Files

T

julian cf1ff5676d feat(tariff): V2 — legacy-parity pricing (time-of-day, category, seasonal, flat)

Bring the legacy ParkSQL2017 pricing BREADTH onto our engine while keeping
integer-minor-unit money + immutable signed versions (rejecting legacy's
float money / mutable rows). TariffStructure becomes a discriminated union:
V1 = the original bare ladder (UNCHANGED, verbatim algorithm, golden-
regression-tested against the live version); V2 = {version:2, tz, shared
knobs, defaultCard, windowedCards[]} where each card is flat OR a block
ladder and may be scoped by wall-clock hour window / day-of-week / date
range / vehicle category.

computeFeeV2 prices by stepping one increment at a time, advancing the
ladder by ELAPSED minutes (continuous) while selecting the active card by
WALL-CLOCK time in the version's FROZEN tz. Decisions: tz is a per-site
setting (site_config.timezone, default Europe/Tirane) stamped server-side
into each version on publish — never the host clock (reproducibility);
default-card cap governs a mixed day; precedence = specificity
(date>dow>hour) -> priority -> name (total, order-independent), validation
rejects ambiguous ties; category = a card FIELD, frozen in the signed
vehicle_entry payload (site_config.default_vehicle_category default), read
at both pricing call-sites.

Composer: default card front-and-centre (flat/ladder toggle), tiers under
an "Advanced" disclosure; emits BARE V1 when no tiers (back-compat). DB:
migrations 0005 (timezone) + 0006 (default_vehicle_category). Stood up
vitest in @parking/shared (was zero tests on the ledger-feeding fee fn);
36 tests incl. golden V1 regression, happy-hour/overnight/dow/flat/category/
cap edges, precedence shuffle-invariance, Europe/Tirane DST determinism,
validation matrix — all green. No event-chain change.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

2026-06-18 20:00:13 +02:00

9.0 KiB

Raw Blame History

type, tags, updated

type

Index

Content catalog for the wiki. Start at overview. Maintained on every ingest. Counts: 4 sources · 19 entities · 42 concepts · 5 decision records.

overview — the top-level synthesis and entry point.
index — this catalog.
log.md — chronological record of ingests/queries/lints.

Sources

parking-system-architecture — design notes: stack, threat model, devices, UHPPOTE, ESP32, readers, BOM, open decisions.
gee-qr-er80 — datasheet: GEE QR access reader (QR/DM/1D; Wiegand/RS-232/485/USB/TCP; Linux).
qrcode-sdk — QRCode SDK v1.6.5: the reader's HTTP-GET-poll protocol + JSON verdict (beep/output).
parksql2017-legacy-schema — predecessor SQL Server schema (Albanian market): legacy tariff/discount/membership/shift/fiscal model; confirms blocks, adds time-windows + categories, lacks postpaid sponsors.

Entities — technology stack

technology-stack — the full stack table; all MIT/Apache/BSD, chosen to avoid lock-in.
fastify — Node backend; hosts device-driver plugins + auth; serves the SPA.
sqlite — local single-writer DB (WAL); limits & why it fits.
drizzle-orm — ORM; schemas port to PostgreSQL for remote sync.
turborepo — monorepo tool.
react-vite-spa — React/Vite frontend served by Fastify.
local-jwt-auth — fully local auth (JWT + bcrypt + role guard); forced by offline-first.

Entities — rejected alternatives

payload-cms — strong, but rejected over BSL license shift (the rug-pull cautionary case).
refine — dropped for plain React; UI too simple to justify a framework.
logto-zitadel-oidc — OIDC providers ruled out by offline-first.

Entities — hardware & devices

uhppote-controller — ❌ rejected/historical; firmware auto-open blocker drove the switch to Dingtian.
esp32-custom-controller — prevention-grade upgrade; device-level auth.
atecc608 — secure element; non-extractable signing key (host events + controller auth).
wiegand — reader standard feeding the controller directly (autonomous permit-holder path).
lpr-camera — edge-AI plate recognition; host-side casual-identity source.
gee-qr-er80 — QR access reader on hand; host-side serial → read bus (the QR-ticket scanner).
zkteco-controller — ❌ rejected/historical; aux-input path was a contender, not pursued.
dingtian-relay — ✅ CHOSEN access controller; decoupled inputs solve the button blocker (driver verified on hardware).
rongta-printer — ✅ CHOSEN 80mm thermal printer; ESC/POS over raw TCP 9100; driver written, one unit reachable at 10.0.10.6.
bom — reference bill of materials (barrier, loops, controller, readers, payment, host, network).

Concepts — foundational forces

offline-first — no network dependency in core operation; what it forces (and doesn't).
threat-model — the operator-at-the-booth reframing; why encryption defends the wrong threat.

Concepts — integrity & anti-fraud

append-only-event-chain — append-only + hash chain + ATECC608 signing = unforgeable log.
reconciliation — the real anti-fraud control; what remote sync actually is.
disk-os-hardening — LUKS/GRUB/Secure Boot; worthwhile but not the main event.

Concepts — device architecture & safety

device-adapter-pattern — business logic talks to interfaces; swap hardware → new adapter.
device-registry — catalog of selectable drivers per category (admin-configurable).
first-run-setup — admin adds controllers + binds readers/cameras to relays from the catalog at install.
device-input-flow — button → device push → backend decides → relay; backend is source of truth.
device-discovery — optional driver capability to scan the LAN (no current driver uses it; UHPPOTE was the example).
barrier-not-a-door — never timed-close a barrier; safety lives in barrier firmware.
printer-roles-failover — ≥2 printers by role; entry ticket falls back outside→booth.
printer-status-monitoring — live poll of paper/cover/cutter/offline via the device's status page; SSE to the booth UI.
device-status-monitoring — unified live status across ALL device categories (healthCheck + printer readStatus) → the booth footer over /api/ws.
trust-boundary — the core fork: network vs. device; auditable vs. unforgeable.
fail-state-safety — entry fails closed, exit fails open; manual override; watchdog.

Concepts — access control

uhppote-udp-protocol — open UDP weakness + the unauthenticated commands that undermine the log.
network-isolation — mandatory VLAN isolation; the network as security boundary.
event-log-ingestion — host-side index tracking that makes the UHPPOTE log trustworthy.
challenge-response-auth — asymmetric nonce scheme for the ESP32 (auth + anti-replay).
entry-exit-readers — two populations, two integration paths; both can share a relay.
entry-exit-points — pool-of-spaces model (no lane); per-relay direction, reader→relay binding, camera snapshots.
uhppote-vs-esp32 — comparison: detection vs. prevention.

Concepts — business domain

parking-session — the core domain entity; a projection over the signed log, never a mutable table.
tariff — fee model; pure, data-driven, offline; pay-on-foot adds a walk-back grace window.
tariff-time-tiers — BUILT (V2 tariff): happy-hour/off-peak/weekend/seasonal + vehicle category + flat rate via wall-clock windowed cards; tz frozen per version.
booth-exit-flow — manned booth: pay → voucher (self-exit later) or immediate exit; active sessions; audited barrier re-open.
shift — manned-only accountability period; explicit Start/End; End → signed + printed Z-report; drawer float carries across shifts.
capacity-occupancy — live count = open sessions; refuse entry + FULL sign when full (soft policy); exit never blocked.
site-metadata — optional park identity (name, operator, VAT, address, contact) in site_config; feeds the ticket header.
valet-overcapacity — "full" is soft: operator may valet-accept over capacity (keys handed over, custody). Manned, deferred.
validation-discounts — merchant validates a ticket → signed discount event applied at fee time.
validation-sponsorship — design: sponsor accounts + postpaid B2B (customers park free, business billed monthly); not a permit.
reporting-analytics — revenue/occupancy/stay reports + plate-search, all projections over the signed log.
clock-integrity — fees depend on the host clock; detect/flag backdating on an offline box.
ticket-encoding — transient ticket id as QR; printed at entry, scanned at pay station + exit; plate-as-ticket alt.
anti-passback — block/flag one id entering twice without an exit; fold over open sessions.
device-events — unsigned hardware telemetry (relay/printer/camera/reader/input); separate from the signed ledger.
subscription — recurring plan (e.g. 10,000 ALL/month); RF/QR or plate identity, car-count + max-concurrent, host-in-loop; short-circuits payment. (Renamed from "permit"; time-of-day windows noted, deferred.)
opencv-anpr-service — host-side vision microservice: ANPR (plate identity) + vehicle verification (anti-plate-spoofing witness).
blocklist — barred plates/cards refused at entry (never at exit); signed, attributed.

Concepts — frontend / operator UI

booth-console — operator-UI architecture: TanStack Query/Router + Zustand + Tailwind terminal theme; one /api/ws live feed (anti-CSWSH); shift control + device-status footer.
i18n — Albanian default + English; per-user server-stored language preference (users.language), loaded on login; tickets stay Albanian.

Dev environment (reference)

local-dev-workflow — running the stack locally; setup, the dev-hang gotchas, seed:admin.
wsl-dev-networking — WSL2 NAT blocks device broadcast; use mirrored mode + the gotchas after.

Decisions

standing-decisions — settled decisions (stack, platform, integrity, access control, readers).
open-questions — 9 open items (procurement + JWT key + FX + pay-station money corners); ESP32 device auth deferred.
access-controller-button-flow — ✅ RESOLVED: Dingtian decoupled inputs enable ticket-first entry (was a UHPPOTE/ZKTeco blocker).
autonomous-direction — roadmap: toward fully unmanned (no booth); reshapes threat model + fail-state.
dingtian-vs-mqtt — transport choice: direct HTTP/UDP now, MQTT parked until multi-lane scale.
session-model — business layer start: session = projection; transient-first; pay-on-foot. New event types.
vision-service — build a host-side ANPR + vehicle-verification service; replaces edge-LPR; scoped AGPL exception.
event-streams-split — split the signed business ledger (ledger_events) from unsigned device telemetry (device_events).

9.0 KiB Raw Blame History