorrectionCutoff > 0 && stockCorrectionCutoff >= blisterStart.getTime()) {
-					effectiveStart = stockCorrectionCutoff + period;
-				} else {
-					effectiveStart = blisterStart.getTime();
-				}
-				if (effectiveStart > now.getTime()) return;
+					let effectiveStart: number;
+					if (stockCorrectionCutoff > 0 && stockCorrectionCutoff >= blisterStart) {
+						const elapsedSinceStart = stockCorrectionCutoff - blisterStart;
+						const periodsElapsed = Math.floor(elapsedSinceStart / period);
+						effectiveStart = blisterStart + (periodsElapsed + 1) * period;
+					} else {
+						effectiveStart = blisterStart;
+					}
 
-				const occurrences = Math.floor((now.getTime() - effectiveStart) / period) + 1;
+					const intake = intakes[blisterIdx];
+					const intakePerson = intake?.takenBy;
+					const fallbackPeople = parseTakenByJson(row.takenByJson);
+					const peopleForThisIntake = intakePerson
+						? [intakePerson]
+						: fallbackPeople.length > 0
+							? fallbackPeople
+							: [null];
 
-				// Get the people for this intake (from intakes array or medication takenBy)
-				const takenByJson = row.takenByJson ? JSON.parse(row.takenByJson) : [];
-				const intake = intakes[blisterIdx];
-				const intakePerson = intake?.takenBy;
-				const peopleForThisIntake: (string | null)[] = intakePerson
-					? [intakePerson]
-					: takenByJson.length > 0
-						? takenByJson
-						: [null];
+					let timeBasedConsumed = 0;
+					let lastAutoConsumedDateMs = 0;
 
-				// Generate expected dose IDs and check if they're taken
-				for (let i = 0; i < occurrences; i++) {
-					const doseDate = new Date(effectiveStart + i * period);
-					const dateOnlyMs = new Date(doseDate.getFullYear(), doseDate.getMonth(), doseDate.getDate()).getTime();
-					const baseDoseId = `${row.id}-${blisterIdx}-${dateOnlyMs}`;
+					if (effectiveStart <= now.getTime()) {
+						const occurrences = Math.floor((now.getTime() - effectiveStart) / period) + 1;
+						timeBasedConsumed = occurrences * blister.usage * peopleForThisIntake.length;
 
-					// Check if each person has taken this dose
-					for (const person of peopleForThisIntake) {
-						const doseId = person ? `${baseDoseId}-${person}` : baseDoseId;
-						if (takenDoseIds.has(doseId)) {
+						const lastDoseTime = new Date(effectiveStart + (occurrences - 1) * period);
+						lastAutoConsumedDateMs = new Date(
+							lastDoseTime.getFullYear(),
+							lastDoseTime.getMonth(),
+							lastDoseTime.getDate()
+						).getTime();
+					}
+
+					const stockCorrectionDateOnly =
+						stockCorrectionCutoff > 0
+							? new Date(
+									new Date(stockCorrectionCutoff).getFullYear(),
+									new Date(stockCorrectionCutoff).getMonth(),
+									new Date(stockCorrectionCutoff).getDate()
+								).getTime()
+							: 0;
+					const earlyCutoff = Math.max(lastAutoConsumedDateMs, stockCorrectionDateOnly);
+
+					let earlyTakenConsumed = 0;
+					for (const doseId of takenDoseIds) {
+						const parts = doseId.split("-");
+						if (parts.length < 3) continue;
+						const bIdx = parseInt(parts[1], 10);
+						const timestamp = parseInt(parts[2], 10);
+						if (!Number.isNaN(bIdx) && !Number.isNaN(timestamp) && bIdx === blisterIdx && timestamp > earlyCutoff) {
+							earlyTakenConsumed += blister.usage;
+						}
+					}
+
+					consumedUntilNow += timeBasedConsumed + earlyTakenConsumed;
+				});
+			} else {
+				blisters.forEach((blister, blisterIdx) => {
+					const blisterStart = parseLocalDateTime(blister.start);
+					const blisterStartDateOnly = new Date(
+						blisterStart.getFullYear(),
+						blisterStart.getMonth(),
+						blisterStart.getDate()
+					).getTime();
+					if (Number.isNaN(blisterStartDateOnly)) return;
+
+					for (const doseId of takenDoseIds) {
+						const parts = doseId.split("-");
+						if (parts.length < 3) continue;
+
+						const parsedBlisterIdx = parseInt(parts[1], 10);
+						const doseTimestamp = parseInt(parts[2], 10);
+						if (Number.isNaN(parsedBlisterIdx) || Number.isNaN(doseTimestamp) || parsedBlisterIdx !== blisterIdx) {
+							continue;
+						}
+
+						const takenAt = takenDoseTimestamps.get(doseId) ?? 0;
+						const afterCorrectionOrNoCorrection = stockCorrectionCutoff === 0 || takenAt > stockCorrectionCutoff;
+
+						if (doseTimestamp >= blisterStartDateOnly && afterCorrectionOrNoCorrection) {
 							consumedUntilNow += blister.usage;
 						}
 					}
-				}
-			});
+				});
+			}
 
 			const currentStock = Math.max(0, originalTotalPills - consumedUntilNow);
 
 			// Calculate usage for the planning period
+			// Always use the user-selected start date for the usage calculation.
+			// Using max(now, start) would cause asymmetric counting when now falls
+			// between morning and evening doses on the start day (e.g., morning dose
+			// skipped but evening counted), leading to confusing off-by-one results.
+			// The stock already reflects consumed doses, so no double-counting occurs.
 			// When includeUntilStart is true, calculate from now to end (useful for trip planning)
-			// When false, calculate from max(now, start) to end (default behavior)
-			const effectivePlannerStart = includeUntilStart ? now : new Date(Math.max(now.getTime(), start.getTime()));
+			const effectivePlannerStart = includeUntilStart ? now : start;
 			const usageTotal = calculateUsageInRange(blisters, effectivePlannerStart, end);
 
 			const blistersNeeded = pillsPerBlister > 0 ? Math.ceil(usageTotal / pillsPerBlister) : 0;
@@ -735,30 +967,41 @@ export async function medicationRoutes(app: FastifyInstance) {
 			// Calculate AVAILABLE = stock AFTER the planned period (currentStock - usageTotal)
 			const availableAfterPeriod = Math.max(0, currentStock - usageTotal);
 
-			// Calculate stock breakdown for availableAfterPeriod
-			// Consumption order: loose pills first, then from blisters
-			const totalConsumedByEnd = originalTotalPills - availableAfterPeriod;
-			const looseConsumedByEnd = Math.min(totalConsumedByEnd, looseTablets);
-			const loosePillsRemaining = Math.max(0, looseTablets - looseConsumedByEnd);
-			const blisterPillsConsumed = totalConsumedByEnd - looseConsumedByEnd;
-			const originalBlisterPills = originalTotalPills - looseTablets;
-			const blisterPillsRemaining = Math.max(0, originalBlisterPills - blisterPillsConsumed);
+			let fullBlisters: number;
+			let loosePills: number;
 
-			const fullBlisters = pillsPerBlister > 0 ? Math.floor(blisterPillsRemaining / pillsPerBlister) : 0;
-			const openBlisterPills = pillsPerBlister > 0 ? blisterPillsRemaining % pillsPerBlister : 0;
-			const loosePills = loosePillsRemaining + openBlisterPills; // Combine open blister + remaining loose
+			if (packageType === "bottle") {
+				// Bottle type: no blisters, everything is loose pills
+				fullBlisters = 0;
+				loosePills = availableAfterPeriod;
+			} else {
+				// Blister type: calculate stock breakdown
+				// Consumption order: loose pills first, then from blisters
+				const totalConsumedByEnd = originalTotalPills - availableAfterPeriod;
+				const looseConsumedByEnd = Math.min(totalConsumedByEnd, looseTablets);
+				const loosePillsRemaining = Math.max(0, looseTablets - looseConsumedByEnd);
+				const blisterPillsConsumed = totalConsumedByEnd - looseConsumedByEnd;
+				const originalBlisterPills = originalTotalPills - looseTablets;
+				const blisterPillsRemaining = Math.max(0, originalBlisterPills - blisterPillsConsumed);
+
+				fullBlisters = pillsPerBlister > 0 ? Math.floor(blisterPillsRemaining / pillsPerBlister) : 0;
+				const openBlisterPills = pillsPerBlister > 0 ? blisterPillsRemaining % pillsPerBlister : 0;
+				loosePills = loosePillsRemaining + openBlisterPills; // Combine open blister + remaining loose
+			}
 
 			const enough = currentStock >= usageTotal;
 			return {
 				medicationId: row.id,
 				medicationName: row.name,
 				totalPills: currentStock,
+				currentPills: currentStock,
 				plannerUsage: usageTotal,
 				blisterSize: pillsPerBlister,
 				blistersNeeded,
 				fullBlisters,
 				loosePills,
 				enough,
+				packageType,
 			};
 		});
 
@@ -824,12 +1067,28 @@ function calculateUsageInRange(
 	end: Date
 ) {
 	let total = 0;
+	const msPerDay = 86400000;
 	blisters.forEach((blister) => {
 		const blisterStart = parseLocalDateTime(blister.start);
 		if (Number.isNaN(blisterStart.getTime())) return;
-		// iterate occurrences from blisterStart up to end
-		for (let dt = new Date(blisterStart); dt < end; dt.setDate(dt.getDate() + blister.every)) {
-			if (dt >= start && dt < end) total += blister.usage;
+
+		const every = Math.max(1, blister.every);
+
+		// Skip ahead to the first occurrence at or after start to avoid
+		// iterating through months/years of past doses
+		const dt = new Date(blisterStart);
+		if (dt < start) {
+			const daysToSkip = Math.floor((start.getTime() - dt.getTime()) / (every * msPerDay));
+			dt.setDate(dt.getDate() + daysToSkip * every);
+			// Fine-tune: advance until we reach or pass start
+			while (dt < start) {
+				dt.setDate(dt.getDate() + every);
+			}
+		}
+
+		// Count occurrences in [start, end)
+		for (; dt < end; dt.setDate(dt.getDate() + every)) {
+			total += blister.usage;
 		}
 	});
 	return Number(total.toFixed(2));

backend/src/routes/oidc.ts

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { eq } from "drizzle-orm";
+import { eq, sql } from "drizzle-orm";
 import type { FastifyInstance, FastifyReply } from "fastify";
 import * as client from "openid-client";
 import { db } from "../db/client.js";
@@ -104,7 +104,7 @@ export async function oidcRoutes(app: FastifyInstance) {
 			});
 
 			return reply.redirect(authUrl.href);
-		} catch (err: any) {
+		} catch (err: unknown) {
 			console.error("[OIDC] Login error:", err);
 			return reply.redirect(`${getFrontendUrl()}/?error=oidc_init_failed`);
 		}
@@ -144,17 +144,17 @@ export async function oidcRoutes(app: FastifyInstance) {
 
 			try {
 				const config = await getOIDCConfig();
-				const _redirectUri = env.OIDC_REDIRECT_URI!;
+				const redirectUri = env.OIDC_REDIRECT_URI!;
 
 				// Exchange code for tokens
-				const tokens = await client.authorizationCodeGrant(
-					config,
-					new URL(request.url, `http://${request.headers.host}`),
-					{
-						pkceCodeVerifier: storedVerifier.value,
-						expectedState: state,
-					}
-				);
+				// Build complete callback URL with query parameters for validation
+				const callbackUrl = new URL(redirectUri);
+				callbackUrl.search = new URLSearchParams(request.query as Record<string, string>).toString();
+
+				const tokens = await client.authorizationCodeGrant(config, callbackUrl, {
+					pkceCodeVerifier: storedVerifier.value,
+					expectedState: state,
+				});
 
 				// Get user info
 				const sub = tokens.claims()?.sub;
@@ -167,7 +167,10 @@ export async function oidcRoutes(app: FastifyInstance) {
 				// Extract username from configured claim
 				const usernameClaim = env.OIDC_USERNAME_CLAIM;
 				const username =
-					(userInfo as any)[usernameClaim] || userInfo.preferred_username || userInfo.email || userInfo.sub;
+					(userInfo as Record<string, string>)[usernameClaim] ||
+					userInfo.preferred_username ||
+					userInfo.email ||
+					userInfo.sub;
 				const oidcSubject = userInfo.sub;
 
 				if (!username || !oidcSubject) {
@@ -201,7 +204,7 @@ export async function oidcRoutes(app: FastifyInstance) {
 				});
 
 				// Set cookies (use app's centralized cookie options)
-				console.log(
+				request.log.debug(
 					`[OIDC] Setting cookies for user ${user.username}, NODE_ENV=${env.NODE_ENV}, secure=${app.config.cookieOptions.secure}`
 				);
 				setAuthCookies(app, reply, accessToken, refreshToken);
@@ -210,7 +213,7 @@ export async function oidcRoutes(app: FastifyInstance) {
 				// In dev: CORS_ORIGINS contains the frontend URL
 				const frontendUrl = env.CORS_ORIGINS.split(",")[0] || "http://localhost:5173";
 				return reply.redirect(`${frontendUrl}/dashboard`);
-			} catch (err: any) {
+			} catch (err: unknown) {
 				console.error("[OIDC] Callback error:", err);
 				return reply.redirect(`${getFrontendUrl()}/?error=oidc_callback_failed`);
 			}
@@ -234,19 +237,19 @@ async function findOrCreateOIDCUser(
 	}
 
 	// Check if username already exists (potential collision)
-	const [existingByUsername] = await db.select().from(users).where(eq(users.username, username));
+	const [existingByUsername] = await db.select().from(users).where(sql`lower(${users.username}) = lower(${username})`);
 
 	if (existingByUsername) {
 		// Username collision! Check if it's a local user without OIDC linked
 		if (existingByUsername.authProvider === "local" && !existingByUsername.oidcSubject) {
 			// Local user exists without SSO - link this OIDC account to existing user
 			await db.update(users).set({ oidcSubject: oidcSubject }).where(eq(users.id, existingByUsername.id));
-			console.log(`[OIDC] Linked OIDC to existing local user: ${username}`);
+			// Linked OIDC to existing local user
 			return { id: existingByUsername.id, username: existingByUsername.username };
 		} else if (existingByUsername.oidcSubject && existingByUsername.oidcSubject !== oidcSubject) {
 			// User already has a DIFFERENT OIDC subject - create new user with suffix
 			username = `${username}_sso`;
-			console.log(`[OIDC] Username collision (different OIDC subject), using: ${username}`);
+			// Username collision (different OIDC subject), use suffixed name
 		}
 	}
 
@@ -268,7 +271,7 @@ async function findOrCreateOIDCUser(
 		})
 		.returning({ id: users.id, username: users.username });
 
-	console.log(`[OIDC] Created new user: ${newUser.username} (ID: ${newUser.id})`);
+	// New OIDC user created
 	return newUser;
 }
 

backend/src/routes/refills.ts

@@ -11,6 +11,7 @@ const refillSchema = z
 	.object({
 		packsAdded: z.number().int().min(0).default(0),
 		loosePillsAdded: z.number().int().min(0).default(0),
+		usePrescription: z.boolean().default(false),
 	})
 	.refine((data) => data.packsAdded > 0 || data.loosePillsAdded > 0, {
 		message: "Must add at least one pack or some loose pills",
@@ -50,19 +51,43 @@ export async function refillRoutes(app: FastifyInstance) {
 			.where(and(eq(medications.id, medId), eq(medications.userId, userId)));
 		if (!med) return reply.notFound("Medication not found");
 
-		const { packsAdded, loosePillsAdded } = parsed.data;
+		const { packsAdded, loosePillsAdded, usePrescription } = parsed.data;
+		const isBottle = (med.packageType ?? "blister") === "bottle";
+		const effectivePacksAdded = isBottle ? 0 : packsAdded;
+		const effectiveLoosePillsAdded = loosePillsAdded;
+		const remainingPrescriptionRefills = med.prescriptionRemainingRefills ?? 0;
+
+		if (effectivePacksAdded < 1 && effectiveLoosePillsAdded < 1) {
+			return reply.status(400).send({ error: "Must add at least one pack or some loose pills" });
+		}
+
+		if (usePrescription) {
+			if (!(med.prescriptionEnabled ?? false)) {
+				return reply.status(400).send({ error: "Prescription refill is not enabled for this medication" });
+			}
+			if (remainingPrescriptionRefills <= 0) {
+				return reply.status(409).send({ error: "No remaining prescription refills" });
+			}
+			if (!isBottle && effectivePacksAdded > remainingPrescriptionRefills) {
+				return reply.status(409).send({ error: "Packs to add exceed remaining prescription refills" });
+			}
+		}
 
 		// Update medication stock
-		const newPackCount = med.packCount + packsAdded;
-		const newLooseTablets = med.looseTablets + loosePillsAdded;
+		const newPackCount = med.packCount + effectivePacksAdded;
+		const newLooseTablets = med.looseTablets + effectiveLoosePillsAdded;
+
+		const consumedRefills = usePrescription ? (isBottle ? 1 : effectivePacksAdded) : 0;
+		const newRemainingRefills = usePrescription
+			? Math.max(0, remainingPrescriptionRefills - consumedRefills)
+			: (med.prescriptionRemainingRefills ?? null);
 
 		await db
 			.update(medications)
 			.set({
 				packCount: newPackCount,
 				looseTablets: newLooseTablets,
-				stockAdjustment: 0, // Reset offset since we're adding to base stock
-				lastStockCorrectionAt: new Date(), // Reset consumed counter to now
+				prescriptionRemainingRefills: newRemainingRefills,
 				updatedAt: new Date(),
 			})
 			.where(and(eq(medications.id, medId), eq(medications.userId, userId)));
@@ -73,28 +98,41 @@ export async function refillRoutes(app: FastifyInstance) {
 			.values({
 				medicationId: medId,
 				userId,
-				packsAdded,
-				loosePillsAdded,
+				packsAdded: effectivePacksAdded,
+				loosePillsAdded: effectiveLoosePillsAdded,
+				usedPrescription: usePrescription,
 			})
 			.returning();
 
-		// Calculate pills added for response
-		const pillsPerPack = med.blistersPerPack * med.pillsPerBlister;
-		const totalPillsAdded = packsAdded * pillsPerPack + loosePillsAdded;
+		// Calculate pills added for response (packageType-aware)
+		const pillsPerPack = isBottle ? 0 : med.blistersPerPack * med.pillsPerBlister;
+		const totalPillsAdded = isBottle
+			? effectiveLoosePillsAdded
+			: effectivePacksAdded * pillsPerPack + effectiveLoosePillsAdded;
+		const newTotalPills = isBottle
+			? newLooseTablets + (med.stockAdjustment ?? 0)
+			: newPackCount * pillsPerPack + newLooseTablets + (med.stockAdjustment ?? 0);
 
 		return {
 			success: true,
 			refill: {
 				id: refill.id,
-				packsAdded,
-				loosePillsAdded,
+				packsAdded: effectivePacksAdded,
+				loosePillsAdded: effectiveLoosePillsAdded,
 				totalPillsAdded,
 				refillDate: refill.refillDate,
 			},
 			newStock: {
 				packCount: newPackCount,
 				looseTablets: newLooseTablets,
-				totalPills: newPackCount * pillsPerPack + newLooseTablets,
+				totalPills: newTotalPills,
+			},
+			prescription: {
+				used: usePrescription,
+				remainingRefills: newRemainingRefills,
+				authorizedRefills: med.prescriptionAuthorizedRefills ?? null,
+				lowRefillThreshold: med.prescriptionLowRefillThreshold ?? 1,
+				enabled: med.prescriptionEnabled ?? false,
 			},
 		};
 	});
@@ -120,13 +158,15 @@ export async function refillRoutes(app: FastifyInstance) {
 			.where(eq(refillHistory.medicationId, medId))
 			.orderBy(desc(refillHistory.refillDate));
 
-		const pillsPerPack = med.blistersPerPack * med.pillsPerBlister;
+		const isBottle = (med.packageType ?? "blister") === "bottle";
+		const pillsPerPack = isBottle ? 0 : med.blistersPerPack * med.pillsPerBlister;
 
 		return refills.map((r) => ({
 			id: r.id,
 			packsAdded: r.packsAdded,
 			loosePillsAdded: r.loosePillsAdded,
-			totalPillsAdded: r.packsAdded * pillsPerPack + r.loosePillsAdded,
+			totalPillsAdded: isBottle ? r.loosePillsAdded : r.packsAdded * pillsPerPack + r.loosePillsAdded,
+			usedPrescription: r.usedPrescription ?? false,
 			refillDate: r.refillDate,
 		}));
 	});

backend/src/routes/report.ts

@@ -0,0 +1,113 @@
+import { eq } from "drizzle-orm";
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import { z } from "zod";
+import { db } from "../db/client.js";
+import { doseTracking, medications, refillHistory } from "../db/schema.js";
+import { getAnonymousUserId, requireAuth } from "../plugins/auth.js";
+import { env } from "../plugins/env.js";
+import type { AuthUser } from "../types/fastify.js";
+
+const reportDataSchema = z.object({
+	medicationIds: z.array(z.number().int().positive()).min(1).max(100),
+});
+
+export async function reportRoutes(app: FastifyInstance) {
+	app.addHook("preHandler", requireAuth);
+
+	async function getUserId(request: FastifyRequest, reply: FastifyReply): Promise<number> {
+		if (!env.AUTH_ENABLED) {
+			return getAnonymousUserId();
+		}
+		const authUser = request.user as unknown as AuthUser | null;
+		if (!authUser) {
+			reply.status(401).send({ error: "User not authenticated", code: "AUTH_REQUIRED" });
+			throw new Error("AUTH_REQUIRED");
+		}
+		return authUser.id;
+	}
+
+	// POST /medications/report-data - Get aggregated dose/refill data for report generation
+	app.post("/medications/report-data", async (req, reply) => {
+		const parsed = reportDataSchema.safeParse(req.body);
+		if (!parsed.success) return reply.status(400).send(parsed.error.format());
+
+		const userId = await getUserId(req, reply);
+		const { medicationIds } = parsed.data;
+
+		// Verify all medications belong to this user
+		const userMeds = await db.select({ id: medications.id }).from(medications).where(eq(medications.userId, userId));
+		const userMedIds = new Set(userMeds.map((m) => m.id));
+
+		for (const id of medicationIds) {
+			if (!userMedIds.has(id)) {
+				return reply.status(403).send({ error: "Access denied to medication" });
+			}
+		}
+
+		// Fetch dose tracking for all requested medications
+		// doseId format: "{medicationId}-{blisterIndex}-{dateMs}" or "{medicationId}-{blisterIndex}-{dateMs}-{takenBy}"
+		const allDoses = await db
+			.select({
+				doseId: doseTracking.doseId,
+				takenAt: doseTracking.takenAt,
+				dismissed: doseTracking.dismissed,
+				takenSource: doseTracking.takenSource,
+			})
+			.from(doseTracking)
+			.where(eq(doseTracking.userId, userId));
+
+		// Group doses by medication ID
+		const dosesByMed = new Map<number, { takenAt: Date; dismissed: boolean; takenSource: string }[]>();
+		for (const dose of allDoses) {
+			const medId = Number.parseInt(dose.doseId.split("-")[0], 10);
+			if (Number.isNaN(medId) || !medicationIds.includes(medId)) continue;
+			if (!dosesByMed.has(medId)) dosesByMed.set(medId, []);
+			dosesByMed.get(medId)!.push({
+				takenAt: dose.takenAt,
+				dismissed: dose.dismissed,
+				takenSource: dose.takenSource ?? "manual",
+			});
+		}
+
+		// Fetch refill history for requested medications
+		const result: Record<
+			number,
+			{
+				dosesTaken: number;
+				automaticDosesTaken: number;
+				dosesDismissed: number;
+				firstDoseAt: string | null;
+				lastDoseAt: string | null;
+				refills: { packsAdded: number; loosePillsAdded: number; usedPrescription: boolean; refillDate: string }[];
+			}
+		> = {};
+
+		for (const medId of medicationIds) {
+			const doses = dosesByMed.get(medId) ?? [];
+			const takenDoses = doses.filter((d) => !d.dismissed);
+			const automaticTakenDoses = takenDoses.filter((d) => d.takenSource === "automatic");
+			const dismissedDoses = doses.filter((d) => d.dismissed);
+
+			const sortedTaken = takenDoses.map((d) => d.takenAt.getTime()).sort((a, b) => a - b);
+
+			// Get refills for this medication
+			const refills = await db.select().from(refillHistory).where(eq(refillHistory.medicationId, medId));
+
+			result[medId] = {
+				dosesTaken: takenDoses.length,
+				automaticDosesTaken: automaticTakenDoses.length,
+				dosesDismissed: dismissedDoses.length,
+				firstDoseAt: sortedTaken.length > 0 ? new Date(sortedTaken[0]).toISOString() : null,
+				lastDoseAt: sortedTaken.length > 0 ? new Date(sortedTaken[sortedTaken.length - 1]).toISOString() : null,
+				refills: refills.map((r) => ({
+					packsAdded: r.packsAdded,
+					loosePillsAdded: r.loosePillsAdded,
+					usedPrescription: r.usedPrescription ?? false,
+					refillDate: r.refillDate instanceof Date ? r.refillDate.toISOString() : String(r.refillDate),
+				})),
+			};
+		}
+
+		return result;
+	});
+}

backend/src/routes/settings.ts

@@ -1,5 +1,5 @@
 import { eq } from "drizzle-orm";
-import type { FastifyInstance } from "fastify";
+import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import nodemailer from "nodemailer";
 import { db } from "../db/client.js";
 import { userSettings } from "../db/schema.js";
@@ -15,10 +15,12 @@ export type UserSettings = {
 	notificationEmail: string | null;
 	emailStockReminders: boolean;
 	emailIntakeReminders: boolean;
+	emailPrescriptionReminders: boolean;
 	shoutrrrEnabled: boolean;
 	shoutrrrUrl: string | null;
 	shoutrrrStockReminders: boolean;
 	shoutrrrIntakeReminders: boolean;
+	shoutrrrPrescriptionReminders: boolean;
 	reminderDaysBefore: number;
 	repeatDailyReminders: boolean;
 	skipRemindersForTakenDoses: boolean;
@@ -30,11 +32,21 @@ export type UserSettings = {
 	highStockDays: number;
 	language: Language;
 	stockCalculationMode: "automatic" | "manual";
+	shareStockStatus: boolean;
+	upcomingTodayOnly: boolean;
+	shareScheduleTodayOnly: boolean;
+	swapDashboardMainSections: boolean;
 	lastAutoEmailSent: string | null;
 	lastNotificationType: string | null;
 	lastNotificationChannel: string | null;
 	lastReminderMedName: string | null;
 	lastReminderTakenBy: string | null;
+	lastStockReminderSent: string | null;
+	lastStockReminderChannel: string | null;
+	lastStockReminderMedNames: string | null;
+	lastPrescriptionReminderSent: string | null;
+	lastPrescriptionReminderChannel: string | null;
+	lastPrescriptionReminderMedNames: string | null;
 };
 
 type SettingsBody = {
@@ -49,14 +61,20 @@ type SettingsBody = {
 	shoutrrrUrl: string;
 	emailStockReminders: boolean;
 	emailIntakeReminders: boolean;
+	emailPrescriptionReminders: boolean;
 	shoutrrrStockReminders: boolean;
 	shoutrrrIntakeReminders: boolean;
+	shoutrrrPrescriptionReminders: boolean;
 	skipRemindersForTakenDoses: boolean;
 	repeatRemindersEnabled: boolean;
 	reminderRepeatIntervalMinutes: number;
 	maxNaggingReminders: number;
 	language: string;
 	stockCalculationMode: "automatic" | "manual";
+	shareStockStatus: boolean;
+	upcomingTodayOnly: boolean;
+	shareScheduleTodayOnly: boolean;
+	swapDashboardMainSections: boolean;
 };
 
 type TestEmailBody = {
@@ -89,10 +107,12 @@ function getDefaultSettings() {
 		notificationEmail: process.env.DEFAULT_NOTIFICATION_EMAIL || null,
 		emailStockReminders: envBool("DEFAULT_EMAIL_STOCK_REMINDERS", true),
 		emailIntakeReminders: envBool("DEFAULT_EMAIL_INTAKE_REMINDERS", true),
+		emailPrescriptionReminders: envBool("DEFAULT_EMAIL_PRESCRIPTION_REMINDERS", true),
 		shoutrrrEnabled: envBool("DEFAULT_SHOUTRRR_ENABLED", false),
 		shoutrrrUrl: process.env.DEFAULT_SHOUTRRR_URL || null,
 		shoutrrrStockReminders: envBool("DEFAULT_SHOUTRRR_STOCK_REMINDERS", true),
 		shoutrrrIntakeReminders: envBool("DEFAULT_SHOUTRRR_INTAKE_REMINDERS", true),
+		shoutrrrPrescriptionReminders: envBool("DEFAULT_SHOUTRRR_PRESCRIPTION_REMINDERS", true),
 		reminderDaysBefore: envInt("REMINDER_DAYS_BEFORE", 7),
 		repeatDailyReminders: envBool("DEFAULT_REPEAT_DAILY_REMINDERS", false),
 		skipRemindersForTakenDoses: envBool("DEFAULT_SKIP_REMINDERS_FOR_TAKEN_DOSES", false),
@@ -104,11 +124,21 @@ function getDefaultSettings() {
 		highStockDays: envInt("DEFAULT_HIGH_STOCK_DAYS", 180),
 		language: (process.env.DEFAULT_LANGUAGE as "en" | "de") || "en",
 		stockCalculationMode: (process.env.DEFAULT_STOCK_CALCULATION_MODE as "automatic" | "manual") || "automatic",
+		shareStockStatus: envBool("DEFAULT_SHARE_STOCK_STATUS", true),
+		upcomingTodayOnly: envBool("DEFAULT_UPCOMING_TODAY_ONLY", false),
+		shareScheduleTodayOnly: envBool("DEFAULT_SHARE_SCHEDULE_TODAY_ONLY", false),
+		swapDashboardMainSections: false,
 		lastAutoEmailSent: null,
 		lastNotificationType: null,
 		lastNotificationChannel: null,
 		lastReminderMedName: null,
 		lastReminderTakenBy: null,
+		lastStockReminderSent: null,
+		lastStockReminderChannel: null,
+		lastStockReminderMedNames: null,
+		lastPrescriptionReminderSent: null,
+		lastPrescriptionReminderChannel: null,
+		lastPrescriptionReminderMedNames: null,
 	};
 }
 
@@ -139,10 +169,12 @@ export async function loadUserSettings(userId: number): Promise<UserSettings> {
 		notificationEmail: settings.notificationEmail,
 		emailStockReminders: settings.emailStockReminders,
 		emailIntakeReminders: settings.emailIntakeReminders,
+		emailPrescriptionReminders: settings.emailPrescriptionReminders ?? true,
 		shoutrrrEnabled: settings.shoutrrrEnabled,
 		shoutrrrUrl: settings.shoutrrrUrl,
 		shoutrrrStockReminders: settings.shoutrrrStockReminders,
 		shoutrrrIntakeReminders: settings.shoutrrrIntakeReminders,
+		shoutrrrPrescriptionReminders: settings.shoutrrrPrescriptionReminders ?? true,
 		reminderDaysBefore: settings.reminderDaysBefore,
 		repeatDailyReminders: settings.repeatDailyReminders,
 		skipRemindersForTakenDoses: settings.skipRemindersForTakenDoses ?? false,
@@ -154,11 +186,21 @@ export async function loadUserSettings(userId: number): Promise<UserSettings> {
 		highStockDays: settings.highStockDays,
 		language: settings.language as Language,
 		stockCalculationMode: (settings.stockCalculationMode as "automatic" | "manual") ?? "automatic",
+		shareStockStatus: settings.shareStockStatus ?? true,
+		upcomingTodayOnly: settings.upcomingTodayOnly ?? false,
+		shareScheduleTodayOnly: settings.shareScheduleTodayOnly ?? false,
+		swapDashboardMainSections: settings.swapDashboardMainSections ?? false,
 		lastAutoEmailSent: settings.lastAutoEmailSent,
 		lastNotificationType: settings.lastNotificationType,
 		lastNotificationChannel: settings.lastNotificationChannel,
 		lastReminderMedName: settings.lastReminderMedName ?? null,
 		lastReminderTakenBy: settings.lastReminderTakenBy ?? null,
+		lastStockReminderSent: settings.lastStockReminderSent ?? null,
+		lastStockReminderChannel: settings.lastStockReminderChannel ?? null,
+		lastStockReminderMedNames: settings.lastStockReminderMedNames ?? null,
+		lastPrescriptionReminderSent: settings.lastPrescriptionReminderSent ?? null,
+		lastPrescriptionReminderChannel: settings.lastPrescriptionReminderChannel ?? null,
+		lastPrescriptionReminderMedNames: settings.lastPrescriptionReminderMedNames ?? null,
 	};
 }
 
@@ -171,10 +213,12 @@ export async function getAllUserSettings(): Promise<UserSettings[]> {
 		notificationEmail: settings.notificationEmail,
 		emailStockReminders: settings.emailStockReminders,
 		emailIntakeReminders: settings.emailIntakeReminders,
+		emailPrescriptionReminders: settings.emailPrescriptionReminders ?? true,
 		shoutrrrEnabled: settings.shoutrrrEnabled,
 		shoutrrrUrl: settings.shoutrrrUrl,
 		shoutrrrStockReminders: settings.shoutrrrStockReminders,
 		shoutrrrIntakeReminders: settings.shoutrrrIntakeReminders,
+		shoutrrrPrescriptionReminders: settings.shoutrrrPrescriptionReminders ?? true,
 		reminderDaysBefore: settings.reminderDaysBefore,
 		repeatDailyReminders: settings.repeatDailyReminders,
 		skipRemindersForTakenDoses: settings.skipRemindersForTakenDoses ?? false,
@@ -186,11 +230,21 @@ export async function getAllUserSettings(): Promise<UserSettings[]> {
 		highStockDays: settings.highStockDays,
 		language: settings.language as Language,
 		stockCalculationMode: (settings.stockCalculationMode as "automatic" | "manual") ?? "automatic",
+		shareStockStatus: settings.shareStockStatus ?? true,
+		upcomingTodayOnly: settings.upcomingTodayOnly ?? false,
+		shareScheduleTodayOnly: settings.shareScheduleTodayOnly ?? false,
+		swapDashboardMainSections: settings.swapDashboardMainSections ?? false,
 		lastAutoEmailSent: settings.lastAutoEmailSent,
 		lastNotificationType: settings.lastNotificationType,
 		lastNotificationChannel: settings.lastNotificationChannel,
 		lastReminderMedName: settings.lastReminderMedName ?? null,
 		lastReminderTakenBy: settings.lastReminderTakenBy ?? null,
+		lastStockReminderSent: settings.lastStockReminderSent ?? null,
+		lastStockReminderChannel: settings.lastStockReminderChannel ?? null,
+		lastStockReminderMedNames: settings.lastStockReminderMedNames ?? null,
+		lastPrescriptionReminderSent: settings.lastPrescriptionReminderSent ?? null,
+		lastPrescriptionReminderChannel: settings.lastPrescriptionReminderChannel ?? null,
+		lastPrescriptionReminderMedNames: settings.lastPrescriptionReminderMedNames ?? null,
 	}));
 }
 
@@ -200,7 +254,7 @@ export async function settingsRoutes(app: FastifyInstance) {
 
 	// Helper to get user ID from request
 	// Returns anonymous user ID when auth is disabled
-	async function getUserId(request: any, reply: any): Promise<number> {
+	async function getUserId(request: FastifyRequest, reply: FastifyReply): Promise<number> {
 		// If auth is disabled, use the anonymous user
 		if (!env.AUTH_ENABLED) {
 			return getAnonymousUserId();
@@ -233,14 +287,20 @@ export async function settingsRoutes(app: FastifyInstance) {
 			shoutrrrUrl: settings.shoutrrrUrl ?? "",
 			emailStockReminders: settings.emailStockReminders,
 			emailIntakeReminders: settings.emailIntakeReminders,
+			emailPrescriptionReminders: settings.emailPrescriptionReminders ?? true,
 			shoutrrrStockReminders: settings.shoutrrrStockReminders,
 			shoutrrrIntakeReminders: settings.shoutrrrIntakeReminders,
+			shoutrrrPrescriptionReminders: settings.shoutrrrPrescriptionReminders ?? true,
 			skipRemindersForTakenDoses: settings.skipRemindersForTakenDoses,
 			repeatRemindersEnabled: settings.repeatRemindersEnabled ?? false,
 			reminderRepeatIntervalMinutes: settings.reminderRepeatIntervalMinutes ?? 30,
 			maxNaggingReminders: settings.maxNaggingReminders ?? 5,
 			language: settings.language,
 			stockCalculationMode: settings.stockCalculationMode ?? "automatic",
+			shareStockStatus: settings.shareStockStatus ?? true,
+			upcomingTodayOnly: settings.upcomingTodayOnly ?? false,
+			shareScheduleTodayOnly: settings.shareScheduleTodayOnly ?? false,
+			swapDashboardMainSections: settings.swapDashboardMainSections ?? false,
 			// SMTP settings (from .env - shared/server-configured)
 			smtpHost: process.env.SMTP_HOST ?? "",
 			smtpPort: parseInt(process.env.SMTP_PORT ?? "587", 10),
@@ -254,6 +314,14 @@ export async function settingsRoutes(app: FastifyInstance) {
 			lastNotificationChannel: settings.lastNotificationChannel,
 			lastReminderMedName: settings.lastReminderMedName ?? null,
 			lastReminderTakenBy: settings.lastReminderTakenBy ?? null,
+			// Stock reminder tracking (separate from intake)
+			lastStockReminderSent: settings.lastStockReminderSent ?? null,
+			lastStockReminderChannel: settings.lastStockReminderChannel ?? null,
+			lastStockReminderMedNames: settings.lastStockReminderMedNames ?? null,
+			// Prescription reminder tracking (separate from stock/intake)
+			lastPrescriptionReminderSent: settings.lastPrescriptionReminderSent ?? null,
+			lastPrescriptionReminderChannel: settings.lastPrescriptionReminderChannel ?? null,
+			lastPrescriptionReminderMedNames: settings.lastPrescriptionReminderMedNames ?? null,
 			// Server settings (from .env, read-only)
 			expiryWarningDays: parseInt(process.env.EXPIRY_WARNING_DAYS ?? "30", 10),
 		});
@@ -281,10 +349,12 @@ export async function settingsRoutes(app: FastifyInstance) {
 			notificationEmail: body.notificationEmail || null,
 			emailStockReminders: body.emailStockReminders ?? true,
 			emailIntakeReminders: body.emailIntakeReminders ?? true,
+			emailPrescriptionReminders: body.emailPrescriptionReminders ?? true,
 			shoutrrrEnabled: body.shoutrrrEnabled ?? false,
 			shoutrrrUrl: body.shoutrrrUrl || null,
 			shoutrrrStockReminders: body.shoutrrrStockReminders ?? true,
 			shoutrrrIntakeReminders: body.shoutrrrIntakeReminders ?? true,
+			shoutrrrPrescriptionReminders: body.shoutrrrPrescriptionReminders ?? true,
 			reminderDaysBefore: body.reminderDaysBefore,
 			repeatDailyReminders,
 			skipRemindersForTakenDoses: body.skipRemindersForTakenDoses ?? false,
@@ -296,6 +366,10 @@ export async function settingsRoutes(app: FastifyInstance) {
 			highStockDays: body.highStockDays ?? 180,
 			language: body.language ?? "en",
 			stockCalculationMode: body.stockCalculationMode ?? "automatic",
+			shareStockStatus: body.shareStockStatus ?? true,
+			upcomingTodayOnly: body.upcomingTodayOnly ?? false,
+			shareScheduleTodayOnly: body.shareScheduleTodayOnly ?? false,
+			swapDashboardMainSections: body.swapDashboardMainSections ?? false,
 			updatedAt: new Date(),
 		};
 
@@ -311,6 +385,30 @@ export async function settingsRoutes(app: FastifyInstance) {
 		return reply.send({ success: true });
 	});
 
+	// Update only the language setting (lightweight, called on dropdown change)
+	app.put<{ Body: { language: string } }>("/settings/language", async (request, reply) => {
+		const userId = await getUserId(request, reply);
+		const { language } = request.body;
+
+		if (!language || !["en", "de"].includes(language)) {
+			return reply.status(400).send({ error: "Invalid language" });
+		}
+
+		const existingSettings = await db.select().from(userSettings).where(eq(userSettings.userId, userId));
+
+		if (existingSettings.length > 0) {
+			await db.update(userSettings).set({ language, updatedAt: new Date() }).where(eq(userSettings.userId, userId));
+		} else {
+			await db.insert(userSettings).values({
+				userId,
+				...getDefaultSettings(),
+				language,
+			});
+		}
+
+		return reply.send({ success: true });
+	});
+
 	// Test email - use SMTP settings from process.env
 	app.post<{ Body: TestEmailBody }>("/settings/test-email", async (request, reply) => {
 		const { email } = request.body;
@@ -467,7 +565,7 @@ export async function sendShoutrrrNotification(
 		}
 
 		// Use ONLY the reconstructed URL from validation - never the original urlStr
-		const { url: sanitizedUrl, isNtfy, auth } = validation;
+		const { url: sanitizedUrl, isNtfy: _isNtfy, auth } = validation;
 
 		let targetUrl: string;
 		const method = "POST";
@@ -510,7 +608,10 @@ export async function sendShoutrrrNotification(
 		// This works for ntfy, Apprise, and most simple push services
 		if (!isJsonWebhook) {
 			targetUrl = sanitizedUrl;
-			headers = { Title: cleanTitle, Tags: "pill" };
+			// Use RFC 2047 Base64 encoding for Title header to safely pass non-ASCII
+			// characters (umlauts, accents, etc.) through HTTP headers
+			const encodedTitle = `=?UTF-8?B?${Buffer.from(cleanTitle, "utf-8").toString("base64")}?=`;
+			headers = { Title: encodedTitle, Tags: "pill" };
 			body = message;
 
 			// Add auth if present (extracted during sanitization)

backend/src/routes/share.ts

@@ -114,7 +114,9 @@ export async function shareRoutes(app: FastifyInstance) {
 			const takenByArray = parseTakenByJson(med.takenByJson);
 
 			const totalPills =
-				med.packCount * med.blistersPerPack * med.pillsPerBlister + med.looseTablets + (med.stockAdjustment ?? 0);
+				(med.packageType ?? "blister") === "bottle"
+					? med.looseTablets + (med.stockAdjustment ?? 0)
+					: med.packCount * med.blistersPerPack * med.pillsPerBlister + med.looseTablets + (med.stockAdjustment ?? 0);
 			return {
 				id: med.id,
 				name: med.name,
@@ -123,6 +125,7 @@ export async function shareRoutes(app: FastifyInstance) {
 				doseUnit: med.doseUnit ?? "mg",
 				imageUrl: med.imageUrl,
 				totalPills,
+				packageType: med.packageType ?? "blister",
 				packCount: med.packCount,
 				blistersPerPack: med.blistersPerPack,
 				looseTablets: med.looseTablets,
@@ -132,6 +135,8 @@ export async function shareRoutes(app: FastifyInstance) {
 				blisters, // Legacy format for backward compat
 				dismissedUntil: med.dismissedUntil,
 				updatedAt: med.updatedAt, // For filtering out doses from previous schedule configurations
+				lastStockCorrectionAt: med.lastStockCorrectionAt?.getTime() ?? null,
+				stockAdjustment: med.stockAdjustment ?? 0,
 			};
 		});
 
@@ -142,7 +147,15 @@ export async function shareRoutes(app: FastifyInstance) {
 			medications: medicationsWithBlisters,
 			stockThresholds: {
 				lowStockDays: settings?.lowStockDays ?? 30,
+				normalStockDays: settings?.normalStockDays ?? 60,
+				highStockDays: settings?.highStockDays ?? 90,
+				reminderDaysBefore: settings?.reminderDaysBefore ?? 7,
+				expiryWarningDays: settings?.expiryWarningDays ?? 90,
 			},
+			stockCalculationMode: (settings?.stockCalculationMode as "automatic" | "manual") ?? "automatic",
+			shareStockStatus: settings?.shareStockStatus ?? true,
+			upcomingTodayOnly: settings?.upcomingTodayOnly ?? false,
+			shareScheduleTodayOnly: settings?.shareScheduleTodayOnly ?? false,
 		};
 	});
 

backend/src/services/intake-reminder-scheduler.ts

@@ -5,8 +5,16 @@ import nodemailer from "nodemailer";
 import { db } from "../db/client.js";
 import { getDataDir } from "../db/db-utils.js";
 import { doseTracking, medications } from "../db/schema.js";
-import { getDateLocale, getTranslations, type Language, t } from "../i18n/translations.js";
+import {
+	getDateLocale,
+	getFooterHtml,
+	getFooterPlain,
+	getTranslations,
+	type Language,
+	t,
+} from "../i18n/translations.js";
 import { getAllUserSettings, sendShoutrrrNotification, type UserSettings } from "../routes/settings.js";
+import type { ServiceLogger } from "../utils/logger.js";
 // Import shared utilities
 import {
 	cleanOldIntakeReminders,
@@ -14,7 +22,6 @@ import {
 	getTimezone,
 	getTodaysIntakes,
 	getUpcomingIntakes,
-	type Intake,
 	type IntakeReminderState,
 	parseIntakeReminderState,
 	parseIntakesJson,
@@ -43,6 +50,113 @@ function saveIntakeReminderState(state: IntakeReminderState): void {
 	writeFileSync(intakeReminderStateFile, JSON.stringify(state, null, 2));
 }
 
+function buildDoseIdForIntake(intake: UpcomingIntake & { medicationId: number; blisterIndex: number }): string {
+	const intakeDate = intake.intakeTime;
+	const dateOnlyMs = new Date(intakeDate.getFullYear(), intakeDate.getMonth(), intakeDate.getDate()).getTime();
+	if (intake.takenBy) {
+		return `${intake.medicationId}-${intake.blisterIndex}-${dateOnlyMs}-${intake.takenBy}`;
+	}
+	return `${intake.medicationId}-${intake.blisterIndex}-${dateOnlyMs}`;
+}
+
+async function autoMarkDueIntakesAsTaken(
+	settings: UserSettings & { userId: number },
+	rows: (typeof medications.$inferSelect)[],
+	locale: string,
+	tz: string,
+	logger: ServiceLogger
+): Promise<number> {
+	if (settings.stockCalculationMode !== "automatic") {
+		return 0;
+	}
+
+	const now = new Date();
+	const nowInTimezone = new Date(now.toLocaleString("en-US", { timeZone: tz }));
+	const todayStart = new Date(now.toLocaleString("en-US", { timeZone: tz }));
+	todayStart.setHours(0, 0, 0, 0);
+	const todayEnd = new Date(now.toLocaleString("en-US", { timeZone: tz }));
+	todayEnd.setHours(23, 59, 59, 999);
+
+	const existingToday = await db
+		.select({ doseId: doseTracking.doseId })
+		.from(doseTracking)
+		.where(
+			and(
+				eq(doseTracking.userId, settings.userId),
+				gte(doseTracking.takenAt, todayStart),
+				lte(doseTracking.takenAt, todayEnd)
+			)
+		);
+	const existingDoseIds = new Set(existingToday.map((d) => d.doseId));
+
+	let inserted = 0;
+
+	for (const med of rows) {
+		if (med.isObsolete) {
+			continue;
+		}
+
+		const intakes = parseIntakesJson(
+			med.intakesJson,
+			{ usageJson: med.usageJson, everyJson: med.everyJson, startJson: med.startJson },
+			med.intakeRemindersEnabled ?? false
+		);
+		if (intakes.length === 0) {
+			continue;
+		}
+
+		const medicationTakenBy = parseTakenByJson(med.takenByJson);
+		const todaysIntakes = getTodaysIntakes(
+			med.name,
+			intakes,
+			medicationTakenBy,
+			med.pillWeightMg,
+			locale,
+			tz,
+			med.id,
+			med.doseUnit ?? "mg"
+		);
+
+		for (const intake of todaysIntakes) {
+			const intakeTimeInTimezone = new Date(intake.intakeTime.toLocaleString("en-US", { timeZone: tz }));
+			if (intakeTimeInTimezone.getTime() > nowInTimezone.getTime()) {
+				continue;
+			}
+			if (intake.medicationId === undefined || intake.blisterIndex === undefined) {
+				continue;
+			}
+
+			const doseId = buildDoseIdForIntake({
+				...intake,
+				medicationId: intake.medicationId,
+				blisterIndex: intake.blisterIndex,
+			});
+
+			if (existingDoseIds.has(doseId)) {
+				continue;
+			}
+
+			await db.insert(doseTracking).values({
+				userId: settings.userId,
+				doseId,
+				takenAt: intake.intakeTime,
+				markedBy: null,
+				takenSource: "automatic",
+				dismissed: false,
+			});
+
+			existingDoseIds.add(doseId);
+			inserted++;
+		}
+	}
+
+	if (inserted > 0) {
+		logger.info(`[IntakeReminder] User ${settings.userId}: Auto-marked ${inserted} due intake dose(s) as taken`);
+	}
+
+	return inserted;
+}
+
 async function sendIntakeReminderEmail(
 	email: string,
 	intakes: UpcomingIntake[],
@@ -149,7 +263,7 @@ async function sendIntakeReminderEmail(
 
         <hr style="border: none; border-top: 1px solid #e5e7eb; margin: 16px 0;" />
         <p style="color: #9ca3af; font-size: 11px; margin: 0;">
-          ${tr.intakeReminder.footer}
+          ${getFooterHtml(language)}
         </p>
       </div>
     </div>
@@ -178,7 +292,7 @@ ${intakes
 	.join("\n")}
 
 ---
-${tr.intakeReminder.footer}`;
+${getFooterPlain(language)}`;
 
 	const subject = isRepeat
 		? `[Reminder] ${t(tr.intakeReminder.subject, { medications: intakes.map((i) => i.medName).join(", ") })}`
@@ -210,21 +324,18 @@ ${tr.intakeReminder.footer}`;
 	}
 }
 
-async function checkAndSendIntakeReminders(logger: {
-	info: (msg: string) => void;
-	error: (msg: string) => void;
-}): Promise<void> {
-	logger.info(`[IntakeReminder] Checking for intake reminders...`);
+async function checkAndSendIntakeReminders(logger: ServiceLogger): Promise<void> {
+	logger.debug(`[IntakeReminder] Checking for intake reminders...`);
 
 	// Get all user settings to iterate over each user
 	const allUserSettings = await getAllUserSettings();
 
 	if (allUserSettings.length === 0) {
-		logger.info(`[IntakeReminder] No users with settings found`);
+		logger.debug(`[IntakeReminder] No users with settings found`);
 		return; // No users with settings
 	}
 
-	logger.info(`[IntakeReminder] Found ${allUserSettings.length} users to check`);
+	logger.debug(`[IntakeReminder] Found ${allUserSettings.length} users to check`);
 
 	for (const userSettings of allUserSettings) {
 		await checkAndSendIntakeRemindersForUser(userSettings, logger);
@@ -233,50 +344,55 @@ async function checkAndSendIntakeReminders(logger: {
 
 async function checkAndSendIntakeRemindersForUser(
 	settings: UserSettings & { userId: number },
-	logger: { info: (msg: string) => void; error: (msg: string) => void }
+	logger: ServiceLogger
 ): Promise<void> {
 	const language = settings.language;
 	const tr = getTranslations(language);
 
-	logger.info(
+	logger.debug(
 		`[IntakeReminder] Checking user ${settings.userId} - repeat:${settings.repeatRemindersEnabled} skip:${settings.skipRemindersForTakenDoses}`
 	);
 
+	const rows = await db
+		.select()
+		.from(medications)
+		.where(eq(medications.userId, settings.userId))
+		.orderBy(medications.id);
+
+	const locale = getDateLocale(language);
+	const tz = getTimezone();
+
+	await autoMarkDueIntakesAsTaken(settings, rows, locale, tz, logger);
+
 	// Check if any intake reminder notifications are enabled (granular check)
 	const emailEnabled = settings.emailEnabled && settings.notificationEmail && settings.emailIntakeReminders;
 	const shoutrrrEnabled = settings.shoutrrrEnabled && settings.shoutrrrUrl && settings.shoutrrrIntakeReminders;
 
 	if (!emailEnabled && !shoutrrrEnabled) {
-		logger.info(
+		logger.debug(
 			`[IntakeReminder] User ${settings.userId}: No intake notifications enabled (email:${emailEnabled}, shoutrrr:${shoutrrrEnabled})`
 		);
 		return; // No intake reminder notifications enabled for this user
 	}
 
-	logger.info(
+	logger.debug(
 		`[IntakeReminder] User ${settings.userId}: Notifications enabled (email:${emailEnabled}, shoutrrr:${shoutrrrEnabled})`
 	);
 
 	// Get all medications with intake reminders enabled for this user
-	const rows = await db
-		.select()
-		.from(medications)
-		.where(eq(medications.userId, settings.userId))
-		.orderBy(medications.id);
 	const medsWithReminders = rows.filter((row) => row.intakeRemindersEnabled);
 
 	if (medsWithReminders.length === 0) {
-		logger.info(`[IntakeReminder] User ${settings.userId}: No medications have reminders enabled`);
+		logger.debug(`[IntakeReminder] User ${settings.userId}: No medications have reminders enabled`);
 		return; // No medications have reminders enabled for this user
 	}
 
-	logger.info(`[IntakeReminder] User ${settings.userId}: Found ${medsWithReminders.length} medications with reminders`);
+	logger.debug(
+		`[IntakeReminder] User ${settings.userId}: Found ${medsWithReminders.length} medications with reminders`
+	);
 
 	const state = loadIntakeReminderState();
 	const allUpcoming: (UpcomingIntake & { medicationId: number; blisterIndex: number })[] = [];
-	const locale = getDateLocale(language);
-	const tz = getTimezone();
-
 	// Get start and end of today in user's timezone (for filtering today's doses only)
 	const now = new Date();
 	const todayStart = new Date(now.toLocaleString("en-US", { timeZone: tz }));
@@ -285,7 +401,7 @@ async function checkAndSendIntakeRemindersForUser(
 	const todayEnd = new Date(now.toLocaleString("en-US", { timeZone: tz }));
 	todayEnd.setHours(23, 59, 59, 999);
 
-	logger.info(
+	logger.debug(
 		`[IntakeReminder] User ${settings.userId}: Today range: ${todayStart.toISOString()} to ${todayEnd.toISOString()}`
 	);
 
@@ -300,7 +416,7 @@ async function checkAndSendIntakeRemindersForUser(
 		// Medication-level takenBy (for fallback/display purposes)
 		const medicationTakenBy = parseTakenByJson(med.takenByJson);
 
-		logger.info(
+		logger.debug(
 			`[IntakeReminder] User ${settings.userId}: Processing medication "${med.name}" with ${intakes.length} intakes`
 		);
 
@@ -308,15 +424,15 @@ async function checkAndSendIntakeRemindersForUser(
 		const intakesWithReminders = intakes.filter((intake, idx) => {
 			const hasReminder = intake.intakeRemindersEnabled || med.intakeRemindersEnabled;
 			if (!hasReminder) {
-				logger.info(`[IntakeReminder] User ${settings.userId}: Intake ${idx} has reminders disabled, skipping`);
+				logger.debug(`[IntakeReminder] User ${settings.userId}: Intake ${idx} has reminders disabled, skipping`);
 			}
 			return hasReminder;
 		});
 
 		// Process each intake separately to track blisterIndex
-		intakesWithReminders.forEach((intake, blisterIndex) => {
+		intakesWithReminders.forEach((intake, _blisterIndex) => {
 			const actualIndex = intakes.indexOf(intake); // Get the actual index in original array
-			logger.info(
+			logger.debug(
 				`[IntakeReminder] User ${settings.userId}: Intake ${actualIndex} - start: ${intake.start}, every: ${intake.every} days, usage: ${intake.usage}, takenBy: ${intake.takenBy || "(none)"}`
 			);
 
@@ -333,7 +449,7 @@ async function checkAndSendIntakeRemindersForUser(
 				med.id,
 				med.doseUnit ?? "mg"
 			);
-			logger.info(
+			logger.debug(
 				`[IntakeReminder] User ${settings.userId}: Intake ${actualIndex} found ${upcomingIntakes.length} upcoming intakes (reminder window)`
 			);
 
@@ -358,13 +474,13 @@ async function checkAndSendIntakeRemindersForUser(
 					med.id,
 					med.doseUnit ?? "mg"
 				);
-				logger.info(
+				logger.debug(
 					`[IntakeReminder] User ${settings.userId}: Intake ${actualIndex} - all today's intakes: ${allTodaysIntakes.length}, times: ${allTodaysIntakes.map((i) => i.intakeTime.toISOString()).join(", ")}`
 				);
 				const missedIntakes = allTodaysIntakes.filter(
 					(todayIntake) => todayIntake.intakeTime.getTime() < now.getTime()
 				);
-				logger.info(
+				logger.debug(
 					`[IntakeReminder] User ${settings.userId}: Intake ${actualIndex} found ${missedIntakes.length} missed intakes (past intake time)`
 				);
 
@@ -383,10 +499,10 @@ async function checkAndSendIntakeRemindersForUser(
 		});
 	}
 
-	logger.info(`[IntakeReminder] User ${settings.userId}: Total ${allUpcoming.length} intakes for today`);
+	logger.debug(`[IntakeReminder] User ${settings.userId}: Total ${allUpcoming.length} intakes for today`);
 
 	if (allUpcoming.length === 0) {
-		logger.info(`[IntakeReminder] User ${settings.userId}: No intakes for today`);
+		logger.debug(`[IntakeReminder] User ${settings.userId}: No intakes for today`);
 		return; // No upcoming intakes for today
 	}
 
@@ -409,15 +525,33 @@ async function checkAndSendIntakeRemindersForUser(
 		if (!existingEntry) {
 			// New dose - send first reminder
 			if (isIntakePast) {
-				// Already missed - this is first nagging reminder (count=1)
-				remindersToSend.push({ ...intake, currentSendCount: 1, maxReminders, isAdvanceReminder: false });
-				logger.info(
-					`[IntakeReminder] User ${settings.userId}: First nagging for missed "${intake.medName}" at ${intake.intakeTimeStr} (1/${maxReminders})`
-				);
+				// Intake time already passed and we have no state entry. Check how recently it was missed.
+				const minutesSinceIntake = (nowMs - intakeTimeMs) / 60000;
+				const gracePeriodMinutes = (settings.reminderRepeatIntervalMinutes ?? 30) + REMINDER_MINUTES_BEFORE;
+
+				if (minutesSinceIntake <= gracePeriodMinutes) {
+					// Recently missed — scheduler likely recovered from sleep/restart.
+					// Send a catch-up reminder (counts as first nagging reminder).
+					remindersToSend.push({ ...intake, currentSendCount: 1, maxReminders, isAdvanceReminder: false });
+					logger.info(
+						`[IntakeReminder] User ${settings.userId}: Catch-up reminder for recently missed "${intake.medName}" at ${intake.intakeTimeStr} (${Math.round(minutesSinceIntake)} min ago)`
+					);
+				} else {
+					// Long ago — seed state without notification (user likely already noticed)
+					state.reminders[key] = {
+						firstSentAt: nowMs,
+						lastSentAt: nowMs,
+						sendCount: 0,
+						advanceSent: false,
+					};
+					logger.debug(
+						`[IntakeReminder] User ${settings.userId}: Seeding state for old past "${intake.medName}" at ${intake.intakeTimeStr} (no notification — ${Math.round(minutesSinceIntake)} min ago)`
+					);
+				}
 			} else {
 				// Upcoming - this is advance reminder (no counter)
 				remindersToSend.push({ ...intake, currentSendCount: 0, maxReminders, isAdvanceReminder: true });
-				logger.info(
+				logger.debug(
 					`[IntakeReminder] User ${settings.userId}: Advance reminder for "${intake.medName}" at ${intake.intakeTimeStr}`
 				);
 			}
@@ -432,13 +566,13 @@ async function checkAndSendIntakeRemindersForUser(
 
 			if (currentNaggingCount >= maxReminders) {
 				// Max nagging reminders reached - stop
-				logger.info(
+				logger.debug(
 					`[IntakeReminder] User ${settings.userId}: Max nagging (${maxReminders}) reached for "${intake.medName}" at ${intake.intakeTimeStr}`
 				);
 			} else if (timeSinceLastReminder >= intervalMs) {
 				const nextSendCount = currentNaggingCount + 1;
 				remindersToSend.push({ ...intake, currentSendCount: nextSendCount, maxReminders, isAdvanceReminder: false });
-				logger.info(
+				logger.debug(
 					`[IntakeReminder] User ${settings.userId}: Nagging reminder for "${intake.medName}" at ${intake.intakeTimeStr} (${nextSendCount}/${maxReminders})`
 				);
 			}
@@ -478,7 +612,7 @@ async function checkAndSendIntakeRemindersForUser(
 				const doseId = `${intake.medicationId}-${intake.blisterIndex}-${dateOnlyMs}-${intake.takenBy}`;
 				const isTaken = takenDoseIds.has(doseId);
 				if (isTaken) {
-					logger.info(
+					logger.debug(
 						`[IntakeReminder] User ${settings.userId}: Skipping "${intake.medName}" - dose ${doseId} already taken`
 					);
 				}
@@ -488,7 +622,7 @@ async function checkAndSendIntakeRemindersForUser(
 				const doseId = `${intake.medicationId}-${intake.blisterIndex}-${dateOnlyMs}`;
 				const isTaken = takenDoseIds.has(doseId);
 				if (isTaken) {
-					logger.info(
+					logger.debug(
 						`[IntakeReminder] User ${settings.userId}: Skipping "${intake.medName}" - dose ${doseId} already taken`
 					);
 				}
@@ -497,7 +631,7 @@ async function checkAndSendIntakeRemindersForUser(
 		});
 
 		if (remindersToSend.length === 0) {
-			logger.info(`[IntakeReminder] User ${settings.userId}: All doses taken, skipping reminders`);
+			logger.debug(`[IntakeReminder] User ${settings.userId}: All doses taken, skipping reminders`);
 			return;
 		}
 	}
@@ -551,7 +685,10 @@ async function checkAndSendIntakeRemindersForUser(
 		if (hasNaggingReminder && highestSendCount > 0) {
 			// Nagging reminder - show counter
 			const counterStr = `(${highestSendCount}/${maxReminderCount})`;
-			title = language === "de" ? `⚠️ Medikamenten-Erinnerung ${counterStr}` : `⚠️ Medication Reminder ${counterStr}`;
+			title =
+				language === "de"
+					? `⚠️ Erinnerung: Medikamenteneinnahme ${counterStr}`
+					: `⚠️ Reminder: Medication intake ${counterStr}`;
 		} else {
 			// Advance reminder - no counter
 			title = t(tr.push.intakeTitle, { minutes: REMINDER_MINUTES_BEFORE });
@@ -590,7 +727,9 @@ async function checkAndSendIntakeRemindersForUser(
 					}
 					return `• ${i.medName}${takenByStr}: ${dosage} @ ${i.intakeTimeStr}`;
 				})
-				.join("\n") + repeatNote;
+				.join("\n") +
+			repeatNote +
+			`\n\n---\n${getFooterPlain(language)}`;
 
 		const result = await sendShoutrrrNotification(settings.shoutrrrUrl!, title, message);
 		shoutrrrSuccess = result.success;
@@ -654,7 +793,8 @@ async function checkAndSendIntakeRemindersForUser(
 		saveIntakeReminderState(state);
 
 		// Update global reminder state for UI display
-		const channel = emailSuccess && shoutrrrSuccess ? "both" : emailSuccess ? "email" : "push";
+		const singleChannel = emailSuccess ? "email" : "push";
+		const channel = emailSuccess && shoutrrrSuccess ? "both" : singleChannel;
 		updateReminderSentTime("intake", channel);
 
 		// Also update user settings in database so frontend can display the info
@@ -668,10 +808,7 @@ async function checkAndSendIntakeRemindersForUser(
 
 let intakeCheckInterval: NodeJS.Timeout | null = null;
 
-export function startIntakeReminderScheduler(logger: {
-	info: (msg: string) => void;
-	error: (msg: string) => void;
-}): void {
+export function startIntakeReminderScheduler(logger: ServiceLogger): void {
 	logger.info(`[IntakeReminder] Starting intake reminder scheduler (checks every minute)...`);
 
 	// Run immediately on start

backend/src/services/reminder-scheduler.ts

@@ -1,13 +1,13 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import nodemailer from "nodemailer";
 import { db } from "../db/client.js";
 import { getDataDir } from "../db/db-utils.js";
-import { medications, userSettings } from "../db/schema.js";
-import { getTranslations, type Language, t } from "../i18n/translations.js";
+import { doseTracking, medications, userSettings } from "../db/schema.js";
+import { getFooterHtml, getFooterPlain, getTranslations, type Language, t } from "../i18n/translations.js";
 import { getAllUserSettings, sendShoutrrrNotification, type UserSettings } from "../routes/settings.js";
-
+import type { ServiceLogger } from "../utils/logger.js";
 // Import shared utilities
 import {
 	type Blister,
@@ -19,11 +19,24 @@ import {
 	getNextScheduledTime,
 	getTimezone,
 	getTodayInTimezone,
-	parseBlisters,
+	parseIntakesJson,
+	parseLocalDateTime,
 	parseReminderState,
+	parseTakenByJson,
 	type ReminderState,
 } from "../utils/scheduler-utils.js";
 
+function escapeHtml(text: string): string {
+	const htmlEscapes: Record<string, string> = {
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		'"': "&quot;",
+		"'": "&#39;",
+	};
+	return text.replace(/[&<>"']/g, (char) => htmlEscapes[char] || char);
+}
+
 const REMINDER_HOUR = parseInt(process.env.REMINDER_HOUR ?? "6", 10); // Default 6:00 AM local time
 
 const reminderStateFile = resolve(getDataDir(), "reminder-state.json");
@@ -48,7 +61,7 @@ export function getReminderState(): ReminderState {
 }
 
 export function updateReminderSentTime(
-	type: "stock" | "intake" = "stock",
+	type: "stock" | "intake" | "prescription" = "stock",
 	channel: "email" | "push" | "both" = "email"
 ): void {
 	const state = loadReminderState();
@@ -63,28 +76,49 @@ export function updateReminderSentTime(
 }
 
 // Update user settings in database when reminder is sent
+// Stock and intake reminders are tracked separately so neither overwrites the other
 export async function updateUserReminderSentTime(
 	userId: number,
-	type: "stock" | "intake" = "stock",
+	type: "stock" | "intake" | "prescription" = "stock",
 	channel: "email" | "push" | "both" = "email",
 	medName?: string,
 	takenBy?: string
 ): Promise<void> {
 	const now = new Date().toISOString();
-	await db
-		.update(userSettings)
-		.set({
-			lastAutoEmailSent: now,
-			lastNotificationType: type,
-			lastNotificationChannel: channel,
-			lastReminderMedName: medName ?? null,
-			lastReminderTakenBy: takenBy ?? null,
-		})
-		.where(eq(userSettings.userId, userId));
-}
-
-function parseBlistersFromRow(row: { usageJson: string; everyJson: string; startJson: string }): Blister[] {
-	return parseBlisters(row);
+	if (type === "stock") {
+		// Write to dedicated stock reminder columns only — do NOT touch the shared
+		// lastNotificationType column, as that would block intake reminder display
+		await db
+			.update(userSettings)
+			.set({
+				lastStockReminderSent: now,
+				lastStockReminderChannel: channel,
+				lastStockReminderMedNames: medName ?? null,
+			})
+			.where(eq(userSettings.userId, userId));
+	} else if (type === "prescription") {
+		// Write to dedicated prescription reminder columns only
+		await db
+			.update(userSettings)
+			.set({
+				lastPrescriptionReminderSent: now,
+				lastPrescriptionReminderChannel: channel,
+				lastPrescriptionReminderMedNames: medName ?? null,
+			})
+			.where(eq(userSettings.userId, userId));
+	} else {
+		// Write to intake reminder columns
+		await db
+			.update(userSettings)
+			.set({
+				lastAutoEmailSent: now,
+				lastNotificationType: type,
+				lastNotificationChannel: channel,
+				lastReminderMedName: medName ?? null,
+				lastReminderTakenBy: takenBy ?? null,
+			})
+			.where(eq(userSettings.userId, userId));
+	}
 }
 
 type LowStockItem = {
@@ -92,30 +126,180 @@ type LowStockItem = {
 	medsLeft: number;
 	daysLeft: number | null;
 	depletionDate: string | null;
+	isCritical: boolean;
+};
+
+type PrescriptionReminderItem = {
+	name: string;
+	remainingRefills: number;
+	lowThreshold: number;
+	expiryDate: string | null;
 };
 
 async function getMedicationsNeedingReminder(
 	userId: number,
 	reminderDaysBefore: number,
-	language: Language
+	lowStockDays: number,
+	language: Language,
+	stockCalculationMode: "automatic" | "manual"
 ): Promise<LowStockItem[]> {
-	const rows = await db.select().from(medications).where(eq(medications.userId, userId)).orderBy(medications.id);
+	const rows = await db
+		.select()
+		.from(medications)
+		.where(and(eq(medications.userId, userId), eq(medications.isObsolete, false)))
+		.orderBy(medications.id);
+
+	const takenDoseRows = await db
+		.select()
+		.from(doseTracking)
+		.where(and(eq(doseTracking.userId, userId), eq(doseTracking.dismissed, false)));
+
+	const takenDoseIdsByMed = new Map<number, Set<string>>();
+	const takenDoseTimestamps = new Map<string, number>();
+	for (const dose of takenDoseRows) {
+		const parts = dose.doseId.split("-");
+		if (parts.length < 3) continue;
+		const medId = parseInt(parts[0], 10);
+		if (Number.isNaN(medId)) continue;
+
+		if (!takenDoseIdsByMed.has(medId)) {
+			takenDoseIdsByMed.set(medId, new Set());
+		}
+		takenDoseIdsByMed.get(medId)!.add(dose.doseId);
+		const rawTakenAt = Number(dose.takenAt);
+		const takenAtMs = Number.isFinite(rawTakenAt)
+			? rawTakenAt < 1_000_000_000_000
+				? rawTakenAt * 1000
+				: rawTakenAt
+			: new Date(dose.takenAt).getTime();
+		takenDoseTimestamps.set(dose.doseId, takenAtMs);
+	}
 
 	const lowStock: LowStockItem[] = [];
+	const now = Date.now();
+	const msPerDay = 86_400_000;
 
 	for (const row of rows) {
-		const blisters = parseBlistersFromRow(row);
-		const totalPills =
-			row.packCount * row.blistersPerPack * row.pillsPerBlister + row.looseTablets + (row.stockAdjustment ?? 0);
-		const { daysLeft, depletionDate } = calculateDepletionInfo({ count: totalPills, blisters }, language);
+		const intakes = parseIntakesJson(
+			row.intakesJson,
+			{ usageJson: row.usageJson, everyJson: row.everyJson, startJson: row.startJson },
+			row.intakeRemindersEnabled ?? false
+		);
+		const blisters: Blister[] = intakes.map((i) => ({ usage: i.usage, every: i.every, start: i.start }));
 
-		// Check if medication runs out within reminderDaysBefore days
-		if (daysLeft !== null && daysLeft <= reminderDaysBefore) {
+		const originalTotalPills =
+			(row.packageType ?? "blister") === "bottle"
+				? row.looseTablets + (row.stockAdjustment ?? 0)
+				: row.packCount * row.blistersPerPack * row.pillsPerBlister + row.looseTablets + (row.stockAdjustment ?? 0);
+
+		const stockCorrectionCutoff = row.lastStockCorrectionAt ? new Date(row.lastStockCorrectionAt).getTime() : 0;
+		const takenDoseIds = takenDoseIdsByMed.get(row.id) ?? new Set<string>();
+
+		let consumed = 0;
+
+		if (stockCalculationMode === "automatic") {
+			blisters.forEach((blister, blisterIdx) => {
+				const blisterStart = parseLocalDateTime(blister.start).getTime();
+				if (Number.isNaN(blisterStart)) return;
+
+				const period = Math.max(1, blister.every) * msPerDay;
+
+				let effectiveStart: number;
+				if (stockCorrectionCutoff > 0 && stockCorrectionCutoff >= blisterStart) {
+					const elapsedSinceStart = stockCorrectionCutoff - blisterStart;
+					const periodsElapsed = Math.floor(elapsedSinceStart / period);
+					effectiveStart = blisterStart + (periodsElapsed + 1) * period;
+				} else {
+					effectiveStart = blisterStart;
+				}
+
+				const intake = intakes[blisterIdx];
+				const intakePerson = intake?.takenBy;
+				const fallbackPeople = parseTakenByJson(row.takenByJson);
+				const peopleForThisIntake = intakePerson ? [intakePerson] : fallbackPeople.length > 0 ? fallbackPeople : [null];
+
+				let timeBasedConsumed = 0;
+				let lastAutoConsumedDateMs = 0;
+
+				if (effectiveStart <= now) {
+					const occurrences = Math.floor((now - effectiveStart) / period) + 1;
+					timeBasedConsumed = occurrences * blister.usage * peopleForThisIntake.length;
+
+					const lastDoseTime = new Date(effectiveStart + (occurrences - 1) * period);
+					lastAutoConsumedDateMs = new Date(
+						lastDoseTime.getFullYear(),
+						lastDoseTime.getMonth(),
+						lastDoseTime.getDate()
+					).getTime();
+				}
+
+				const stockCorrectionDateOnly =
+					stockCorrectionCutoff > 0
+						? new Date(
+								new Date(stockCorrectionCutoff).getFullYear(),
+								new Date(stockCorrectionCutoff).getMonth(),
+								new Date(stockCorrectionCutoff).getDate()
+							).getTime()
+						: 0;
+				const earlyCutoff = Math.max(lastAutoConsumedDateMs, stockCorrectionDateOnly);
+
+				let earlyTakenConsumed = 0;
+				for (const doseId of takenDoseIds) {
+					const parts = doseId.split("-");
+					if (parts.length < 3) continue;
+					const bIdx = parseInt(parts[1], 10);
+					const timestamp = parseInt(parts[2], 10);
+					if (!Number.isNaN(bIdx) && !Number.isNaN(timestamp) && bIdx === blisterIdx && timestamp > earlyCutoff) {
+						earlyTakenConsumed += blister.usage;
+					}
+				}
+
+				consumed += timeBasedConsumed + earlyTakenConsumed;
+			});
+		} else {
+			blisters.forEach((blister, blisterIdx) => {
+				const blisterStart = parseLocalDateTime(blister.start);
+				const blisterStartDateOnly = new Date(
+					blisterStart.getFullYear(),
+					blisterStart.getMonth(),
+					blisterStart.getDate()
+				).getTime();
+				if (Number.isNaN(blisterStartDateOnly)) return;
+
+				for (const doseId of takenDoseIds) {
+					const parts = doseId.split("-");
+					if (parts.length < 3) continue;
+
+					const parsedBlisterIdx = parseInt(parts[1], 10);
+					const doseTimestamp = parseInt(parts[2], 10);
+					if (Number.isNaN(parsedBlisterIdx) || Number.isNaN(doseTimestamp) || parsedBlisterIdx !== blisterIdx) {
+						continue;
+					}
+
+					const takenAt = takenDoseTimestamps.get(doseId) ?? 0;
+					const afterCorrectionOrNoCorrection = stockCorrectionCutoff === 0 || takenAt > stockCorrectionCutoff;
+					if (doseTimestamp >= blisterStartDateOnly && afterCorrectionOrNoCorrection) {
+						consumed += blister.usage;
+					}
+				}
+			});
+		}
+
+		const currentPills = Math.max(0, originalTotalPills - consumed);
+		const { daysLeft, depletionDate } = calculateDepletionInfo({ count: currentPills, blisters }, language);
+
+		if (daysLeft === null) continue;
+
+		const isCritical = daysLeft <= reminderDaysBefore;
+		const isLow = daysLeft < lowStockDays;
+
+		if (isCritical || isLow) {
 			lowStock.push({
 				name: row.name,
-				medsLeft: totalPills,
+				medsLeft: currentPills,
 				daysLeft,
 				depletionDate,
+				isCritical,
 			});
 		}
 	}
@@ -123,6 +307,46 @@ async function getMedicationsNeedingReminder(
 	return lowStock;
 }
 
+async function getMedicationsNeedingPrescriptionReminder(userId: number): Promise<PrescriptionReminderItem[]> {
+	const rows = await db
+		.select()
+		.from(medications)
+		.where(and(eq(medications.userId, userId), eq(medications.isObsolete, false)))
+		.orderBy(medications.id);
+
+	return rows
+		.filter(
+			(row) =>
+				(row.prescriptionEnabled ?? false) &&
+				(row.prescriptionRemainingRefills ?? 0) <= (row.prescriptionLowRefillThreshold ?? 1)
+		)
+		.map((row) => ({
+			name: row.name,
+			remainingRefills: row.prescriptionRemainingRefills ?? 0,
+			lowThreshold: row.prescriptionLowRefillThreshold ?? 1,
+			expiryDate: row.prescriptionExpiryDate ?? null,
+		}));
+}
+
+// Test-only hook to validate scheduler stock semantics against planner/coverage behavior.
+export async function getMedicationsNeedingReminderForTests(
+	userId: number,
+	reminderDaysBefore: number,
+	lowStockDays: number,
+	language: Language,
+	stockCalculationMode: "automatic" | "manual"
+): Promise<
+	Array<{
+		name: string;
+		medsLeft: number;
+		daysLeft: number | null;
+		depletionDate: string | null;
+		isCritical: boolean;
+	}>
+> {
+	return getMedicationsNeedingReminder(userId, reminderDaysBefore, lowStockDays, language, stockCalculationMode);
+}
+
 async function sendReminderEmail(
 	email: string,
 	lowStock: LowStockItem[],
@@ -141,35 +365,84 @@ async function sendReminderEmail(
 	}
 
 	const tr = getTranslations(language);
-	const tableRows = lowStock
-		.map(
-			(row) => `
-      <tr>
-        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; white-space: nowrap;">${row.name}</td>
-        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;"><strong>${row.medsLeft}</strong></td>
-        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;">${row.daysLeft ?? 0}</td>
-        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;">${row.depletionDate ?? "-"}</td>
-      </tr>
-    `
-		)
-		.join("");
 
-	const alertText =
-		lowStock.length === 1
-			? tr.stockReminder.alertSingle
-			: t(tr.stockReminder.alertMultiple, { count: lowStock.length });
+	// Separate into 3 categories: empty, critical, and low stock
+	const emptyMeds = lowStock.filter((item) => item.medsLeft <= 0);
+	const criticalMeds = lowStock.filter((item) => item.medsLeft > 0 && item.isCritical);
+	const lowStockMeds = lowStock.filter((item) => item.medsLeft > 0 && !item.isCritical);
+
+	// Build per-category alert boxes
+	const alertParts: string[] = [];
+	if (emptyMeds.length > 0) {
+		const emptyAlert =
+			emptyMeds.length === 1
+				? tr.stockReminder.alertEmptySingle
+				: t(tr.stockReminder.alertEmptyMultiple, { count: emptyMeds.length });
+		alertParts.push(`
+            <div style="padding: 10px 14px; border-radius: 8px; margin-bottom: 12px; background: #fef2f2; border: 1px solid #dc2626;">
+              <p style="margin: 0; color: #dc2626; font-weight: 600; font-size: 13px;">${emptyAlert}</p>
+            </div>`);
+	}
+	if (criticalMeds.length > 0) {
+		const criticalAlert =
+			criticalMeds.length === 1
+				? tr.stockReminder.alertLowSingle
+				: t(tr.stockReminder.alertLowMultiple, { count: criticalMeds.length });
+		alertParts.push(`
+            <div style="padding: 10px 14px; border-radius: 8px; margin-bottom: 12px; background: #fff7ed; border: 1px solid #ea580c;">
+              <p style="margin: 0; color: #c2410c; font-weight: 600; font-size: 13px;">${criticalAlert}</p>
+            </div>`);
+	}
+	if (lowStockMeds.length > 0) {
+		const lowAlert =
+			lowStockMeds.length === 1
+				? tr.stockReminder.alertLowStockSingle
+				: t(tr.stockReminder.alertLowStockMultiple, { count: lowStockMeds.length });
+		alertParts.push(`
+            <div style="padding: 10px 14px; border-radius: 8px; margin-bottom: 12px; background: #fffbeb; border: 1px solid #f59e0b;">
+              <p style="margin: 0; color: #b45309; font-weight: 500; font-size: 13px;">${lowAlert}</p>
+            </div>`);
+	}
+	const alertHtml = alertParts.join("");
+
+	// Build description text
+	let descriptionText: string;
+	if (emptyMeds.length > 0 && (criticalMeds.length > 0 || lowStockMeds.length > 0)) {
+		descriptionText = tr.stockReminder.descriptionMixed;
+	} else if (emptyMeds.length > 0) {
+		descriptionText = tr.stockReminder.descriptionEmpty;
+	} else if (criticalMeds.length > 0) {
+		descriptionText = tr.stockReminder.description;
+	} else {
+		descriptionText = tr.stockReminder.descriptionLow;
+	}
+
+	// Build table rows with status indicator
+	const tableRows = lowStock
+		.map((row) => {
+			const isEmpty = row.medsLeft <= 0;
+			const isCritical = row.isCritical;
+			const nonEmptyIcon = isCritical ? "🚨" : "⚠️";
+			const statusIcon = isEmpty ? "🚨" : nonEmptyIcon;
+			const nonEmptyBg = isCritical ? "#fff7ed" : "white";
+			const rowBg = isEmpty ? "#fef2f2" : nonEmptyBg;
+			return `
+      <tr style="background: ${rowBg};">
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; white-space: nowrap;">${statusIcon} ${row.name}</td>
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap; ${isEmpty ? "color: #dc2626; font-weight: 600;" : ""}"><strong>${row.medsLeft}</strong></td>
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;">${row.daysLeft ?? 0}</td>
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;">${isEmpty ? `<strong>${tr.stockReminder.now ?? "-"}</strong>` : (row.depletionDate ?? "-")}</td>
+      </tr>`;
+		})
+		.join("");
 
 	const html = `
     <div style="font-family: system-ui, -apple-system, sans-serif; max-width: 100%; margin: 0 auto; padding: 12px; background: #f9fafb;">
       <div style="background: white; border-radius: 12px; padding: 16px; box-shadow: 0 1px 3px rgba(0,0,0,0.1);">
-        <h2 style="color: #1f2937; margin: 0 0 8px; font-size: 18px;">${tr.stockReminder.title}</h2>
-        <p style="color: #6b7280; margin: 0 0 16px; font-size: 13px;">${tr.stockReminder.description}</p>
+        <h2 style="color: #1f2937; margin: 0 0 8px; font-size: 18px;">${emptyMeds.length > 0 ? "🚨" : "⚠️"} MedAssist-ng - ${tr.push.reorderNow}</h2>
+        <p style="color: #6b7280; margin: 0 0 16px; font-size: 13px;">${descriptionText}</p>
         
-        <div style="padding: 10px 14px; border-radius: 8px; margin-bottom: 16px; background: #fef2f2; border: 1px solid #fecaca;">
-          <p style="margin: 0; color: #991b1b; font-weight: 500; font-size: 13px;">
-            ${alertText}
-          </p>
-        </div>
+        ${alertHtml}
 
         <div style="overflow-x: auto; -webkit-overflow-scrolling: touch;">
           <table style="width: 100%; border-collapse: collapse; background: white; min-width: 400px;">
@@ -189,7 +462,7 @@ async function sendReminderEmail(
 
         <hr style="border: none; border-top: 1px solid #e5e7eb; margin: 16px 0;" />
         <p style="color: #9ca3af; font-size: 11px; margin: 0;">
-          ${tr.stockReminder.footer}
+          ${getFooterHtml(language)}
         </p>
         ${isRepeatDaily ? `<p style="color: #9ca3af; font-size: 11px; margin: 8px 0 0 0; font-style: italic;">${tr.stockReminder.repeatDailyNote}</p>` : ""}
       </div>
@@ -203,9 +476,10 @@ ${tr.stockReminder.description}
 ${lowStock.map((r) => `${r.name}: ${r.medsLeft} ${tr.common.pills}, ${r.daysLeft ?? 0} ${tr.common.days}, ${tr.stockReminder.tableHeaders.runsOut}: ${r.depletionDate ?? tr.common.soon}`).join("\n")}
 
 ---
-${tr.stockReminder.footer}${isRepeatDaily ? `\n\n${tr.stockReminder.repeatDailyNote}` : ""}`;
+${getFooterPlain(language)}${isRepeatDaily ? `\n\n${tr.stockReminder.repeatDailyNote}` : ""}`;
 
-	const subjectPlural = lowStock.length === 1 ? "" : language === "de" ? "e" : "s";
+	const pluralSuffix = language === "de" ? "e" : "s";
+	const subjectPlural = lowStock.length === 1 ? "" : pluralSuffix;
 	const subject = t(tr.stockReminder.subject, { count: lowStock.length, s: subjectPlural, e: subjectPlural });
 
 	try {
@@ -222,7 +496,7 @@ ${tr.stockReminder.footer}${isRepeatDaily ? `\n\n${tr.stockReminder.repeatDailyN
 		await transporter.sendMail({
 			from: smtpFrom,
 			to: email,
-			subject: `⚠️ ${subject}`,
+			subject,
 			text: plainText,
 			html,
 		});
@@ -234,15 +508,12 @@ ${tr.stockReminder.footer}${isRepeatDaily ? `\n\n${tr.stockReminder.repeatDailyN
 	}
 }
 
-async function checkAndSendReminder(logger: {
-	info: (msg: string) => void;
-	error: (msg: string) => void;
-}): Promise<void> {
+async function checkAndSendReminder(logger: ServiceLogger): Promise<void> {
 	// Get all user settings to iterate over each user
 	const allUserSettings = await getAllUserSettings();
 
 	if (allUserSettings.length === 0) {
-		logger.info("[Reminder] No users with settings found");
+		logger.debug("[Reminder] No users with settings found");
 		return;
 	}
 
@@ -253,129 +524,314 @@ async function checkAndSendReminder(logger: {
 
 async function checkAndSendReminderForUser(
 	settings: UserSettings & { userId: number },
-	logger: { info: (msg: string) => void; error: (msg: string) => void }
+	logger: ServiceLogger
 ): Promise<void> {
 	const language = settings.language;
 	const tr = getTranslations(language);
 
-	// Check if any stock reminder notifications are enabled (granular check)
-	const emailEnabled = settings.emailEnabled && settings.notificationEmail && settings.emailStockReminders;
-	const shoutrrrEnabled = settings.shoutrrrEnabled && settings.shoutrrrUrl && settings.shoutrrrStockReminders;
+	const stockEmailEnabled = settings.emailEnabled && settings.notificationEmail && settings.emailStockReminders;
+	const stockPushEnabled = settings.shoutrrrEnabled && settings.shoutrrrUrl && settings.shoutrrrStockReminders;
+	const prescriptionEmailEnabled =
+		settings.emailEnabled && settings.notificationEmail && settings.emailPrescriptionReminders;
+	const prescriptionPushEnabled =
+		settings.shoutrrrEnabled && settings.shoutrrrUrl && settings.shoutrrrPrescriptionReminders;
 
-	if (!emailEnabled && !shoutrrrEnabled) {
-		return; // No stock reminder notifications enabled for this user
+	if (!stockEmailEnabled && !stockPushEnabled && !prescriptionEmailEnabled && !prescriptionPushEnabled) {
+		return;
 	}
 
 	const state = loadReminderState();
 	const today = getTodayInTimezone(); // YYYY-MM-DD in configured timezone
 	const userStateKey = `user_${settings.userId}`;
+	const userStockNotifiedKey = `${userStateKey}_${today}_stock`;
+	const userPrescriptionNotifiedKey = `${userStateKey}_${today}_prescription`;
 
-	// Get all medications that need a reminder for this user
-	const allLowStock = await getMedicationsNeedingReminder(settings.userId, settings.reminderDaysBefore, language);
+	const allLowStock = await getMedicationsNeedingReminder(
+		settings.userId,
+		settings.reminderDaysBefore,
+		settings.lowStockDays,
+		language,
+		settings.stockCalculationMode
+	);
+	const allPrescriptionLow = await getMedicationsNeedingPrescriptionReminder(settings.userId);
 
-	if (allLowStock.length === 0) {
-		return; // No low stock for this user
-	}
-
-	// Simple per-user tracking - check if we already sent today
-	const userNotifiedKey = `${userStateKey}_${today}`;
-	if (state.notifiedMedications.includes(userNotifiedKey) && !settings.repeatDailyReminders) {
-		return; // Already notified this user today
-	}
-
-	logger.info(`[Reminder] User ${settings.userId}: Sending reminder for ${allLowStock.length} medications...`);
-
-	let emailSuccess = false;
-	let shoutrrrSuccess = false;
-
-	// Send email if enabled
-	if (emailEnabled) {
-		const result = await sendReminderEmail(
-			settings.notificationEmail!,
-			allLowStock,
-			language,
-			settings.repeatDailyReminders
-		);
-		emailSuccess = result.success;
-		if (result.success) {
-			logger.info(`[Reminder] User ${settings.userId}: Email sent successfully to ${settings.notificationEmail}`);
-		} else {
-			logger.error(`[Reminder] User ${settings.userId}: Failed to send email: ${result.error}`);
-		}
-	}
-
-	// Send Shoutrrr notification if enabled
-	if (shoutrrrEnabled) {
-		// Separate empty from low stock medications
-		const emptyMeds = allLowStock.filter((m) => m.medsLeft <= 0);
-		const lowMeds = allLowStock.filter((m) => m.medsLeft > 0);
-
-		// Build clear title
-		const titleParts: string[] = [];
-		if (emptyMeds.length > 0) {
-			titleParts.push(`🚨 ${emptyMeds.length} ${tr.push.empty || "Empty"}`);
-		}
-		if (lowMeds.length > 0) {
-			titleParts.push(`⚠️ ${lowMeds.length} ${tr.push.low || "Low"}`);
-		}
-		const title = `MedAssist: ${titleParts.join(", ")} - ${tr.push.reorderNow || "Reorder Now!"}`;
-
-		// Build clear message with sections
-		const messageParts: string[] = [];
-		if (emptyMeds.length > 0) {
-			messageParts.push(`🚨 ${tr.push.emptySection || "EMPTY (reorder immediately)"}:`);
-			emptyMeds.forEach((m) => messageParts.push(`  • ${m.name}`));
-		}
-		if (lowMeds.length > 0) {
-			if (emptyMeds.length > 0) messageParts.push("");
-			messageParts.push(`⚠️ ${tr.push.lowSection || "RUNNING LOW (reorder soon)"}:`);
-			lowMeds.forEach((m) =>
-				messageParts.push(
-					`  • ${m.name}: ${t(tr.push.pillsLeft, { count: m.medsLeft })}, ${t(tr.push.daysLeft, { count: m.daysLeft ?? 0 })}`
-				)
+	if (allLowStock.length > 0 && (stockEmailEnabled || stockPushEnabled)) {
+		if (!state.notifiedMedications.includes(userStockNotifiedKey) || settings.repeatDailyReminders) {
+			logger.info(
+				`[Reminder] User ${settings.userId}: Sending stock reminder for ${allLowStock.length} medications...`
 			);
-		}
 
-		if (settings.repeatDailyReminders) {
-			messageParts.push("");
-			messageParts.push(tr.push.repeatDailyNote);
-		}
+			let emailSuccess = false;
+			let shoutrrrSuccess = false;
 
-		const message = messageParts.join("\n");
+			if (stockEmailEnabled) {
+				const result = await sendReminderEmail(
+					settings.notificationEmail!,
+					allLowStock,
+					language,
+					settings.repeatDailyReminders
+				);
+				emailSuccess = result.success;
+				if (!result.success) {
+					logger.error(`[Reminder] User ${settings.userId}: Failed to send stock email: ${result.error}`);
+				}
+			}
 
-		const result = await sendShoutrrrNotification(settings.shoutrrrUrl!, title, message);
-		shoutrrrSuccess = result.success;
-		if (result.success) {
-			logger.info(`[Reminder] User ${settings.userId}: Push notification sent successfully`);
-		} else {
-			logger.error(`[Reminder] User ${settings.userId}: Failed to send push notification: ${result.error}`);
+			if (stockPushEnabled) {
+				const emptyMeds = allLowStock.filter((m) => m.medsLeft <= 0);
+				const criticalMeds = allLowStock.filter((m) => m.medsLeft > 0 && m.isCritical);
+				const lowStockMeds = allLowStock.filter((m) => m.medsLeft > 0 && !m.isCritical);
+
+				const titleParts: string[] = [];
+				if (emptyMeds.length > 0) titleParts.push(`🚨 ${emptyMeds.length} ${tr.push.empty}`);
+				if (criticalMeds.length > 0) titleParts.push(`🚨 ${criticalMeds.length} ${tr.push.critical}`);
+				if (lowStockMeds.length > 0) titleParts.push(`⚠️ ${lowStockMeds.length} ${tr.push.lowStock}`);
+				const title = `MedAssist-ng: ${titleParts.join(", ")} - ${tr.push.reorderNow}`;
+
+				const messageParts: string[] = [];
+				if (emptyMeds.length > 0) {
+					messageParts.push(`🚨 ${tr.push.emptySection}:`);
+					emptyMeds.forEach((m) => messageParts.push(`  • ${m.name}`));
+				}
+				if (criticalMeds.length > 0) {
+					if (messageParts.length > 0) messageParts.push("");
+					messageParts.push(`🚨 ${tr.push.criticalSection}:`);
+					criticalMeds.forEach((m) =>
+						messageParts.push(
+							`  • ${m.name}: ${t(tr.push.pillsLeft, { count: m.medsLeft })}, ${t(tr.push.daysLeft, { count: m.daysLeft ?? 0 })}`
+						)
+					);
+				}
+				if (lowStockMeds.length > 0) {
+					if (messageParts.length > 0) messageParts.push("");
+					messageParts.push(`⚠️ ${tr.push.lowStockSection}:`);
+					lowStockMeds.forEach((m) =>
+						messageParts.push(
+							`  • ${m.name}: ${t(tr.push.pillsLeft, { count: m.medsLeft })}, ${t(tr.push.daysLeft, { count: m.daysLeft ?? 0 })}`
+						)
+					);
+				}
+				const message = `${messageParts.join("\n")}\n\n---\n${getFooterPlain(language)}`;
+				const result = await sendShoutrrrNotification(settings.shoutrrrUrl!, title, message);
+				shoutrrrSuccess = result.success;
+				if (!result.success) {
+					logger.error(`[Reminder] User ${settings.userId}: Failed to send stock push: ${result.error}`);
+				}
+			}
+
+			if (emailSuccess || shoutrrrSuccess) {
+				const currentState = loadReminderState();
+				const singleChannel = emailSuccess ? "email" : "push";
+				const channel = emailSuccess && shoutrrrSuccess ? "both" : singleChannel;
+				saveReminderState({
+					lastAutoEmailSent: new Date().toISOString(),
+					lastAutoEmailDate: today,
+					notifiedMedications: [...new Set([...currentState.notifiedMedications, userStockNotifiedKey])],
+					nextScheduledCheck: currentState.nextScheduledCheck,
+					lastNotificationType: "stock",
+					lastNotificationChannel: channel,
+				});
+
+				const medNames = allLowStock.map((m) => m.name).join(", ");
+				await updateUserReminderSentTime(settings.userId, "stock", channel, medNames);
+			}
 		}
 	}
 
-	// Update state if any notification was sent successfully
-	if (emailSuccess || shoutrrrSuccess) {
-		const currentState = loadReminderState();
-		const channel = emailSuccess && shoutrrrSuccess ? "both" : emailSuccess ? "email" : "push";
-		saveReminderState({
-			lastAutoEmailSent: new Date().toISOString(),
-			lastAutoEmailDate: today,
-			notifiedMedications: [...new Set([...currentState.notifiedMedications, userNotifiedKey])],
-			nextScheduledCheck: currentState.nextScheduledCheck,
-			lastNotificationType: "stock",
-			lastNotificationChannel: channel,
-		});
+	if (allPrescriptionLow.length > 0 && (prescriptionEmailEnabled || prescriptionPushEnabled)) {
+		if (!state.notifiedMedications.includes(userPrescriptionNotifiedKey) || settings.repeatDailyReminders) {
+			logger.info(
+				`[Reminder] User ${settings.userId}: Sending prescription reminder for ${allPrescriptionLow.length} medications...`
+			);
 
-		// Also update user settings in database so frontend can display the info
-		// For stock reminders, show the first medication name
-		const firstMed = allLowStock[0];
-		const medNames = allLowStock.length > 1 ? `${firstMed.name} (+${allLowStock.length - 1})` : firstMed?.name;
-		await updateUserReminderSentTime(settings.userId, "stock", channel, medNames);
+			const emptyRx = allPrescriptionLow.filter((m) => m.remainingRefills <= 0);
+			const lowRx = allPrescriptionLow.filter((m) => m.remainingRefills > 0);
+			const lines = allPrescriptionLow.map((m) => {
+				const expirySuffix = m.expiryDate ? t(tr.prescriptionReminder.expiresSuffix, { date: m.expiryDate }) : "";
+				if (m.remainingRefills <= 0) {
+					return `- ${t(tr.prescriptionReminder.lineEmpty, {
+						name: m.name,
+						expirySuffix,
+					})}`;
+				}
+				return `- ${t(tr.prescriptionReminder.line, {
+					name: m.name,
+					refills: m.remainingRefills,
+					expirySuffix,
+				})}`;
+			});
+
+			let emailSuccess = false;
+			let shoutrrrSuccess = false;
+
+			if (prescriptionEmailEnabled) {
+				const smtpHost = process.env.SMTP_HOST;
+				const smtpUser = process.env.SMTP_USER;
+				const smtpPass = process.env.SMTP_TOKEN || process.env.SMTP_PASS;
+				const smtpPort = parseInt(process.env.SMTP_PORT ?? "587", 10);
+				const smtpSecure = process.env.SMTP_SECURE === "true";
+				const smtpFrom = process.env.SMTP_FROM ?? smtpUser;
+
+				if (smtpHost && smtpUser) {
+					try {
+						const transporter = nodemailer.createTransport({
+							host: smtpHost,
+							port: smtpPort,
+							secure: smtpSecure,
+							auth: { user: smtpUser, pass: smtpPass ?? "" },
+						});
+
+						const subject =
+							allPrescriptionLow.length === 1
+								? tr.prescriptionReminder.subjectSingle
+								: t(tr.prescriptionReminder.subjectMultiple, { count: allPrescriptionLow.length });
+
+						const bodyText =
+							emptyRx.length > 0 ? tr.prescriptionReminder.descriptionEmpty : tr.prescriptionReminder.descriptionLow;
+						const emptyAlert =
+							emptyRx.length === 1
+								? tr.prescriptionReminder.alertEmptySingle
+								: t(tr.prescriptionReminder.alertEmptyMultiple, { count: emptyRx.length });
+						const lowAlert =
+							lowRx.length === 1
+								? tr.prescriptionReminder.alertLowSingle
+								: t(tr.prescriptionReminder.alertLowMultiple, { count: lowRx.length });
+						const alertText = emptyRx.length > 0 ? emptyAlert : lowAlert;
+
+						const tableRows = allPrescriptionLow
+							.map((item) => {
+								const isEmpty = item.remainingRefills <= 0;
+								const safeName = escapeHtml(item.name);
+								const safeRefills = Number(item.remainingRefills) || 0;
+								const safeThreshold = Number(item.lowThreshold) || 0;
+								const safeExpiry = item.expiryDate ? escapeHtml(String(item.expiryDate)) : "-";
+								const rowBg = isEmpty ? "#fef2f2" : "white";
+								return `
+      <tr style="background: ${rowBg};">
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; white-space: nowrap;">${isEmpty ? "🚨" : "⚠️"} ${safeName}</td>
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap; ${isEmpty ? "color: #dc2626; font-weight: 600;" : ""}"><strong>${safeRefills}</strong></td>
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;">${safeThreshold}</td>
+        <td style="padding: 10px 12px; border-bottom: 1px solid #e5e7eb; text-align: center; white-space: nowrap;">${safeExpiry}</td>
+      </tr>`;
+							})
+							.join("");
+
+						const html = `
+    <div style="font-family: system-ui, -apple-system, sans-serif; max-width: 100%; margin: 0 auto; padding: 12px; background: #f9fafb;">
+      <div style="background: white; border-radius: 12px; padding: 16px; box-shadow: 0 1px 3px rgba(0,0,0,0.1);">
+        <h2 style="color: #1f2937; margin: 0 0 8px; font-size: 18px;">${emptyRx.length > 0 ? tr.prescriptionReminder.titleEmpty : tr.prescriptionReminder.title}</h2>
+        <p style="color: #6b7280; margin: 0 0 16px; font-size: 13px;">${bodyText}</p>
+
+        <div style="padding: 10px 14px; border-radius: 8px; margin-bottom: 16px; ${
+					emptyRx.length > 0
+						? "background: #fef2f2; border: 1px solid #dc2626;"
+						: "background: #fffbeb; border: 1px solid #f59e0b;"
+				}">
+          <p style="margin: 0; ${emptyRx.length > 0 ? "color: #dc2626; font-weight: 600;" : "color: #b45309; font-weight: 500;"} font-size: 13px;">
+            ${alertText}
+          </p>
+        </div>
+
+        <div style="overflow-x: auto; -webkit-overflow-scrolling: touch;">
+          <table style="width: 100%; border-collapse: collapse; background: white; min-width: 460px;">
+            <thead>
+              <tr style="background: #f3f4f6;">
+                <th style="padding: 10px 12px; text-align: left; font-size: 11px; text-transform: uppercase; color: #6b7280; white-space: nowrap;">${tr.prescriptionReminder.tableHeaders.medication}</th>
+                <th style="padding: 10px 12px; text-align: center; font-size: 11px; text-transform: uppercase; color: #6b7280; white-space: nowrap;">${tr.prescriptionReminder.tableHeaders.refillsLeft}</th>
+                <th style="padding: 10px 12px; text-align: center; font-size: 11px; text-transform: uppercase; color: #6b7280; white-space: nowrap;">${tr.prescriptionReminder.tableHeaders.reminderThreshold}</th>
+                <th style="padding: 10px 12px; text-align: center; font-size: 11px; text-transform: uppercase; color: #6b7280; white-space: nowrap;">${tr.prescriptionReminder.tableHeaders.prescriptionExpires}</th>
+              </tr>
+            </thead>
+            <tbody>
+              ${tableRows}
+            </tbody>
+          </table>
+        </div>
+
+        <hr style="border: none; border-top: 1px solid #e5e7eb; margin: 16px 0;" />
+        <p style="color: #9ca3af; font-size: 11px; margin: 0;">
+          ${getFooterHtml(language)}
+        </p>
+        ${settings.repeatDailyReminders ? `<p style="color: #9ca3af; font-size: 11px; margin: 8px 0 0 0; font-style: italic;">${tr.prescriptionReminder.repeatDailyNote}</p>` : ""}
+      </div>
+    </div>
+  `;
+						const text = `${emptyRx.length > 0 ? tr.prescriptionReminder.titleEmpty : tr.prescriptionReminder.title}\n\n${bodyText}\n\n${lines.join("\n")}\n\n---\n${getFooterPlain(language)}${settings.repeatDailyReminders ? `\n\n${tr.prescriptionReminder.repeatDailyNote}` : ""}`;
+
+						await transporter.sendMail({
+							from: smtpFrom,
+							to: settings.notificationEmail!,
+							subject,
+							text,
+							html,
+						});
+						emailSuccess = true;
+					} catch (error) {
+						const errorMessage = error instanceof Error ? error.message : "Unknown error";
+						logger.error(`[Reminder] User ${settings.userId}: Failed to send prescription email: ${errorMessage}`);
+					}
+				}
+			}
+
+			if (prescriptionPushEnabled) {
+				const titleParts: string[] = [];
+				if (emptyRx.length > 0)
+					titleParts.push(
+						`🚨 ${emptyRx.length} ${emptyRx.length === 1 ? tr.prescriptionReminder.pushEmptySingle : tr.prescriptionReminder.pushEmpty}`
+					);
+				if (lowRx.length > 0)
+					titleParts.push(
+						`🚨 ${lowRx.length} ${lowRx.length === 1 ? tr.prescriptionReminder.pushLowSingle : tr.prescriptionReminder.pushLow}`
+					);
+				const title = `MedAssist-ng: ${titleParts.join(", ")} - ${tr.prescriptionReminder.pushRenewNow}`;
+
+				const messageParts: string[] = [];
+				if (emptyRx.length > 0) {
+					messageParts.push(`🚨 ${tr.prescriptionReminder.pushEmptySection}:`);
+					for (const m of emptyRx) {
+						messageParts.push(`  • ${m.name}`);
+					}
+				}
+				if (lowRx.length > 0) {
+					if (emptyRx.length > 0) messageParts.push("");
+					messageParts.push(`🚨 ${tr.prescriptionReminder.pushLowSection}:`);
+					for (const m of lowRx) {
+						messageParts.push(
+							`  • ${m.name}: ${t(tr.prescriptionReminder.pushRefillsLeft, { count: m.remainingRefills })}`
+						);
+					}
+				}
+				const message = `${messageParts.join("\n")}\n\n---\n${getFooterPlain(language)}`;
+				const result = await sendShoutrrrNotification(settings.shoutrrrUrl!, title, message);
+				shoutrrrSuccess = result.success;
+				if (!result.success) {
+					logger.error(`[Reminder] User ${settings.userId}: Failed to send prescription push: ${result.error}`);
+				}
+			}
+
+			if (emailSuccess || shoutrrrSuccess) {
+				const currentState = loadReminderState();
+				const singleChannel = emailSuccess ? "email" : "push";
+				const channel = emailSuccess && shoutrrrSuccess ? "both" : singleChannel;
+				saveReminderState({
+					lastAutoEmailSent: new Date().toISOString(),
+					lastAutoEmailDate: today,
+					notifiedMedications: [...new Set([...currentState.notifiedMedications, userPrescriptionNotifiedKey])],
+					nextScheduledCheck: currentState.nextScheduledCheck,
+					lastNotificationType: "prescription",
+					lastNotificationChannel: channel,
+				});
+
+				const medNames = allPrescriptionLow.map((m) => m.name).join(", ");
+				await updateUserReminderSentTime(settings.userId, "prescription", channel, medNames);
+			}
+		}
 	}
 }
 
 let schedulerTimeout: NodeJS.Timeout | null = null;
 
-function scheduleNextCheck(logger: { info: (msg: string) => void; error: (msg: string) => void }): void {
+function scheduleNextCheck(logger: ServiceLogger): void {
 	const msUntilNext = getMsUntilNextCheck(REMINDER_HOUR);
 	const nextTime = getNextScheduledTime(REMINDER_HOUR);
 
@@ -386,7 +842,7 @@ function scheduleNextCheck(logger: { info: (msg: string) => void; error: (msg: s
 		nextScheduledCheck: nextTime.toISOString(),
 	});
 
-	logger.info(
+	logger.debug(
 		`[Reminder] Next check scheduled for ${formatInTimezone(nextTime)} (${getTimezone()}) (in ${Math.round(msUntilNext / 1000 / 60)} minutes)`
 	);
 
@@ -397,7 +853,7 @@ function scheduleNextCheck(logger: { info: (msg: string) => void; error: (msg: s
 	}, msUntilNext);
 }
 
-export function startReminderScheduler(logger: { info: (msg: string) => void; error: (msg: string) => void }): void {
+export function startReminderScheduler(logger: ServiceLogger): void {
 	logger.info(`[Reminder] Starting reminder scheduler (timezone: ${getTimezone()})...`);
 
 	// Check if we need to run immediately (missed today's check)

backend/src/test/auth.test.ts

@@ -194,6 +194,29 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 			expect(response.json().code).toBe("USERNAME_EXISTS");
 		});
 
+		it("should reject duplicate username regardless of case", async () => {
+			await app.inject({
+				method: "POST",
+				url: "/auth/register",
+				payload: {
+					username: "CaseUser",
+					password: "TestPassword123",
+				},
+			});
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/auth/register",
+				payload: {
+					username: "caseuser",
+					password: "AnotherPassword123",
+				},
+			});
+
+			expect(response.statusCode).toBe(409);
+			expect(response.json().code).toBe("USERNAME_EXISTS");
+		});
+
 		it("should reject short password", async () => {
 			const response = await app.inject({
 				method: "POST",
@@ -271,8 +294,23 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 
 			// Should set cookies
 			const cookies = response.cookies;
-			expect(cookies.find((c: any) => c.name === "access_token")).toBeDefined();
-			expect(cookies.find((c: any) => c.name === "refresh_token")).toBeDefined();
+			expect(cookies.find((c: { name: string }) => c.name === "access_token")).toBeDefined();
+			expect(cookies.find((c: { name: string }) => c.name === "refresh_token")).toBeDefined();
+		});
+
+		it("should login case-insensitively with different username casing", async () => {
+			const response = await app.inject({
+				method: "POST",
+				url: "/auth/login",
+				payload: {
+					username: "LOGINUSER",
+					password: "TestPassword123",
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json().ok).toBe(true);
+			expect(response.json().user.username).toBe("loginuser");
 		});
 
 		it("should reject invalid password", async () => {
@@ -355,7 +393,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const refreshToken = login.cookies.find((c: any) => c.name === "refresh_token");
+			const refreshToken = login.cookies.find((c: { name: string }) => c.name === "refresh_token");
 
 			const response = await app.inject({
 				method: "POST",
@@ -418,7 +456,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const refreshToken = login.cookies.find((c: any) => c.name === "refresh_token");
+			const refreshToken = login.cookies.find((c: { name: string }) => c.name === "refresh_token");
 
 			const response = await app.inject({
 				method: "POST",
@@ -468,7 +506,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const accessToken = login.cookies.find((c: any) => c.name === "access_token");
+			const accessToken = login.cookies.find((c: { name: string }) => c.name === "access_token");
 
 			const response = await app.inject({
 				method: "GET",
@@ -566,7 +604,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const accessToken = login.cookies.find((c: any) => c.name === "access_token");
+			const accessToken = login.cookies.find((c: { name: string }) => c.name === "access_token");
 
 			const response = await app.inject({
 				method: "PUT",
@@ -615,7 +653,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const accessToken = login.cookies.find((c: any) => c.name === "access_token");
+			const accessToken = login.cookies.find((c: { name: string }) => c.name === "access_token");
 
 			const response = await app.inject({
 				method: "PUT",
@@ -651,7 +689,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const accessToken = login.cookies.find((c: any) => c.name === "access_token");
+			const accessToken = login.cookies.find((c: { name: string }) => c.name === "access_token");
 
 			const response = await app.inject({
 				method: "PUT",
@@ -704,7 +742,7 @@ describe("Auth Routes (AUTH_ENABLED=true)", () => {
 				},
 			});
 
-			const accessToken = login.cookies.find((c: any) => c.name === "access_token");
+			const accessToken = login.cookies.find((c: { name: string }) => c.name === "access_token");
 
 			// Delete account
 			const response = await app.inject({

backend/src/test/database.test.ts

@@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url";
 import { createClient } from "@libsql/client";
 import { drizzle } from "drizzle-orm/libsql";
 import { migrate } from "drizzle-orm/libsql/migrator";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 // Import utility functions from db-utils (no side effects, unlike client.ts which initializes the DB)
 import {

backend/src/test/db-client.test.ts

@@ -0,0 +1,125 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+type ClientTestOptions = {
+	dirWritable?: boolean;
+	authEnabled?: boolean;
+};
+
+async function loadDbClientModule(options: ClientTestOptions = {}) {
+	const { dirWritable = true, authEnabled = false } = options;
+
+	vi.resetModules();
+	vi.restoreAllMocks();
+
+	process.env.AUTH_ENABLED = authEnabled ? "true" : "false";
+	process.env.DOTENV_PATH = "/tmp/medassist-nonexistent.env";
+
+	const existsSync = vi.fn().mockReturnValue(false);
+	const statSync = vi.fn().mockReturnValue({ mode: 0o40755, uid: 1000, gid: 1000 });
+	vi.doMock("node:fs", () => ({ existsSync, statSync }));
+
+	const dotenvConfig = vi.fn();
+	vi.doMock("dotenv", () => ({ default: { config: dotenvConfig } }));
+
+	const createClient = vi.fn().mockReturnValue({ execute: vi.fn() });
+	vi.doMock("@libsql/client", () => ({ createClient }));
+
+	const drizzle = vi.fn().mockReturnValue({ __db: true });
+	vi.doMock("drizzle-orm/libsql", () => ({ drizzle }));
+
+	const ensureDataDirectory = vi
+		.fn()
+		.mockReturnValue(dirWritable ? { success: true } : { success: false, error: "permission denied" });
+	const getDbPaths = vi.fn().mockReturnValue({
+		dataDir: "/tmp/medassist-data",
+		dbPath: "/tmp/medassist-data/medassist.db",
+		url: "file:/tmp/medassist-data/medassist.db",
+	});
+	const runDrizzleMigrations = vi.fn().mockResolvedValue({ success: true });
+	const runAlterMigrations = vi.fn().mockResolvedValue({ errors: [] });
+	const repairTrailingHyphenDoseIds = vi.fn().mockResolvedValue({ repaired: 0, errors: [] });
+	const repairOrphanedDoseIds = vi.fn().mockResolvedValue({ repaired: 0, errors: [] });
+	const ensureDefaultUser = vi.fn().mockResolvedValue(false);
+
+	vi.doMock("../db/db-utils.js", () => ({
+		buildDbUrl: vi.fn(),
+		getDataDir: vi.fn(),
+		ensureDataDirectory,
+		getDbPaths,
+		runDrizzleMigrations,
+		runAlterMigrations,
+		repairTrailingHyphenDoseIds,
+		repairOrphanedDoseIds,
+		ensureDefaultUser,
+	}));
+
+	const log = {
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+	};
+	vi.doMock("../utils/logger.js", () => ({ log }));
+
+	const exitSpy = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+		throw new Error(`process.exit:${code ?? 0}`);
+	}) as never);
+
+	const modulePromise = import("../db/client.js");
+
+	return {
+		modulePromise,
+		mocks: {
+			existsSync,
+			statSync,
+			dotenvConfig,
+			createClient,
+			drizzle,
+			ensureDataDirectory,
+			getDbPaths,
+			runDrizzleMigrations,
+			runAlterMigrations,
+			repairTrailingHyphenDoseIds,
+			repairOrphanedDoseIds,
+			ensureDefaultUser,
+			log,
+			exitSpy,
+		},
+	};
+}
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+describe("db/client bootstrap", () => {
+	it("initializes db and runs migrations when directory is writable", async () => {
+		const { modulePromise, mocks } = await loadDbClientModule({ dirWritable: true, authEnabled: false });
+		const mod = await modulePromise;
+
+		expect(mod.db).toBeTruthy();
+		expect(mod.migrationsReady).toBeInstanceOf(Promise);
+		await mod.migrationsReady;
+
+		expect(mocks.ensureDataDirectory).toHaveBeenCalledWith("/tmp/medassist-data");
+		expect(mocks.createClient).toHaveBeenCalledWith({ url: "file:/tmp/medassist-data/medassist.db" });
+		expect(mocks.runDrizzleMigrations).toHaveBeenCalledTimes(1);
+		expect(mocks.runAlterMigrations).toHaveBeenCalledTimes(1);
+		expect(mocks.repairTrailingHyphenDoseIds).toHaveBeenCalledTimes(1);
+		expect(mocks.repairOrphanedDoseIds).toHaveBeenCalledTimes(1);
+		expect(mocks.ensureDefaultUser).toHaveBeenCalledWith(expect.anything(), false);
+	});
+
+	it("passes auth-enabled flag to ensureDefaultUser", async () => {
+		const { modulePromise, mocks } = await loadDbClientModule({ dirWritable: true, authEnabled: true });
+		const mod = await modulePromise;
+		await mod.migrationsReady;
+
+		expect(mocks.ensureDefaultUser).toHaveBeenCalledWith(expect.anything(), true);
+	});
+
+	it("exits when data directory is not writable", async () => {
+		const { modulePromise } = await loadDbClientModule({ dirWritable: false });
+		await expect(modulePromise).rejects.toThrow("process.exit:1");
+	});
+});

backend/src/test/doses.test.ts

@@ -271,7 +271,7 @@ describe("Dose Tracking API", () => {
 			expect(response.statusCode).toBe(200);
 			const data = response.json();
 			expect(data.doses).toHaveLength(2);
-			expect(data.doses.map((d: any) => d.doseId).sort()).toEqual([doseId1, doseId2].sort());
+			expect(data.doses.map((d: { doseId: string }) => d.doseId).sort()).toEqual([doseId1, doseId2].sort());
 			// Each dose should have a takenAt timestamp
 			for (const dose of data.doses) {
 				expect(dose.takenAt).toBeTypeOf("number");

backend/src/test/e2e-routes.test.ts

@@ -55,6 +55,7 @@ const { medicationRoutes } = await import("../routes/medications.js");
 const { settingsRoutes } = await import("../routes/settings.js");
 const { healthRoutes } = await import("../routes/health.js");
 const { refillRoutes } = await import("../routes/refills.js");
+const { reportRoutes } = await import("../routes/report.js");
 const { exportRoutes } = await import("../routes/export.js");
 
 // =============================================================================
@@ -99,6 +100,14 @@ async function createSchema(client: Client) {
 		    expiry_date text,
 		    notes text,
 		    intake_reminders_enabled integer NOT NULL DEFAULT 0,
+		    medication_start_date text NOT NULL DEFAULT '',
+		    is_obsolete integer NOT NULL DEFAULT 0,
+		    obsolete_at integer,
+		    prescription_enabled integer NOT NULL DEFAULT 0,
+		    prescription_authorized_refills integer,
+		    prescription_remaining_refills integer,
+		    prescription_low_refill_threshold integer NOT NULL DEFAULT 1,
+		    prescription_expiry_date text,
 		    dismissed_until text,
 		    updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
 		    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
@@ -110,10 +119,12 @@ async function createSchema(client: Client) {
       notification_email text,
       email_stock_reminders integer NOT NULL DEFAULT 1,
       email_intake_reminders integer NOT NULL DEFAULT 1,
+	email_prescription_reminders integer NOT NULL DEFAULT 1,
       shoutrrr_enabled integer NOT NULL DEFAULT 0,
       shoutrrr_url text,
       shoutrrr_stock_reminders integer NOT NULL DEFAULT 1,
       shoutrrr_intake_reminders integer NOT NULL DEFAULT 1,
+	shoutrrr_prescription_reminders integer NOT NULL DEFAULT 1,
       reminder_days_before integer NOT NULL DEFAULT 7,
       repeat_daily_reminders integer NOT NULL DEFAULT 0,
       skip_reminders_for_taken_doses integer NOT NULL DEFAULT 0,
@@ -126,11 +137,21 @@ async function createSchema(client: Client) {
       expiry_warning_days integer NOT NULL DEFAULT 90,
       language text NOT NULL DEFAULT 'en',
       stock_calculation_mode text NOT NULL DEFAULT 'automatic',
+      share_stock_status integer NOT NULL DEFAULT 1,
+	upcoming_today_only integer NOT NULL DEFAULT 0,
+	share_schedule_today_only integer NOT NULL DEFAULT 0,
+	swap_dashboard_main_sections integer NOT NULL DEFAULT 0,
       last_auto_email_sent text,
       last_notification_type text,
       last_notification_channel text,
       last_reminder_med_name text,
       last_reminder_taken_by text,
+      last_stock_reminder_sent text,
+      last_stock_reminder_channel text,
+      last_stock_reminder_med_names text,
+			last_prescription_reminder_sent text,
+			last_prescription_reminder_channel text,
+			last_prescription_reminder_med_names text,
       updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,
@@ -150,6 +171,7 @@ async function createSchema(client: Client) {
       dose_id text NOT NULL,
       taken_at integer NOT NULL DEFAULT (strftime('%s','now')),
       marked_by text,
+		taken_source text NOT NULL DEFAULT 'manual',
       dismissed integer NOT NULL DEFAULT 0,
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,
@@ -159,6 +181,7 @@ async function createSchema(client: Client) {
       user_id integer NOT NULL,
       packs_added integer NOT NULL DEFAULT 0,
       loose_pills_added integer NOT NULL DEFAULT 0,
+		used_prescription integer NOT NULL DEFAULT 0,
       refill_date integer NOT NULL DEFAULT (strftime('%s','now')),
       FOREIGN KEY (medication_id) REFERENCES medications(id) ON DELETE CASCADE,
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
@@ -243,11 +266,80 @@ describe("E2E Tests with Real Routes", () => {
 		await app.register(settingsRoutes);
 		await app.register(healthRoutes);
 		await app.register(refillRoutes);
+		await app.register(reportRoutes);
 		await app.register(exportRoutes);
 
 		await app.ready();
 	});
 
+	// ---------------------------------------------------------------------------
+	// Report Routes
+	// ---------------------------------------------------------------------------
+
+	describe("Real /medications/report-data route", () => {
+		it("should return 400 for invalid payload", async () => {
+			const response = await app.inject({
+				method: "POST",
+				url: "/medications/report-data",
+				payload: { medicationIds: [] },
+			});
+
+			expect(response.statusCode).toBe(400);
+		});
+
+		it("should return 403 when requested medication is not owned by user", async () => {
+			const response = await app.inject({
+				method: "POST",
+				url: "/medications/report-data",
+				payload: { medicationIds: [999999] },
+			});
+
+			expect(response.statusCode).toBe(403);
+			expect(response.json().error).toBe("Access denied to medication");
+		});
+
+		it("should aggregate taken/dismissed doses and refill history", async () => {
+			const medId = await createMedication(testClient, userId, "Report Med", ["Daniel"]);
+
+			// One taken dose and one dismissed dose for the same medication
+			await testClient.execute({
+				sql: `INSERT INTO dose_tracking (user_id, dose_id, taken_at, dismissed)
+				      VALUES (?, ?, ?, 0)`,
+				args: [userId, `${medId}-0-1735344000000`, 1735344000],
+			});
+			await testClient.execute({
+				sql: `INSERT INTO dose_tracking (user_id, dose_id, taken_at, dismissed)
+				      VALUES (?, ?, ?, 1)`,
+				args: [userId, `${medId}-0-1735430400000-Daniel`, 1735430400],
+			});
+
+			await testClient.execute({
+				sql: `INSERT INTO refill_history (medication_id, user_id, packs_added, loose_pills_added, used_prescription, refill_date)
+				      VALUES (?, ?, ?, ?, ?, ?)`,
+				args: [medId, userId, 2, 5, 1, 1735516800],
+			});
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/medications/report-data",
+				payload: { medicationIds: [medId] },
+			});
+
+			expect(response.statusCode).toBe(200);
+			const data = response.json();
+			expect(data[medId].dosesTaken).toBe(1);
+			expect(data[medId].dosesDismissed).toBe(1);
+			expect(data[medId].firstDoseAt).toBe(new Date(1735344000 * 1000).toISOString());
+			expect(data[medId].lastDoseAt).toBe(new Date(1735344000 * 1000).toISOString());
+			expect(data[medId].refills).toHaveLength(1);
+			expect(data[medId].refills[0]).toMatchObject({
+				packsAdded: 2,
+				loosePillsAdded: 5,
+				usedPrescription: true,
+			});
+		});
+	});
+
 	afterAll(async () => {
 		await app.close();
 		testClient.close();
@@ -726,6 +818,39 @@ describe("E2E Tests with Real Routes", () => {
 			const data = getResponse.json();
 			expect(data.repeatDailyReminders).toBe(false);
 		});
+
+		it("should reject invalid language in lightweight language endpoint", async () => {
+			const response = await app.inject({
+				method: "PUT",
+				url: "/settings/language",
+				payload: { language: "fr" },
+			});
+
+			expect(response.statusCode).toBe(400);
+			expect(response.json().error).toBe("Invalid language");
+		});
+
+		it("should create and update language via lightweight language endpoint", async () => {
+			let response = await app.inject({
+				method: "PUT",
+				url: "/settings/language",
+				payload: { language: "de" },
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json()).toEqual({ success: true });
+
+			response = await app.inject({
+				method: "PUT",
+				url: "/settings/language",
+				payload: { language: "en" },
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			const getResponse = await app.inject({ method: "GET", url: "/settings" });
+			expect(getResponse.json().language).toBe("en");
+		});
 	});
 
 	// ---------------------------------------------------------------------------
@@ -1617,6 +1742,83 @@ describe("E2E Tests with Real Routes", () => {
 			expect(data.newStock.looseTablets).toBe(15); // 5 + 10
 		});
 
+		it("should decrement remaining refills and mark history when using prescription refill", async () => {
+			const createResponse = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: {
+					name: "Prescription Refill Med",
+					packCount: 1,
+					blistersPerPack: 2,
+					pillsPerBlister: 10,
+					looseTablets: 0,
+					prescriptionEnabled: true,
+					prescriptionAuthorizedRefills: 3,
+					prescriptionRemainingRefills: 2,
+					prescriptionLowRefillThreshold: 1,
+					blisters: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+				},
+			});
+			expect(createResponse.statusCode).toBe(200);
+			const medId = createResponse.json().id;
+
+			const refillResponse = await app.inject({
+				method: "POST",
+				url: `/medications/${medId}/refill`,
+				payload: { packsAdded: 1, loosePillsAdded: 0, usePrescription: true },
+			});
+
+			expect(refillResponse.statusCode).toBe(200);
+			const refillData = refillResponse.json();
+			expect(refillData.prescription.used).toBe(true);
+			expect(refillData.prescription.remainingRefills).toBe(1);
+
+			const medsResponse = await app.inject({
+				method: "GET",
+				url: "/medications",
+			});
+			expect(medsResponse.statusCode).toBe(200);
+			const med = medsResponse.json().find((m: Record<string, unknown>) => m.id === medId);
+			expect(med.prescriptionRemainingRefills).toBe(1);
+
+			const historyResponse = await app.inject({
+				method: "GET",
+				url: `/medications/${medId}/refills`,
+			});
+			expect(historyResponse.statusCode).toBe(200);
+			expect(historyResponse.json()[0].usedPrescription).toBe(true);
+		});
+
+		it("should reject prescription refill when no remaining prescription refills are available", async () => {
+			const createResponse = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: {
+					name: "Prescription Empty Med",
+					packCount: 1,
+					blistersPerPack: 2,
+					pillsPerBlister: 10,
+					looseTablets: 0,
+					prescriptionEnabled: true,
+					prescriptionAuthorizedRefills: 2,
+					prescriptionRemainingRefills: 0,
+					prescriptionLowRefillThreshold: 1,
+					blisters: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+				},
+			});
+			expect(createResponse.statusCode).toBe(200);
+			const medId = createResponse.json().id;
+
+			const refillResponse = await app.inject({
+				method: "POST",
+				url: `/medications/${medId}/refill`,
+				payload: { packsAdded: 1, loosePillsAdded: 0, usePrescription: true },
+			});
+
+			expect(refillResponse.statusCode).toBe(409);
+			expect(refillResponse.json().error).toContain("No remaining prescription refills");
+		});
+
 		it("should return 400 when no packs or pills added", async () => {
 			const createResponse = await app.inject({
 				method: "POST",
@@ -1714,8 +1916,10 @@ describe("E2E Tests with Real Routes", () => {
 			const refills = response.json();
 			expect(refills).toHaveLength(2);
 			// Check both refills exist (order may vary)
-			const hasPackRefill = refills.some((r: any) => r.packsAdded === 1 && r.loosePillsAdded === 0);
-			const hasLooseRefill = refills.some((r: any) => r.packsAdded === 0 && r.loosePillsAdded === 5);
+			const hasPackRefill = refills.some((r: Record<string, unknown>) => r.packsAdded === 1 && r.loosePillsAdded === 0);
+			const hasLooseRefill = refills.some(
+				(r: Record<string, unknown>) => r.packsAdded === 0 && r.loosePillsAdded === 5
+			);
 			expect(hasPackRefill).toBe(true);
 			expect(hasLooseRefill).toBe(true);
 		});
@@ -1793,7 +1997,7 @@ describe("E2E Tests with Real Routes", () => {
 
 			expect(getResponse.statusCode).toBe(200);
 			const meds = getResponse.json();
-			const med = meds.find((m: any) => m.id === medId);
+			const med = meds.find((m: Record<string, unknown>) => m.id === medId);
 			expect(med).toBeDefined();
 			expect(med.stockAdjustment).toBe(-7);
 			expect(med.lastStockCorrectionAt).toBeTruthy();
@@ -1839,7 +2043,7 @@ describe("E2E Tests with Real Routes", () => {
 				method: "GET",
 				url: "/medications",
 			});
-			const med = getResponse.json().find((m: any) => m.id === medId);
+			const med = getResponse.json().find((m: Record<string, unknown>) => m.id === medId);
 			expect(med.name).toBe("Renamed Med");
 			expect(med.stockAdjustment).toBe(-5);
 		});
@@ -1908,7 +2112,7 @@ describe("E2E Tests with Real Routes", () => {
 
 			// Verify adjustment is set
 			let getMeds = await app.inject({ method: "GET", url: "/medications" });
-			let med = getMeds.json().find((m: any) => m.id === medId);
+			let med = getMeds.json().find((m: Record<string, unknown>) => m.id === medId);
 			expect(med.stockAdjustment).toBe(-10);
 
 			// Edit medication with CHANGED stock fields (packCount 1 → 2)
@@ -1927,7 +2131,7 @@ describe("E2E Tests with Real Routes", () => {
 
 			// stockAdjustment should be reset to 0
 			getMeds = await app.inject({ method: "GET", url: "/medications" });
-			med = getMeds.json().find((m: any) => m.id === medId);
+			med = getMeds.json().find((m: Record<string, unknown>) => m.id === medId);
 			expect(med.stockAdjustment).toBe(0);
 			expect(med.lastStockCorrectionAt).toBeTruthy();
 		});
@@ -1971,7 +2175,7 @@ describe("E2E Tests with Real Routes", () => {
 
 			// stockAdjustment should be preserved
 			const getMeds = await app.inject({ method: "GET", url: "/medications" });
-			const med = getMeds.json().find((m: any) => m.id === medId);
+			const med = getMeds.json().find((m: Record<string, unknown>) => m.id === medId);
 			expect(med.name).toBe("Renamed Preserve Med");
 			expect(med.stockAdjustment).toBe(-5);
 		});
@@ -2019,7 +2223,7 @@ describe("E2E Tests with Real Routes", () => {
 
 			expect(response.statusCode).toBe(200);
 			const data = response.json();
-			const med = data.find((m: any) => m.medicationId === medId);
+			const med = data.find((m: Record<string, unknown>) => m.medicationId === medId);
 			expect(med).toBeDefined();
 			// Total should be very close to 113 (not 112 or lower from phantom consumption)
 			// Allow up to 1 pill of natural consumption (test runs fast, but at most 1 day could pass)
@@ -2106,6 +2310,87 @@ describe("E2E Tests with Real Routes", () => {
 			expect(data.settings).toBeDefined();
 			expect(data.settings.emailEnabled).toBe(true);
 		});
+
+		it("should include sensitive settings when requested", async () => {
+			await app.inject({
+				method: "PUT",
+				url: "/settings",
+				payload: {
+					emailEnabled: false,
+					notificationEmail: "",
+					reminderDaysBefore: 7,
+					repeatDailyReminders: false,
+					lowStockDays: 30,
+					normalStockDays: 90,
+					highStockDays: 180,
+					shoutrrrEnabled: true,
+					shoutrrrUrl: "https://example.com/topic",
+					emailStockReminders: false,
+					emailIntakeReminders: false,
+					emailPrescriptionReminders: false,
+					shoutrrrStockReminders: true,
+					shoutrrrIntakeReminders: true,
+					shoutrrrPrescriptionReminders: true,
+					skipRemindersForTakenDoses: false,
+					repeatRemindersEnabled: false,
+					reminderRepeatIntervalMinutes: 30,
+					maxNaggingReminders: 5,
+					language: "en",
+					stockCalculationMode: "automatic",
+					shareStockStatus: true,
+					upcomingTodayOnly: false,
+					shareScheduleTodayOnly: false,
+					swapDashboardMainSections: false,
+				},
+			});
+
+			const response = await app.inject({
+				method: "GET",
+				url: "/export?includeSensitive=true",
+			});
+
+			expect(response.statusCode).toBe(200);
+			const data = response.json();
+			expect(data.settings.shoutrrrEnabled).toBe(true);
+			expect(data.settings.shoutrrrUrl).toBe("https://example.com/topic");
+		});
+
+		it("should gracefully export malformed date-like DB values", async () => {
+			const createResponse = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: {
+					name: "Date Edge Med",
+					blisters: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+				},
+			});
+			const medId = createResponse.json().id as number;
+
+			await testClient.execute({
+				sql: `INSERT INTO dose_tracking (user_id, dose_id, taken_at, dismissed) VALUES (?, ?, ?, 0)`,
+				args: [userId, `${medId}-0-1735344000000`, "not-a-date"],
+			});
+			await testClient.execute({
+				sql: `INSERT INTO refill_history (medication_id, user_id, packs_added, loose_pills_added, used_prescription, refill_date)
+				      VALUES (?, ?, ?, ?, ?, ?)`,
+				args: [medId, userId, 1, 0, 0, "still-not-a-date"],
+			});
+			await testClient.execute({
+				sql: `INSERT INTO share_tokens (user_id, token, taken_by, schedule_days, expires_at) VALUES (?, ?, ?, ?, ?)`,
+				args: [userId, "date-edge-token", "Daniel", 30, "broken-date"],
+			});
+
+			const response = await app.inject({ method: "GET", url: "/export" });
+			expect(response.statusCode).toBe(200);
+
+			const data = response.json();
+			expect(data.doseHistory).toHaveLength(1);
+			expect(Number.isNaN(Date.parse(data.doseHistory[0].takenAt))).toBe(false);
+			expect(data.refillHistory).toHaveLength(1);
+			expect(Number.isNaN(Date.parse(data.refillHistory[0].refillDate))).toBe(false);
+			expect(data.shareLinks).toHaveLength(1);
+			expect(data.shareLinks[0].expiresAt).toBeNull();
+		});
 	});
 
 	describe("Real /import routes", () => {
@@ -2214,4 +2499,250 @@ describe("E2E Tests with Real Routes", () => {
 			expect(medsResponse.json()[0].packCount).toBe(10);
 		});
 	});
+
+	// ---------------------------------------------------------------------------
+	// Package Type (bottle vs blister) Tests
+	// ---------------------------------------------------------------------------
+
+	describe("Package type handling (bottle vs blister)", () => {
+		const bottleMedication = {
+			name: "Vitamin D Drops",
+			packageType: "bottle",
+			packCount: 0,
+			blistersPerPack: 1,
+			pillsPerBlister: 1,
+			looseTablets: 120,
+			blisters: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+		};
+
+		const blisterMedication = {
+			name: "Aspirin Blister",
+			packageType: "blister",
+			packCount: 2,
+			blistersPerPack: 3,
+			pillsPerBlister: 10,
+			looseTablets: 5,
+			blisters: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+		};
+
+		it("should create and return bottle type medication", async () => {
+			const response = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: bottleMedication,
+			});
+
+			expect(response.statusCode).toBe(200);
+			const data = response.json();
+			expect(data.packageType).toBe("bottle");
+			expect(data.looseTablets).toBe(120);
+		});
+
+		it("should return packageType in shared schedule for bottle type", async () => {
+			// Create bottle medication with takenBy
+			await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: { ...bottleMedication, takenBy: ["Daniel"] },
+			});
+
+			// Create share token
+			const shareResponse = await app.inject({
+				method: "POST",
+				url: "/share",
+				payload: { takenBy: "Daniel", scheduleDays: 30 },
+			});
+			expect(shareResponse.statusCode).toBe(200);
+			const { token } = shareResponse.json();
+
+			// Get shared schedule
+			const scheduleResponse = await app.inject({
+				method: "GET",
+				url: `/share/${token}`,
+			});
+
+			expect(scheduleResponse.statusCode).toBe(200);
+			const data = scheduleResponse.json();
+			expect(data.medications).toHaveLength(1);
+			expect(data.medications[0].packageType).toBe("bottle");
+			// Bottle totalPills = looseTablets + stockAdjustment (no blister math)
+			expect(data.medications[0].totalPills).toBe(120);
+		});
+
+		it("should calculate correct totalPills for shared blister medication", async () => {
+			await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: { ...blisterMedication, takenBy: ["Daniel"] },
+			});
+
+			const shareResponse = await app.inject({
+				method: "POST",
+				url: "/share",
+				payload: { takenBy: "Daniel", scheduleDays: 30 },
+			});
+			const { token } = shareResponse.json();
+
+			const scheduleResponse = await app.inject({
+				method: "GET",
+				url: `/share/${token}`,
+			});
+
+			expect(scheduleResponse.statusCode).toBe(200);
+			const data = scheduleResponse.json();
+			expect(data.medications).toHaveLength(1);
+			expect(data.medications[0].packageType).toBe("blister");
+			// Blister totalPills = 2 * 3 * 10 + 5 = 65
+			expect(data.medications[0].totalPills).toBe(65);
+		});
+
+		it("should calculate correct refill totalPillsAdded for bottle type", async () => {
+			const createResponse = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: bottleMedication,
+			});
+			const medId = createResponse.json().id;
+
+			// Refill bottle: only loosePillsAdded matters, packs should add 0 pills
+			const refillResponse = await app.inject({
+				method: "POST",
+				url: `/medications/${medId}/refill`,
+				payload: { packsAdded: 0, loosePillsAdded: 30 },
+			});
+
+			expect(refillResponse.statusCode).toBe(200);
+			const data = refillResponse.json();
+			expect(data.refill.totalPillsAdded).toBe(30);
+			// newStock.totalPills should be looseTablets only (no blister math)
+			expect(data.newStock.totalPills).toBe(150); // 120 + 30
+		});
+
+		it("should calculate correct refill totalPillsAdded for blister type", async () => {
+			const createResponse = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: blisterMedication,
+			});
+			const medId = createResponse.json().id;
+
+			// Refill blister: 1 pack = 3 blisters * 10 pills = 30 pills + 5 loose
+			const refillResponse = await app.inject({
+				method: "POST",
+				url: `/medications/${medId}/refill`,
+				payload: { packsAdded: 1, loosePillsAdded: 5 },
+			});
+
+			expect(refillResponse.statusCode).toBe(200);
+			const data = refillResponse.json();
+			expect(data.refill.totalPillsAdded).toBe(35); // 1*30 + 5
+		});
+
+		it("should return correct totalPillsAdded in refill history for bottle type", async () => {
+			const createResponse = await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: bottleMedication,
+			});
+			const medId = createResponse.json().id;
+
+			// Add refill
+			await app.inject({
+				method: "POST",
+				url: `/medications/${medId}/refill`,
+				payload: { packsAdded: 0, loosePillsAdded: 25 },
+			});
+
+			// Get refill history
+			const historyResponse = await app.inject({
+				method: "GET",
+				url: `/medications/${medId}/refills`,
+			});
+
+			expect(historyResponse.statusCode).toBe(200);
+			const refills = historyResponse.json();
+			expect(refills).toHaveLength(1);
+			// For bottle type, totalPillsAdded = loosePillsAdded only
+			expect(refills[0].totalPillsAdded).toBe(25);
+		});
+
+		it("should export and import bottle type medication correctly", async () => {
+			// Create bottle medication
+			await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: bottleMedication,
+			});
+
+			// Export
+			const exportResponse = await app.inject({
+				method: "GET",
+				url: "/export",
+			});
+
+			expect(exportResponse.statusCode).toBe(200);
+			const exportData = exportResponse.json();
+			expect(exportData.medications).toHaveLength(1);
+			expect(exportData.medications[0].inventory.packageType).toBe("bottle");
+			expect(exportData.medications[0].inventory.looseTablets).toBe(120);
+
+			// Clear and re-import
+			await clearData(testClient);
+			await testClient.execute(
+				"INSERT INTO users (id, username, auth_provider) VALUES (999999999, '__anonymous__', 'anonymous')"
+			);
+
+			const importResponse = await app.inject({
+				method: "POST",
+				url: "/import",
+				payload: exportData,
+			});
+
+			expect(importResponse.statusCode).toBe(200);
+			expect(importResponse.json().success).toBe(true);
+
+			// Verify imported medication has correct packageType
+			const medsResponse = await app.inject({
+				method: "GET",
+				url: "/medications",
+			});
+
+			expect(medsResponse.json()).toHaveLength(1);
+			const med = medsResponse.json()[0];
+			expect(med.name).toBe("Vitamin D Drops");
+			expect(med.packageType).toBe("bottle");
+			expect(med.looseTablets).toBe(120);
+		});
+
+		it("should default to blister when importing without packageType", async () => {
+			const importData = {
+				version: "1.0",
+				exportedAt: new Date().toISOString(),
+				medications: [
+					{
+						_exportId: "med-1",
+						name: "Old Export Med",
+						inventory: { packCount: 2, blistersPerPack: 3, pillsPerBlister: 10, looseTablets: 0 },
+						schedules: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+					},
+				],
+			};
+
+			const importResponse = await app.inject({
+				method: "POST",
+				url: "/import",
+				payload: importData,
+			});
+
+			expect(importResponse.statusCode).toBe(200);
+
+			const medsResponse = await app.inject({
+				method: "GET",
+				url: "/medications",
+			});
+
+			expect(medsResponse.json()).toHaveLength(1);
+			expect(medsResponse.json()[0].packageType).toBe("blister");
+		});
+	});
 });

backend/src/test/env-runtime.test.ts

@@ -0,0 +1,76 @@
+import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+const ORIGINAL_ENV = { ...process.env };
+
+describe("plugins/env runtime validation", () => {
+	beforeEach(() => {
+		vi.resetModules();
+		vi.restoreAllMocks();
+		process.env = {
+			...ORIGINAL_ENV,
+			DOTENV_PATH: "/tmp/medassist-nonexistent.env",
+		};
+	});
+
+	afterAll(() => {
+		process.env = ORIGINAL_ENV;
+	});
+
+	it("loads with defaults when auth and oidc are disabled", async () => {
+		delete process.env.AUTH_ENABLED;
+		delete process.env.OIDC_ENABLED;
+		delete process.env.JWT_SECRET;
+		delete process.env.REFRESH_SECRET;
+		delete process.env.COOKIE_SECRET;
+
+		const mod = await import("../plugins/env.js");
+		expect(mod.env.AUTH_ENABLED).toBe(false);
+		expect(mod.env.OIDC_ENABLED).toBe(false);
+		expect(mod.env.PORT).toBe(3000);
+	});
+
+	it("exits when auth is enabled but secrets are missing", async () => {
+		process.env.AUTH_ENABLED = "true";
+		delete process.env.JWT_SECRET;
+		delete process.env.REFRESH_SECRET;
+		delete process.env.COOKIE_SECRET;
+
+		vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+			throw new Error(`process.exit:${code ?? 0}`);
+		}) as never);
+
+		await expect(import("../plugins/env.js")).rejects.toThrow("process.exit:1");
+	});
+
+	it("exits when oidc is enabled but required settings are missing", async () => {
+		process.env.AUTH_ENABLED = "false";
+		process.env.OIDC_ENABLED = "true";
+		delete process.env.OIDC_ISSUER_URL;
+		delete process.env.OIDC_CLIENT_ID;
+		delete process.env.OIDC_CLIENT_SECRET;
+		delete process.env.OIDC_REDIRECT_URI;
+
+		vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+			throw new Error(`process.exit:${code ?? 0}`);
+		}) as never);
+
+		await expect(import("../plugins/env.js")).rejects.toThrow("process.exit:1");
+	});
+
+	it("loads when auth and oidc settings are complete", async () => {
+		process.env.AUTH_ENABLED = "true";
+		process.env.JWT_SECRET = "jwt-secret-for-runtime-test";
+		process.env.REFRESH_SECRET = "refresh-secret-runtime-test";
+		process.env.COOKIE_SECRET = "cookie-secret-runtime-test";
+		process.env.OIDC_ENABLED = "true";
+		process.env.OIDC_ISSUER_URL = "https://auth.example.com";
+		process.env.OIDC_CLIENT_ID = "medassist";
+		process.env.OIDC_CLIENT_SECRET = "super-secret-client";
+		process.env.OIDC_REDIRECT_URI = "https://app.example.com/api/auth/oidc/callback";
+
+		const mod = await import("../plugins/env.js");
+		expect(mod.env.AUTH_ENABLED).toBe(true);
+		expect(mod.env.OIDC_ENABLED).toBe(true);
+		expect(mod.env.OIDC_CLIENT_ID).toBe("medassist");
+	});
+});

backend/src/test/env.test.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 
 // Mock process.exit to prevent tests from exiting
 const mockExit = vi.fn();
-vi.spyOn(process, "exit").mockImplementation(mockExit as any);
+vi.spyOn(process, "exit").mockImplementation(mockExit as unknown as (...args: unknown[]) => never);
 
 // Re-create the schema from env.ts for testing
 const EnvSchema = z.object({

backend/src/test/export.test.ts

@@ -23,10 +23,12 @@ async function registerExportRoutes(ctx: TestContext) {
 	const userId = 1; // Test user ID
 
 	// Helper to parse blisters from DB
-	function parseBlisters(row: any): Array<{ usage: number; every: number; start: string; remind: boolean }> {
-		const usage = JSON.parse(row.usage_json || "[]") as number[];
-		const every = JSON.parse(row.every_json || "[]") as number[];
-		const start = JSON.parse(row.start_json || "[]") as string[];
+	function parseBlisters(
+		row: Record<string, unknown>
+	): Array<{ usage: number; every: number; start: string; remind: boolean }> {
+		const usage = JSON.parse((row.usage_json as string) || "[]") as number[];
+		const every = JSON.parse((row.every_json as string) || "[]") as number[];
+		const start = JSON.parse((row.start_json as string) || "[]") as string[];
 		const len = Math.min(usage.length, every.length, start.length);
 		return Array.from({ length: len }, (_, i) => ({
 			usage: usage[i],
@@ -99,7 +101,7 @@ async function registerExportRoutes(ctx: TestContext) {
 			args: [userId],
 		});
 
-		let settings;
+		let settings: Record<string, unknown> | undefined;
 		if (settingsResult.rows.length > 0) {
 			const s = settingsResult.rows[0];
 			settings = {
@@ -150,7 +152,8 @@ async function registerExportRoutes(ctx: TestContext) {
 	});
 
 	// POST /import
-	app.post<{ Body: any }>("/import", async (request, reply) => {
+	// biome-ignore lint/suspicious/noExplicitAny: test helper with dynamic import data shape
+	app.post("/import", async (request, reply) => {
 		const importData = request.body as any;
 
 		// Basic validation
@@ -167,9 +170,15 @@ async function registerExportRoutes(ctx: TestContext) {
 		// Import medications
 		const exportIdToNewId = new Map<string, number>();
 		for (const med of importData.medications || []) {
-			const usageJson = JSON.stringify((med.schedules || []).map((s: any) => s.usage));
-			const everyJson = JSON.stringify((med.schedules || []).map((s: any) => s.every));
-			const startJson = JSON.stringify((med.schedules || []).map((s: any) => s.start));
+			const usageJson = JSON.stringify(
+				((med.schedules as Array<Record<string, unknown>>) || []).map((s: Record<string, unknown>) => s.usage)
+			);
+			const everyJson = JSON.stringify(
+				((med.schedules as Array<Record<string, unknown>>) || []).map((s: Record<string, unknown>) => s.every)
+			);
+			const startJson = JSON.stringify(
+				((med.schedules as Array<Record<string, unknown>>) || []).map((s: Record<string, unknown>) => s.start)
+			);
 			const takenByJson = JSON.stringify(med.takenBy || []);
 
 			const result = await client.execute({

backend/src/test/integration.test.ts

@@ -94,6 +94,14 @@ async function createSchema(client: Client) {
 		    expiry_date text,
 		    notes text,
 		    intake_reminders_enabled integer NOT NULL DEFAULT 0,
+		    medication_start_date text NOT NULL DEFAULT '',
+		    is_obsolete integer NOT NULL DEFAULT 0,
+		    obsolete_at integer,
+		    prescription_enabled integer NOT NULL DEFAULT 0,
+		    prescription_authorized_refills integer,
+		    prescription_remaining_refills integer,
+		    prescription_low_refill_threshold integer NOT NULL DEFAULT 1,
+		    prescription_expiry_date text,
 		    dismissed_until text,
 		    updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
 		    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
@@ -105,10 +113,12 @@ async function createSchema(client: Client) {
       notification_email text,
       email_stock_reminders integer NOT NULL DEFAULT 1,
       email_intake_reminders integer NOT NULL DEFAULT 1,
+	email_prescription_reminders integer NOT NULL DEFAULT 1,
       shoutrrr_enabled integer NOT NULL DEFAULT 0,
       shoutrrr_url text,
       shoutrrr_stock_reminders integer NOT NULL DEFAULT 1,
       shoutrrr_intake_reminders integer NOT NULL DEFAULT 1,
+	shoutrrr_prescription_reminders integer NOT NULL DEFAULT 1,
       reminder_days_before integer NOT NULL DEFAULT 7,
       repeat_daily_reminders integer NOT NULL DEFAULT 0,
       skip_reminders_for_taken_doses integer NOT NULL DEFAULT 0,
@@ -121,11 +131,21 @@ async function createSchema(client: Client) {
       expiry_warning_days integer NOT NULL DEFAULT 90,
       language text NOT NULL DEFAULT 'en',
       stock_calculation_mode text NOT NULL DEFAULT 'automatic',
+      share_stock_status integer NOT NULL DEFAULT 1,
+	upcoming_today_only integer NOT NULL DEFAULT 0,
+	share_schedule_today_only integer NOT NULL DEFAULT 0,
+	swap_dashboard_main_sections integer NOT NULL DEFAULT 0,
       last_auto_email_sent text,
       last_notification_type text,
       last_notification_channel text,
       last_reminder_med_name text,
       last_reminder_taken_by text,
+      last_stock_reminder_sent text,
+      last_stock_reminder_channel text,
+      last_stock_reminder_med_names text,
+			last_prescription_reminder_sent text,
+			last_prescription_reminder_channel text,
+			last_prescription_reminder_med_names text,
       updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,
@@ -145,6 +165,7 @@ async function createSchema(client: Client) {
       dose_id text NOT NULL,
       taken_at integer NOT NULL DEFAULT (strftime('%s','now')),
       marked_by text,
+		taken_source text NOT NULL DEFAULT 'manual',
       dismissed integer NOT NULL DEFAULT 0,
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,
@@ -1181,6 +1202,92 @@ describe("Integration Tests", () => {
 			expect(data[0].plannerUsage).toBe(10);
 			expect(data[0].enough).toBe(true); // 45 > 10
 		});
+
+		it("should use user-selected start date, not current time (fix asymmetric counting)", async () => {
+			// Regression test: When a planner range starts today, the old code used
+			// max(now, start) as the effective start. If now was between the morning
+			// dose (07:00) and evening dose (20:00), morning was skipped but evening
+			// counted, giving an asymmetric result (e.g., 5 instead of 6).
+			//
+			// Example: medication with daily morning (07:00) + evening (20:00) intakes,
+			// planner range [today 01:00, today+3 01:00).
+			// Old code at 15:00: morning 07:00 < 15:00 → skipped, evening 20:00 ≥ 15:00 → counted
+			// Result: 2 morning + 3 evening = 5 instead of 3+3 = 6.
+
+			// Use a past start date so the intakes predate the planner range
+			const intakeStart = "2025-01-01T07:00:00.000Z";
+			const intakeEvening = "2025-01-01T20:00:00.000Z";
+
+			// Plan range: Feb 9 00:00 to Feb 12 00:00 UTC (3 full days)
+			const planStart = "2026-02-09T00:00:00.000Z";
+			const planEnd = "2026-02-12T00:00:00.000Z";
+
+			await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: {
+					name: "Twice Daily Med Asymmetric",
+					packCount: 5,
+					blistersPerPack: 5,
+					pillsPerBlister: 10,
+					blisters: [
+						{ usage: 1, every: 1, start: intakeStart },
+						{ usage: 1, every: 1, start: intakeEvening },
+					],
+				},
+			});
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/medications/usage",
+				payload: {
+					startDate: planStart,
+					endDate: planEnd,
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			const data = response.json();
+			// Both morning and evening should have exactly 3 occurrences each
+			// (Feb 9, 10, 11) for a total of 6, regardless of current time
+			expect(data[0].plannerUsage).toBe(6);
+		});
+
+		it("should handle planner range starting before blister start", async () => {
+			// Blister starts on Feb 10, planner range starts Feb 9
+			// Should only count doses from Feb 10 onwards
+			const intakeMorning = "2026-02-10T07:00:00.000Z";
+			const intakeEvening = "2026-02-10T20:00:00.000Z";
+
+			await app.inject({
+				method: "POST",
+				url: "/medications",
+				payload: {
+					name: "Recent Start Med",
+					packCount: 1,
+					blistersPerPack: 1,
+					pillsPerBlister: 30,
+					blisters: [
+						{ usage: 1, every: 1, start: intakeMorning },
+						{ usage: 1, every: 1, start: intakeEvening },
+					],
+				},
+			});
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/medications/usage",
+				payload: {
+					startDate: "2026-02-09T00:00:00.000Z",
+					endDate: "2026-02-12T00:00:00.000Z",
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			const data = response.json();
+			// Only Feb 10 and Feb 11 have doses (blister starts Feb 10)
+			expect(data[0].plannerUsage).toBe(4); // 2 days × 2 intakes
+		});
 	});
 
 	// ---------------------------------------------------------------------------
@@ -1230,8 +1337,8 @@ describe("Integration Tests", () => {
 				url: "/medications",
 			});
 			const meds = medsRes.json();
-			const med1 = meds.find((m: any) => m.id === med1Id);
-			const med2 = meds.find((m: any) => m.id === med2Id);
+			const med1 = meds.find((m: Record<string, unknown>) => m.id === med1Id);
+			const med2 = meds.find((m: Record<string, unknown>) => m.id === med2Id);
 
 			expect(med1.dismissedUntil).toBe("2025-01-15");
 			expect(med2.dismissedUntil).toBe("2025-01-15");
@@ -1273,7 +1380,7 @@ describe("Integration Tests", () => {
 				method: "GET",
 				url: "/medications",
 			});
-			const med = medsRes.json().find((m: any) => m.id === medId);
+			const med = medsRes.json().find((m: Record<string, unknown>) => m.id === medId);
 			expect(med.dismissedUntil).toBeNull();
 		});
 
@@ -1343,7 +1450,7 @@ describe("Integration Tests", () => {
 				method: "GET",
 				url: "/medications",
 			});
-			const med = medsRes.json().find((m: any) => m.id === medId);
+			const med = medsRes.json().find((m: Record<string, unknown>) => m.id === medId);
 			expect(med.dismissedUntil).toBeNull();
 		});
 	});

backend/src/test/oidc.test.ts

@@ -0,0 +1,151 @@
+import cookie from "@fastify/cookie";
+import Fastify, { type FastifyInstance } from "fastify";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+type OidcMocks = {
+	discovery: ReturnType<typeof vi.fn>;
+	buildAuthorizationUrl: ReturnType<typeof vi.fn>;
+};
+
+async function buildOidcApp(envOverrides: Record<string, unknown>) {
+	vi.resetModules();
+
+	const env = {
+		OIDC_ENABLED: true,
+		OIDC_ISSUER_URL: "https://issuer.example.com",
+		OIDC_CLIENT_ID: "medassist-client",
+		OIDC_CLIENT_SECRET: "medassist-client-secret",
+		OIDC_REDIRECT_URI: "https://app.example.com/api/auth/oidc/callback",
+		OIDC_SCOPES: "openid profile email",
+		OIDC_AUTO_CREATE_USERS: true,
+		OIDC_USERNAME_CLAIM: "preferred_username",
+		OIDC_PROVIDER_NAME: "SSO",
+		NODE_ENV: "test",
+		CORS_ORIGINS: "http://localhost:5173",
+		ACCESS_TOKEN_TTL_MINUTES: 15,
+		REFRESH_TOKEN_TTL_DAYS: 7,
+		...envOverrides,
+	};
+
+	vi.doMock("../plugins/env.js", () => ({ env }));
+
+	vi.doMock("../db/client.js", () => ({
+		db: {
+			select: vi.fn(() => ({ from: vi.fn(() => ({ where: vi.fn().mockResolvedValue([]) })) })),
+			insert: vi.fn(() => ({
+				values: vi.fn(() => ({ returning: vi.fn().mockResolvedValue([{ id: 1, username: "sso-user" }]) })),
+			})),
+			update: vi.fn(() => ({ set: vi.fn(() => ({ where: vi.fn().mockResolvedValue(undefined) })) })),
+		},
+	}));
+
+	const discovery = vi.fn().mockResolvedValue({ issuer: "https://issuer.example.com" });
+	const buildAuthorizationUrl = vi.fn().mockImplementation((_cfg, params) => {
+		const state = typeof params?.state === "string" ? params.state : "state";
+		return new URL(`https://issuer.example.com/authorize?state=${state}`);
+	});
+
+	vi.doMock("openid-client", () => ({
+		discovery,
+		buildAuthorizationUrl,
+		authorizationCodeGrant: vi.fn(),
+		fetchUserInfo: vi.fn(),
+	}));
+
+	const { oidcRoutes } = await import("../routes/oidc.js");
+
+	const app = Fastify({ logger: false });
+	await app.register(cookie, { secret: "test-cookie-secret" });
+	app.decorate("config", {
+		accessSecret: "test-jwt-secret-12345",
+		refreshSecret: "test-refresh-secret-12345",
+		accessTtl: 15 * 60,
+		refreshTtl: 7 * 24 * 60 * 60,
+		cookieOptions: { httpOnly: true, sameSite: "lax", secure: false, path: "/" },
+		refreshCookieOptions: { httpOnly: true, sameSite: "lax", secure: false, path: "/auth" },
+	});
+	await app.register(oidcRoutes);
+	await app.ready();
+
+	return {
+		app,
+		mocks: { discovery, buildAuthorizationUrl } as OidcMocks,
+	};
+}
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+describe("OIDC routes", () => {
+	it("returns 400 on login and callback when oidc is disabled", async () => {
+		const { app } = await buildOidcApp({ OIDC_ENABLED: false });
+		try {
+			const login = await app.inject({ method: "GET", url: "/auth/oidc/login" });
+			const callback = await app.inject({ method: "GET", url: "/auth/oidc/callback" });
+
+			expect(login.statusCode).toBe(400);
+			expect(callback.statusCode).toBe(400);
+		} finally {
+			await app.close();
+		}
+	});
+
+	it("redirects to provider and sets PKCE cookies on /auth/oidc/login", async () => {
+		const { app, mocks } = await buildOidcApp({ OIDC_ENABLED: true });
+		try {
+			const res = await app.inject({ method: "GET", url: "/auth/oidc/login" });
+
+			expect(res.statusCode).toBe(302);
+			expect(res.headers.location).toContain("https://issuer.example.com/authorize");
+			expect(res.cookies.some((c) => c.name === "oidc_code_verifier")).toBe(true);
+			expect(res.cookies.some((c) => c.name === "oidc_state")).toBe(true);
+			expect(mocks.discovery).toHaveBeenCalledTimes(1);
+			expect(mocks.buildAuthorizationUrl).toHaveBeenCalledTimes(1);
+		} finally {
+			await app.close();
+		}
+	});
+
+	it("redirects with provider error when callback contains error params", async () => {
+		const { app } = await buildOidcApp({ OIDC_ENABLED: true });
+		try {
+			const res = await app.inject({
+				method: "GET",
+				url: "/auth/oidc/callback?error=access_denied&error_description=user_cancelled",
+			});
+
+			expect(res.statusCode).toBe(302);
+			expect(res.headers.location).toBe("http://localhost:5173/?error=oidc_access_denied");
+		} finally {
+			await app.close();
+		}
+	});
+
+	it("redirects when callback is missing required params", async () => {
+		const { app } = await buildOidcApp({ OIDC_ENABLED: true });
+		try {
+			const res = await app.inject({ method: "GET", url: "/auth/oidc/callback" });
+
+			expect(res.statusCode).toBe(302);
+			expect(res.headers.location).toBe("http://localhost:5173/?error=oidc_missing_params");
+		} finally {
+			await app.close();
+		}
+	});
+
+	it("redirects when callback state validation fails", async () => {
+		const { app } = await buildOidcApp({ OIDC_ENABLED: true });
+		try {
+			const res = await app.inject({
+				method: "GET",
+				url: "/auth/oidc/callback?code=abc123&state=state123",
+			});
+
+			expect(res.statusCode).toBe(302);
+			expect(res.headers.location).toBe("http://localhost:5173/?error=oidc_state_mismatch");
+		} finally {
+			await app.close();
+		}
+	});
+});

backend/src/test/planner.test.ts

@@ -63,7 +63,7 @@ vi.mock("../services/reminder-scheduler.js", () => ({
 
 // Mock sendShoutrrrNotification from settings
 vi.mock("../routes/settings.js", async (importOriginal) => {
-	const original = (await importOriginal()) as any;
+	const original = (await importOriginal()) as Record<string, unknown>;
 	return {
 		...original,
 		sendShoutrrrNotification: mockSendShoutrrr,
@@ -86,6 +86,42 @@ async function createSchema(client: Client) {
       is_active integer NOT NULL DEFAULT 1,
       created_at integer NOT NULL DEFAULT (strftime('%s','now')),
       updated_at integer NOT NULL DEFAULT (strftime('%s','now'))
+    )`,
+		`CREATE TABLE IF NOT EXISTS medications (
+      id integer PRIMARY KEY AUTOINCREMENT,
+      user_id integer NOT NULL,
+      name text NOT NULL,
+      generic_name text,
+      taken_by_json text NOT NULL DEFAULT '[]',
+      package_type text NOT NULL DEFAULT 'blister',
+      pack_count integer NOT NULL DEFAULT 1,
+      blisters_per_pack integer NOT NULL DEFAULT 1,
+      pills_per_blister integer NOT NULL DEFAULT 1,
+      total_pills integer,
+      loose_tablets integer NOT NULL DEFAULT 0,
+      stock_adjustment integer NOT NULL DEFAULT 0,
+      last_stock_correction_at integer,
+      pill_weight_mg integer,
+      dose_unit text DEFAULT 'mg',
+      usage_json text NOT NULL DEFAULT '[]',
+      every_json text NOT NULL DEFAULT '[]',
+      start_json text NOT NULL DEFAULT '[]',
+      intakes_json text NOT NULL DEFAULT '[]',
+      image_url text,
+      expiry_date text,
+      notes text,
+      intake_reminders_enabled integer NOT NULL DEFAULT 0,
+      medication_start_date text NOT NULL DEFAULT '',
+      is_obsolete integer NOT NULL DEFAULT 0,
+      obsolete_at integer,
+      prescription_enabled integer NOT NULL DEFAULT 0,
+      prescription_authorized_refills integer,
+      prescription_remaining_refills integer,
+      prescription_low_refill_threshold integer NOT NULL DEFAULT 1,
+      prescription_expiry_date text,
+      dismissed_until text,
+      updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,
 		`CREATE TABLE IF NOT EXISTS user_settings (
       id integer PRIMARY KEY AUTOINCREMENT,
@@ -94,10 +130,12 @@ async function createSchema(client: Client) {
       notification_email text,
       email_stock_reminders integer NOT NULL DEFAULT 1,
       email_intake_reminders integer NOT NULL DEFAULT 1,
+		email_prescription_reminders integer NOT NULL DEFAULT 1,
       shoutrrr_enabled integer NOT NULL DEFAULT 0,
       shoutrrr_url text,
       shoutrrr_stock_reminders integer NOT NULL DEFAULT 1,
       shoutrrr_intake_reminders integer NOT NULL DEFAULT 1,
+		shoutrrr_prescription_reminders integer NOT NULL DEFAULT 1,
       reminder_days_before integer NOT NULL DEFAULT 7,
       repeat_daily_reminders integer NOT NULL DEFAULT 0,
       skip_reminders_for_taken_doses integer NOT NULL DEFAULT 0,
@@ -110,11 +148,21 @@ async function createSchema(client: Client) {
       expiry_warning_days integer NOT NULL DEFAULT 90,
       language text NOT NULL DEFAULT 'en',
       stock_calculation_mode text NOT NULL DEFAULT 'automatic',
+      share_stock_status integer NOT NULL DEFAULT 1,
+	upcoming_today_only integer NOT NULL DEFAULT 0,
+	share_schedule_today_only integer NOT NULL DEFAULT 0,
+	swap_dashboard_main_sections integer NOT NULL DEFAULT 0,
       last_auto_email_sent text,
       last_notification_type text,
       last_notification_channel text,
       last_reminder_med_name text,
       last_reminder_taken_by text,
+      last_stock_reminder_sent text,
+      last_stock_reminder_channel text,
+      last_stock_reminder_med_names text,
+			last_prescription_reminder_sent text,
+			last_prescription_reminder_channel text,
+			last_prescription_reminder_med_names text,
       updated_at integer NOT NULL DEFAULT (strftime('%s','now')),
       FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )`,
@@ -126,6 +174,7 @@ async function createSchema(client: Client) {
 }
 
 async function clearData(client: Client) {
+	await client.execute("DELETE FROM medications");
 	await client.execute("DELETE FROM user_settings");
 	await client.execute("DELETE FROM users");
 	await client.execute("DELETE FROM sqlite_sequence");
@@ -146,6 +195,18 @@ describe("Planner Routes", () => {
 			"INSERT INTO users (id, username, auth_provider) VALUES (999999999, '__anonymous__', 'anonymous')"
 		);
 
+		// Insert test medications so active-medication filters pass
+		await testClient.execute({
+			sql: `INSERT INTO medications (id, user_id, name, taken_by_json, usage_json, every_json, start_json)
+			       VALUES (1, 999999999, 'Aspirin', '["Daniel"]', '[1]', '[1]', '["2025-01-01T08:00:00.000Z"]')`,
+			args: [],
+		});
+		await testClient.execute({
+			sql: `INSERT INTO medications (id, user_id, name, taken_by_json, usage_json, every_json, start_json)
+			       VALUES (2, 999999999, 'Ibuprofen', '["Daniel"]', '[1]', '[1]', '["2025-01-01T08:00:00.000Z"]')`,
+			args: [],
+		});
+
 		app = Fastify({ logger: false });
 		await app.register(plannerRoutes);
 		await app.ready();
@@ -161,21 +222,6 @@ describe("Planner Routes", () => {
 	});
 
 	describe("POST /planner/send-email", () => {
-		it("should reject request with missing email", async () => {
-			const response = await app.inject({
-				method: "POST",
-				url: "/planner/send-email",
-				payload: {
-					from: "2025-01-01",
-					until: "2025-01-31",
-					rows: [{ medicationName: "Test", totalPills: 10, plannerUsage: 5, enough: true }],
-				},
-			});
-
-			expect(response.statusCode).toBe(400);
-			expect(response.json()).toEqual({ error: "Missing email or planner data" });
-		});
-
 		it("should reject request with missing rows", async () => {
 			const response = await app.inject({
 				method: "POST",
@@ -189,10 +235,16 @@ describe("Planner Routes", () => {
 			});
 
 			expect(response.statusCode).toBe(400);
-			expect(response.json()).toEqual({ error: "Missing email or planner data" });
+			expect(response.json()).toEqual({ error: "Missing planner data" });
 		});
 
-		it("should reject when SMTP is not configured", async () => {
+		it("should return error when no notification channels configured", async () => {
+			// User settings exist but email/shoutrrr disabled
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 0, 0, 'en')`,
+				args: [999999999],
+			});
+
 			const response = await app.inject({
 				method: "POST",
 				url: "/planner/send-email",
@@ -217,7 +269,7 @@ describe("Planner Routes", () => {
 			});
 
 			expect(response.statusCode).toBe(400);
-			expect(response.json()).toEqual({ error: "SMTP not configured" });
+			expect(response.json()).toEqual({ error: "No notification channels configured" });
 		});
 
 		it("should send email successfully when SMTP is configured", async () => {
@@ -226,6 +278,12 @@ describe("Planner Routes", () => {
 			process.env.SMTP_USER = "user@test.com";
 			process.env.SMTP_PASS = "password";
 
+			// Enable email in user settings
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 1, 0, 'en')`,
+				args: [999999999],
+			});
+
 			mockSendMail.mockResolvedValueOnce({ messageId: "123" });
 
 			const response = await app.inject({
@@ -253,7 +311,7 @@ describe("Planner Routes", () => {
 			});
 
 			expect(response.statusCode).toBe(200);
-			expect(response.json()).toEqual({ success: true, message: "Email sent successfully" });
+			expect(response.json()).toEqual({ success: true, message: "Notification sent via email" });
 			expect(mockSendMail).toHaveBeenCalledTimes(1);
 
 			// Cleanup
@@ -267,6 +325,11 @@ describe("Planner Routes", () => {
 			process.env.SMTP_USER = "user@test.com";
 			process.env.SMTP_PASS = "password";
 
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 1, 0, 'en')`,
+				args: [999999999],
+			});
+
 			mockSendMail.mockResolvedValueOnce({ messageId: "123" });
 
 			const response = await app.inject({
@@ -308,7 +371,7 @@ describe("Planner Routes", () => {
 
 			// Check that HTML contains out of stock warning
 			const mailCall = mockSendMail.mock.calls[0][0];
-			expect(mailCall.html).toContain("Out of Stock");
+			expect(mailCall.html).toContain("Empty");
 			expect(mailCall.html).toContain("1 medication");
 
 			delete process.env.SMTP_HOST;
@@ -321,6 +384,11 @@ describe("Planner Routes", () => {
 			process.env.SMTP_USER = "user@test.com";
 			process.env.SMTP_PASS = "password";
 
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 1, 0, 'en')`,
+				args: [999999999],
+			});
+
 			mockSendMail.mockRejectedValueOnce(new Error("Connection refused"));
 
 			const response = await app.inject({
@@ -347,7 +415,7 @@ describe("Planner Routes", () => {
 			});
 
 			expect(response.statusCode).toBe(500);
-			expect(response.json().error).toContain("Failed to send email");
+			expect(response.json().error).toContain("Email:");
 			expect(response.json().error).toContain("Connection refused");
 
 			delete process.env.SMTP_HOST;
@@ -360,6 +428,12 @@ describe("Planner Routes", () => {
 			process.env.SMTP_USER = "user@test.com";
 			process.env.SMTP_PASS = "password";
 
+			// User settings with German language
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 1, 0, 'de')`,
+				args: [999999999],
+			});
+
 			mockSendMail.mockResolvedValueOnce({ messageId: "123" });
 
 			const response = await app.inject({
@@ -390,12 +464,178 @@ describe("Planner Routes", () => {
 
 			// German date format should be used
 			const mailCall = mockSendMail.mock.calls[0][0];
-			expect(mailCall.subject).toContain("Supply Overview");
+			expect(mailCall.subject).toContain("Bestandsübersicht");
 
 			delete process.env.SMTP_HOST;
 			delete process.env.SMTP_USER;
 			delete process.env.SMTP_PASS;
 		});
+
+		it("should send push notification when shoutrrr is enabled", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 0, 1, 'ntfy://localhost/test', 'en')`,
+				args: [999999999],
+			});
+
+			mockSendShoutrrr.mockResolvedValueOnce({ success: true });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/planner/send-email",
+				payload: {
+					email: "test@example.com",
+					from: "2025-01-01",
+					until: "2025-01-31",
+					rows: [
+						{
+							medicationId: 1,
+							medicationName: "Aspirin",
+							totalPills: 30,
+							plannerUsage: 10,
+							blisterSize: 10,
+							blistersNeeded: 1,
+							fullBlisters: 3,
+							loosePills: 0,
+							enough: true,
+						},
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json()).toEqual({ success: true, message: "Notification sent via push" });
+			expect(mockSendShoutrrr).toHaveBeenCalledTimes(1);
+
+			// Verify push message contains medication info
+			const [_url, title, message] = mockSendShoutrrr.mock.calls[0];
+			expect(title).toContain("Supply Overview");
+			expect(message).toContain("Aspirin");
+		});
+
+		it("should send both email and push when both enabled", async () => {
+			process.env.SMTP_HOST = "smtp.test.com";
+			process.env.SMTP_USER = "user@test.com";
+			process.env.SMTP_PASS = "password";
+
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 1, 1, 'ntfy://localhost/test', 'en')`,
+				args: [999999999],
+			});
+
+			mockSendMail.mockResolvedValueOnce({ messageId: "123" });
+			mockSendShoutrrr.mockResolvedValueOnce({ success: true });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/planner/send-email",
+				payload: {
+					email: "test@example.com",
+					from: "2025-01-01",
+					until: "2025-01-31",
+					rows: [
+						{
+							medicationId: 1,
+							medicationName: "Aspirin",
+							totalPills: 5,
+							plannerUsage: 30,
+							blisterSize: 10,
+							blistersNeeded: 3,
+							fullBlisters: 0,
+							loosePills: 5,
+							enough: false,
+						},
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json()).toEqual({ success: true, message: "Notification sent via email and push" });
+			expect(mockSendMail).toHaveBeenCalledTimes(1);
+			expect(mockSendShoutrrr).toHaveBeenCalledTimes(1);
+
+			// Verify push message contains out of stock info
+			const [_url, _title, message] = mockSendShoutrrr.mock.calls[0];
+			expect(message).toContain("Aspirin");
+			expect(message).toContain("Empty");
+
+			delete process.env.SMTP_HOST;
+			delete process.env.SMTP_USER;
+			delete process.env.SMTP_PASS;
+		});
+
+		it("should send push with German translations", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 0, 1, 'ntfy://localhost/test', 'de')`,
+				args: [999999999],
+			});
+
+			mockSendShoutrrr.mockResolvedValueOnce({ success: true });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/planner/send-email",
+				payload: {
+					email: "test@example.com",
+					from: "2025-01-01",
+					until: "2025-01-31",
+					rows: [
+						{
+							medicationId: 1,
+							medicationName: "Aspirin",
+							totalPills: 5,
+							plannerUsage: 30,
+							blisterSize: 10,
+							blistersNeeded: 3,
+							fullBlisters: 0,
+							loosePills: 5,
+							enough: false,
+						},
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			// Check German translations in push
+			const [_url, title] = mockSendShoutrrr.mock.calls[0];
+			expect(title).toContain("Bestandsübersicht");
+		});
+
+		it("should handle push error gracefully", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 0, 1, 'ntfy://localhost/test', 'en')`,
+				args: [999999999],
+			});
+
+			mockSendShoutrrr.mockResolvedValueOnce({ success: false, error: "Connection failed" });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/planner/send-email",
+				payload: {
+					email: "test@example.com",
+					from: "2025-01-01",
+					until: "2025-01-31",
+					rows: [
+						{
+							medicationId: 1,
+							medicationName: "Aspirin",
+							totalPills: 30,
+							plannerUsage: 10,
+							blisterSize: 10,
+							blistersNeeded: 1,
+							fullBlisters: 3,
+							loosePills: 0,
+							enough: true,
+						},
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(500);
+			expect(response.json().error).toContain("Push:");
+			expect(response.json().error).toContain("Connection failed");
+		});
 	});
 
 	describe("POST /reminder/send-email", () => {
@@ -503,10 +743,10 @@ describe("Planner Routes", () => {
 
 			expect(response.statusCode).toBe(200);
 
-			// Check email contains EMPTY warning
+			// Check email contains empty warning
 			const mailCall = mockSendMail.mock.calls[0][0];
 			expect(mailCall.subject).toContain("Empty");
-			expect(mailCall.html).toContain("EMPTY");
+			expect(mailCall.html).toContain("empty");
 
 			delete process.env.SMTP_HOST;
 			delete process.env.SMTP_USER;
@@ -541,7 +781,7 @@ describe("Planner Routes", () => {
 
 			const mailCall = mockSendMail.mock.calls[0][0];
 			expect(mailCall.subject).toContain("Empty");
-			expect(mailCall.subject).toContain("Running Low");
+			expect(mailCall.subject).toContain("Critical");
 
 			delete process.env.SMTP_HOST;
 			delete process.env.SMTP_USER;
@@ -698,5 +938,205 @@ describe("Planner Routes", () => {
 			expect(response.json().error).toContain("Push:");
 			expect(response.json().error).toContain("Network error");
 		});
+
+		it("should differentiate critical and low stock in push notification", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 0, 1, 'ntfy://localhost/test', 'en')`,
+				args: [999999999],
+			});
+
+			mockSendShoutrrr.mockResolvedValueOnce({ success: true });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-email",
+				payload: {
+					email: "test@example.com",
+					lowStock: [
+						{ name: "Aspirin", medsLeft: 5, daysLeft: 3, depletionDate: "2025-01-03", isCritical: true },
+						{ name: "Ibuprofen", medsLeft: 49, daysLeft: 24, depletionDate: "2025-01-24", isCritical: false },
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			const [_url, title, message] = mockSendShoutrrr.mock.calls[0];
+			// Title should contain both Critical and Low labels
+			expect(title).toContain("Critical");
+			expect(title).toContain("Low");
+			// Message should have separate sections
+			expect(message).toContain("Running critically low");
+			expect(message).toContain("Aspirin");
+			expect(message).toContain("Running low");
+			expect(message).toContain("Ibuprofen");
+		});
+
+		it("should differentiate critical and low stock in email", async () => {
+			process.env.SMTP_HOST = "smtp.test.com";
+			process.env.SMTP_USER = "user@test.com";
+			process.env.SMTP_PASS = "password";
+
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 1, 0, 'en')`,
+				args: [999999999],
+			});
+
+			mockSendMail.mockResolvedValueOnce({ messageId: "123" });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-email",
+				payload: {
+					email: "test@example.com",
+					lowStock: [
+						{ name: "Aspirin", medsLeft: 5, daysLeft: 3, depletionDate: "2025-01-03", isCritical: true },
+						{ name: "Ibuprofen", medsLeft: 49, daysLeft: 24, depletionDate: "2025-01-24", isCritical: false },
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			const mailCall = mockSendMail.mock.calls[0][0];
+			// Subject should contain both Critical and Low
+			expect(mailCall.subject).toContain("Critical");
+			expect(mailCall.subject).toContain("Low");
+			// HTML should have separate alert boxes
+			expect(mailCall.html).toContain("critically low");
+			expect(mailCall.html).toContain("running low");
+
+			delete process.env.SMTP_HOST;
+			delete process.env.SMTP_USER;
+			delete process.env.SMTP_PASS;
+		});
+
+		it("should label all meds as critical when isCritical not provided", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 0, 1, 'ntfy://localhost/test', 'en')`,
+				args: [999999999],
+			});
+
+			mockSendShoutrrr.mockResolvedValueOnce({ success: true });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-email",
+				payload: {
+					email: "test@example.com",
+					lowStock: [{ name: "Aspirin", medsLeft: 5, daysLeft: 3, depletionDate: "2025-01-03" }],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			const [_url, title, message] = mockSendShoutrrr.mock.calls[0];
+			// Should be treated as critical (backwards compat)
+			expect(title).toContain("Critical");
+			expect(title).not.toContain("Low");
+			expect(message).toContain("Running critically low");
+		});
+	});
+
+	describe("POST /reminder/send-prescription", () => {
+		it("should reject request with missing prescription data", async () => {
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-prescription",
+				payload: {
+					email: "test@example.com",
+					prescriptionLow: [],
+				},
+			});
+
+			expect(response.statusCode).toBe(400);
+			expect(response.json()).toEqual({ error: "Missing prescription reminder data" });
+		});
+
+		it("should return error when no notification channels configured", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 0, 0, 'en')`,
+				args: [999999999],
+			});
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-prescription",
+				payload: {
+					email: "test@example.com",
+					prescriptionLow: [{ name: "Aspirin", remainingRefills: 0, threshold: 1, expiryDate: "2026-01-01" }],
+				},
+			});
+
+			expect(response.statusCode).toBe(400);
+			expect(response.json()).toEqual({ error: "No notification channels configured" });
+		});
+
+		it("should send prescription email reminder when email is enabled", async () => {
+			process.env.SMTP_HOST = "smtp.test.com";
+			process.env.SMTP_USER = "user@test.com";
+			process.env.SMTP_PASS = "password";
+
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, language) VALUES (?, 1, 0, 'en')`,
+				args: [999999999],
+			});
+
+			mockSendMail.mockResolvedValueOnce({ messageId: "123" });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-prescription",
+				payload: {
+					email: "test@example.com",
+					prescriptionLow: [
+						{ name: "Aspirin", remainingRefills: 0, threshold: 1, expiryDate: "2026-01-01" },
+						{ name: "Ibuprofen", remainingRefills: 1, threshold: 2, expiryDate: null },
+					],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json()).toEqual({ success: true, message: "Prescription reminder sent via email" });
+			expect(mockSendMail).toHaveBeenCalledTimes(1);
+			expect(mockUpdateReminderSentTime).toHaveBeenCalledWith("prescription", "email");
+			expect(mockUpdateUserReminderSentTime).toHaveBeenCalledWith(
+				999999999,
+				"prescription",
+				"email",
+				"Aspirin, Ibuprofen"
+			);
+
+			delete process.env.SMTP_HOST;
+			delete process.env.SMTP_USER;
+			delete process.env.SMTP_PASS;
+		});
+
+		it("should send prescription push reminder when shoutrrr is enabled", async () => {
+			await testClient.execute({
+				sql: `INSERT INTO user_settings (user_id, email_enabled, shoutrrr_enabled, shoutrrr_url, language) VALUES (?, 0, 1, 'ntfy://localhost/test', 'en')`,
+				args: [999999999],
+			});
+
+			mockSendShoutrrr.mockResolvedValueOnce({ success: true });
+
+			const response = await app.inject({
+				method: "POST",
+				url: "/reminder/send-prescription",
+				payload: {
+					email: "test@example.com",
+					prescriptionLow: [{ name: "Aspirin", remainingRefills: 1, threshold: 2, expiryDate: "2026-01-01" }],
+				},
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json()).toEqual({ success: true, message: "Prescription reminder sent via push" });
+			expect(mockSendShoutrrr).toHaveBeenCalledTimes(1);
+			const [_url, title, message] = mockSendShoutrrr.mock.calls[0];
+			expect(title).toContain("Renew Now");
+			expect(message).toContain("Aspirin");
+			expect(mockUpdateReminderSentTime).toHaveBeenCalledWith("prescription", "push");
+			expect(mockUpdateUserReminderSentTime).toHaveBeenCalledWith(999999999, "prescription", "push", "Aspirin");
+		});
 	});
 });

backend/src/test/routes-real.test.ts

@@ -0,0 +1,422 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { migrate } from "drizzle-orm/libsql/migrator";
+import Fastify, { type FastifyInstance } from "fastify";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { runAlterMigrations } from "../db/db-utils.js";
+
+const { testClient, testDb, mockedEnv, nodemailerSendMail, fetchMock } = vi.hoisted(() => {
+	const { createClient } = require("@libsql/client");
+	const { drizzle } = require("drizzle-orm/libsql");
+	const client = createClient({ url: ":memory:" });
+	const db = drizzle(client);
+	const env = {
+		AUTH_ENABLED: false,
+		OIDC_ENABLED: false,
+		OIDC_PROVIDER_NAME: "SSO",
+		NODE_ENV: "test",
+	};
+	return {
+		testClient: client,
+		testDb: db,
+		mockedEnv: env,
+		nodemailerSendMail: vi.fn(),
+		fetchMock: vi.fn(),
+	};
+});
+
+vi.mock("../db/client.js", () => ({
+	db: testDb,
+	migrationsReady: Promise.resolve(),
+}));
+
+vi.mock("../plugins/env.js", () => ({ env: mockedEnv }));
+
+vi.mock("../plugins/auth.js", () => ({
+	requireAuth: async () => {},
+	getAnonymousUserId: async () => 1,
+}));
+
+vi.mock("nodemailer", () => ({
+	default: {
+		createTransport: () => ({
+			sendMail: nodemailerSendMail,
+		}),
+	},
+}));
+
+const { settingsRoutes, sendShoutrrrNotification } = await import("../routes/settings.js");
+const { exportRoutes } = await import("../routes/export.js");
+const { reportRoutes } = await import("../routes/report.js");
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const migrationsFolder = resolve(__dirname, "../../drizzle");
+
+async function clearTables() {
+	await testClient.execute("DELETE FROM refill_history");
+	await testClient.execute("DELETE FROM dose_tracking");
+	await testClient.execute("DELETE FROM share_tokens");
+	await testClient.execute("DELETE FROM user_settings");
+	await testClient.execute("DELETE FROM medications");
+	await testClient.execute("DELETE FROM users");
+}
+
+async function seedAnonymousUser() {
+	await testClient.execute({
+		sql: "INSERT INTO users (id, username, auth_provider, is_active) VALUES (?, ?, ?, 1)",
+		args: [1, "anon", "anonymous"],
+	});
+}
+
+async function seedMedication(name = "Aspirin") {
+	const result = await testClient.execute({
+		sql: `INSERT INTO medications (
+      user_id, name, generic_name, taken_by_json, package_type,
+      pack_count, blisters_per_pack, pills_per_blister, loose_tablets,
+      usage_json, every_json, start_json, intakes_json,
+      stock_adjustment, intake_reminders_enabled
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING id`,
+		args: [
+			1,
+			name,
+			"Acetylsalicylic acid",
+			JSON.stringify(["Daniel"]),
+			"blister",
+			2,
+			2,
+			10,
+			3,
+			JSON.stringify([1]),
+			JSON.stringify([1]),
+			JSON.stringify(["2026-01-01T08:00:00.000Z"]),
+			JSON.stringify([
+				{ usage: 1, every: 1, start: "2026-01-01T08:00:00.000Z", takenBy: "Daniel", intakeRemindersEnabled: true },
+			]),
+			0,
+			1,
+		],
+	});
+	return result.rows[0].id as number;
+}
+
+describe("Real route coverage: settings/export/report", () => {
+	let app: FastifyInstance;
+
+	beforeAll(async () => {
+		await migrate(testDb, { migrationsFolder });
+		await runAlterMigrations(testClient);
+		app = Fastify({ logger: false });
+		await app.register(settingsRoutes);
+		await app.register(exportRoutes);
+		await app.register(reportRoutes);
+		await app.ready();
+	});
+
+	afterAll(async () => {
+		await app.close();
+		testClient.close();
+	});
+
+	beforeEach(async () => {
+		vi.clearAllMocks();
+		vi.stubGlobal("fetch", fetchMock);
+		await clearTables();
+		await seedAnonymousUser();
+		delete process.env.SMTP_HOST;
+		delete process.env.SMTP_USER;
+		delete process.env.SMTP_TOKEN;
+		delete process.env.SMTP_PASS;
+		delete process.env.SMTP_FROM;
+		delete process.env.SMTP_PORT;
+		delete process.env.SMTP_SECURE;
+	});
+
+	it("GET /settings creates defaults for anonymous user", async () => {
+		const response = await app.inject({ method: "GET", url: "/settings" });
+		expect(response.statusCode).toBe(200);
+		const body = response.json();
+		expect(body.language).toBe("en");
+		expect(body.shareStockStatus).toBe(true);
+		expect(body.upcomingTodayOnly).toBe(false);
+		expect(body.shareScheduleTodayOnly).toBe(false);
+	});
+
+	it("PUT /settings disables repeatDailyReminders when no stock reminder channel exists", async () => {
+		const response = await app.inject({
+			method: "PUT",
+			url: "/settings",
+			payload: {
+				emailEnabled: false,
+				notificationEmail: "",
+				reminderDaysBefore: 7,
+				repeatDailyReminders: true,
+				lowStockDays: 30,
+				normalStockDays: 90,
+				highStockDays: 180,
+				shoutrrrEnabled: false,
+				shoutrrrUrl: "",
+				emailStockReminders: true,
+				emailIntakeReminders: true,
+				emailPrescriptionReminders: true,
+				shoutrrrStockReminders: true,
+				shoutrrrIntakeReminders: true,
+				shoutrrrPrescriptionReminders: true,
+				skipRemindersForTakenDoses: false,
+				repeatRemindersEnabled: false,
+				reminderRepeatIntervalMinutes: 30,
+				maxNaggingReminders: 5,
+				language: "en",
+				stockCalculationMode: "automatic",
+				shareStockStatus: true,
+				upcomingTodayOnly: false,
+				shareScheduleTodayOnly: false,
+				swapDashboardMainSections: false,
+			},
+		});
+
+		expect(response.statusCode).toBe(200);
+
+		const stored = await testClient.execute({
+			sql: "SELECT repeat_daily_reminders FROM user_settings WHERE user_id = 1",
+		});
+		expect(stored.rows[0].repeat_daily_reminders).toBe(0);
+	});
+
+	it("PUT /settings/language validates supported language", async () => {
+		const response = await app.inject({
+			method: "PUT",
+			url: "/settings/language",
+			payload: { language: "fr" },
+		});
+		expect(response.statusCode).toBe(400);
+		expect(response.json().error).toBe("Invalid language");
+	});
+
+	it("POST /settings/test-email fails when SMTP is not configured", async () => {
+		const response = await app.inject({
+			method: "POST",
+			url: "/settings/test-email",
+			payload: { email: "person@example.com" },
+		});
+		expect(response.statusCode).toBe(400);
+		expect(response.json().error).toBe("SMTP not configured");
+	});
+
+	it("POST /settings/test-email sends email when SMTP is configured", async () => {
+		process.env.SMTP_HOST = "smtp.example.com";
+		process.env.SMTP_USER = "mailer@example.com";
+		process.env.SMTP_TOKEN = "secret";
+		nodemailerSendMail.mockResolvedValue(undefined);
+
+		const response = await app.inject({
+			method: "POST",
+			url: "/settings/test-email",
+			payload: { email: "person@example.com" },
+		});
+
+		expect(response.statusCode).toBe(200);
+		expect(nodemailerSendMail).toHaveBeenCalledTimes(1);
+	});
+
+	it("POST /settings/test-shoutrrr validates URL presence", async () => {
+		const response = await app.inject({
+			method: "POST",
+			url: "/settings/test-shoutrrr",
+			payload: { url: "" },
+		});
+		expect(response.statusCode).toBe(400);
+	});
+
+	it("sendShoutrrrNotification blocks localhost/private targets", async () => {
+		const result = await sendShoutrrrNotification("http://127.0.0.1/hook", "test", "message");
+		expect(result.success).toBe(false);
+		expect(result.error).toContain("not allowed");
+	});
+
+	it("sendShoutrrrNotification handles ntfy auth and safe URL reconstruction", async () => {
+		fetchMock.mockResolvedValue({ ok: true });
+
+		const result = await sendShoutrrrNotification("ntfy://user:pass@ntfy.sh/mytopic", "Title ä", "Message");
+
+		expect(result.success).toBe(true);
+		expect(fetchMock).toHaveBeenCalledWith(
+			"https://ntfy.sh/mytopic",
+			expect.objectContaining({
+				headers: expect.objectContaining({
+					Authorization: expect.stringMatching(/^Basic /),
+				}),
+				method: "POST",
+				redirect: "error",
+			})
+		);
+	});
+
+	it("sendShoutrrrNotification uses JSON payload for webhook URLs", async () => {
+		fetchMock.mockResolvedValue({ ok: true });
+		const result = await sendShoutrrrNotification("https://hooks.slack.com/services/a/b/c", "Title", "Body");
+		expect(result.success).toBe(true);
+		const call = fetchMock.mock.calls[0];
+		expect(call[1].headers["Content-Type"]).toBe("application/json");
+		expect(JSON.parse(call[1].body)).toMatchObject({ title: "Title", message: "Body" });
+	});
+
+	it("POST /medications/report-data returns 403 for meds not owned by user", async () => {
+		await seedMedication("Owned Med");
+		const response = await app.inject({
+			method: "POST",
+			url: "/medications/report-data",
+			payload: { medicationIds: [9999] },
+		});
+		expect(response.statusCode).toBe(403);
+	});
+
+	it("POST /medications/report-data aggregates doses and refills", async () => {
+		const medId = await seedMedication("Report Med");
+		await testClient.execute({
+			sql: "INSERT INTO dose_tracking (user_id, dose_id, taken_at, dismissed) VALUES (?, ?, ?, ?)",
+			args: [1, `${medId}-0-1700000000000-Daniel`, 1700000000, 0],
+		});
+		await testClient.execute({
+			sql: "INSERT INTO dose_tracking (user_id, dose_id, taken_at, dismissed) VALUES (?, ?, ?, ?)",
+			args: [1, `${medId}-0-1700000600000-Daniel`, 1700000600, 1],
+		});
+		await testClient.execute({
+			sql: "INSERT INTO refill_history (medication_id, user_id, packs_added, loose_pills_added, used_prescription, refill_date) VALUES (?, ?, ?, ?, ?, ?)",
+			args: [medId, 1, 1, 2, 1, 1700001200],
+		});
+
+		const response = await app.inject({
+			method: "POST",
+			url: "/medications/report-data",
+			payload: { medicationIds: [medId] },
+		});
+		expect(response.statusCode).toBe(200);
+		const body = response.json();
+		expect(body[medId].dosesTaken).toBe(1);
+		expect(body[medId].dosesDismissed).toBe(1);
+		expect(body[medId].refills).toHaveLength(1);
+	});
+
+	it("GET /export includes medications, settings, doseHistory and refillHistory", async () => {
+		const medId = await seedMedication("Export Med");
+		await testClient.execute({
+			sql: "INSERT INTO dose_tracking (user_id, dose_id, taken_at, marked_by) VALUES (?, ?, ?, ?)",
+			args: [1, `${medId}-0-1700000000000-Daniel`, 1700000000, "Daniel"],
+		});
+		await testClient.execute({
+			sql: "INSERT INTO refill_history (medication_id, user_id, packs_added, loose_pills_added, used_prescription, refill_date) VALUES (?, ?, ?, ?, ?, ?)",
+			args: [medId, 1, 1, 3, 0, 1700000000],
+		});
+		await testClient.execute({
+			sql: "INSERT INTO user_settings (user_id, email_enabled, notification_email, share_stock_status, language) VALUES (?, ?, ?, ?, ?)",
+			args: [1, 1, "x@example.com", 1, "de"],
+		});
+		await testClient.execute({
+			sql: "INSERT INTO share_tokens (user_id, token, taken_by, schedule_days) VALUES (?, ?, ?, ?)",
+			args: [1, "abc123", "Daniel", 30],
+		});
+
+		const response = await app.inject({
+			method: "GET",
+			url: "/export?includeSensitive=true&includeImages=false",
+		});
+		expect(response.statusCode).toBe(200);
+		const body = response.json();
+		expect(body.medications).toHaveLength(1);
+		expect(body.doseHistory).toHaveLength(1);
+		expect(body.refillHistory).toHaveLength(1);
+		expect(body.settings.language).toBe("de");
+		expect(body.shareLinks).toHaveLength(1);
+	});
+
+	it("POST /import validates payload and imports minimal valid structure", async () => {
+		const invalid = await app.inject({
+			method: "POST",
+			url: "/import",
+			payload: { foo: "bar" },
+		});
+		expect(invalid.statusCode).toBe(400);
+
+		const validImport = {
+			version: "1.1",
+			exportedAt: new Date().toISOString(),
+			includeSensitiveData: false,
+			medications: [
+				{
+					_exportId: "med-1",
+					name: "Imported Med",
+					genericName: null,
+					takenBy: ["Daniel"],
+					inventory: {
+						packCount: 1,
+						blistersPerPack: 1,
+						pillsPerBlister: 10,
+						totalPills: null,
+						looseTablets: 0,
+						stockAdjustment: 0,
+						packageType: "blister",
+					},
+					pillWeightMg: null,
+					doseUnit: "mg",
+					schedules: [{ usage: 1, every: 1, start: "2026-01-01T08:00:00.000Z", remind: false, takenBy: "Daniel" }],
+					medicationStartDate: "",
+					expiryDate: null,
+					notes: null,
+					intakeRemindersEnabled: false,
+					isObsolete: false,
+					obsoleteAt: null,
+					prescriptionEnabled: false,
+					prescriptionAuthorizedRefills: null,
+					prescriptionRemainingRefills: null,
+					prescriptionLowRefillThreshold: 1,
+					prescriptionExpiryDate: null,
+					dismissedUntil: null,
+					image: null,
+					lastStockCorrectionAt: null,
+				},
+			],
+			doseHistory: [],
+			refillHistory: [],
+			settings: {
+				emailEnabled: false,
+				notificationEmail: null,
+				emailStockReminders: true,
+				emailIntakeReminders: true,
+				emailPrescriptionReminders: true,
+				shoutrrrEnabled: false,
+				shoutrrrUrl: null,
+				shoutrrrStockReminders: true,
+				shoutrrrIntakeReminders: true,
+				shoutrrrPrescriptionReminders: true,
+				reminderDaysBefore: 7,
+				repeatDailyReminders: false,
+				skipRemindersForTakenDoses: false,
+				repeatRemindersEnabled: false,
+				reminderRepeatIntervalMinutes: 30,
+				maxNaggingReminders: 5,
+				lowStockDays: 30,
+				normalStockDays: 90,
+				highStockDays: 180,
+				expiryWarningDays: 30,
+				language: "en",
+				stockCalculationMode: "automatic",
+				shareStockStatus: true,
+			},
+			shareLinks: [],
+		};
+
+		const valid = await app.inject({
+			method: "POST",
+			url: "/import",
+			payload: validImport,
+		});
+		expect(valid.statusCode).toBe(200);
+		expect(valid.json().imported.medications).toBe(1);
+
+		const rows = await testClient.execute({
+			sql: "SELECT name FROM medications WHERE user_id = 1",
+		});
+		expect(rows.rows[0].name).toBe("Imported Med");
+	});
+});

backend/src/test/server.test.ts

@@ -4,7 +4,7 @@ import { resolve } from "node:path";
 import cookie from "@fastify/cookie";
 import cors from "@fastify/cors";
 import sensible from "@fastify/sensible";
-import Fastify from "fastify";
+import Fastify, { type FastifyInstance } from "fastify";
 import { afterEach, describe, expect, it } from "vitest";
 
 // Import from utils to avoid index.ts import side effects (server start)
@@ -294,10 +294,18 @@ describe("Server Bootstrap", () => {
 				refreshCookieOptions,
 			});
 
-			expect((app as any).config.accessTtl).toBe(15);
-			expect((app as any).config.refreshTtl).toBe(7);
-			expect((app as any).config.cookieOptions.httpOnly).toBe(true);
-			expect((app as any).config.refreshCookieOptions.maxAge).toBe(7 * 24 * 60 * 60);
+			const appWithConfig = app as unknown as {
+				config: {
+					accessTtl: number;
+					refreshTtl: number;
+					cookieOptions: { httpOnly: boolean };
+					refreshCookieOptions: { maxAge: number };
+				};
+			};
+			expect(appWithConfig.config.accessTtl).toBe(15);
+			expect(appWithConfig.config.refreshTtl).toBe(7);
+			expect(appWithConfig.config.cookieOptions.httpOnly).toBe(true);
+			expect(appWithConfig.config.refreshCookieOptions.maxAge).toBe(7 * 24 * 60 * 60);
 
 			await app.close();
 		});
@@ -364,15 +372,15 @@ describe("Server Bootstrap", () => {
 			const app = Fastify({ logger: false });
 
 			// Mock route plugins
-			const healthRoutes = async (app: any) => {
+			const healthRoutes = async (app: FastifyInstance) => {
 				app.get("/health", async () => ({ status: "ok" }));
 			};
 
-			const authRoutes = async (app: any) => {
+			const authRoutes = async (app: FastifyInstance) => {
 				app.post("/auth/login", async () => ({ token: "mock" }));
 			};
 
-			const medicationRoutes = async (app: any) => {
+			const medicationRoutes = async (app: FastifyInstance) => {
 				app.get("/medications", async () => []);
 			};
 

backend/src/test/services.test.ts

@@ -388,6 +388,56 @@ describe("Scheduler Utils - Upcoming Intakes", () => {
 			// Both should be found as they're within the window
 			expect(result.length).toBeGreaterThanOrEqual(1);
 		});
+
+		it("should catch up missed advance reminder when notify window passed but intake still future", () => {
+			// Intake at 15:57, reminder 15 min before = 15:42
+			// Scheduler was down at 15:42, now running at 15:50 (intake still in future)
+			const intakes: Intake[] = [blisterToIntake({ usage: 1, every: 1, start: "2025-01-01T15:57:00" })];
+			// "now" = 15:50 local time on the same day — past the 15:42 notify window, but before 15:57 intake
+			const now = new Date(2025, 0, 1, 15, 50, 0).getTime();
+
+			const result = getUpcomingIntakes("TestMed", intakes, 15, [], null, "en-US", "UTC", now);
+
+			// Should still return the intake as a catch-up advance reminder
+			expect(result).toHaveLength(1);
+			expect(result[0].medName).toBe("TestMed");
+			expect(result[0].usage).toBe(1);
+		});
+
+		it("should catch up missed advance reminder even 1 minute before intake", () => {
+			// Intake at 08:00, reminder at 07:45. Scheduler catches up at 07:59.
+			const intakes: Intake[] = [blisterToIntake({ usage: 1, every: 1, start: "2025-01-01T08:00:00" })];
+			const now = new Date(2025, 0, 1, 7, 59, 30).getTime();
+
+			const result = getUpcomingIntakes("TestMed", intakes, 15, [], null, "en-US", "UTC", now);
+
+			expect(result).toHaveLength(1);
+		});
+
+		it("should not catch up for intakes already in the past", () => {
+			// Intake at 08:00, reminder at 07:45. Now = 08:05 (intake already past).
+			const intakes: Intake[] = [blisterToIntake({ usage: 1, every: 1, start: "2025-01-01T08:00:00" })];
+			const now = new Date(2025, 0, 1, 8, 5, 0).getTime();
+
+			const result = getUpcomingIntakes("TestMed", intakes, 15, [], null, "en-US", "UTC", now);
+
+			// Should NOT return — intake is past, handled by getTodaysIntakes instead
+			expect(result).toHaveLength(0);
+		});
+
+		it("should catch up for recurring intake on later day", () => {
+			// Intake started Jan 1 at 10:00, every 1 day. Now = Jan 3 at 09:50 (past notify, before intake)
+			const intakes: Intake[] = [blisterToIntake({ usage: 1, every: 1, start: "2025-01-01T10:00:00" })];
+			const now = new Date(2025, 0, 3, 9, 50, 0).getTime();
+
+			const result = getUpcomingIntakes("TestMed", intakes, 15, [], null, "en-US", "UTC", now);
+
+			// Should return today's occurrence via catch-up
+			expect(result).toHaveLength(1);
+			// The intake time should be Jan 3 at 10:00
+			expect(result[0].intakeTime.getHours()).toBe(10);
+			expect(result[0].intakeTime.getDate()).toBe(3);
+		});
 	});
 
 	describe("getTodaysIntakes", () => {

backend/src/test/settings.test.ts

@@ -51,6 +51,7 @@ async function registerSettingsRoutes(ctx: TestContext) {
 				expiryWarningDays: 90,
 				language: "en",
 				stockCalculationMode: "automatic",
+				shareStockStatus: true,
 			};
 		}
 
@@ -76,6 +77,7 @@ async function registerSettingsRoutes(ctx: TestContext) {
 			expiryWarningDays: s.expiry_warning_days,
 			language: s.language,
 			stockCalculationMode: s.stock_calculation_mode,
+			shareStockStatus: Boolean(s.share_stock_status ?? 1),
 		};
 	});
 
@@ -102,6 +104,7 @@ async function registerSettingsRoutes(ctx: TestContext) {
 			expiryWarningDays?: number;
 			language?: string;
 			stockCalculationMode?: "automatic" | "manual";
+			shareStockStatus?: boolean;
 		};
 	}>("/settings", async (request, reply) => {
 		const userId = 1;
@@ -150,8 +153,8 @@ async function registerSettingsRoutes(ctx: TestContext) {
           reminder_days_before, repeat_daily_reminders, skip_reminders_for_taken_doses,
           repeat_reminders_enabled, reminder_repeat_interval_minutes, max_nagging_reminders,
           low_stock_days, normal_stock_days, high_stock_days,
-          expiry_warning_days, language, stock_calculation_mode
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+          expiry_warning_days, language, stock_calculation_mode, share_stock_status
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 				args: [
 					userId,
 					body.emailEnabled ? 1 : 0,
@@ -174,6 +177,7 @@ async function registerSettingsRoutes(ctx: TestContext) {
 					body.expiryWarningDays ?? 90,
 					body.language || "en",
 					body.stockCalculationMode || "automatic",
+					body.shareStockStatus !== false ? 1 : 0,
 				],
 			});
 		} else {
@@ -200,6 +204,7 @@ async function registerSettingsRoutes(ctx: TestContext) {
           expiry_warning_days = ?,
           language = ?,
           stock_calculation_mode = ?,
+          share_stock_status = ?,
           updated_at = strftime('%s','now')
         WHERE user_id = ?`,
 				args: [
@@ -223,6 +228,7 @@ async function registerSettingsRoutes(ctx: TestContext) {
 					body.expiryWarningDays ?? 90,
 					body.language || "en",
 					body.stockCalculationMode || "automatic",
+					body.shareStockStatus !== false ? 1 : 0,
 					userId,
 				],
 			});
@@ -542,6 +548,64 @@ describe("Settings API", () => {
 		});
 	});
 
+	// ---------------------------------------------------------------------------
+	// Share Stock Status
+	// ---------------------------------------------------------------------------
+
+	describe("Share Stock Status", () => {
+		it("should default to true (show stock on shared links)", async () => {
+			const response = await ctx.app.inject({
+				method: "GET",
+				url: "/settings",
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json().shareStockStatus).toBe(true);
+		});
+
+		it("should disable share stock status", async () => {
+			const response = await ctx.app.inject({
+				method: "PUT",
+				url: "/settings",
+				payload: { shareStockStatus: false },
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			const getResponse = await ctx.app.inject({
+				method: "GET",
+				url: "/settings",
+			});
+
+			expect(getResponse.json().shareStockStatus).toBe(false);
+		});
+
+		it("should re-enable share stock status", async () => {
+			// Disable first
+			await ctx.app.inject({
+				method: "PUT",
+				url: "/settings",
+				payload: { shareStockStatus: false },
+			});
+
+			// Re-enable
+			const response = await ctx.app.inject({
+				method: "PUT",
+				url: "/settings",
+				payload: { shareStockStatus: true },
+			});
+
+			expect(response.statusCode).toBe(200);
+
+			const getResponse = await ctx.app.inject({
+				method: "GET",
+				url: "/settings",
+			});
+
+			expect(getResponse.json().shareStockStatus).toBe(true);
+		});
+	});
+
 	// ---------------------------------------------------------------------------
 	// Repeat Reminders & Skip Reminders Settings
 	// ---------------------------------------------------------------------------

backend/src/test/setup.ts

@@ -216,13 +216,14 @@ export interface UpdateUserSettingsOptions {
 	userId: number;
 	stockCalculationMode?: "automatic" | "manual";
 	lowStockDays?: number;
+	shareStockStatus?: boolean;
 }
 
 /**
  * Create or update user settings
  */
 export async function setUserSettings(client: Client, options: UpdateUserSettingsOptions): Promise<void> {
-	const { userId, stockCalculationMode = "automatic", lowStockDays = 30 } = options;
+	const { userId, stockCalculationMode = "automatic", lowStockDays = 30, shareStockStatus } = options;
 
 	// Check if settings exist
 	const existing = await client.execute({
@@ -232,13 +233,19 @@ export async function setUserSettings(client: Client, options: UpdateUserSetting
 
 	if (existing.rows.length > 0) {
 		await client.execute({
-			sql: `UPDATE user_settings SET stock_calculation_mode = ?, low_stock_days = ? WHERE user_id = ?`,
-			args: [stockCalculationMode, lowStockDays, userId],
+			sql: `UPDATE user_settings SET stock_calculation_mode = ?, low_stock_days = ?${shareStockStatus !== undefined ? ", share_stock_status = ?" : ""} WHERE user_id = ?`,
+			args:
+				shareStockStatus !== undefined
+					? [stockCalculationMode, lowStockDays, shareStockStatus ? 1 : 0, userId]
+					: [stockCalculationMode, lowStockDays, userId],
 		});
 	} else {
 		await client.execute({
-			sql: `INSERT INTO user_settings (user_id, stock_calculation_mode, low_stock_days) VALUES (?, ?, ?)`,
-			args: [userId, stockCalculationMode, lowStockDays],
+			sql: `INSERT INTO user_settings (user_id, stock_calculation_mode, low_stock_days${shareStockStatus !== undefined ? ", share_stock_status" : ""}) VALUES (?, ?, ?${shareStockStatus !== undefined ? ", ?" : ""})`,
+			args:
+				shareStockStatus !== undefined
+					? [userId, stockCalculationMode, lowStockDays, shareStockStatus ? 1 : 0]
+					: [userId, stockCalculationMode, lowStockDays],
 		});
 	}
 }

backend/src/test/share.test.ts

@@ -10,6 +10,7 @@ import {
 	createTestMedication,
 	createTestShareToken,
 	createTestUser,
+	setUserSettings,
 	type TestContext,
 } from "./setup.js";
 
@@ -141,6 +142,14 @@ async function registerShareRoutes(ctx: TestContext) {
 
 		const lowStockDays = settingsResult.rows.length > 0 ? (settingsResult.rows[0].low_stock_days as number) : 30;
 
+		// Get shareStockStatus setting
+		const shareStockResult = await client.execute({
+			sql: `SELECT share_stock_status FROM user_settings WHERE user_id = ?`,
+			args: [share.user_id],
+		});
+		const shareStockStatus =
+			shareStockResult.rows.length > 0 ? Boolean(shareStockResult.rows[0].share_stock_status ?? 1) : true;
+
 		return {
 			takenBy: share.taken_by,
 			sharedBy: share.owner_username,
@@ -149,6 +158,7 @@ async function registerShareRoutes(ctx: TestContext) {
 			stockThresholds: {
 				lowStockDays,
 			},
+			shareStockStatus,
 		};
 	});
 
@@ -421,6 +431,41 @@ describe("Share Link API", () => {
 			expect(med.blisters).toHaveLength(1);
 			expect(med.blisters[0].usage).toBe(1);
 			expect(med.blisters[0].every).toBe(1);
+
+			// shareStockStatus should default to true
+			expect(data.shareStockStatus).toBe(true);
+		});
+
+		it("should respect shareStockStatus setting when disabled", async () => {
+			// Create medication
+			await createTestMedication(ctx.client, {
+				userId,
+				name: "TestMed",
+				takenBy: ["Daniel"],
+				packCount: 1,
+				blistersPerPack: 1,
+				pillsPerBlister: 10,
+				looseTablets: 0,
+				blisters: [{ usage: 1, every: 1, start: "2025-01-01T08:00:00.000Z" }],
+			});
+
+			// Set shareStockStatus to false
+			await setUserSettings(ctx.client, { userId, shareStockStatus: false });
+
+			// Create share token
+			const token = await createTestShareToken(ctx.client, {
+				userId,
+				takenBy: "Daniel",
+				scheduleDays: 30,
+			});
+
+			const response = await ctx.app.inject({
+				method: "GET",
+				url: `/share/${token}`,
+			});
+
+			expect(response.statusCode).toBe(200);
+			expect(response.json().shareStockStatus).toBe(false);
 		});
 
 		it("should return 404 for invalid token", async () => {

backend/src/test/stock-calculation.test.ts

@@ -612,8 +612,8 @@ describe("Stock Calculation API", () => {
 			const data = response.json();
 			expect(data).toHaveLength(2);
 
-			const medA = data.find((d: any) => d.medicationName === "Med A");
-			const medB = data.find((d: any) => d.medicationName === "Med B");
+			const medA = data.find((d: Record<string, unknown>) => d.medicationName === "Med A");
+			const medB = data.find((d: Record<string, unknown>) => d.medicationName === "Med B");
 
 			expect(medA.plannerUsage).toBe(10); // 10 days × 1 pill
 			expect(medB.plannerUsage).toBe(10); // 5 doses × 2 pills

backend/src/test/stock-semantics-parity.test.ts

@@ -0,0 +1,350 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { migrate } from "drizzle-orm/libsql/migrator";
+import Fastify, { type FastifyInstance } from "fastify";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { runAlterMigrations } from "../db/db-utils.js";
+
+const { testClient, testDb, mockedEnv } = vi.hoisted(() => {
+	const { createClient } = require("@libsql/client");
+	const { drizzle } = require("drizzle-orm/libsql");
+	const client = createClient({ url: ":memory:" });
+	const db = drizzle(client);
+	return {
+		testClient: client,
+		testDb: db,
+		mockedEnv: {
+			AUTH_ENABLED: false,
+			OIDC_ENABLED: false,
+			OIDC_PROVIDER_NAME: "SSO",
+			NODE_ENV: "test",
+		},
+	};
+});
+
+vi.mock("../db/client.js", () => ({
+	db: testDb,
+	migrationsReady: Promise.resolve(),
+}));
+
+vi.mock("../plugins/env.js", () => ({ env: mockedEnv }));
+
+vi.mock("../plugins/auth.js", () => ({
+	requireAuth: async () => {},
+	getAnonymousUserId: async () => 1,
+}));
+
+const { medicationRoutes } = await import("../routes/medications.js");
+const { getMedicationsNeedingReminderForTests } = await import("../services/reminder-scheduler.js");
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const migrationsFolder = resolve(__dirname, "../../drizzle");
+
+async function clearTables() {
+	await testClient.execute("DELETE FROM refill_history");
+	await testClient.execute("DELETE FROM dose_tracking");
+	await testClient.execute("DELETE FROM share_tokens");
+	await testClient.execute("DELETE FROM user_settings");
+	await testClient.execute("DELETE FROM medications");
+	await testClient.execute("DELETE FROM users");
+}
+
+async function seedAnonymousUser() {
+	await testClient.execute({
+		sql: "INSERT INTO users (id, username, auth_provider, is_active) VALUES (?, ?, ?, 1)",
+		args: [1, "anon", "anonymous"],
+	});
+}
+
+async function setStockMode(mode: "automatic" | "manual") {
+	await testClient.execute({
+		sql: `INSERT INTO user_settings (user_id, stock_calculation_mode, reminder_days_before, low_stock_days, language)
+              VALUES (?, ?, 7, 365, 'en')`,
+		args: [1, mode],
+	});
+}
+
+async function createMedication(options: {
+	name: string;
+	packCount?: number;
+	blistersPerPack?: number;
+	pillsPerBlister?: number;
+	looseTablets?: number;
+	stockAdjustment?: number;
+	lastStockCorrectionAt?: number | null;
+	isObsolete?: boolean;
+	takenBy?: string[];
+	intakes: Array<{ usage: number; every: number; start: string; takenBy?: string | null }>;
+}) {
+	const {
+		name,
+		packCount = 1,
+		blistersPerPack = 1,
+		pillsPerBlister = 10,
+		looseTablets = 0,
+		stockAdjustment = 0,
+		lastStockCorrectionAt = null,
+		isObsolete = false,
+		takenBy = [],
+		intakes,
+	} = options;
+
+	const usageJson = JSON.stringify(intakes.map((i) => i.usage));
+	const everyJson = JSON.stringify(intakes.map((i) => i.every));
+	const startJson = JSON.stringify(intakes.map((i) => i.start));
+	const intakesJson = JSON.stringify(
+		intakes.map((i) => ({
+			usage: i.usage,
+			every: i.every,
+			start: i.start,
+			takenBy: i.takenBy ?? null,
+			intakeRemindersEnabled: false,
+		}))
+	);
+
+	const result = await testClient.execute({
+		sql: `INSERT INTO medications (
+        user_id, name, taken_by_json, package_type,
+        pack_count, blisters_per_pack, pills_per_blister, loose_tablets,
+        stock_adjustment, last_stock_correction_at,
+        usage_json, every_json, start_json, intakes_json,
+        is_obsolete, intake_reminders_enabled
+      ) VALUES (?, ?, ?, 'blister', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+      RETURNING id`,
+		args: [
+			1,
+			name,
+			JSON.stringify(takenBy),
+			packCount,
+			blistersPerPack,
+			pillsPerBlister,
+			looseTablets,
+			stockAdjustment,
+			lastStockCorrectionAt,
+			usageJson,
+			everyJson,
+			startJson,
+			intakesJson,
+			isObsolete ? 1 : 0,
+		],
+	});
+
+	return Number(result.rows[0].id);
+}
+
+async function markDoseTaken(options: {
+	medicationId: number;
+	blisterIdx: number;
+	doseDateOnlyMs: number;
+	takenAtMs: number;
+	personSuffix?: string;
+}) {
+	const { medicationId, blisterIdx, doseDateOnlyMs, takenAtMs, personSuffix } = options;
+	const baseId = `${medicationId}-${blisterIdx}-${doseDateOnlyMs}`;
+	const doseId = personSuffix ? `${baseId}-${personSuffix}` : baseId;
+	await testClient.execute({
+		sql: "INSERT INTO dose_tracking (user_id, dose_id, taken_at, dismissed) VALUES (?, ?, ?, 0)",
+		args: [1, doseId, Math.floor(takenAtMs / 1000)],
+	});
+}
+
+async function getUsageRow(app: FastifyInstance, startDate: string, endDate: string, medicationName: string) {
+	const response = await app.inject({
+		method: "POST",
+		url: "/medications/usage",
+		payload: { startDate, endDate },
+	});
+
+	expect(response.statusCode).toBe(200);
+	const rows = response.json();
+	const row = rows.find((r: { medicationName: string }) => r.medicationName === medicationName);
+	expect(row).toBeDefined();
+	return row;
+}
+
+function toDateOnlyMs(date: Date) {
+	return new Date(date.getFullYear(), date.getMonth(), date.getDate()).getTime();
+}
+
+describe("Stock semantics parity (planner usage vs scheduler)", () => {
+	let app: FastifyInstance;
+
+	beforeAll(async () => {
+		await migrate(testDb, { migrationsFolder });
+		await runAlterMigrations(testClient);
+		app = Fastify({ logger: false });
+		await app.register(medicationRoutes);
+		await app.ready();
+	});
+
+	afterAll(async () => {
+		await app.close();
+		testClient.close();
+	});
+
+	beforeEach(async () => {
+		await clearTables();
+		await seedAnonymousUser();
+	});
+
+	it("keeps automatic mode current stock in sync", async () => {
+		await setStockMode("automatic");
+		const medName = "Auto Sync";
+		await createMedication({
+			name: medName,
+			packCount: 1,
+			blistersPerPack: 1,
+			pillsPerBlister: 10,
+			intakes: [{ usage: 1, every: 1, start: "2026-01-01T08:00:00" }],
+		});
+
+		const usageRow = await getUsageRow(app, "2026-01-01T00:00:00.000Z", "2026-01-31T23:59:59.999Z", medName);
+		const lowStock = await getMedicationsNeedingReminderForTests(1, 7, 365, "en", "automatic");
+		const schedulerRow = lowStock.find((r) => r.name === medName);
+
+		expect(schedulerRow).toBeDefined();
+		expect(usageRow.currentPills).toBe(usageRow.totalPills);
+		expect(usageRow.currentPills).toBe(schedulerRow!.medsLeft);
+	});
+
+	it("keeps manual mode current stock in sync and does not auto-consume", async () => {
+		await setStockMode("manual");
+		const medName = "Manual Sync";
+		await createMedication({
+			name: medName,
+			packCount: 1,
+			blistersPerPack: 1,
+			pillsPerBlister: 10,
+			intakes: [{ usage: 1, every: 1, start: "2026-01-01T08:00:00" }],
+		});
+
+		const usageRow = await getUsageRow(app, "2026-01-01T00:00:00.000Z", "2026-01-31T23:59:59.999Z", medName);
+		const lowStock = await getMedicationsNeedingReminderForTests(1, 7, 365, "en", "manual");
+		const schedulerRow = lowStock.find((r) => r.name === medName);
+
+		expect(schedulerRow).toBeDefined();
+		expect(usageRow.currentPills).toBe(10);
+		expect(usageRow.currentPills).toBe(schedulerRow!.medsLeft);
+	});
+
+	it("respects lastStockCorrectionAt cutoff in manual mode by takenAt", async () => {
+		await setStockMode("manual");
+		const medName = "Manual Correction";
+		const correctionMs = new Date("2026-01-05T12:00:00.000Z").getTime();
+		const medicationId = await createMedication({
+			name: medName,
+			packCount: 1,
+			blistersPerPack: 1,
+			pillsPerBlister: 10,
+			lastStockCorrectionAt: correctionMs,
+			intakes: [{ usage: 1, every: 1, start: "2026-01-01T08:00:00" }],
+		});
+
+		const jan5DateOnly = toDateOnlyMs(new Date("2026-01-05T00:00:00.000Z"));
+		const jan6DateOnly = toDateOnlyMs(new Date("2026-01-06T00:00:00.000Z"));
+
+		await markDoseTaken({
+			medicationId,
+			blisterIdx: 0,
+			doseDateOnlyMs: jan5DateOnly,
+			takenAtMs: new Date("2026-01-05T10:00:00.000Z").getTime(),
+		});
+		await markDoseTaken({
+			medicationId,
+			blisterIdx: 0,
+			doseDateOnlyMs: jan6DateOnly,
+			takenAtMs: new Date("2026-01-06T10:00:00.000Z").getTime(),
+		});
+
+		const usageRow = await getUsageRow(app, "2026-01-01T00:00:00.000Z", "2026-01-31T23:59:59.999Z", medName);
+		const lowStock = await getMedicationsNeedingReminderForTests(1, 7, 365, "en", "manual");
+		const schedulerRow = lowStock.find((r) => r.name === medName);
+
+		expect(schedulerRow).toBeDefined();
+		expect(usageRow.currentPills).toBe(schedulerRow!.medsLeft);
+	});
+
+	it("counts early taken dose in automatic mode without drift", async () => {
+		await setStockMode("automatic");
+		const medName = "Early Taken";
+		const now = new Date();
+		const tomorrow = new Date(now);
+		tomorrow.setDate(now.getDate() + 1);
+		tomorrow.setHours(20, 0, 0, 0);
+		const medicationId = await createMedication({
+			name: medName,
+			packCount: 1,
+			blistersPerPack: 1,
+			pillsPerBlister: 10,
+			intakes: [{ usage: 1, every: 1, start: tomorrow.toISOString().slice(0, 19) }],
+		});
+
+		const tomorrowDateOnly = toDateOnlyMs(tomorrow);
+		await markDoseTaken({
+			medicationId,
+			blisterIdx: 0,
+			doseDateOnlyMs: tomorrowDateOnly,
+			takenAtMs: now.getTime(),
+		});
+
+		const rangeStart = new Date(now);
+		rangeStart.setDate(now.getDate() - 1);
+		const rangeEnd = new Date(now);
+		rangeEnd.setDate(now.getDate() + 7);
+		const usageRow = await getUsageRow(app, rangeStart.toISOString(), rangeEnd.toISOString(), medName);
+		const lowStock = await getMedicationsNeedingReminderForTests(1, 7, 365, "en", "automatic");
+		const schedulerRow = lowStock.find((r) => r.name === medName);
+
+		expect(schedulerRow).toBeDefined();
+		expect(usageRow.currentPills).toBe(9);
+		expect(usageRow.currentPills).toBe(schedulerRow!.medsLeft);
+	});
+
+	it("handles mixed intake-level and fallback takenBy consistently", async () => {
+		await setStockMode("automatic");
+		const medName = "Mixed TakenBy";
+		await createMedication({
+			name: medName,
+			packCount: 2,
+			blistersPerPack: 1,
+			pillsPerBlister: 10,
+			takenBy: ["Alice", "Bob"],
+			intakes: [
+				{ usage: 1, every: 1, start: "2026-01-01T08:00:00", takenBy: "Alice" },
+				{ usage: 1, every: 1, start: "2026-01-01T20:00:00", takenBy: null },
+			],
+		});
+
+		const usageRow = await getUsageRow(app, "2026-01-01T00:00:00.000Z", "2026-01-31T23:59:59.999Z", medName);
+		const lowStock = await getMedicationsNeedingReminderForTests(1, 7, 365, "en", "automatic");
+		const schedulerRow = lowStock.find((r) => r.name === medName);
+
+		expect(schedulerRow).toBeDefined();
+		expect(usageRow.currentPills).toBe(schedulerRow!.medsLeft);
+		expect(usageRow.currentPills).toBeLessThan(20);
+	});
+
+	it("excludes obsolete medications from planner usage and scheduler", async () => {
+		await setStockMode("automatic");
+		await createMedication({
+			name: "Obsolete Med",
+			isObsolete: true,
+			packCount: 1,
+			blistersPerPack: 1,
+			pillsPerBlister: 10,
+			intakes: [{ usage: 1, every: 1, start: "2026-01-01T08:00:00" }],
+		});
+
+		const response = await app.inject({
+			method: "POST",
+			url: "/medications/usage",
+			payload: { startDate: "2026-01-01T00:00:00.000Z", endDate: "2026-01-31T23:59:59.999Z" },
+		});
+		expect(response.statusCode).toBe(200);
+		expect(response.json().some((r: { medicationName: string }) => r.medicationName === "Obsolete Med")).toBe(false);
+
+		const lowStock = await getMedicationsNeedingReminderForTests(1, 7, 365, "en", "automatic");
+		expect(lowStock.some((r) => r.name === "Obsolete Med")).toBe(false);
+	});
+});

backend/src/test/translations.test.ts

@@ -69,8 +69,8 @@ describe("Translations Module", () => {
 		});
 
 		it("should replace multiple placeholders", () => {
-			const result = t("{count} {type} running low", { count: 3, type: "medications" });
-			expect(result).toBe("3 medications running low");
+			const result = t("{count} {type} running critically low", { count: 3, type: "medications" });
+			expect(result).toBe("3 medications running critically low");
 		});
 
 		it("should replace same placeholder multiple times", () => {
@@ -98,7 +98,7 @@ describe("Translations Module", () => {
 
 			// Stock reminder subject
 			const subject = t(translations.stockReminder.subject, { count: 3, s: "s" });
-			expect(subject).toBe("MedAssist-ng Auto-Reminder: 3 Medications Running Low");
+			expect(subject).toBe("MedAssist-ng: ⚠️ 3 Medications Running Critically Low");
 
 			// Intake reminder description
 			const description = t(translations.intakeReminder.description, { minutes: 30 });
@@ -113,7 +113,7 @@ describe("Translations Module", () => {
 			const translations = getTranslations("de");
 
 			const subject = t(translations.stockReminder.subject, { count: 2, e: "e" });
-			expect(subject).toBe("MedAssist-ng Auto-Erinnerung: 2 Medikamente wird knapp");
+			expect(subject).toBe("MedAssist-ng: ⚠️ 2 Medikamente kritisch niedrig");
 
 			const takenBy = t(translations.intakeReminder.takenBy, { name: "Daniel" });
 			expect(takenBy).toBe("für Daniel");

backend/src/utils/logger.ts

@@ -0,0 +1,46 @@
+/**
+ * Simple startup logger that respects LOG_LEVEL environment variable.
+ * Used for code that runs before Fastify is initialized (db/client.ts, migrations).
+ * Once Fastify is running, use app.log instead.
+ */
+
+const LOG_LEVELS: Record<string, number> = {
+	silent: 60,
+	fatal: 60,
+	error: 50,
+	warn: 40,
+	info: 30,
+	debug: 20,
+	trace: 10,
+};
+
+function getLevel(): number {
+	const envLevel = (process.env.LOG_LEVEL || "info").toLowerCase();
+	return LOG_LEVELS[envLevel] ?? LOG_LEVELS.info;
+}
+
+function shouldLog(level: string): boolean {
+	return LOG_LEVELS[level] >= getLevel();
+}
+
+export const log = {
+	debug(msg: string): void {
+		if (shouldLog("debug")) console.log(msg);
+	},
+	info(msg: string): void {
+		if (shouldLog("info")) console.log(msg);
+	},
+	warn(msg: string): void {
+		if (shouldLog("warn")) console.warn(msg);
+	},
+	error(msg: string): void {
+		if (shouldLog("error")) console.error(msg);
+	},
+};
+
+/** Logger interface for services that receive a logger from the caller */
+export type ServiceLogger = {
+	info: (msg: string) => void;
+	debug: (msg: string) => void;
+	error: (msg: string) => void;
+};

backend/src/utils/scheduler-utils.ts

@@ -191,7 +191,7 @@ export function parseIntakesJson(
 		try {
 			const parsed = JSON.parse(intakesJson);
 			if (Array.isArray(parsed) && parsed.length > 0) {
-				return parsed.map((intake: any) => ({
+				return parsed.map((intake: Record<string, unknown>) => ({
 					usage: typeof intake.usage === "number" ? intake.usage : 0,
 					every: typeof intake.every === "number" ? intake.every : 1,
 					start: typeof intake.start === "string" ? intake.start : new Date().toISOString(),
@@ -312,7 +312,7 @@ export type UpcomingIntake = {
 export function getTodaysIntakes(
 	medName: string,
 	intakes: Intake[],
-	medicationTakenBy: string[], // Medication-level takenBy as fallback
+	_medicationTakenBy: string[], // Medication-level takenBy as fallback
 	pillWeightMg: number | null,
 	locale: string,
 	tz?: string,
@@ -388,7 +388,7 @@ export function getUpcomingIntakes(
 	medName: string,
 	intakes: Intake[],
 	minutesBefore: number,
-	medicationTakenBy: string[], // Medication-level takenBy as fallback
+	_medicationTakenBy: string[], // Medication-level takenBy as fallback
 	pillWeightMg: number | null,
 	locale: string,
 	tz?: string,
@@ -432,6 +432,11 @@ export function getUpcomingIntakes(
 			const currentNotifyTime = currentOccurrence - minutesBefore * 60 * 1000;
 			if (currentNotifyTime >= currentMinuteStart && currentOccurrence > now) {
 				nextTime = currentOccurrence;
+			} else if (currentNotifyTime < currentMinuteStart && currentOccurrence > now) {
+				// CATCH-UP: The notify window was missed (e.g. due to system sleep/restart)
+				// but the intake time is still in the future — include it so the advance
+				// reminder can still be sent rather than falling into a dead zone.
+				nextTime = currentOccurrence;
 			} else {
 				nextTime = nextOccurrence;
 			}
@@ -440,8 +445,15 @@ export function getUpcomingIntakes(
 		// Calculate when we should notify for this intake
 		const notifyTime = nextTime - minutesBefore * 60 * 1000;
 
-		// Check if notifyTime falls within the current minute (precise matching)
-		if (notifyTime >= currentMinuteStart && notifyTime < currentMinuteEnd) {
+		// Match if:
+		// 1. notifyTime falls within the current minute (normal case), OR
+		// 2. notifyTime is in the past but intakeTime is still in the future (catch-up
+		//    for missed advance reminder window — e.g. scheduler was down during the
+		//    exact notification minute due to system sleep, restart, or heavy load)
+		const isInCurrentMinute = notifyTime >= currentMinuteStart && notifyTime < currentMinuteEnd;
+		const isMissedButStillUpcoming = notifyTime < currentMinuteStart && nextTime > now;
+
+		if (isInCurrentMinute || isMissedButStillUpcoming) {
 			const intakeDate = new Date(nextTime);
 			upcoming.push({
 				medName,
@@ -473,7 +485,7 @@ export type ReminderState = {
 	lastAutoEmailDate: string | null;
 	notifiedMedications: string[];
 	nextScheduledCheck: string | null;
-	lastNotificationType: "stock" | "intake" | null;
+	lastNotificationType: "stock" | "intake" | "prescription" | null;
 	lastNotificationChannel: "email" | "push" | "both" | null;
 };
 

backend/vitest.config.ts

@@ -14,5 +14,25 @@ export default defineConfig({
     },
     // Timeout for longer integration tests
     testTimeout: 10000,
+    coverage: {
+      provider: "v8",
+      reporter: ["text", "json", "html"],
+      include: ["src/**/*.ts"],
+      exclude: [
+        "src/test/**",
+        "src/**/*.d.ts",
+        "src/**/index.ts",
+        "src/services/**",
+        "src/utils/logger.ts",
+      ],
+      thresholds: {
+        global: {
+          lines: 60,
+          functions: 65,
+          branches: 50,
+          statements: 60,
+        },
+      },
+    },
   },
 });

biome.json

@@ -2,14 +2,22 @@
 	"$schema": "https://biomejs.dev/schemas/2.3.12/schema.json",
 	"assist": { "actions": { "source": { "organizeImports": "on" } } },
 	"files": {
-		"includes": ["backend/src/**/*.ts", "frontend/src/**/*.ts", "frontend/src/**/*.tsx", "frontend/src/**/*.css", "frontend/e2e/**/*.ts", "frontend/playwright.config.ts"]
+		"includes": [
+			"backend/src/**/*.ts",
+			"frontend/src/**/*.ts",
+			"frontend/src/**/*.tsx",
+			"frontend/src/**/*.css",
+			"frontend/e2e/**/*.ts",
+			"frontend/playwright.config.ts"
+		]
 	},
 	"linter": {
 		"enabled": true,
 		"rules": {
 			"recommended": true,
 			"complexity": {
-				"noForEach": "off"
+				"noForEach": "off",
+				"noImportantStyles": "off"
 			},
 			"suspicious": {
 				"noExplicitAny": "warn",
@@ -21,7 +29,8 @@
 			"style": {
 				"noNonNullAssertion": "off",
 				"useConst": "error",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noNestedTernary": "warn"
 			},
 			"correctness": {
 				"noUnusedVariables": "warn",

docker-compose.dev.yml

@@ -11,6 +11,7 @@ services:
       - .env
     environment:
       - DATA_DIR=/app/data
+      - RATE_LIMIT_MAX=1000
     ports:
       - "3000:3000"
     security_opt:
@@ -29,6 +30,10 @@ services:
     volumes:
       - ./frontend:/app
       - frontend_node_modules:/app/node_modules
+    env_file:
+      - .env
+    environment:
+      - BACKEND_URL=http://backend-dev:3000
     ports:
       - "5173:5173"
     security_opt:

docker-compose.yml

@@ -35,6 +35,8 @@ services:
   frontend:
     image: ghcr.io/danielvolz/medassist-ng-frontend:latest
     container_name: medassist-ng-frontend
+    env_file:
+      - .env
     environment:
       - BACKEND_URL=backend:3000
     ports:

docs/PROJECT_SETUP.md

@@ -0,0 +1,80 @@
+# GitHub Project Setup
+
+This repository includes a GitHub Actions workflow that automatically adds new issues to a GitHub Project for tracking feature requests and bugs.
+
+## Setup Steps
+
+### 1. Create a GitHub Project
+
+1. Go to your GitHub profile → **Projects** → **New project**
+2. Choose the **Board** template (recommended for feature tracking)
+3. Name it e.g. **MedAssist-ng Roadmap**
+4. Configure the default columns:
+   - **Triage** – New issues land here
+   - **Backlog** – Accepted but not yet started
+   - **In Progress** – Currently being worked on
+   - **Done** – Completed
+
+### 2. Create a Personal Access Token (PAT)
+
+The workflow needs a token with project permissions. The built-in `GITHUB_TOKEN` does not support GitHub Projects.
+
+1. Go to **Settings** → **Developer settings** → **Personal access tokens** → **Fine-grained tokens**
+2. Click **Generate new token**
+3. Set:
+   - **Token name**: `add-to-project`
+   - **Expiration**: Choose an appropriate duration
+   - **Repository access**: Select **Only select repositories** → `DanielVolz/medassist-ng`
+   - **Permissions**:
+     - Repository permissions: **Issues** → Read
+     - Organization permissions (if applicable): **Projects** → Read and write
+   - For **user-owned projects**, you need a **classic** token with the `project` scope instead
+4. Copy the generated token
+
+### 3. Add Repository Secrets and Variables
+
+1. Go to the repository → **Settings** → **Secrets and variables** → **Actions**
+2. Add a **secret**:
+   - Name: `ADD_TO_PROJECT_PAT`
+   - Value: The PAT from step 2
+3. Add a **variable** (under the **Variables** tab):
+   - Name: `PROJECT_URL`
+   - Value: The full URL of your GitHub Project (e.g. `https://github.com/users/DanielVolz/projects/1`)
+
+### 4. Verify
+
+1. Create a test issue using the **✨ Feature Request** template
+2. Check the **Actions** tab to see the workflow run
+3. Verify the issue appears in your GitHub Project under **Triage**
+
+## How It Works
+
+The workflow (`.github/workflows/add-to-project.yml`) triggers when:
+- A new issue is **opened**
+- A label is **added** to an existing issue
+
+Issues with any of these labels are automatically added to the project:
+- `enhancement` – Feature requests
+- `bug` – Bug reports
+- `triage` – New issues needing review
+
+Both the feature request and bug report issue templates automatically apply the `triage` label, so all new issues from templates are captured.
+
+## Customization
+
+### Adding more labels
+
+Edit `.github/workflows/add-to-project.yml` and add labels to the `labeled` field:
+
+```yaml
+labeled: enhancement, bug, triage, documentation
+```
+
+### Restricting to feature requests only
+
+Change the `labeled` field to only include `enhancement`:
+
+```yaml
+labeled: enhancement
+label-operator: OR
+```

frontend/Dockerfile

@@ -41,6 +41,9 @@ RUN sed -i 's|include /etc/nginx/conf.d/\*.conf;|include /tmp/default.conf;|' /e
 # nginx-unprivileged automatically substitutes env vars in .template files
 COPY nginx.conf /etc/nginx/templates/default.conf.template
 
+# Copy entrypoint wrapper (translates LOG_LEVEL → nginx access log control)
+COPY --chmod=755 nginx-entrypoint.sh /nginx-entrypoint.sh
+
 # Copy built static files with correct ownership (nginx user = uid 101)
 COPY --from=builder --chown=101:101 /app/dist /usr/share/nginx/html
 
@@ -50,5 +53,6 @@ EXPOSE 8080
 # Already runs as non-root (nginx user, uid 101)
 USER nginx
 
-# Start nginx (entrypoint processes templates automatically)
+# Use wrapper entrypoint that maps LOG_LEVEL to nginx config
+ENTRYPOINT ["/nginx-entrypoint.sh"]
 CMD ["nginx", "-g", "daemon off;"]

frontend/e2e/auth.setup.ts

@@ -6,8 +6,31 @@ import { TEST_USER } from "./fixtures";
 const authFile = path.join(import.meta.dirname, ".auth", "user.json");
 
 /**
- * Global setup for authentication
- * This runs before all tests to ensure a test user exists and stores the authenticated state
+ * Check if a JWT token is still valid (not expired) without making a
+ * network request.  Returns `true` when the token has at least 2 minutes
+ * of remaining validity.
+ */
+function isTokenValid(token: string): boolean {
+	try {
+		const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString());
+		// Require at least 10 minutes of remaining validity to ensure the token
+		// lasts through the entire test run (which can take 7+ minutes)
+		return typeof payload.exp === "number" && Date.now() / 1000 < payload.exp - 600;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Global setup: ensure a test user exists and persist authenticated state.
+ * Runs once before all test projects.
+ *
+ * Strategy:
+ * 1. If a valid auth file exists whose access_token JWT has not expired,
+ *    reuse it without any network call (saves rate-limit budget).
+ * 2. If auth is disabled (no login page), save state immediately.
+ * 3. Try to register via API (idempotent — fails silently if user exists).
+ * 4. Log in via the UI.
  */
 setup("authenticate", async ({ page }) => {
 	// Create .auth directory if it doesn't exist
@@ -16,61 +39,73 @@ setup("authenticate", async ({ page }) => {
 		fs.mkdirSync(authDir, { recursive: true });
 	}
 
+	// ---- 1. Try to reuse an existing auth file (offline check) ----
+	if (fs.existsSync(authFile)) {
+		try {
+			const saved = JSON.parse(fs.readFileSync(authFile, "utf-8"));
+			const accessCookie = saved.cookies?.find((c: { name: string }) => c.name === "access_token");
+			if (accessCookie?.value && isTokenValid(accessCookie.value)) {
+				// Token still has enough validity — skip login entirely
+				return;
+			}
+		} catch {
+			// Invalid file — fall through to regular login
+		}
+	}
+
+	// ---- 2. Check if auth is disabled ----
 	await page.goto("/");
 
-	// Wait for the app to fully load (network idle + content visible)
-	await page.waitForLoadState("networkidle");
-	await expect(page.locator("body")).not.toHaveText(/^$/, { timeout: 15000 });
-
-	// Check if auth is disabled (we can access dashboard directly)
-	const dashboardVisible = await page
-		.getByText(/dashboard|medications|schedule/i)
+	const authDisabled = await page
+		.locator("header.hero")
 		.isVisible()
 		.catch(() => false);
-	if (dashboardVisible) {
-		// Auth is disabled - save empty state and return
+	if (authDisabled) {
 		await page.context().storageState({ path: authFile });
 		return;
 	}
 
-	// Check if we need to register (first user setup)
-	const needsSetup = await page
-		.getByText(/create.*first.*user|create.*account|register|first user setup/i)
+	// Wait for auth container
+	await expect(page.locator(".auth-container")).toBeVisible({ timeout: 15000 });
+
+	// ---- 3. Ensure the test user exists ----
+	const baseURL = process.env.PLAYWRIGHT_BASE_URL || "http://localhost:5173";
+	await page.request
+		.post(`${baseURL}/api/auth/register`, {
+			data: { username: TEST_USER.username, password: TEST_USER.password },
+		})
+		.catch(() => {});
+
+	// ---- 4. Log in via UI ----
+	const usernameField = page.locator("#username");
+	const passwordField = page.locator("#password");
+
+	// Make sure we're on the login form (not register)
+	const isOnRegister = await page
+		.locator(".auth-subtitle")
+		.filter({ hasText: /Create Account/i })
 		.isVisible()
 		.catch(() => false);
 
-	if (needsSetup) {
-		// Register the test user
-		const usernameField = page.getByLabel(/username/i);
-		const passwordField = page.getByLabel(/password/i).first();
-
-		await usernameField.fill(TEST_USER.username);
-		await passwordField.fill(TEST_USER.password);
-
-		// Look for register/create button
-		const registerButton = page.getByRole("button", { name: /register|create|sign up/i });
-		await registerButton.click();
-
-		// Wait for successful registration and redirect
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 15000 });
-	} else {
-		// Need to login
-		const usernameField = page.getByLabel(/username/i);
-		const passwordField = page.getByLabel(/password/i);
-
-		// Check if we're on login page
-		if (await usernameField.isVisible().catch(() => false)) {
-			await usernameField.fill(TEST_USER.username);
-			await passwordField.fill(TEST_USER.password);
-
-			const loginButton = page.getByRole("button", { name: /sign in|log in|login/i });
-			await loginButton.click();
-
-			// Wait for successful login
-			await expect(page.getByRole("navigation")).toBeVisible({ timeout: 15000 });
+	if (isOnRegister) {
+		const switchBtn = page.locator("button.auth-link-btn");
+		if (await switchBtn.isVisible().catch(() => false)) {
+			await switchBtn.click();
+			await page.waitForTimeout(500);
 		}
 	}
 
-	// Save the authenticated state
+	await usernameField.clear();
+	await usernameField.fill(TEST_USER.username);
+	await passwordField.clear();
+	await passwordField.fill(TEST_USER.password);
+
+	// Click the submit button (not the SSO button)
+	await page.locator('button.auth-submit[type="submit"]').click();
+
+	// Wait for successful auth — app header should appear
+	await expect(page.locator("header.hero")).toBeVisible({ timeout: 15000 });
+
+	// Persist authenticated state for all test projects
 	await page.context().storageState({ path: authFile });
 });

frontend/e2e/auth.spec.ts

@@ -1,118 +1,113 @@
-import { expect, test } from "@playwright/test";
+import { expect, type Page, test } from "@playwright/test";
 
-/**
- * Helper to wait for the app's auth state to be determined
- * The app shows Loading/Initializing until auth state is fetched
- */
-async function waitForAuthReady(page: import("@playwright/test").Page): Promise<void> {
-	// Wait for the loading indicator to disappear
-	await page.waitForLoadState("networkidle");
-	// The app should have loaded something meaningful
-	await expect(page.locator("body")).not.toHaveText(/^$/, { timeout: 10000 });
+async function isAuthEnabled(page: Page): Promise<boolean> {
+	try {
+		const response = await page.request.get("/api/auth/state");
+		if (!response.ok()) return true;
+		const state = await response.json();
+		return state?.authEnabled !== false;
+	} catch {
+		return true;
+	}
 }
 
 /**
  * Authentication E2E Tests
  *
- * These tests verify the authentication flow including login, registration,
- * and logout functionality.
+ * Tests the login/register UI when not authenticated.
+ * Uses empty storage state to simulate unauthenticated access.
+ *
+ * NOTE: This file intentionally imports `test` from @playwright/test
+ * (not from fixtures) because auth tests use empty storageState and
+ * must NOT have the auth-me caching interceptor.
  */
 test.describe("Authentication", () => {
-	// Skip auth dependency for these tests since we're testing auth itself
 	test.use({ storageState: { cookies: [], origins: [] } });
 
-	test("should display login page when not authenticated", async ({ page }) => {
+	test("should show login page for unauthenticated users", async ({ page }) => {
+		test.skip(!(await isAuthEnabled(page)), "Auth is disabled in this environment");
+
 		await page.goto("/");
-		await waitForAuthReady(page);
+		await expect(page.locator(".auth-container")).toBeVisible({ timeout: 15000 });
 
-		// Should show either login form, registration form (first setup), or dashboard (auth disabled)
-		const hasLoginForm = await page
-			.getByLabel(/username/i)
-			.isVisible()
-			.catch(() => false);
-		const hasDashboard = await page
-			.getByText(/dashboard|medications/i)
-			.isVisible()
-			.catch(() => false);
-
-		expect(hasLoginForm || hasDashboard).toBeTruthy();
+		// Should have the app title
+		await expect(page.locator(".auth-title")).toContainText("MedAssist-ng");
 	});
 
-	test("should have accessible form fields", async ({ page }) => {
+	test("should have username and password fields", async ({ page }) => {
+		test.skip(!(await isAuthEnabled(page)), "Auth is disabled in this environment");
+
 		await page.goto("/");
-		await waitForAuthReady(page);
+		await expect(page.locator(".auth-container")).toBeVisible({ timeout: 15000 });
 
-		// Check if auth is enabled
-		const hasLoginForm = await page
-			.getByLabel(/username/i)
-			.isVisible()
-			.catch(() => false);
+		const usernameField = page.locator("#username");
+		const passwordField = page.locator("#password");
 
-		if (hasLoginForm) {
-			// Username field should be accessible
-			const usernameField = page.getByLabel(/username/i);
-			await expect(usernameField).toBeVisible();
-			await expect(usernameField).toBeEnabled();
-
-			// Password field should be accessible
-			const passwordField = page.getByLabel(/password/i);
-			await expect(passwordField).toBeVisible();
-			await expect(passwordField).toBeEnabled();
-		}
+		await expect(usernameField).toBeVisible();
+		await expect(usernameField).toBeEnabled();
+		await expect(passwordField).toBeVisible();
+		await expect(passwordField).toBeEnabled();
 	});
 
-	test("should show validation error for empty credentials", async ({ page }) => {
+	test("should have a submit button", async ({ page }) => {
+		test.skip(!(await isAuthEnabled(page)), "Auth is disabled in this environment");
+
 		await page.goto("/");
-		await waitForAuthReady(page);
+		await expect(page.locator(".auth-container")).toBeVisible({ timeout: 15000 });
 
-		const hasLoginForm = await page
-			.getByLabel(/username/i)
-			.isVisible()
-			.catch(() => false);
-
-		if (hasLoginForm) {
-			// Try to submit empty form
-			const submitButton = page.getByRole("button", { name: /sign in|log in|login|register|create/i });
-
-			if (await submitButton.isVisible()) {
-				await submitButton.click();
-
-				// Check for validation - either HTML5 validation or custom error
-				const usernameField = page.getByLabel(/username/i);
-				const isInvalid =
-					(await usernameField.evaluate((el) => (el as HTMLInputElement).validity.valueMissing).catch(() => false)) ||
-					(await page
-						.getByText(/required|invalid|error/i)
-						.isVisible()
-						.catch(() => false));
-
-				expect(isInvalid || true).toBeTruthy(); // Validation varies by implementation
-			}
-		}
+		const submitButton = page.locator('button.auth-submit[type="submit"]');
+		await expect(submitButton).toBeVisible();
+		await expect(submitButton).toBeEnabled();
 	});
 
-	test("should toggle password visibility", async ({ page }) => {
+	test("should not navigate to dashboard without credentials", async ({ page }) => {
+		test.skip(!(await isAuthEnabled(page)), "Auth is disabled in this environment");
+
+		await page.goto("/dashboard");
+
+		// Should NOT show the app header (redirected to login)
+		await expect(page.locator("header.hero")).not.toBeVisible({ timeout: 10000 });
+
+		// Should show auth form instead
+		await expect(page.locator(".auth-container")).toBeVisible();
+	});
+
+	test("should show error for invalid credentials", async ({ page }) => {
+		test.skip(!(await isAuthEnabled(page)), "Auth is disabled in this environment");
+
 		await page.goto("/");
-		await waitForAuthReady(page);
+		await expect(page.locator(".auth-container")).toBeVisible({ timeout: 15000 });
 
-		const passwordField = page.getByLabel(/password/i).first();
-		const hasPasswordField = await passwordField.isVisible().catch(() => false);
+		// Fill in invalid credentials
+		await page.locator("#username").fill("nonexistent-user");
+		await page.locator("#password").fill("wrongpassword");
+		await page.locator('button.auth-submit[type="submit"]').click();
 
-		if (hasPasswordField) {
-			// Check initial type is password
-			await expect(passwordField).toHaveAttribute("type", "password");
+		// Should show an error message
+		await expect(page.locator(".auth-error")).toBeVisible({ timeout: 5000 });
+	});
 
-			// Find and click the toggle button (often an eye icon)
-			const toggleButton = page.getByRole("button", { name: /show|hide|toggle.*password/i });
-			const hasToggle = await toggleButton.isVisible().catch(() => false);
+	test("should toggle between login and register forms", async ({ page }) => {
+		test.skip(!(await isAuthEnabled(page)), "Auth is disabled in this environment");
 
-			if (hasToggle) {
-				await toggleButton.click();
-				await expect(passwordField).toHaveAttribute("type", "text");
+		await page.goto("/");
+		await expect(page.locator(".auth-container")).toBeVisible({ timeout: 15000 });
 
-				await toggleButton.click();
-				await expect(passwordField).toHaveAttribute("type", "password");
-			}
-		}
+		const toggleButton = page.locator("button.auth-link-btn");
+		test.skip(
+			!(await toggleButton.isVisible().catch(() => false)),
+			"Registration toggle is unavailable in this environment"
+		);
+
+		// Check current subtitle text
+		const subtitle = page.locator(".auth-subtitle");
+		const initialText = await subtitle.textContent();
+
+		// Click the toggle link (Create account / Already have an account)
+		await toggleButton.click();
+
+		// Subtitle should change
+		const newText = await subtitle.textContent();
+		expect(newText).not.toBe(initialText);
 	});
 });

frontend/e2e/dashboard-data.spec.ts

@@ -0,0 +1,228 @@
+import {
+	authFile,
+	createMedicationViaAPI,
+	deleteAllMedicationsViaAPI,
+	expect,
+	navigateTo,
+	type TestMedication,
+	test,
+} from "./fixtures";
+
+/**
+ * Dashboard with Medication Data E2E Tests
+ *
+ * Creates medications via API, then verifies the dashboard
+ * overview table, coverage cards, timeline, and dose tracking.
+ */
+test.describe("Dashboard with medications", () => {
+	test.use({ storageState: authFile });
+	test.describe.configure({ timeout: 60000 });
+
+	// Unique medication names to avoid conflicts with parallel workers
+	const MED_1 = "DashData Ibuprofen";
+	const MED_2 = "DashData Vitamin C";
+
+	// Set start to earlier today so doses appear on the timeline
+	const todayMorning = (() => {
+		const d = new Date();
+		d.setHours(8, 0, 0, 0);
+		const pad = (n: number) => n.toString().padStart(2, "0");
+		return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`;
+	})();
+
+	const createdMeds: TestMedication[] = [];
+
+	test.beforeAll(async () => {
+		// Clean up any leftover medications from previous test runs
+		await deleteAllMedicationsViaAPI();
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: MED_1,
+				genericName: "Ibuprofen",
+				packageType: "blister",
+				packCount: 2,
+				blistersPerPack: 3,
+				pillsPerBlister: 10,
+				looseTablets: 0,
+				intakes: [{ usage: 1, every: 1, start: todayMorning, intakeRemindersEnabled: false }],
+			})
+		);
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: MED_2,
+				packageType: "bottle",
+				totalPills: 90,
+				looseTablets: 90,
+				intakes: [{ usage: 1, every: 1, start: todayMorning, intakeRemindersEnabled: false }],
+			})
+		);
+	});
+
+	test.afterAll(async () => {
+		await deleteAllMedicationsViaAPI();
+	});
+
+	test("should show medication overview table with medications", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const overviewTable = page.locator(".table.table-7");
+		await expect(overviewTable).toBeVisible({ timeout: 10000 });
+		await expect(overviewTable.locator(".table-head")).toBeVisible();
+
+		// Our medications should have rows
+		await expect(overviewTable.getByText(MED_1)).toBeVisible();
+		await expect(overviewTable.getByText(MED_2)).toBeVisible();
+	});
+
+	test("should show status chips in overview table", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const overviewTable = page.locator(".table.table-7");
+		await expect(overviewTable).toBeVisible({ timeout: 10000 });
+
+		// Each medication row should have a status chip
+		const statusChips = overviewTable.locator(".status-chip");
+		expect(await statusChips.count()).toBeGreaterThanOrEqual(2);
+	});
+
+	test("should show stock information in overview", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const overviewTable = page.locator(".table.table-7");
+		await expect(overviewTable).toBeVisible({ timeout: 10000 });
+
+		// The Ibuprofen row should show stock info (60 pills minus today's usage = 59)
+		const ibuprofenRow = overviewTable.locator(".table-row").filter({ hasText: MED_1 });
+		await expect(ibuprofenRow).toBeVisible();
+		const rowText = await ibuprofenRow.textContent();
+		// Stock should show around 59-60 (60 pills minus today's consumed dose)
+		expect((rowText ?? "").includes("59") || (rowText ?? "").includes("60")).toBeTruthy();
+	});
+
+	test("should show today block in timeline", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 10000 });
+	});
+
+	test("should show medication names in today's schedule", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 10000 });
+		await expect(todayBlock.getByText(MED_1)).toBeVisible();
+		await expect(todayBlock.getByText(MED_2)).toBeVisible();
+	});
+
+	test("should show day summary with dose progress", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 10000 });
+		await expect(todayBlock.locator(".day-summary")).toBeVisible();
+	});
+
+	test("should show dose take buttons in today's schedule", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 10000 });
+
+		const takeButtons = todayBlock.locator("button.dose-btn.take");
+		expect(await takeButtons.count()).toBeGreaterThanOrEqual(1);
+	});
+
+	test("should mark a dose as taken and show undo", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 10000 });
+
+		const takeBtn = todayBlock.locator("button.dose-btn.take:not([disabled])").first();
+		test.skip(!(await takeBtn.isVisible().catch(() => false)), "No actionable take-dose button is visible for today");
+
+		await takeBtn.click();
+		await expect(todayBlock.locator("button.dose-btn.undo").first()).toBeVisible({ timeout: 5000 });
+	});
+
+	test("should undo a taken dose", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+		await page.waitForLoadState("networkidle");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 15000 });
+
+		// Normalize state first: if a dose is already taken, undo it so we can
+		// always execute the same take -> undo flow deterministically.
+		const existingUndo = todayBlock.locator("button.dose-btn.undo").first();
+		if (await existingUndo.isVisible().catch(() => false)) {
+			await existingUndo.click();
+			await page.waitForLoadState("networkidle");
+		}
+
+		// Mark a dose as taken first
+		const takeBtn = todayBlock.locator("button.dose-btn.take:not([disabled])").first();
+		await expect(takeBtn).toBeVisible({ timeout: 10000 });
+		await takeBtn.click();
+		await page.waitForLoadState("networkidle");
+
+		// Wait for undo button to appear (confirms the take succeeded)
+		const undoBtn = todayBlock.locator("button.dose-btn.undo").first();
+		await expect(undoBtn).toBeVisible({ timeout: 10000 });
+		await undoBtn.click();
+		await page.waitForLoadState("networkidle");
+
+		// Take button should reappear
+		await expect(todayBlock.locator("button.dose-btn.take:not([disabled])").first()).toBeVisible({ timeout: 10000 });
+	});
+
+	test("should show multiple day blocks in timeline", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		// Wait for timeline to fully render
+		await page.waitForLoadState("networkidle");
+		const dayBlocks = page.locator(".day-block");
+		await expect(dayBlocks.first()).toBeVisible({ timeout: 15000 });
+		// With 30-day default, there should be multiple day blocks
+		expect(await dayBlocks.count()).toBeGreaterThanOrEqual(1);
+	});
+
+	test("should show day header with date text", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const todayBlock = page.locator(".day-block.today");
+		await expect(todayBlock).toBeVisible({ timeout: 10000 });
+
+		const dayDivider = todayBlock.locator(".day-divider");
+		await expect(dayDivider).toBeVisible();
+		expect(await dayDivider.textContent()).toBeTruthy();
+	});
+
+	test("should open medication detail modal from overview table", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const overviewTable = page.locator(".table.table-7");
+		await expect(overviewTable).toBeVisible({ timeout: 10000 });
+
+		const medRow = overviewTable.locator(".table-row").filter({ hasText: MED_1 }).first();
+		await medRow.click();
+
+		const modal = page.locator(".modal-overlay");
+		await expect(modal).toBeVisible({ timeout: 5000 });
+		await expect(modal.getByText(MED_1)).toBeVisible();
+
+		await page.locator("button.modal-close").click();
+		await expect(modal).not.toBeVisible();
+	});
+
+	test("should show schedule days selector", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const daysSelect = page.locator("select.schedule-days-select");
+		await expect(daysSelect).toBeVisible();
+		await expect(daysSelect.locator('option[value="30"]')).toBeAttached();
+		await expect(daysSelect.locator('option[value="90"]')).toBeAttached();
+		await expect(daysSelect.locator('option[value="180"]')).toBeAttached();
+	});
+});

frontend/e2e/dashboard.spec.ts

@@ -1,122 +1,96 @@
-import * as path from "node:path";
-import { expect, test } from "@playwright/test";
-
-const authFile = path.join(import.meta.dirname, ".auth", "user.json");
+import { expect } from "@playwright/test";
+import { authFile, navigateTo, test } from "./fixtures";
 
 /**
  * Dashboard E2E Tests
  *
- * These tests verify the main dashboard functionality including
- * medication overview and upcoming schedules.
+ * Verifies the main dashboard with medication overview (coverage cards)
+ * and upcoming schedules timeline.
  */
 test.describe("Dashboard", () => {
 	test.use({ storageState: authFile });
 
-	test("should display dashboard page", async ({ page }) => {
-		await page.goto("/dashboard");
+	test("should display the dashboard page with header", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
 
-		// Wait for app to load
-		await expect(page.locator("body")).not.toContainText(/Loading\.\.\.|Initializing\.\.\./, {
-			timeout: 10000,
-		});
+		// App header with navigation tabs should be visible
+		await expect(page.locator("header.hero")).toBeVisible();
+		await expect(page.locator("header.hero h1")).toBeVisible();
 
-		// Should display navigation
-		await expect(page.getByRole("navigation")).toBeVisible();
-
-		// Should show dashboard content
-		const hasDashboardContent =
-			(await page
-				.getByText(/dashboard|overview|medications/i)
-				.isVisible()
-				.catch(() => false)) ||
-			(await page
-				.getByText(/no medications/i)
-				.isVisible()
-				.catch(() => false));
-
-		expect(hasDashboardContent).toBeTruthy();
+		// Eyebrow should show "Overview"
+		await expect(page.locator(".eyebrow")).toContainText("Overview");
 	});
 
-	test("should have working navigation links", async ({ page }) => {
-		await page.goto("/dashboard");
+	test("should show navigation tabs", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
 
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
+		// All three nav tabs should be visible
+		await expect(page.locator('button.pill:has-text("Dashboard")')).toBeVisible();
+		await expect(page.locator('button.pill:has-text("Medications")')).toBeVisible();
+		await expect(page.locator('button.pill:has-text("Planner")')).toBeVisible();
 
-		// Check for navigation links - these are the common nav items
-		const navLinks = ["dashboard", "medications", "planner", "settings", "schedule"];
+		// Dashboard tab should be active
+		await expect(page.locator('button.pill.primary:has-text("Dashboard")')).toBeVisible();
+	});
 
-		for (const link of navLinks) {
-			const navLink = page.getByRole("link", { name: new RegExp(link, "i") });
-			const isVisible = await navLink.isVisible().catch(() => false);
+	test("should navigate to medications via tab", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
 
-			// At least some nav links should be present
-			if (isVisible) {
-				await expect(navLink).toBeEnabled();
+		await page.locator('button.pill:has-text("Medications")').click();
+		await expect(page).toHaveURL(/\/medications/);
+	});
+
+	test("should navigate to planner via tab", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		await page.locator('button.pill:has-text("Planner")').click();
+		await expect(page).toHaveURL(/\/planner/);
+	});
+
+	test("should display medication overview section", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		// Should show either the overview section or "no medications" state
+		const hasOverviewTitle = page.locator("h2").filter({ hasText: /Medication Overview/i });
+		const hasNoMeds = page.getByText(/No medications/i);
+
+		const overviewVisible = await hasOverviewTitle.isVisible().catch(() => false);
+		const noMedsVisible = await hasNoMeds.isVisible().catch(() => false);
+
+		expect(overviewVisible || noMedsVisible).toBeTruthy();
+	});
+
+	test("should display schedules section", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		// Should show the schedules section title or "no medications" state
+		const hasSchedulesTitle = page.locator("h2").filter({ hasText: /Upcoming Schedules/i });
+		const hasNoMeds = page.getByText(/No medications/i);
+
+		const schedulesVisible = await hasSchedulesTitle.isVisible().catch(() => false);
+		const noMedsVisible = await hasNoMeds.isVisible().catch(() => false);
+
+		expect(schedulesVisible || noMedsVisible).toBeTruthy();
+	});
+
+	test("should have schedule days selector when schedules exist", async ({ page }) => {
+		await navigateTo(page, "/dashboard");
+
+		const schedulesTitle = page.locator("h2").filter({ hasText: /Upcoming Schedules/i });
+		if (await schedulesTitle.isVisible().catch(() => false)) {
+			// Days select should be present with 1/3/6 month options
+			const daysSelect = page.locator("select.schedule-days-select");
+			if (await daysSelect.isVisible().catch(() => false)) {
+				await expect(daysSelect).toBeVisible();
+				const options = daysSelect.locator("option");
+				await expect(options).toHaveCount(3);
 			}
 		}
 	});
 
-	test("should navigate to medications page", async ({ page }) => {
-		await page.goto("/dashboard");
-
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
-
-		// Click medications link
-		const medsLink = page.getByRole("link", { name: /medications/i });
-		if (await medsLink.isVisible()) {
-			await medsLink.click();
-			await expect(page).toHaveURL(/medications/);
-		}
-	});
-
-	test("should navigate to settings page", async ({ page }) => {
-		await page.goto("/dashboard");
-
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
-
-		// Click settings link
-		const settingsLink = page.getByRole("link", { name: /settings/i });
-		if (await settingsLink.isVisible()) {
-			await settingsLink.click();
-			await expect(page).toHaveURL(/settings/);
-		}
-	});
-
-	test("should display medication overview section", async ({ page }) => {
-		await page.goto("/dashboard");
-
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
-
-		// Look for medication overview or "no medications" message
-		const hasOverview =
-			(await page
-				.getByText(/medication overview|stock/i)
-				.isVisible()
-				.catch(() => false)) ||
-			(await page
-				.getByText(/no medications/i)
-				.isVisible()
-				.catch(() => false));
-
-		expect(hasOverview).toBeTruthy();
-	});
-
-	test("should display upcoming schedules section", async ({ page }) => {
-		await page.goto("/dashboard");
-
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
-
-		// Look for schedules section or indication that there are no schedules
-		const hasSchedules =
-			(await page
-				.getByText(/upcoming|schedule|1 month|3 months/i)
-				.isVisible()
-				.catch(() => false)) ||
-			(await page
-				.getByText(/no medications/i)
-				.isVisible()
-				.catch(() => false));
-
-		expect(hasSchedules).toBeTruthy();
+	test("should redirect root to dashboard", async ({ page }) => {
+		await page.goto("/");
+		await expect(page.locator("header.hero")).toBeVisible({ timeout: 15000 });
+		await expect(page).toHaveURL(/\/dashboard/);
 	});
 });

frontend/e2e/fixtures/index.ts

@@ -2,122 +2,327 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { test as base, expect, type Page } from "@playwright/test";
 
-// Storage state path for authenticated sessions
-const authFile = path.join(import.meta.dirname, "..", ".auth", "user.json");
+/** Storage state path for authenticated sessions */
+export const authFile = path.join(import.meta.dirname, "..", ".auth", "user.json");
 
 /**
- * Test user credentials for E2E tests
- * These are used for setting up a test user during the setup phase
+ * Test user credentials for E2E tests.
+ * Override with PLAYWRIGHT_USERNAME / PLAYWRIGHT_PASSWORD env vars.
+ * The setup script registers this user if it doesn't exist and registration is enabled.
  */
 export const TEST_USER = {
-	username: "e2e-test-user",
-	password: "TestPassword123!",
+	username: process.env.PLAYWRIGHT_USERNAME || "e2e-test-user",
+	password: process.env.PLAYWRIGHT_PASSWORD || "TestPassword123!",
 } as const;
 
-/**
- * Custom test fixture that extends Playwright's base test
- * Provides utility functions for common testing operations
- */
-export const test = base.extend<{
-	/**
-	 * Authenticated page instance - uses stored auth state
-	 */
-	authenticatedPage: Page;
-}>({
-	authenticatedPage: async ({ page }, use) => {
-		// Load auth state if it exists
-		if (fs.existsSync(authFile)) {
-			const storageState = JSON.parse(fs.readFileSync(authFile, "utf-8"));
-			await page.context().addCookies(storageState.cookies || []);
-			// Note: localStorage must be set after navigating to the page
-		}
+// ---------------------------------------------------------------------------
+// Auth-me response mocking
+// ---------------------------------------------------------------------------
+// The backend rate-limits /auth/me to 10 req/min.  Because every page
+// navigation triggers the React app's auth-state check (which calls
+// /auth/me), running 50+ E2E tests in a single suite easily exceeds the
+// limit.
+//
+// Solution: build a synthetic /auth/me response from the JWT payload
+// stored in the auth file.  This avoids all /auth/me network requests
+// from test pages, completely eliminating rate-limit issues while still
+// testing the real backend for all other API calls.
+// ---------------------------------------------------------------------------
+let mockMeBody: string | null = null;
 
+function getMockAuthMeBody(): string | null {
+	if (mockMeBody) return mockMeBody;
+	try {
+		const state = JSON.parse(fs.readFileSync(authFile, "utf-8"));
+		const token = state.cookies?.find((c: { name: string }) => c.name === "access_token")?.value;
+		if (!token) return null;
+		const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64").toString());
+		mockMeBody = JSON.stringify({
+			id: payload.sub,
+			username: payload.username,
+			avatarUrl: null,
+			authProvider: "local",
+			createdAt: new Date().toISOString(),
+			lastLoginAt: new Date().toISOString(),
+		});
+		return mockMeBody;
+	} catch {
+		return null;
+	}
+}
+
+async function setupAuthMeMock(page: Page): Promise<void> {
+	const body = getMockAuthMeBody();
+	if (body) {
+		await page.route("**/api/auth/me", (route) =>
+			route.fulfill({ status: 200, contentType: "application/json", body })
+		);
+	}
+}
+
+/**
+ * Extended test fixture that automatically mocks /auth/me on every page
+ * using user data from the JWT in the stored auth file.
+ *
+ * Import this `test` (instead of `@playwright/test`) in every spec file
+ * that logs in via `storageState: authFile`.
+ *
+ * auth.spec.ts should keep importing from `@playwright/test` directly
+ * since it tests the unauthenticated flow.
+ */
+export const test = base.extend<{}>({
+	page: async ({ page }, use) => {
+		await setupAuthMeMock(page);
 		await use(page);
 	},
 });
 
 /**
- * Helper to wait for the app to be fully loaded
+ * Wait for the app to be fully loaded past any loading/initializing screens.
+ * Includes a single retry with page reload to handle transient auth failures
+ * (e.g. brief race between context setup and cookie application).
  */
 export async function waitForAppReady(page: Page): Promise<void> {
-	// Wait for the app to finish loading (no "Loading..." or "Initializing...")
-	await expect(page.getByText(/Loading\.\.\.|Initializing\.\.\./i)).not.toBeVisible({
-		timeout: 10000,
-	});
+	const hero = page.locator("header.hero");
+	try {
+		await expect(hero).toBeVisible({ timeout: 15000 });
+	} catch {
+		// Auth might have failed transiently — reload and retry once
+		await page.reload();
+		await expect(hero).toBeVisible({ timeout: 15000 });
+	}
 }
 
 /**
- * Helper to login with the test user
+ * Navigate to a page and wait for it to be ready.
  */
-export async function loginTestUser(page: Page): Promise<void> {
-	await page.goto("/");
+export async function navigateTo(page: Page, path: string): Promise<void> {
+	await page.goto(path);
 	await waitForAppReady(page);
-
-	// Check if we're already logged in
-	const isLoggedIn = await page
-		.getByRole("navigation")
-		.isVisible()
-		.catch(() => false);
-	if (isLoggedIn) {
-		return;
-	}
-
-	// Fill login form
-	await page.getByLabel(/username/i).fill(TEST_USER.username);
-	await page.getByLabel(/password/i).fill(TEST_USER.password);
-	await page.getByRole("button", { name: /sign in|log in|login/i }).click();
-
-	// Wait for successful login
-	await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
+	await page.waitForLoadState("networkidle");
 }
 
 /**
- * Helper to register a new user (for setup)
+ * Click a navigation tab by its text.
  */
-export async function registerTestUser(page: Page): Promise<void> {
-	await page.goto("/");
-	await waitForAppReady(page);
-
-	// Check if we're on the registration page (needs setup)
-	const needsSetup = await page
-		.getByText(/create.*account|register|first user/i)
-		.isVisible()
-		.catch(() => false);
-
-	if (needsSetup) {
-		// Fill registration form
-		await page.getByLabel(/username/i).fill(TEST_USER.username);
-		await page
-			.getByLabel(/password/i)
-			.first()
-			.fill(TEST_USER.password);
-
-		// Look for confirm password field if present
-		const confirmPassword = page.getByLabel(/confirm.*password/i);
-		if (await confirmPassword.isVisible().catch(() => false)) {
-			await confirmPassword.fill(TEST_USER.password);
-		}
-
-		// Submit registration
-		await page.getByRole("button", { name: /register|create|sign up/i }).click();
-
-		// Wait for successful registration
-		await expect(page.getByRole("navigation")).toBeVisible({ timeout: 10000 });
-	}
+export async function clickNavTab(page: Page, tabName: string): Promise<void> {
+	await page.locator(`button.pill:has-text("${tabName}")`).click();
 }
 
 /**
- * Helper to logout
+ * Open the user dropdown menu (when auth is enabled).
  */
-export async function logout(page: Page): Promise<void> {
-	// Click on user profile/menu button
-	const userButton = page.getByRole("button", { name: /profile|user|account|menu/i });
-	if (await userButton.isVisible().catch(() => false)) {
-		await userButton.click();
-		await page.getByRole("button", { name: /logout|sign out|log out/i }).click();
-		await expect(page.getByLabel(/username/i)).toBeVisible({ timeout: 5000 });
-	}
+export async function openUserMenu(page: Page): Promise<void> {
+	await page.locator(".user-menu-btn").click();
+	await expect(page.locator(".user-dropdown")).toBeVisible();
+}
+
+/**
+ * Sign out via the user dropdown menu.
+ */
+export async function signOut(page: Page): Promise<void> {
+	await openUserMenu(page);
+	await page.locator('.dropdown-item:has-text("Sign Out")').click();
+	// Should redirect to login page
+	await expect(page.locator(".auth-container")).toBeVisible({ timeout: 10000 });
 }
 
 // Re-export expect for convenience
 export { expect };
+
+// ---------------------------------------------------------------------------
+// API helpers — create / delete medications via backend API
+// ---------------------------------------------------------------------------
+const API_BASE = process.env.PLAYWRIGHT_BASE_URL || "http://localhost:5173";
+
+function getAuthCookie(): string | null {
+	try {
+		const state = JSON.parse(fs.readFileSync(authFile, "utf-8"));
+		return state.cookies?.find((c: { name: string }) => c.name === "access_token")?.value ?? null;
+	} catch {
+		return null;
+	}
+}
+
+/** Typed medication response (subset of fields we care about) */
+export interface TestMedication {
+	id: number;
+	name: string;
+	genericName?: string | null;
+	takenBy?: string[];
+	notes?: string | null;
+}
+
+/** Typed share token response */
+export interface TestShareToken {
+	token: string;
+	takenBy: string;
+	scheduleDays: number;
+	expiresAt: string;
+}
+
+/**
+ * Create a medication via the backend API.  Returns the created medication
+ * including its `id`.  Uses the stored auth cookie from the setup project.
+ * Includes automatic retry for rate-limit (429) responses.
+ */
+export async function createMedicationViaAPI(data: {
+	name: string;
+	genericName?: string;
+	takenBy?: string[];
+	notes?: string;
+	expiryDate?: string;
+	packageType?: "blister" | "bottle";
+	packCount?: number;
+	blistersPerPack?: number;
+	pillsPerBlister?: number;
+	looseTablets?: number;
+	totalPills?: number;
+	intakeRemindersEnabled?: boolean;
+	intakes?: {
+		usage: number;
+		every: number;
+		start: string;
+		intakeRemindersEnabled?: boolean;
+		takenBy?: string | null;
+	}[];
+}): Promise<TestMedication> {
+	const token = getAuthCookie();
+	const isBottle = data.packageType === "bottle";
+	const body = {
+		packageType: isBottle ? "bottle" : "blister",
+		packCount: isBottle ? 1 : (data.packCount ?? 1),
+		blistersPerPack: isBottle ? 1 : (data.blistersPerPack ?? 1),
+		pillsPerBlister: isBottle ? 1 : (data.pillsPerBlister ?? 10),
+		// For bottles: looseTablets IS the current stock. Default to totalPills if not specified.
+		looseTablets: isBottle ? (data.looseTablets ?? data.totalPills ?? 0) : (data.looseTablets ?? 0),
+		totalPills: isBottle ? (data.totalPills ?? null) : null,
+		intakes: [
+			{
+				usage: 1,
+				every: 1,
+				start: new Date().toISOString().slice(0, 16),
+				intakeRemindersEnabled: false,
+			},
+		],
+		...data,
+		// Ensure takenBy is always an array (medication-level)
+		takenBy: data.takenBy ?? [],
+	};
+
+	for (let attempt = 0; attempt < 5; attempt++) {
+		const res = await fetch(`${API_BASE}/api/medications`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...(token ? { Cookie: `access_token=${token}` } : {}),
+			},
+			body: JSON.stringify(body),
+		});
+		if (res.status === 429) {
+			// Rate limited — exponential backoff: 3s, 6s, 9s, 12s, 15s
+			await new Promise((r) => setTimeout(r, 3000 * (attempt + 1)));
+			continue;
+		}
+		if (!res.ok) {
+			const text = await res.text();
+			throw new Error(`Failed to create medication: ${res.status} ${text}`);
+		}
+		return res.json() as Promise<TestMedication>;
+	}
+	throw new Error("Failed to create medication after 5 retries (rate limited)");
+}
+
+/**
+ * Delete a medication via the backend API.
+ */
+export async function deleteMedicationViaAPI(id: number): Promise<void> {
+	const token = getAuthCookie();
+	await fetch(`${API_BASE}/api/medications/${id}`, {
+		method: "DELETE",
+		headers: token ? { Cookie: `access_token=${token}` } : {},
+	});
+}
+
+/**
+ * Delete ALL medications for the test user via the backend API.
+ * Includes retry logic for rate-limited responses.
+ */
+export async function deleteAllMedicationsViaAPI(): Promise<void> {
+	const token = getAuthCookie();
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const res = await fetch(`${API_BASE}/api/medications`, {
+			headers: token ? { Cookie: `access_token=${token}` } : {},
+		});
+		if (res.status === 429) {
+			await new Promise((r) => setTimeout(r, 3000 * (attempt + 1)));
+			continue;
+		}
+		if (!res.ok) return;
+		const meds = (await res.json()) as TestMedication[];
+		for (const med of meds) {
+			for (let delAttempt = 0; delAttempt < 3; delAttempt++) {
+				const delRes = await fetch(`${API_BASE}/api/medications/${med.id}`, {
+					method: "DELETE",
+					headers: token ? { Cookie: `access_token=${token}` } : {},
+				});
+				if (delRes.status === 429) {
+					await new Promise((r) => setTimeout(r, 3000));
+					continue;
+				}
+				break;
+			}
+		}
+		return;
+	}
+}
+
+/**
+ * Create a share token via the backend API.
+ * Requires a medication with takenBy to exist first.
+ */
+export async function createShareTokenViaAPI(takenBy: string, scheduleDays = 30): Promise<TestShareToken> {
+	const token = getAuthCookie();
+	for (let attempt = 0; attempt < 5; attempt++) {
+		const res = await fetch(`${API_BASE}/api/share`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...(token ? { Cookie: `access_token=${token}` } : {}),
+			},
+			body: JSON.stringify({ takenBy, scheduleDays }),
+		});
+		if (res.status === 429) {
+			await new Promise((r) => setTimeout(r, 3000 * (attempt + 1)));
+			continue;
+		}
+		if (!res.ok) {
+			const text = await res.text();
+			throw new Error(`Failed to create share token: ${res.status} ${text}`);
+		}
+		return res.json() as Promise<TestShareToken>;
+	}
+	throw new Error("Failed to create share token after 5 retries (rate limited)");
+}
+
+/**
+ * Update user settings via the backend API.
+ */
+export async function updateSettingsViaAPI(settings: Record<string, unknown>): Promise<void> {
+	const token = getAuthCookie();
+	for (let attempt = 0; attempt < 3; attempt++) {
+		const res = await fetch(`${API_BASE}/api/settings`, {
+			method: "PUT",
+			headers: {
+				"Content-Type": "application/json",
+				...(token ? { Cookie: `access_token=${token}` } : {}),
+			},
+			body: JSON.stringify(settings),
+		});
+		if (res.status === 429) {
+			await new Promise((r) => setTimeout(r, 3000 * (attempt + 1)));
+			continue;
+		}
+		if (res.ok) return;
+	}
+}

frontend/e2e/medication-crud.spec.ts

@@ -0,0 +1,442 @@
+import type { Page } from "@playwright/test";
+import {
+	authFile,
+	createMedicationViaAPI,
+	deleteAllMedicationsViaAPI,
+	deleteMedicationViaAPI,
+	expect,
+	navigateTo,
+	type TestMedication,
+	test,
+} from "./fixtures";
+
+/**
+ * Medication CRUD E2E Tests
+ *
+ * Tests creating, editing, and deleting medications via the UI form.
+ * Each test cleans up after itself to avoid side effects.
+ */
+
+/**
+ * Helper: fill the medication form and save.  Waits for the successful
+ * API response and verifies the medication appears in the list.
+ */
+async function fillAndSaveMedication(
+	page: Page,
+	opts: {
+		name: string;
+		genericName?: string;
+		packageType?: "blister" | "bottle";
+		packs?: string;
+		blistersPerPack?: string;
+		pillsPerBlister?: string;
+		loosePills?: string;
+		totalCapacity?: string;
+		currentPills?: string;
+		expiryDate?: string;
+		notes?: string;
+		intakes?: { usage: string; every: string }[];
+	}
+): Promise<void> {
+	const openCreateBtn = page.getByRole("button", { name: /New medication|New entry|form\.newEntry/i }).first();
+	if (await openCreateBtn.isVisible().catch(() => false)) {
+		await openCreateBtn.click();
+	}
+	const form = page.locator("form.form-grid:visible").first();
+	await expect(form.getByLabel(/(Commercial Name|form\.commercialName)/i)).toBeVisible({ timeout: 10000 });
+	await form.getByLabel(/(Commercial Name|form\.commercialName)/i).fill(opts.name);
+	if (opts.genericName) {
+		await form.getByLabel(/(Generic Name|form\.genericName)/i).fill(opts.genericName);
+	}
+
+	const packageTypeSelect = form.locator("select.package-type-select");
+	if (opts.packageType === "bottle") {
+		await packageTypeSelect.selectOption("bottle");
+		await page.getByRole("tab", { name: /Package/i }).click();
+		if (opts.totalCapacity)
+			await form.getByLabel(/(Total Capacity|form\.totalCapacity|Total \(pills\))/i).fill(opts.totalCapacity);
+		if (opts.currentPills) await form.getByLabel(/(Current Pills|form\.currentPills)/i).fill(opts.currentPills);
+	} else {
+		await packageTypeSelect.selectOption("blister");
+		await page.getByRole("tab", { name: /Package/i }).click();
+		if (opts.packs) await form.getByLabel(/(^Packs$|form\.packs)/i).fill(opts.packs);
+		if (opts.blistersPerPack)
+			await form.getByLabel(/(Blisters per pack|form\.blistersPerPack)/i).fill(opts.blistersPerPack);
+		if (opts.pillsPerBlister)
+			await form.getByLabel(/(Pills per blister|form\.pillsPerBlister)/i).fill(opts.pillsPerBlister);
+		if (opts.loosePills) {
+			const looseField = form.getByLabel(/(Loose pills|form\.loosePills)/i);
+			if (await looseField.isVisible().catch(() => false)) {
+				await looseField.fill(opts.loosePills);
+			}
+		}
+	}
+
+	if (opts.expiryDate) await form.getByLabel(/(Expiry Date|form\.expiryDate)/i).fill(opts.expiryDate);
+	if (opts.notes) await form.getByLabel(/(Notes|form\.notes)/i).fill(opts.notes);
+
+	// Fill intake schedules
+	const intakes = opts.intakes ?? [{ usage: "1", every: "1" }];
+	await page.getByRole("tab", { name: /Schedule/i }).click();
+	for (let i = 0; i < intakes.length; i++) {
+		if (i > 0) {
+			await form.getByRole("button", { name: /(Intake|form\.blisters\.addIntake)/i }).click();
+		}
+		const row = form.locator(".blister-row").nth(i);
+		await row.getByLabel(/(Usage \(pills\)|form\.blisters\.usage)/i).fill(intakes[i].usage);
+		await row.getByLabel(/(Every \(days\)|form\.blisters\.everyDays)/i).fill(intakes[i].every);
+	}
+
+	await page.waitForLoadState("networkidle");
+	await form.locator("button[type='submit']").click();
+
+	// Verify the medication appears in the list (may need reload if GET was rate-limited)
+	const medRow = page.locator(".med-row").filter({ hasText: opts.name });
+	try {
+		await expect(medRow).toBeVisible({ timeout: 5000 });
+	} catch {
+		await page.reload();
+		await page.waitForLoadState("networkidle");
+		await expect(medRow).toBeVisible({ timeout: 10000 });
+	}
+}
+
+/**
+ * Helper: save after editing (PUT) and wait for success.
+ */
+async function saveEdit(page: Page, medName: string): Promise<void> {
+	const form = page.locator("form.form-grid:visible").first();
+	await page.waitForLoadState("networkidle");
+	const submitBtn = form.locator("button[type='submit']");
+	if (
+		(await submitBtn.count()) > 0 &&
+		(await submitBtn
+			.first()
+			.isVisible()
+			.catch(() => false))
+	) {
+		await submitBtn.first().click();
+	} else {
+		const closeBtn = form.getByRole("button", { name: /Close|Cancel/i }).first();
+		if (await closeBtn.isVisible().catch(() => false)) {
+			await closeBtn.click();
+		}
+	}
+	// Wait for the list to update with the new name — retry with reload if rate-limited
+	const medRow = page.locator(".med-row").filter({ hasText: medName });
+	try {
+		await expect(medRow).toBeVisible({ timeout: 15000 });
+	} catch {
+		await page.reload();
+		await page.waitForLoadState("networkidle");
+		await expect(medRow).toBeVisible({ timeout: 10000 });
+	}
+}
+
+test.describe("Medication CRUD", () => {
+	test.use({ storageState: authFile });
+
+	// Clean up any leftover medications before and after all tests
+	test.beforeAll(async () => {
+		await deleteAllMedicationsViaAPI();
+	});
+	test.afterAll(async () => {
+		await deleteAllMedicationsViaAPI();
+	});
+
+	test.describe("Create medication", () => {
+		// Clean up after each create test to avoid state leakage to later test blocks
+		test.afterEach(async () => {
+			await deleteAllMedicationsViaAPI();
+		});
+
+		test("should create a blister-pack medication via the form", async ({ page }) => {
+			await navigateTo(page, "/medications");
+
+			await fillAndSaveMedication(page, {
+				name: "Test Ibuprofen",
+				genericName: "Ibuprofen",
+				packageType: "blister",
+				packs: "2",
+				blistersPerPack: "3",
+				pillsPerBlister: "10",
+				loosePills: "5",
+			});
+
+			// Verify medication details in the list
+			const medRow = page.locator(".med-row").filter({ hasText: "Test Ibuprofen" });
+			await expect(medRow.locator(".med-name")).toContainText("Test Ibuprofen");
+		});
+
+		test("should create a bottle medication via the form", async ({ page }) => {
+			await navigateTo(page, "/medications");
+
+			await fillAndSaveMedication(page, {
+				name: "Test Vitamin D Drops",
+				packageType: "bottle",
+				totalCapacity: "60",
+				currentPills: "45",
+			});
+		});
+
+		test("should create medication with multiple intake schedules", async ({ page }) => {
+			await navigateTo(page, "/medications");
+
+			await fillAndSaveMedication(page, {
+				name: "Test Multi-Intake Med",
+				packs: "1",
+				blistersPerPack: "2",
+				pillsPerBlister: "14",
+				intakes: [
+					{ usage: "1", every: "1" },
+					{ usage: "0.5", every: "7" },
+				],
+			});
+		});
+
+		test("should create medication with notes and expiry date", async ({ page }) => {
+			await navigateTo(page, "/medications");
+
+			const expiryDate = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).toISOString().split("T")[0];
+			await fillAndSaveMedication(page, {
+				name: "Test Aspirin",
+				packs: "1",
+				blistersPerPack: "1",
+				pillsPerBlister: "20",
+				expiryDate,
+				notes: "Take with food. Do not exceed 3 per day.",
+			});
+		});
+
+		test("should not save with empty commercial name", async ({ page }) => {
+			await navigateTo(page, "/medications");
+			await page
+				.getByRole("button", { name: /New medication|New entry|form\.newEntry/i })
+				.first()
+				.click();
+
+			// Saving without name should not create a medication row.
+			const saveBtn = page.locator("form.form-grid button[type='submit']");
+			await expect(saveBtn).toBeVisible();
+			await saveBtn.click();
+			await expect(page.locator(".med-row")).toHaveCount(0);
+		});
+
+		test("should reset form after saving a medication", async ({ page }) => {
+			await navigateTo(page, "/medications");
+
+			await fillAndSaveMedication(page, {
+				name: "Test Reset Check",
+				packs: "1",
+				blistersPerPack: "1",
+				pillsPerBlister: "10",
+			});
+
+			// Opening a fresh form after save should start with an empty commercial name.
+			await page
+				.getByRole("button", { name: /New medication|New entry|form\.newEntry/i })
+				.first()
+				.click();
+			await expect(page.getByLabel(/(Commercial Name|form\.commercialName)/i)).toHaveValue("");
+		});
+	});
+
+	test.describe("Edit medication", () => {
+		test.describe.configure({ timeout: 60000 });
+		const createdMeds: TestMedication[] = [];
+
+		test.afterEach(async () => {
+			for (const med of createdMeds) {
+				await deleteMedicationViaAPI(med.id);
+			}
+			createdMeds.length = 0;
+		});
+
+		test("should edit an existing medication", async ({ page }) => {
+			// Create prerequisite via API (faster, no rate-limit issues)
+			createdMeds.push(await createMedicationViaAPI({ name: "Before Edit" }));
+			await navigateTo(page, "/medications");
+
+			// Click Edit
+			const medRow = page.locator(".med-row").filter({ hasText: "Before Edit" });
+			await expect(medRow).toBeVisible({ timeout: 10000 });
+			await medRow.locator("button.info").click();
+
+			// Form title should say "Edit entry" (or legacy "Edit medication").
+			await expect(
+				page.locator("h2").filter({ hasText: /(Edit(:| (entry|medication))|form\.editEntry)/i })
+			).toBeVisible();
+
+			// The name field should have the current value
+			await expect(page.getByLabel(/(Commercial Name|form\.commercialName)/i)).toHaveValue("Before Edit");
+
+			// Change the name
+			await page.getByLabel(/(Commercial Name|form\.commercialName)/i).fill("After Edit");
+
+			// Save the edit
+			await saveEdit(page, "After Edit");
+
+			// Old name should no longer appear
+			await expect(page.locator(".med-row").filter({ hasText: "Before Edit" })).not.toBeVisible();
+
+			// Update tracked ID for cleanup
+			createdMeds[0].name = "After Edit";
+		});
+
+		test("should cancel editing and discard changes", async ({ page }) => {
+			createdMeds.push(await createMedicationViaAPI({ name: "Cancel Test Med" }));
+			await navigateTo(page, "/medications");
+
+			// Click Edit
+			const medRow = page.locator(".med-row").filter({ hasText: "Cancel Test Med" });
+			await expect(medRow).toBeVisible({ timeout: 10000 });
+			await medRow.locator("button.info").click();
+
+			// Change the name
+			await page.getByLabel(/(Commercial Name|form\.commercialName)/i).fill("Modified Name");
+
+			// Click Cancel
+			await page
+				.getByRole("button", { name: /Close|Cancel/i })
+				.first()
+				.click();
+
+			// Original name should still be in the list
+			await expect(page.locator(".med-row").filter({ hasText: "Cancel Test Med" })).toBeVisible();
+		});
+	});
+
+	test.describe("Delete medication", () => {
+		test.describe.configure({ timeout: 60000 });
+		const createdMeds: TestMedication[] = [];
+
+		test.afterEach(async () => {
+			for (const med of createdMeds) {
+				await deleteMedicationViaAPI(med.id);
+			}
+			createdMeds.length = 0;
+		});
+
+		test("should delete a medication after confirming", async ({ page }) => {
+			createdMeds.push(await createMedicationViaAPI({ name: "Delete Me Med" }));
+			await navigateTo(page, "/medications");
+
+			const medRow = page.locator(".med-row").filter({ hasText: "Delete Me Med" });
+			await expect(medRow).toBeVisible({ timeout: 10000 });
+
+			await medRow.locator("button.danger").click();
+			await page
+				.locator(".confirm-modal-overlay, .modal-overlay")
+				.getByRole("button", { name: /Delete/i })
+				.click();
+
+			// Medication should be removed
+			await expect(medRow).toHaveCount(0, { timeout: 10000 });
+
+			// Already deleted via UI — clear tracked list
+			createdMeds.length = 0;
+		});
+
+		test("should not delete when confirm dialog is dismissed", async ({ page }) => {
+			createdMeds.push(await createMedicationViaAPI({ name: "Keep Me Med" }));
+			await navigateTo(page, "/medications");
+
+			const medRow = page.locator(".med-row").filter({ hasText: "Keep Me Med" });
+			await expect(medRow).toBeVisible({ timeout: 10000 });
+
+			// Dismiss the native confirm()
+			page.on("dialog", (dialog) => dialog.dismiss());
+			await medRow.locator("button.danger").click();
+
+			// Medication should still be there
+			await expect(medRow).toBeVisible();
+		});
+	});
+
+	test.describe("Medication list", () => {
+		test.describe.configure({ timeout: 60000 });
+		const createdMeds: TestMedication[] = [];
+
+		test.afterEach(async () => {
+			for (const med of createdMeds) {
+				await deleteMedicationViaAPI(med.id);
+			}
+			createdMeds.length = 0;
+		});
+
+		test("should display multiple medications in the list", async ({ page }) => {
+			createdMeds.push(await createMedicationViaAPI({ name: "Med Alpha" }));
+			createdMeds.push(
+				await createMedicationViaAPI({
+					name: "Med Beta",
+					packCount: 2,
+					blistersPerPack: 2,
+					pillsPerBlister: 14,
+					intakes: [
+						{ usage: 2, every: 1, start: new Date().toISOString().slice(0, 16), intakeRemindersEnabled: false },
+					],
+				})
+			);
+			await navigateTo(page, "/medications");
+
+			// Both medications should be in the list
+			await expect(page.locator(".med-row").filter({ hasText: "Med Alpha" })).toBeVisible({ timeout: 10000 });
+			await expect(page.locator(".med-row").filter({ hasText: "Med Beta" })).toBeVisible();
+			expect(await page.locator(".med-row").count()).toBeGreaterThanOrEqual(2);
+		});
+
+		test("should show stock details on medication row", async ({ page }) => {
+			createdMeds.push(
+				await createMedicationViaAPI({
+					name: "Stock Detail Med",
+					packCount: 3,
+					blistersPerPack: 2,
+					pillsPerBlister: 10,
+					looseTablets: 3,
+				})
+			);
+			await navigateTo(page, "/medications");
+
+			const medRow = page.locator(".med-row").filter({ hasText: "Stock Detail Med" });
+			try {
+				await expect(medRow).toBeVisible({ timeout: 10000 });
+			} catch {
+				// Reload in case the list didn't include the newly created med
+				await page.reload();
+				await page.waitForLoadState("networkidle");
+				await expect(medRow).toBeVisible({ timeout: 10000 });
+			}
+
+			// Should display stock details
+			const medDetails = medRow.locator(".med-details, .med-total");
+			expect(await medDetails.count()).toBeGreaterThan(0);
+		});
+	});
+
+	test.describe("Intake schedule management", () => {
+		test("should add and remove intake schedule rows", async ({ page }) => {
+			await navigateTo(page, "/medications");
+			await page
+				.getByRole("button", { name: /New medication|New entry|form\.newEntry/i })
+				.first()
+				.click();
+			await page.getByRole("tab", { name: /Schedule/i }).click();
+			const form = page.locator("form.form-grid:visible").first();
+
+			expect(await form.locator(".blister-row").count()).toBe(1);
+
+			await form.getByRole("button", { name: /(Intake|form\.blisters\.addIntake)/i }).click();
+			expect(await form.locator(".blister-row").count()).toBe(2);
+
+			await form.getByRole("button", { name: /(Intake|form\.blisters\.addIntake)/i }).click();
+			expect(await form.locator(".blister-row").count()).toBe(3);
+
+			const removeBtn = page
+				.locator("form.form-grid:visible .blister-row")
+				.last()
+				.getByRole("button", { name: /Remove/i });
+			await removeBtn.click();
+			expect(await form.locator(".blister-row").count()).toBe(2);
+		});
+	});
+});

frontend/e2e/medication-edit.spec.ts

@@ -0,0 +1,403 @@
+import type { Page } from "@playwright/test";
+import {
+	authFile,
+	createMedicationViaAPI,
+	deleteAllMedicationsViaAPI,
+	expect,
+	navigateTo,
+	type TestMedication,
+	test,
+} from "./fixtures";
+
+/**
+ * Medication Edit E2E Tests
+ *
+ * Tests editing medications: changing fields, adding notes, taken-by persons,
+ * generic name, refill stock, intake reminders, and intake schedule changes.
+ * Each test creates a medication via API, edits it via the UI, and verifies the change.
+ */
+
+/** Helper: click Edit button on a medication row */
+async function clickEditMed(page: Page, medName: string): Promise<void> {
+	const medRow = page.locator(".med-row").filter({ hasText: medName });
+	for (let attempt = 0; attempt < 3; attempt++) {
+		if (await medRow.isVisible().catch(() => false)) break;
+		await page.reload();
+		await page.waitForLoadState("networkidle");
+		await page.waitForTimeout(1000);
+	}
+	await expect(medRow).toBeVisible({ timeout: 10000 });
+	await medRow.locator("button.info").click();
+	await expect(page.locator("h2").filter({ hasText: /(Edit(:| (entry|medication))|form\.editEntry)/i })).toBeVisible({
+		timeout: 5000,
+	});
+}
+
+/** Helper: save edit and verify success */
+async function saveEditAndVerify(page: Page, medName: string): Promise<void> {
+	const form = page.locator("form.form-grid:visible").first();
+	// Wait for any pending network before clicking save
+	await page.waitForLoadState("networkidle");
+
+	const submitBtn = form.locator("button[type='submit']");
+	if (
+		(await submitBtn.count()) > 0 &&
+		(await submitBtn
+			.first()
+			.isVisible()
+			.catch(() => false))
+	) {
+		await submitBtn.first().click();
+	} else {
+		const closeBtn = form.getByRole("button", { name: /Close|Cancel/i }).first();
+		if (await closeBtn.isVisible().catch(() => false)) {
+			await closeBtn.click();
+		}
+	}
+
+	// Wait for save request + re-fetch to complete
+	await page.waitForLoadState("networkidle");
+
+	// Reload page to get fresh data from the backend
+	// This ensures the meds array passed to startEdit has the saved changes
+	await page.reload();
+	await page.waitForLoadState("networkidle");
+
+	// Verify the med row is visible in the list
+	const medRow = page.locator(".med-row").filter({ hasText: medName });
+	await expect(medRow).toBeVisible({ timeout: 10000 });
+}
+
+test.describe("Medication Editing", () => {
+	test.use({ storageState: authFile });
+	test.describe.configure({ timeout: 60000 });
+
+	const createdMeds: TestMedication[] = [];
+
+	test.beforeAll(async () => {
+		await deleteAllMedicationsViaAPI();
+	});
+
+	test.afterAll(async () => {
+		await deleteAllMedicationsViaAPI();
+	});
+
+	test("should edit generic name on an existing medication", async ({ page }) => {
+		createdMeds.push(await createMedicationViaAPI({ name: "Edit GenName Med" }));
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Edit GenName Med");
+
+		// Generic name should be empty initially
+		const genericField = page.getByLabel(/(Generic Name|form\.genericName)/i);
+		await expect(genericField).toHaveValue("");
+
+		// Add a generic name
+		await genericField.fill("Acetylsalicylic acid");
+		await expect(genericField).toHaveValue("Acetylsalicylic acid");
+
+		await saveEditAndVerify(page, "Edit GenName Med");
+
+		// Click edit again and verify the generic name was saved
+		await clickEditMed(page, "Edit GenName Med");
+		await expect(page.getByLabel(/(Generic Name|form\.genericName)/i)).toHaveValue("Acetylsalicylic acid");
+	});
+
+	test("should add notes to an existing medication", async ({ page }) => {
+		createdMeds.push(await createMedicationViaAPI({ name: "Edit Notes Med" }));
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Edit Notes Med");
+		await page.getByRole("tab", { name: /Package/i }).click();
+
+		// Notes should be empty initially
+		const notesField = page.getByLabel(/(Notes|form\.notes)/i);
+		await expect(notesField).toHaveValue("");
+
+		// Add notes text
+		await notesField.fill("Take with food after breakfast. Do not exceed 3 per day. Store below 25°C.");
+		await expect(notesField).toContainText("Take with food after breakfast");
+
+		await saveEditAndVerify(page, "Edit Notes Med");
+
+		// Verify notes were saved by clicking edit again
+		await clickEditMed(page, "Edit Notes Med");
+		await expect(page.getByLabel(/(Notes|form\.notes)/i)).toContainText("Take with food after breakfast");
+	});
+
+	test("should add taken-by person to a medication", async ({ page }) => {
+		createdMeds.push(await createMedicationViaAPI({ name: "TakenBy Med" }));
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "TakenBy Med");
+
+		// Find the taken-by input field inside the tag-input-container
+		const takenByContainer = page.locator(".tag-input-container");
+		await expect(takenByContainer).toBeVisible();
+		const takenByInput = takenByContainer.locator("input");
+
+		// Add a person name
+		await takenByInput.fill("Alice");
+		await takenByInput.press("Enter");
+
+		// Tag should appear
+		await expect(takenByContainer.locator(".tag").filter({ hasText: "Alice" })).toBeVisible();
+
+		// Add another person
+		await takenByInput.fill("Bob");
+		await takenByInput.press("Enter");
+		await expect(takenByContainer.locator(".tag").filter({ hasText: "Bob" })).toBeVisible();
+
+		await saveEditAndVerify(page, "TakenBy Med");
+
+		// Verify tags are persisted
+		await clickEditMed(page, "TakenBy Med");
+		await expect(page.locator(".tag-input-container .tag").filter({ hasText: "Alice" })).toBeVisible();
+		await expect(page.locator(".tag-input-container .tag").filter({ hasText: "Bob" })).toBeVisible();
+	});
+
+	test("should remove a taken-by person from a medication", async ({ page }) => {
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: "Remove TakenBy Med",
+				takenBy: ["Alice", "Bob"],
+			})
+		);
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Remove TakenBy Med");
+
+		// Both persons should appear as tags
+		const container = page.locator(".tag-input-container");
+		await expect(container.locator(".tag")).toHaveCount(2, { timeout: 5000 });
+
+		// Use Backspace in the empty input to remove the last tag (Bob)
+		// The app handles this: if input empty + backspace → remove last takenBy person
+		const takenByInput = container.locator("input");
+		await takenByInput.click();
+		await takenByInput.press("Backspace");
+
+		// After backspace, Bob (the last tag) should be removed, leaving Alice
+		await expect(container.locator(".tag")).toHaveCount(1, { timeout: 5000 });
+		await expect(container.locator(".tag").filter({ hasText: "Alice" })).toBeVisible();
+
+		await saveEditAndVerify(page, "Remove TakenBy Med");
+
+		// Verify only Alice remains after save
+		await clickEditMed(page, "Remove TakenBy Med");
+		await expect(container.locator(".tag")).toHaveCount(1, { timeout: 5000 });
+		await expect(container.locator(".tag").filter({ hasText: "Alice" })).toBeVisible();
+	});
+
+	test("should add an expiry date to a medication", async ({ page }) => {
+		createdMeds.push(await createMedicationViaAPI({ name: "Expiry Date Med" }));
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Expiry Date Med");
+		await page.getByRole("tab", { name: /Package/i }).click();
+
+		// Set expiry date to 6 months from now
+		const expiryDate = new Date(Date.now() + 180 * 24 * 60 * 60 * 1000).toISOString().split("T")[0];
+		const expiryField = page.getByLabel(/(Expiry Date|form\.expiryDate)/i);
+		await expiryField.fill(expiryDate);
+		await expect(expiryField).toHaveValue(expiryDate);
+
+		// Also touch the name field to ensure form is dirty
+		// Expiry change itself is enough to persist in the current edit flow.
+
+		await saveEditAndVerify(page, "Expiry Date Med");
+
+		// Verify expiry date was saved
+		await clickEditMed(page, "Expiry Date Med");
+		await expect(page.getByLabel(/(Expiry Date|form\.expiryDate)/i)).toHaveValue(expiryDate);
+	});
+
+	test("should edit intake schedule usage and interval", async ({ page }) => {
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: "Edit Intake Med",
+				intakes: [
+					{
+						usage: 1,
+						every: 1,
+						start: new Date().toISOString().slice(0, 16),
+						intakeRemindersEnabled: false,
+					},
+				],
+			})
+		);
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Edit Intake Med");
+		await page.getByRole("tab", { name: /Schedule/i }).click();
+
+		// Change intake from 1 pill daily to 2 pills every 7 days
+		const intakeRow = page.locator(".blister-row").first();
+		const usageField = intakeRow.getByLabel(/(Usage \(pills\)|form\.blisters\.usage)/i);
+		const everyField = intakeRow.getByLabel(/(Every \(days\)|form\.blisters\.everyDays)/i);
+
+		await usageField.fill("2");
+		await everyField.fill("7");
+
+		await expect(usageField).toHaveValue("2");
+		await expect(everyField).toHaveValue("7");
+
+		await saveEditAndVerify(page, "Edit Intake Med");
+
+		// Verify the changes persisted
+		await clickEditMed(page, "Edit Intake Med");
+		const savedRow = page.locator(".blister-row").first();
+		await expect(savedRow.getByLabel(/(Usage \(pills\)|form\.blisters\.usage)/i)).toHaveValue("2");
+		await expect(savedRow.getByLabel(/(Every \(days\)|form\.blisters\.everyDays)/i)).toHaveValue("7");
+	});
+
+	test("should add a second intake schedule row", async ({ page }) => {
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: "Add Intake Med",
+				intakes: [
+					{
+						usage: 1,
+						every: 1,
+						start: new Date().toISOString().slice(0, 16),
+						intakeRemindersEnabled: false,
+					},
+				],
+			})
+		);
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Add Intake Med");
+		await page.getByRole("tab", { name: /Schedule/i }).click();
+
+		// Should have 1 intake row initially
+		await expect(page.locator(".blister-row")).toHaveCount(1);
+
+		// Add a second intake
+		await page.getByRole("button", { name: /(Intake|form\.blisters\.addIntake)/i }).click();
+		await expect(page.locator(".blister-row")).toHaveCount(2);
+
+		// Fill the new intake row
+		const secondRow = page.locator(".blister-row").nth(1);
+		await secondRow.getByLabel(/(Usage \(pills\)|form\.blisters\.usage)/i).fill("0.5");
+		await secondRow.getByLabel(/(Every \(days\)|form\.blisters\.everyDays)/i).fill("7");
+
+		await saveEditAndVerify(page, "Add Intake Med");
+
+		// Verify 2 intakes persisted
+		await clickEditMed(page, "Add Intake Med");
+		await expect(page.locator(".blister-row")).toHaveCount(2, { timeout: 10000 });
+	});
+
+	test("should toggle intake reminder on a medication", async ({ page }) => {
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: "Reminder Toggle Med",
+				intakes: [
+					{
+						usage: 1,
+						every: 1,
+						start: new Date().toISOString().slice(0, 16),
+						intakeRemindersEnabled: false,
+					},
+				],
+			})
+		);
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Reminder Toggle Med");
+		await page.getByRole("tab", { name: /Schedule/i }).click();
+
+		// Find the remind checkbox in the intake row
+		const intakeRow = page.locator(".blister-row").first();
+		const remindCheckbox = intakeRow.locator('input[type="checkbox"]');
+
+		if (await remindCheckbox.isVisible().catch(() => false)) {
+			// Should be unchecked initially
+			await expect(remindCheckbox).not.toBeChecked();
+
+			// Enable it
+			await remindCheckbox.check();
+			await expect(remindCheckbox).toBeChecked();
+
+			await saveEditAndVerify(page, "Reminder Toggle Med");
+
+			// Verify reminder was saved
+			await clickEditMed(page, "Reminder Toggle Med");
+			const savedCheckbox = page.locator(".blister-row").first().locator('input[type="checkbox"]');
+			await expect(savedCheckbox).toBeChecked();
+		}
+	});
+
+	test("should change package type between blister and bottle", async ({ page }) => {
+		createdMeds.push(
+			await createMedicationViaAPI({
+				name: "PackType Change Med",
+				packageType: "blister",
+				packCount: 2,
+				blistersPerPack: 3,
+				pillsPerBlister: 10,
+			})
+		);
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "PackType Change Med");
+		const form = page.locator("form.form-grid:visible").first();
+
+		// Should be blister type initially
+		const packageSelect = form.locator("select.package-type-select");
+		await expect(packageSelect).toHaveValue("blister");
+
+		// Blister-specific fields are shown in the Package tab.
+		await page.getByRole("tab", { name: /Package/i }).click();
+		await expect(form.getByLabel(/(Blisters per pack|form\.blistersPerPack)/i)).toBeVisible();
+		await page.getByRole("tab", { name: /General/i }).click();
+
+		// Switch to bottle
+		await packageSelect.selectOption("bottle");
+		await page.getByRole("tab", { name: /Package/i }).click();
+		await expect(form.getByLabel(/(Total Capacity|form\.totalCapacity|Total \(pills\))/i)).toBeVisible();
+
+		// Fill bottle-specific fields
+		await form.getByLabel(/(Total Capacity|form\.totalCapacity|Total \(pills\))/i).fill("120");
+
+		await saveEditAndVerify(page, "PackType Change Med");
+
+		// Verify it's still a bottle after reload
+		await clickEditMed(page, "PackType Change Med");
+		await expect(page.locator("select.package-type-select")).toHaveValue("bottle");
+	});
+
+	test("should edit multiple fields at once (name, notes, generic, taken-by)", async ({ page }) => {
+		createdMeds.push(await createMedicationViaAPI({ name: "Multi Edit Med" }));
+		await navigateTo(page, "/medications");
+
+		await clickEditMed(page, "Multi Edit Med");
+
+		// Change the name
+		await page.getByLabel(/(Commercial Name|form\.commercialName)/i).fill("Fully Edited Med");
+
+		// Add generic name
+		await page.getByLabel(/(Generic Name|form\.genericName)/i).fill("Ibuprofen Lysinate");
+
+		// Add notes
+		await page.getByRole("tab", { name: /Package/i }).click();
+		await page.getByLabel(/(Notes|form\.notes)/i).fill("Morning dose only. Take with plenty of water.");
+		await page.getByRole("tab", { name: /General/i }).click();
+
+		// Add a taken-by person
+		const takenByInput = page.locator(".tag-input-container input");
+		await takenByInput.fill("Charlie");
+		await takenByInput.press("Enter");
+		await expect(page.locator(".tag-input-container .tag").filter({ hasText: "Charlie" })).toBeVisible();
+
+		await saveEditAndVerify(page, "Fully Edited Med");
+
+		// Verify all changes persisted
+		await clickEditMed(page, "Fully Edited Med");
+		await expect(page.getByLabel(/(Commercial Name|form\.commercialName)/i)).toHaveValue("Fully Edited Med");
+		await expect(page.getByLabel(/(Generic Name|form\.genericName)/i)).toHaveValue("Ibuprofen Lysinate");
+		await expect(page.getByLabel(/(Notes|form\.notes)/i)).toContainText("Morning dose only");
+		await expect(page.locator(".tag-input-container .tag").filter({ hasText: "Charlie" })).toBeVisible();
+	});
+});