Merge pull request #6 from tiquis0290/dev

Dev

.github/workflows/docker.yml

@@ -3,6 +3,9 @@ name: Build & Push Docker Image
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
 
 permissions:

AUDIT_FINDINGS.md

@@ -1,281 +0,0 @@
-# TREK Security & Code Quality Audit
-
-**Date:** 2026-03-30
-**Auditor:** Automated comprehensive audit
-**Scope:** Full codebase — server, client, infrastructure, dependencies
-
----
-
-## Table of Contents
-
-1. [Security](#1-security)
-2. [Code Quality](#2-code-quality)
-3. [Best Practices](#3-best-practices)
-4. [Dependency Hygiene](#4-dependency-hygiene)
-5. [Documentation & DX](#5-documentation--dx)
-6. [Testing](#6-testing)
-7. [Remediation Summary](#7-remediation-summary)
-
----
-
-## 1. Security
-
-### 1.1 General
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| S-1 | **CRITICAL** | `server/src/middleware/auth.ts` | 17 | JWT `verify()` does not pin algorithm — accepts whatever algorithm is in the token header, potentially including `none`. | Pass `{ algorithms: ['HS256'] }` to all `jwt.verify()` calls. | FIXED |
-| S-2 | **HIGH** | `server/src/websocket.ts` | 56 | Same JWT verify without algorithm pinning in WebSocket auth. | Pin algorithm to HS256. | FIXED |
-| S-3 | **HIGH** | `server/src/middleware/mfaPolicy.ts` | 54 | Same JWT verify without algorithm pinning. | Pin algorithm to HS256. | FIXED |
-| S-4 | **HIGH** | `server/src/routes/oidc.ts` | 84-88 | OIDC `generateToken()` includes excessive claims (username, email, role) in JWT payload. If the JWT is leaked, this exposes PII. | Only include `{ id: user.id }` in token, consistent with auth.ts. | FIXED |
-| S-5 | **HIGH** | `client/src/api/websocket.ts` | 27 | Auth token passed in WebSocket URL query string (`?token=`). Tokens in URLs appear in server logs, proxy logs, and browser history. | Document as known limitation; WebSocket protocol doesn't easily support headers from browsers. Add `LOW` priority note to switch to message-based auth in the future. | DOCUMENTED |
-| S-6 | **HIGH** | `client/vite.config.js` | 47-56 | Service worker caches ALL `/api/.*` responses with `NetworkFirst`, including auth tokens, user data, budget, reservations. Data persists after logout. | Exclude sensitive API paths from caching: `/api/auth/.*`, `/api/admin/.*`, `/api/backup/.*`. | FIXED |
-| S-7 | **HIGH** | `client/vite.config.js` | 57-65 | User-uploaded files (possibly passport scans, booking confirmations) cached with `CacheFirst` for 30 days, persisting after logout. | Reduce cache lifetime; add note about clearing on logout. | FIXED |
-| S-8 | **MEDIUM** | `server/src/index.ts` | 60 | CSP allows `'unsafe-inline'` for scripts, weakening XSS protection. | Remove `'unsafe-inline'` from `scriptSrc` if Vite build doesn't require it. If needed for development, only allow in non-production. | FIXED |
-| S-9 | **MEDIUM** | `server/src/index.ts` | 64 | CSP `connectSrc` allows `http:` and `https:` broadly, permitting connections to any origin. | Restrict to known API domains (nominatim, overpass, Google APIs) or use `'self'` with specific external origins. | FIXED |
-| S-10 | **MEDIUM** | `server/src/index.ts` | 62 | CSP `imgSrc` allows `http:` broadly. | Restrict to `https:` and `'self'` plus known image domains. | FIXED |
-| S-11 | **MEDIUM** | `server/src/websocket.ts` | 84-90 | No message size limit on WebSocket messages. A malicious client could send very large messages to exhaust server memory. | Set `maxPayload` on WebSocketServer configuration. | FIXED |
-| S-12 | **MEDIUM** | `server/src/websocket.ts` | 84 | No rate limiting on WebSocket messages. A client can flood the server with join/leave messages. | Add per-connection message rate limiting. | FIXED |
-| S-13 | **MEDIUM** | `server/src/websocket.ts` | 29 | No origin validation on WebSocket connections. | Add origin checking against allowed origins. | FIXED |
-| S-14 | **MEDIUM** | `server/src/routes/auth.ts` | 157-163 | JWT tokens have 24h expiry with no refresh token mechanism. Long-lived tokens increase window of exposure if leaked. | Document as accepted risk for self-hosted app. Consider refresh tokens in future. | DOCUMENTED |
-| S-15 | **MEDIUM** | `server/src/routes/auth.ts` | 367-368 | Password change does not invalidate existing JWT tokens. Old tokens remain valid for up to 24h. | Implement token version/generation tracking, or reduce token expiry and add refresh tokens. | REQUIRES MANUAL REVIEW |
-| S-16 | **MEDIUM** | `server/src/services/mfaCrypto.ts` | 2, 5 | MFA encryption key is derived from JWT_SECRET. If JWT_SECRET is compromised, all MFA secrets are also compromised. Single point of failure. | Use a separate MFA_ENCRYPTION_KEY env var, or derive using a different salt/purpose. Current implementation with `:mfa:v1` salt is acceptable but tightly coupled. | DOCUMENTED |
-| S-17 | **MEDIUM** | `server/src/routes/maps.ts` | 429 | Google API key exposed in URL query string (`&key=${apiKey}`). Could appear in logs. | Use header-based auth (X-Goog-Api-Key) consistently. Already used elsewhere in the file. | FIXED |
-| S-18 | **MEDIUM** | `MCP.md` | 232-235 | Contains publicly accessible database download link with hardcoded credentials (`admin@admin.com` / `admin123`). | Remove credentials from documentation. | FIXED |
-| S-19 | **LOW** | `server/src/index.ts` | 229 | Error handler logs full error object including stack trace to console. In containerized deployments, this could leak to centralized logging. | Sanitize error logging in production. | FIXED |
-| S-20 | **LOW** | `server/src/routes/backup.ts` | 301-304 | Error detail leaked in non-production environments (`detail: process.env.NODE_ENV !== 'production' ? msg : undefined`). | Acceptable for dev, but ensure it's consistently not leaked in production. Already correct. | OK |
-
-### 1.2 Auth (JWT + OIDC + TOTP)
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| A-1 | **CRITICAL** | All jwt.verify calls | Multiple | JWT algorithm not pinned. `jsonwebtoken` library defaults to accepting the algorithm specified in the token header, which could include `none`. | Add `{ algorithms: ['HS256'] }` to every `jwt.verify()` call. | FIXED |
-| A-2 | **MEDIUM** | `server/src/routes/auth.ts` | 315-318 | MFA login token uses same JWT_SECRET and same `jwt.sign()`. Purpose field `mfa_login` prevents misuse but should use a shorter expiry. Currently 5m which is acceptable. | OK — 5 minute expiry is reasonable. | OK |
-| A-3 | **MEDIUM** | `server/src/routes/oidc.ts` | 113-143 | OIDC redirect URI is dynamically constructed from request headers (`x-forwarded-proto`, `x-forwarded-host`). An attacker who can control these headers could redirect the callback to a malicious domain. | Validate the constructed redirect URI against an allowlist, or use a configured base URL from env vars. | FIXED |
-| A-4 | **LOW** | `server/src/routes/auth.ts` | 21 | TOTP `window: 1` allows codes from adjacent time periods (±30s). This is standard and acceptable. | OK | OK |
-
-### 1.3 SQLite (better-sqlite3)
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| D-1 | **HIGH** | `server/src/routes/files.ts` | 90-91 | Dynamic SQL with `IN (${placeholders})` — however, placeholders are correctly generated from array length and values are parameterized. **Not an injection risk.** | OK — pattern is safe. | OK |
-| D-2 | **MEDIUM** | `server/src/routes/auth.ts` | 455 | Dynamic SQL `UPDATE users SET ${updates.join(', ')} WHERE id = ?` — column names come from controlled server-side code, not user input. Parameters are properly bound. | OK — column names are from a controlled set. | OK |
-| D-3 | **LOW** | `server/src/db/database.ts` | 26-28 | WAL mode and busy_timeout configured. Good. | OK | OK |
-
-### 1.4 WebSocket (ws)
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| W-1 | **MEDIUM** | `server/src/websocket.ts` | 29 | No `maxPayload` set on WebSocketServer. Default is 100MB which is excessive. | Set `maxPayload: 64 * 1024` (64KB). | FIXED |
-| W-2 | **MEDIUM** | `server/src/websocket.ts` | 84-110 | Only `join` and `leave` message types are handled; unknown types are silently ignored. This is acceptable but there is no schema validation on the message structure. | Add basic type/schema validation using Zod. | FIXED |
-| W-3 | **LOW** | `server/src/websocket.ts` | 88 | `JSON.parse` errors are silently caught with empty catch. | Log malformed messages at debug level. | FIXED |
-
-### 1.5 Express
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| E-1 | **LOW** | `server/src/index.ts` | 82 | Body parser limit set to 100KB. Good. | OK | OK |
-| E-2 | **LOW** | `server/src/index.ts` | 14-16 | Trust proxy configured conditionally. Good. | OK | OK |
-| E-3 | **LOW** | `server/src/index.ts` | 121-136 | Path traversal protection on uploads endpoint. Uses `path.basename` and `path.resolve` check. Good. | OK | OK |
-
-### 1.6 PWA / Workbox
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| P-1 | **HIGH** | `client/vite.config.js` | 47-56 | API response caching includes sensitive endpoints. | Exclude auth, admin, backup, and settings endpoints from caching. | FIXED |
-| P-2 | **MEDIUM** | `client/vite.config.js` | 23, 31, 42, 54, 63 | `cacheableResponse: { statuses: [0, 200] }` — status 0 represents opaque responses which may cache error responses silently. | Remove status 0 from API and upload caches (keep for CDN/map tiles where CORS may return opaque responses). | FIXED |
-| P-3 | **MEDIUM** | `client/src/store/authStore.ts` | 126-135 | Logout does not clear service worker caches. Sensitive data persists after logout. | Clear CacheStorage for `api-data` and `user-uploads` caches on logout. | FIXED |
-
----
-
-## 2. Code Quality
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| Q-1 | **MEDIUM** | `client/src/store/authStore.ts` | 153-161 | `loadUser` silently catches all errors and logs user out. A transient network failure logs the user out. | Only logout on 401 responses, not on network errors. | FIXED |
-| Q-2 | **MEDIUM** | `client/src/hooks/useRouteCalculation.ts` | 36 | `useCallback` depends on entire `tripStore` object, defeating memoization. | Select only needed properties from the store. | DOCUMENTED |
-| Q-3 | **MEDIUM** | `client/src/hooks/useTripWebSocket.ts` | 14 | `collabFileSync` captures stale `tripStore` reference from initial render. | Use `useTripStore.getState()` instead. | DOCUMENTED |
-| Q-4 | **MEDIUM** | `client/src/store/authStore.ts` | 38 vs 105 | `register` function accepts 4 params but TypeScript interface only declares 3. | Update interface to include optional `invite_token`. | FIXED |
-| Q-5 | **LOW** | `client/src/store/slices/filesSlice.ts` | — | Empty catch block on file link operation (`catch {}`). | Log error. | DOCUMENTED |
-| Q-6 | **LOW** | `client/src/App.tsx` | 101, 108 | Empty catch blocks silently swallow errors. | Add minimal error logging. | DOCUMENTED |
-| Q-7 | **LOW** | `client/src/App.tsx` | 155 | `RegisterPage` imported but never used — `/register` route renders `LoginPage`. | Remove unused import. | FIXED |
-| Q-8 | **LOW** | `client/tsconfig.json` | 14 | `strict: false` disables TypeScript strict mode. | Enable strict mode and fix resulting type errors. | REQUIRES MANUAL REVIEW |
-| Q-9 | **LOW** | `client/src/main.tsx` | 7 | Non-null assertion on `getElementById('root')!`. | Add null check. | DOCUMENTED |
-| Q-10 | **LOW** | `server/src/routes/files.ts` | 278 | Empty catch block on file link insert (`catch {}`). | Log duplicate link errors. | FIXED |
-| Q-11 | **LOW** | `server/src/db/database.ts` | 20-21 | Silent catch on WAL checkpoint in `initDb`. | Log warning on failure. | DOCUMENTED |
-
----
-
-## 3. Best Practices
-
-### 3.1 Node / Express
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| B-1 | **LOW** | `server/src/index.ts` | 251-271 | Graceful shutdown implemented with SIGTERM/SIGINT handlers. Good — closes DB, HTTP server, with 10s timeout. | OK | OK |
-| B-2 | **LOW** | `server/src/index.ts` | 87-112 | Debug logging redacts sensitive fields. Good. | OK | OK |
-
-### 3.2 React / Vite
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| V-1 | **MEDIUM** | `client/vite.config.js` | — | No explicit `build.sourcemap: false` for production. Source maps may be generated. | Add `build: { sourcemap: false }` to Vite config. | FIXED |
-| V-2 | **LOW** | `client/index.html` | 24 | Leaflet CSS loaded from unpkg CDN without Subresource Integrity (SRI) hash. | Add `integrity` and `crossorigin` attributes. | FIXED |
-
-### 3.3 Docker
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| K-1 | **MEDIUM** | `Dockerfile` | 2, 10 | Base images use floating tags (`node:22-alpine`), not pinned to digest. | Pin to specific digest for reproducible builds. | DOCUMENTED |
-| K-2 | **MEDIUM** | `Dockerfile` | — | No `HEALTHCHECK` instruction. Only docker-compose has health check. | Add `HEALTHCHECK` to Dockerfile for standalone deployments. | FIXED |
-| K-3 | **LOW** | `.dockerignore` | — | Missing exclusions for `chart/`, `docs/`, `.github/`, `docker-compose.yml`, `*.sqlite*`. | Add missing exclusions. | FIXED |
-
-### 3.4 docker-compose.yml
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| C-1 | **HIGH** | `docker-compose.yml` | 25 | `JWT_SECRET` defaults to empty string if not set. App auto-generates one, but it changes on restart, invalidating all sessions. | Log a prominent warning on startup if JWT_SECRET is auto-generated. | FIXED |
-| C-2 | **MEDIUM** | `docker-compose.yml` | — | No resource limits defined for the `app` service. | Add `deploy.resources.limits` section. | DOCUMENTED |
-
-### 3.5 Git Hygiene
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| G-1 | **HIGH** | `.gitignore` | 12-14 | Missing `*.sqlite`, `*.sqlite-wal`, `*.sqlite-shm` patterns. Only `*.db` variants covered. | Add sqlite patterns. | FIXED |
-| G-2 | **LOW** | — | — | No `.env` or `.sqlite` files found in git history. | OK | OK |
-
-### 3.6 Helm Chart
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| H-1 | **MEDIUM** | `chart/templates/secret.yaml` | 22 | `randAlphaNum 32` generates a new JWT secret on every `helm upgrade`, invalidating all sessions. | Use `lookup` to preserve existing secret across upgrades. | FIXED |
-| H-2 | **MEDIUM** | `chart/values.yaml` | 3 | Default image tag is `latest`. | Use a specific version tag. | DOCUMENTED |
-| H-3 | **MEDIUM** | `chart/templates/deployment.yaml` | — | No `securityContext` on pod or container. Runs as root by default. | Add `runAsNonRoot: true`, `runAsUser: 1000`. | FIXED |
-| H-4 | **MEDIUM** | `chart/templates/pvc.yaml` | — | PVC always created regardless of `.Values.persistence.enabled`. | Add conditional check. | FIXED |
-| H-5 | **LOW** | `chart/values.yaml` | 41 | `resources: {}` — no default resource requests or limits. | Add sensible defaults. | FIXED |
-
----
-
-## 4. Dependency Hygiene
-
-### 4.1 npm audit
-
-| Package | Severity | Description | Status |
-|---------|----------|-------------|--------|
-| `serialize-javascript` (via vite-plugin-pwa → workbox-build → @rollup/plugin-terser) | **HIGH** | RCE via RegExp.flags / CPU exhaustion DoS | Fix requires `vite-plugin-pwa` major version upgrade. | DOCUMENTED |
-| `picomatch` (via @rollup/pluginutils, tinyglobby) | **MODERATE** | ReDoS via extglob quantifiers | `npm audit fix` available. | FIXED |
-
-**Server:** 0 vulnerabilities.
-
-### 4.2 Outdated Dependencies (Notable)
-
-| Package | Current | Latest | Risk | Status |
-|---------|---------|--------|------|--------|
-| `express` | ^4.18.3 | 5.2.1 | Major version — breaking changes | DOCUMENTED |
-| `uuid` | ^9.0.0 | 13.0.0 | Major version | DOCUMENTED |
-| `dotenv` | ^16.4.1 | 17.3.1 | Major version | DOCUMENTED |
-| `lucide-react` | ^0.344.0 | 1.7.0 | Major version | DOCUMENTED |
-| `react` | ^18.2.0 | 19.2.4 | Major version | DOCUMENTED |
-| `zustand` | ^4.5.2 | 5.0.12 | Major version | DOCUMENTED |
-
-> Major version upgrades require manual evaluation and testing. Not applied in this remediation pass.
-
----
-
-## 5. Documentation & DX
-
-| # | Severity | File | Description | Recommended Fix | Status |
-|---|----------|------|-------------|-----------------|--------|
-| X-1 | **MEDIUM** | `server/.env.example` | Missing many env vars documented in README: `OIDC_*`, `FORCE_HTTPS`, `TRUST_PROXY`, `DEMO_MODE`, `TZ`, `ALLOWED_ORIGINS`, `DEBUG`. | Add all configurable env vars. | FIXED |
-| X-2 | **MEDIUM** | `server/.env.example` | JWT_SECRET placeholder is `your-super-secret-jwt-key-change-in-production` — easily overlooked. | Use `CHANGEME_GENERATE_WITH_openssl_rand_hex_32`. | FIXED |
-| X-3 | **LOW** | `server/.env.example` | `PORT=3001` differs from Docker default of `3000`. | Align to `3000`. | FIXED |
-
----
-
-## 6. Testing
-
-| # | Severity | Description | Status |
-|---|----------|-------------|--------|
-| T-1 | **HIGH** | No test files found anywhere in the repository. Zero test coverage for auth flows, WebSocket handling, SQLite queries, API routes, or React components. | REQUIRES MANUAL REVIEW |
-| T-2 | **HIGH** | No test framework configured (no jest, vitest, or similar in dependencies). | REQUIRES MANUAL REVIEW |
-| T-3 | **MEDIUM** | No CI step runs tests before building Docker image. | DOCUMENTED |
-
----
-
-## 7. Remediation Summary
-
-### Applied Fixes
-
-- **Immich SSRF prevention** — Added URL validation on save (block private IPs, metadata endpoints, non-HTTP protocols)
-- **Immich API key isolation** — Removed `userId` query parameter from asset proxy endpoints; all Immich requests now use authenticated user's own credentials only
-- **Immich asset ID validation** — Added alphanumeric pattern validation to prevent path traversal in proxied URLs
-- **JWT algorithm pinning** — Added `{ algorithms: ['HS256'] }` to all `jwt.verify()` calls (auth middleware, MFA policy, WebSocket, OIDC, auth routes)
-- **OIDC token payload** — Reduced to `{ id }` only, matching auth.ts pattern
-- **OIDC redirect URI validation** — Validates against `APP_URL` env var when set
-- **WebSocket hardening** — Added `maxPayload: 64KB`, message rate limiting (30 msg/10s), origin validation, improved message validation
-- **CSP tightening** — Removed `'unsafe-inline'` from scripts in production, restricted `connectSrc` and `imgSrc` to known domains
-- **PWA cache security** — Excluded sensitive API paths from caching, removed opaque response caching for API/uploads, clear caches on logout
-- **Service worker cache cleanup on logout**
-- **Google API key** — Moved from URL query string to header in maps photo endpoint
-- **MCP.md credentials** — Removed hardcoded demo credentials
-- **.gitignore** — Added `*.sqlite*` patterns
-- **.dockerignore** — Added missing exclusions
-- **Dockerfile** — Added HEALTHCHECK instruction
-- **Helm chart** — Fixed secret rotation, added securityContext, conditional PVC, resource defaults
-- **Vite config** — Disabled source maps in production
-- **CDN integrity** — Added SRI hash for Leaflet CSS
-- **.env.example** — Complete with all env vars
-- **Various code quality fixes** — Removed dead imports, fixed empty catch blocks, fixed auth store interface
-
-### Requires Manual Review
-
-- Password change should invalidate existing tokens (S-15)
-- TypeScript strict mode should be enabled (Q-8)
-- Test suite needs to be created from scratch (T-1, T-2)
-- Major dependency upgrades (express 5, React 19, zustand 5, etc.)
-- `serialize-javascript` vulnerability fix requires vite-plugin-pwa major upgrade
-
-### 1.7 Immich Integration
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| I-1 | **CRITICAL** | `server/src/routes/immich.ts` | 38-39, 85, 199, 250, 274 | SSRF via user-controlled `immich_url`. Users can set any URL which is then used in `fetch()` calls, allowing requests to internal metadata endpoints (169.254.169.254), localhost services, etc. | Validate URL on save: require HTTP(S) protocol, block private/internal IPs. | FIXED |
-| I-2 | **CRITICAL** | `server/src/routes/immich.ts` | 194-196, 244-246, 269-270 | Asset info/thumbnail/original endpoints accept `userId` query param, allowing any authenticated user to proxy requests through another user's Immich API key. This exposes other users' Immich credentials and photo libraries. | Restrict all Immich proxy endpoints to the authenticated user's own credentials only. | FIXED |
-| I-3 | **MEDIUM** | `server/src/routes/immich.ts` | 199, 250, 274 | `assetId` URL parameter used directly in `fetch()` URL construction. Path traversal characters could redirect requests to unintended Immich API endpoints. | Validate assetId matches `[a-zA-Z0-9_-]+` pattern. | FIXED |
-
-### 1.8 Admin Routes
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| AD-1 | **MEDIUM** | `server/src/routes/admin.ts` | 302-310 | Self-update endpoint runs `git pull` then `npm run build`. While admin-only and `npm install` uses `--ignore-scripts`, `npm run build` executes whatever is in the pulled package.json. A compromised upstream could execute arbitrary code. | Document as accepted risk for self-hosted self-update feature. Users should pin to specific versions. | DOCUMENTED |
-
-### 1.9 Client-Side XSS
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| X-1 | **CRITICAL** | `client/src/components/Admin/GitHubPanel.tsx` | 66, 106 | `dangerouslySetInnerHTML` with `inlineFormat()` renders GitHub release notes as HTML without escaping. Malicious HTML in release notes could execute scripts. | Escape HTML entities before applying markdown-style formatting. Validate link URLs. | FIXED |
-| X-2 | **LOW** | `client/src/components/Map/MapView.tsx` | divIcon | Uses `escAttr()` for HTML sanitization in divIcon strings. Properly mitigated. | OK | OK |
-
-### 1.10 Route Calculator Bug
-
-| # | Severity | File | Line(s) | Description | Recommended Fix | Status |
-|---|----------|------|---------|-------------|-----------------|--------|
-| RC-1 | **HIGH** | `client/src/components/Map/RouteCalculator.ts` | 16 | OSRM URL hardcodes `'driving'` profile, ignoring the `profile` parameter. Walking/cycling routes always return driving results. | Use the `profile` parameter in URL construction. | FIXED |
-
-### Additional Findings (from exhaustive scan)
-
-- **MEDIUM** — `server/src/index.ts:121-136`: Upload files (`/uploads/:type/:filename`) served without authentication. UUIDs are unguessable but this is security-through-obscurity. **REQUIRES MANUAL REVIEW** — adding auth would break shared trip image URLs.
-- **MEDIUM** — `server/src/routes/oidc.ts:194`: OIDC token exchange error was logging full token response (potentially including access tokens). **FIXED** — now logs only HTTP status.
-- **MEDIUM** — `server/src/services/notifications.ts:194-196`: Email body is not HTML-escaped. User-generated content (trip names, usernames) interpolated directly into HTML email template. Potential stored XSS in email clients. **DOCUMENTED** — needs HTML entity escaping.
-- **LOW** — `server/src/demo/demo-seed.ts:7-9`: Hardcoded demo credentials (`demo12345`, `admin12345`). Intentional for demo mode but dangerous if DEMO_MODE accidentally left on in production. Already has startup warning.
-- **LOW** — `server/src/routes/auth.ts:742`: MFA setup returns plaintext TOTP secret to client. This is standard TOTP enrollment flow — users need the secret for manual entry. Must be served over HTTPS.
-- **LOW** — `server/src/routes/auth.ts:473`: Admin settings GET returns API keys in full (not masked). Only accessible to admins.
-- **LOW** — `server/src/routes/auth.ts:564`: SMTP password stored as plaintext in `app_settings` table. Masked in API response but unencrypted at rest.
-
-### Accepted Risks (Documented)
-
-- WebSocket token in URL query string (browser limitation)
-- 24h JWT expiry without refresh tokens (acceptable for self-hosted)
-- MFA encryption key derived from JWT_SECRET (noted coupling)
-- localStorage for token storage (standard SPA pattern)
-- Upload files served without auth (UUID-based obscurity, needed for shared trips)

README.md

@@ -155,7 +155,7 @@ services:
       # - OIDC_ONLY=false # Set to true to disable local password auth entirely (SSO only)
       # - OIDC_ADMIN_CLAIM=groups # OIDC claim used to identify admin users
       # - OIDC_ADMIN_VALUE=app-trek-admins # Value of the OIDC claim that grants admin role
-      # - OIDC_SCOPE=openid email profile groups # Space-separated OIDC scopes to request (must include scopes for any claim used by OIDC_ADMIN_CLAIM)
+      # - OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes as needed (e.g. add groups if using OIDC_ADMIN_CLAIM)
       # - OIDC_DISCOVERY_URL= # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik)
       # - DEMO_MODE=false # Enable demo mode (resets data hourly)
       # - ADMIN_EMAIL=admin@trek.local # Initial admin e-mail — only used on first boot when no users exist
@@ -295,7 +295,7 @@ trek.yourdomain.com {
 | `OIDC_ONLY` | Disable local password auth entirely (first SSO login becomes admin) | `false` |
 | `OIDC_ADMIN_CLAIM` | OIDC claim used to identify admin users | — |
 | `OIDC_ADMIN_VALUE` | Value of the OIDC claim that grants admin role | — |
-| `OIDC_SCOPE` | Space-separated OIDC scopes to request. Must include scopes for any claim used by `OIDC_ADMIN_CLAIM` (e.g. add `groups` for group-based admin mapping) | `openid email profile groups` |
+| `OIDC_SCOPE` | Space-separated OIDC scopes to request. **Fully replaces** the default — always include `openid email profile` plus any extra scopes you need (e.g. add `groups` when using `OIDC_ADMIN_CLAIM`) | `openid email profile` |
 | `OIDC_DISCOVERY_URL` | Override the auto-constructed OIDC discovery endpoint. Useful for providers that expose it at a non-standard path (e.g. Authentik: `https://auth.example.com/application/o/trek/.well-known/openid-configuration`) | — |
 | **Initial Setup** | | |
 | `ADMIN_EMAIL` | Email for the first admin account created on initial boot. Must be set together with `ADMIN_PASSWORD`. If either is omitted a random password is generated and printed to the server log. Has no effect once any user exists. | `admin@trek.local` |

client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "trek-client",
-  "version": "2.7.2",
+  "version": "2.8.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trek-client",
-      "version": "2.7.2",
+      "version": "2.8.4",
       "dependencies": {
         "@react-pdf/renderer": "^4.3.2",
         "axios": "^1.6.7",

client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek-client",
-  "version": "2.7.2",
+  "version": "2.8.4",
   "private": true,
   "type": "module",
   "scripts": {

client/src/api/client.ts

@@ -136,6 +136,16 @@ export const packingApi = {
   deleteBag: (tripId: number | string, bagId: number) => apiClient.delete(`/trips/${tripId}/packing/bags/${bagId}`).then(r => r.data),
 }
 
+export const todoApi = {
+  list: (tripId: number | string) => apiClient.get(`/trips/${tripId}/todo`).then(r => r.data),
+  create: (tripId: number | string, data: Record<string, unknown>) => apiClient.post(`/trips/${tripId}/todo`, data).then(r => r.data),
+  update: (tripId: number | string, id: number, data: Record<string, unknown>) => apiClient.put(`/trips/${tripId}/todo/${id}`, data).then(r => r.data),
+  delete: (tripId: number | string, id: number) => apiClient.delete(`/trips/${tripId}/todo/${id}`).then(r => r.data),
+  reorder: (tripId: number | string, orderedIds: number[]) => apiClient.put(`/trips/${tripId}/todo/reorder`, { orderedIds }).then(r => r.data),
+  getCategoryAssignees: (tripId: number | string) => apiClient.get(`/trips/${tripId}/todo/category-assignees`).then(r => r.data),
+  setCategoryAssignees: (tripId: number | string, categoryName: string, userIds: number[]) => apiClient.put(`/trips/${tripId}/todo/category-assignees/${encodeURIComponent(categoryName)}`, { user_ids: userIds }).then(r => r.data),
+}
+
 export const tagsApi = {
   list: () => apiClient.get('/tags').then(r => r.data),
   create: (data: Record<string, unknown>) => apiClient.post('/tags', data).then(r => r.data),

client/src/components/Collab/CollabNotes.tsx

@@ -3,7 +3,7 @@ import { useState, useEffect, useCallback, useRef, useMemo } from 'react'
 import DOM from 'react-dom'
 import Markdown from 'react-markdown'
 import remarkGfm from 'remark-gfm'
-import { Plus, Trash2, Pin, PinOff, Pencil, X, Check, StickyNote, Settings, ExternalLink, Maximize2 } from 'lucide-react'
+import { Plus, Trash2, Pin, PinOff, Pencil, X, Check, StickyNote, Settings, ExternalLink, Maximize2, Loader2 } from 'lucide-react'
 import { collabApi } from '../../api/client'
 import { getAuthUrl } from '../../api/authUrl'
 import { useCanDo } from '../../store/permissionsStore'
@@ -100,6 +100,7 @@ function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
   const [authUrl, setAuthUrl] = useState('')
   const rawUrl = file?.url || ''
   useEffect(() => {
+    setAuthUrl('')
     if (!rawUrl) return
     getAuthUrl(rawUrl, 'download').then(setAuthUrl)
   }, [rawUrl])
@@ -119,7 +120,10 @@ function FilePreviewPortal({ file, onClose }: FilePreviewPortalProps) {
       {isImage ? (
         /* Image lightbox — floating controls */
         <div style={{ position: 'relative', maxWidth: '90vw', maxHeight: '90vh' }} onClick={e => e.stopPropagation()}>
-          <img src={authUrl} alt={file.original_name} style={{ maxWidth: '90vw', maxHeight: '90vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} />
+          {authUrl
+            ? <img src={authUrl} alt={file.original_name} style={{ maxWidth: '90vw', maxHeight: '90vh', objectFit: 'contain', borderRadius: 8, display: 'block' }} />
+            : <Loader2 size={32} className="animate-spin" style={{ color: 'rgba(255,255,255,0.5)' }} />
+          }
           <div style={{ position: 'absolute', top: -36, left: 0, right: 0, display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '0 4px' }}>
             <span style={{ fontSize: 11, color: 'rgba(255,255,255,0.7)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', maxWidth: '70%' }}>{file.original_name}</span>
             <div style={{ display: 'flex', gap: 8 }}>
@@ -487,7 +491,7 @@ function NoteFormModal({ onClose, onSubmit, onDeleteFile, existingCategories, ca
                 const isImage = a.mime_type?.startsWith('image/')
                 return (
                   <div key={a.id} style={{ display: 'flex', alignItems: 'center', gap: 4, padding: '3px 8px', borderRadius: 8, background: 'var(--bg-secondary)', fontSize: 11, color: 'var(--text-muted)' }}>
-                    {isImage && <img src={a.url} style={{ width: 18, height: 18, objectFit: 'cover', borderRadius: 3 }} />}
+                    {isImage && <AuthedImg src={a.url} style={{ width: 18, height: 18, objectFit: 'cover', borderRadius: 3 }} />}
                     {(a.original_name || '').length > 20 ? a.original_name.slice(0, 17) + '...' : a.original_name}
                     <button type="button" onClick={() => handleDeleteAttachment(a.id)} style={{ background: 'none', border: 'none', cursor: 'pointer', color: '#ef4444', padding: 0, display: 'flex' }}>
                       <X size={10} />
@@ -1350,6 +1354,41 @@ export default function CollabNotes({ tripId, currentUser }: CollabNotesProps) {
             </div>
             <div className="collab-note-md-full" style={{ padding: '16px 20px', overflowY: 'auto', fontSize: 14, color: 'var(--text-primary)', lineHeight: 1.7 }}>
               <Markdown remarkPlugins={[remarkGfm]}>{viewingNote.content || ''}</Markdown>
+              {(viewingNote.attachments || []).length > 0 && (
+                <div style={{ marginTop: 16, paddingTop: 16, borderTop: '1px solid var(--border-primary)' }}>
+                  <div style={{ fontSize: 11, fontWeight: 600, color: 'var(--text-faint)', textTransform: 'uppercase', letterSpacing: 0.5, marginBottom: 10 }}>{t('files.title')}</div>
+                  <div style={{ display: 'flex', flexWrap: 'wrap', gap: 8 }}>
+                    {(viewingNote.attachments || []).map(a => {
+                      const isImage = a.mime_type?.startsWith('image/')
+                      const ext = (a.original_name || '').split('.').pop()?.toUpperCase() || '?'
+                      return (
+                        <div key={a.id} style={{ display: 'flex', flexDirection: 'column', alignItems: 'center', gap: 4, maxWidth: 72 }}>
+                          {isImage ? (
+                            <AuthedImg src={a.url} alt={a.original_name}
+                              style={{ width: 64, height: 64, objectFit: 'cover', borderRadius: 8, cursor: 'pointer', transition: 'transform 0.12s, box-shadow 0.12s' }}
+                              onClick={() => setPreviewFile(a)}
+                              onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.06)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
+                              onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.boxShadow = 'none' }} />
+                          ) : (
+                            <div title={a.original_name} onClick={() => setPreviewFile(a)}
+                              style={{
+                                width: 64, height: 64, borderRadius: 8, cursor: 'pointer',
+                                background: a.mime_type === 'application/pdf' ? '#ef44441a' : 'var(--bg-secondary)',
+                                display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center', gap: 1,
+                                transition: 'transform 0.12s, box-shadow 0.12s',
+                              }}
+                              onMouseEnter={e => { e.currentTarget.style.transform = 'scale(1.06)'; e.currentTarget.style.boxShadow = '0 2px 8px rgba(0,0,0,0.15)' }}
+                              onMouseLeave={e => { e.currentTarget.style.transform = 'scale(1)'; e.currentTarget.style.boxShadow = 'none' }}>
+                              <span style={{ fontSize: 10, fontWeight: 700, color: a.mime_type === 'application/pdf' ? '#ef4444' : 'var(--text-muted)', letterSpacing: 0.3 }}>{ext}</span>
+                            </div>
+                          )}
+                          <span style={{ fontSize: 9, color: 'var(--text-faint)', textAlign: 'center', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', width: '100%' }}>{a.original_name}</span>
+                        </div>
+                      )
+                    })}
+                  </div>
+                </div>
+              )}
             </div>
           </div>
         </div>,

client/src/components/Layout/InAppNotificationBell.tsx

@@ -96,7 +96,7 @@ export default function InAppNotificationBell(): React.ReactElement {
                 {t('notifications.title')}
                 {unreadCount > 0 && (
                   <span className="ml-2 px-1.5 py-0.5 rounded-full text-xs font-medium"
-                    style={{ background: '#6366f1', color: '#fff' }}>
+                    style={{ background: 'var(--text-primary)', color: 'var(--bg-primary)' }}>
                     {unreadCount}
                   </span>
                 )}
@@ -133,7 +133,7 @@ export default function InAppNotificationBell(): React.ReactElement {
             <div className="overflow-y-auto flex-1">
               {isLoading && notifications.length === 0 ? (
                 <div className="flex items-center justify-center py-10">
-                  <div className="w-5 h-5 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />
+                  <div className="w-5 h-5 border-2 rounded-full animate-spin" style={{ borderColor: 'var(--border-primary)', borderTopColor: 'var(--text-primary)' }} />
                 </div>
               ) : notifications.length === 0 ? (
                 <div className="flex flex-col items-center justify-center py-10 px-4 text-center gap-2">
@@ -154,7 +154,7 @@ export default function InAppNotificationBell(): React.ReactElement {
               className="w-full py-2.5 text-xs font-medium transition-colors flex-shrink-0"
               style={{
                 borderTop: '1px solid var(--border-secondary)',
-                color: '#6366f1',
+                color: 'var(--text-primary)',
                 background: 'transparent',
               }}
               onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}

client/src/components/Layout/Navbar.tsx

@@ -133,7 +133,7 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
         {tripTitle && (
           <>
             <span className="hidden sm:inline" style={{ color: 'var(--text-faint)' }}>/</span>
-            <span className="text-sm font-medium truncate max-w-48" style={{ color: 'var(--text-muted)' }}>
+            <span className="hidden sm:inline text-sm font-medium truncate max-w-48" style={{ color: 'var(--text-muted)' }}>
               {tripTitle}
             </span>
           </>
@@ -155,17 +155,18 @@ export default function Navbar({ tripTitle, tripId, onBack, showBack, onShare }:
         </button>
       )}
 
-      {/* Dark mode toggle (light ↔ dark, overrides auto) */}
+      {/* Dark mode toggle (light ↔ dark, overrides auto) — hidden on mobile */}
       <button onClick={toggleDarkMode} title={dark ? t('nav.lightMode') : t('nav.darkMode')}
-        className="p-2 rounded-lg transition-colors flex-shrink-0"
+        className="p-2 rounded-lg transition-colors flex-shrink-0 hidden sm:flex"
         style={{ color: 'var(--text-muted)' }}
         onMouseEnter={e => e.currentTarget.style.background = 'var(--bg-hover)'}
         onMouseLeave={e => e.currentTarget.style.background = 'transparent'}>
         {dark ? <Sun className="w-4 h-4" /> : <Moon className="w-4 h-4" />}
       </button>
 
-      {/* Notification bell */}
-      {user && <InAppNotificationBell />}
+      {/* Notification bell — only in trip view on mobile, everywhere on desktop */}
+      {user && tripId && <InAppNotificationBell />}
+      {user && !tripId && <span className="hidden sm:block"><InAppNotificationBell /></span>}
 
       {/* User menu */}
       {user && (

client/src/components/Memories/MemoriesPanel.tsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useCallback } from 'react'
-import { Camera, Plus, Share2, EyeOff, Eye, X, Check, Search, ArrowUpDown, MapPin, Filter, Link2, RefreshCw, Unlink, FolderOpen } from 'lucide-react'
+import { Camera, Plus, Share2, EyeOff, Eye, X, Check, Search, ArrowUpDown, MapPin, Filter, Link2, RefreshCw, Unlink, FolderOpen, Info } from 'lucide-react'
 import apiClient, { addonsApi } from '../../api/client'
 import { useAuthStore } from '../../store/authStore'
 import { useTranslation } from '../../i18n'
@@ -137,7 +137,8 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
   const unlinkAlbum = async (linkId: number) => {
     try {
       await apiClient.delete(`/integrations/memories/unified/trips/${tripId}/album-links/${linkId}`)
-      loadAlbumLinks()
+      await loadAlbumLinks()
+      await loadPhotos()
     } catch { toast.error(t('memories.error.unlinkAlbum')) }
   }
 
@@ -159,6 +160,14 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
   const [lightboxInfo, setLightboxInfo] = useState<any>(null)
   const [lightboxInfoLoading, setLightboxInfoLoading] = useState(false)
   const [lightboxOriginalSrc, setLightboxOriginalSrc] = useState('')
+  const [showMobileInfo, setShowMobileInfo] = useState(false)
+  const [isMobile, setIsMobile] = useState(() => window.innerWidth < 768)
+
+  useEffect(() => {
+    const handleResize = () => setIsMobile(window.innerWidth < 768)
+    window.addEventListener('resize', handleResize)
+    return () => window.removeEventListener('resize', handleResize)
+  }, [])
 
   // ── Init ──────────────────────────────────────────────────────────────────
 
@@ -885,117 +894,153 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
       )}
 
       {/* Lightbox */}
-      {lightboxId && lightboxUserId && (
-        <div onClick={() => { if (lightboxOriginalSrc) URL.revokeObjectURL(lightboxOriginalSrc); setLightboxOriginalSrc(''); setLightboxId(null); setLightboxUserId(null) }}
-          style={{
-            position: 'absolute', inset: 0, zIndex: 100,
-            background: 'rgba(0,0,0,0.92)', display: 'flex', alignItems: 'center', justifyContent: 'center',
-          }}>
-          <button onClick={() => { if (lightboxOriginalSrc) URL.revokeObjectURL(lightboxOriginalSrc); setLightboxOriginalSrc(''); setLightboxId(null); setLightboxUserId(null) }}
-            style={{
-              position: 'absolute', top: 16, right: 16, width: 40, height: 40, borderRadius: '50%',
-              background: 'rgba(255,255,255,0.1)', border: 'none', cursor: 'pointer',
-              display: 'flex', alignItems: 'center', justifyContent: 'center',
-            }}>
-            <X size={20} color="white" />
-          </button>
-          <div onClick={e => e.stopPropagation()} style={{ display: 'flex', gap: 16, alignItems: 'flex-start', justifyContent: 'center', padding: 20, width: '100%', height: '100%' }}>
-            <img
-              src={lightboxOriginalSrc}
-              alt=""
-              style={{ maxWidth: lightboxInfo ? 'calc(100% - 280px)' : '100%', maxHeight: '100%', objectFit: 'contain', borderRadius: 10, cursor: 'default' }}
-            />
+      {lightboxId && lightboxUserId && (() => {
+        const closeLightbox = () => {
+          if (lightboxOriginalSrc) URL.revokeObjectURL(lightboxOriginalSrc)
+          setLightboxOriginalSrc('')
+          setLightboxId(null)
+          setLightboxUserId(null)
+          setShowMobileInfo(false)
+        }
 
-            {/* Info panel — liquid glass */}
-            {lightboxInfo && (
-              <div style={{
-                width: 240, flexShrink: 0, borderRadius: 16, padding: 18,
-                background: 'rgba(255,255,255,0.08)', backdropFilter: 'blur(20px)', WebkitBackdropFilter: 'blur(20px)',
-                border: '1px solid rgba(255,255,255,0.12)', color: 'white',
-                display: 'flex', flexDirection: 'column', gap: 14, maxHeight: '100%', overflowY: 'auto',
-              }}>
-                {/* Date */}
-                {lightboxInfo.takenAt && (
+        const exifContent = lightboxInfo ? (
+          <>
+            {lightboxInfo.takenAt && (
+              <div>
+                <div style={{ fontSize: 9, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.08em', color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>Date</div>
+                <div style={{ fontSize: 13, fontWeight: 600 }}>{new Date(lightboxInfo.takenAt).toLocaleDateString(undefined, { day: 'numeric', month: 'long', year: 'numeric' })}</div>
+                <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.5)' }}>{new Date(lightboxInfo.takenAt).toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' })}</div>
+              </div>
+            )}
+            {(lightboxInfo.city || lightboxInfo.country) && (
+              <div>
+                <div style={{ fontSize: 9, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.08em', color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>
+                  <MapPin size={9} style={{ display: 'inline', verticalAlign: '-1px', marginRight: 3 }} />Location
+                </div>
+                <div style={{ fontSize: 13, fontWeight: 600 }}>
+                  {[lightboxInfo.city, lightboxInfo.state, lightboxInfo.country].filter(Boolean).join(', ')}
+                </div>
+              </div>
+            )}
+            {lightboxInfo.camera && (
+              <div>
+                <div style={{ fontSize: 9, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.08em', color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>Camera</div>
+                <div style={{ fontSize: 12, fontWeight: 500 }}>{lightboxInfo.camera}</div>
+                {lightboxInfo.lens && <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.5)', marginTop: 2 }}>{lightboxInfo.lens}</div>}
+              </div>
+            )}
+            {(lightboxInfo.focalLength || lightboxInfo.aperture || lightboxInfo.iso) && (
+              <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 8 }}>
+                {lightboxInfo.focalLength && (
                   <div>
-                    <div style={{ fontSize: 9, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.08em', color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>Date</div>
-                    <div style={{ fontSize: 13, fontWeight: 600 }}>{new Date(lightboxInfo.takenAt).toLocaleDateString(undefined, { day: 'numeric', month: 'long', year: 'numeric' })}</div>
-                    <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.5)' }}>{new Date(lightboxInfo.takenAt).toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' })}</div>
+                    <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>Focal</div>
+                    <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.focalLength}</div>
                   </div>
                 )}
-
-                {/* Location */}
-                {(lightboxInfo.city || lightboxInfo.country) && (
+                {lightboxInfo.aperture && (
                   <div>
-                    <div style={{ fontSize: 9, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.08em', color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>
-                      <MapPin size={9} style={{ display: 'inline', verticalAlign: '-1px', marginRight: 3 }} />Location
-                    </div>
-                    <div style={{ fontSize: 13, fontWeight: 600 }}>
-                      {[lightboxInfo.city, lightboxInfo.state, lightboxInfo.country].filter(Boolean).join(', ')}
-                    </div>
+                    <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>Aperture</div>
+                    <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.aperture}</div>
                   </div>
                 )}
-
-                {/* Camera */}
-                {lightboxInfo.camera && (
+                {lightboxInfo.shutter && (
                   <div>
-                    <div style={{ fontSize: 9, fontWeight: 700, textTransform: 'uppercase', letterSpacing: '0.08em', color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>Camera</div>
-                    <div style={{ fontSize: 12, fontWeight: 500 }}>{lightboxInfo.camera}</div>
-                    {lightboxInfo.lens && <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.5)', marginTop: 2 }}>{lightboxInfo.lens}</div>}
+                    <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>Shutter</div>
+                    <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.shutter}</div>
                   </div>
                 )}
-
-                {/* Settings */}
-                {(lightboxInfo.focalLength || lightboxInfo.aperture || lightboxInfo.iso) && (
-                  <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 8 }}>
-                    {lightboxInfo.focalLength && (
-                      <div>
-                        <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>Focal</div>
-                        <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.focalLength}</div>
-                      </div>
-                    )}
-                    {lightboxInfo.aperture && (
-                      <div>
-                        <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>Aperture</div>
-                        <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.aperture}</div>
-                      </div>
-                    )}
-                    {lightboxInfo.shutter && (
-                      <div>
-                        <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>Shutter</div>
-                        <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.shutter}</div>
-                      </div>
-                    )}
-                    {lightboxInfo.iso && (
-                      <div>
-                        <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>ISO</div>
-                        <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.iso}</div>
-                      </div>
-                    )}
-                  </div>
-                )}
-
-                {/* Resolution & File */}
-                {(lightboxInfo.width || lightboxInfo.fileName) && (
-                  <div style={{ borderTop: '1px solid rgba(255,255,255,0.08)', paddingTop: 10 }}>
-                    {lightboxInfo.width && lightboxInfo.height && (
-                      <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>{lightboxInfo.width} × {lightboxInfo.height}</div>
-                    )}
-                    {lightboxInfo.fileSize && (
-                      <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.4)' }}>{(lightboxInfo.fileSize / 1024 / 1024).toFixed(1)} MB</div>
-                    )}
+                {lightboxInfo.iso && (
+                  <div>
+                    <div style={{ fontSize: 9, color: 'rgba(255,255,255,0.4)', textTransform: 'uppercase', letterSpacing: '0.05em' }}>ISO</div>
+                    <div style={{ fontSize: 13, fontWeight: 700 }}>{lightboxInfo.iso}</div>
                   </div>
                 )}
               </div>
             )}
+            {(lightboxInfo.width || lightboxInfo.fileName) && (
+              <div style={{ borderTop: '1px solid rgba(255,255,255,0.08)', paddingTop: 10 }}>
+                {lightboxInfo.width && lightboxInfo.height && (
+                  <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.4)', marginBottom: 3 }}>{lightboxInfo.width} × {lightboxInfo.height}</div>
+                )}
+                {lightboxInfo.fileSize && (
+                  <div style={{ fontSize: 11, color: 'rgba(255,255,255,0.4)' }}>{(lightboxInfo.fileSize / 1024 / 1024).toFixed(1)} MB</div>
+                )}
+              </div>
+            )}
+          </>
+        ) : null
 
-            {lightboxInfoLoading && (
-              <div style={{ width: 240, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
-                <div className="w-6 h-6 border-2 rounded-full animate-spin" style={{ borderColor: 'rgba(255,255,255,0.2)', borderTopColor: 'white' }} />
+        return (
+          <div onClick={closeLightbox}
+            style={{
+              position: 'absolute', inset: 0, zIndex: 100,
+              background: 'rgba(0,0,0,0.92)', display: 'flex', alignItems: 'center', justifyContent: 'center',
+            }}>
+            {/* Close button */}
+            <button onClick={closeLightbox}
+              style={{
+                position: 'absolute', top: 16, right: 16, zIndex: 10, width: 40, height: 40, borderRadius: '50%',
+                background: 'rgba(255,255,255,0.1)', border: 'none', cursor: 'pointer',
+                display: 'flex', alignItems: 'center', justifyContent: 'center',
+              }}>
+              <X size={20} color="white" />
+            </button>
+
+            {/* Mobile info toggle button */}
+            {isMobile && (lightboxInfo || lightboxInfoLoading) && (
+              <button onClick={e => { e.stopPropagation(); setShowMobileInfo(prev => !prev) }}
+                style={{
+                  position: 'absolute', top: 16, right: 68, zIndex: 10, width: 40, height: 40, borderRadius: '50%',
+                  background: showMobileInfo ? 'rgba(255,255,255,0.25)' : 'rgba(255,255,255,0.1)',
+                  border: 'none', cursor: 'pointer',
+                  display: 'flex', alignItems: 'center', justifyContent: 'center',
+                }}>
+                <Info size={20} color="white" />
+              </button>
+            )}
+
+            <div onClick={e => e.stopPropagation()} style={{ display: 'flex', gap: 16, alignItems: 'flex-start', justifyContent: 'center', padding: 20, width: '100%', height: '100%' }}>
+              <img
+                src={lightboxOriginalSrc}
+                alt=""
+                style={{ maxWidth: (!isMobile && lightboxInfo) ? 'calc(100% - 280px)' : '100%', maxHeight: '100%', objectFit: 'contain', borderRadius: 10, cursor: 'default' }}
+              />
+
+              {/* Desktop info panel — liquid glass */}
+              {!isMobile && lightboxInfo && (
+                <div style={{
+                  width: 240, flexShrink: 0, borderRadius: 16, padding: 18,
+                  background: 'rgba(255,255,255,0.08)', backdropFilter: 'blur(20px)', WebkitBackdropFilter: 'blur(20px)',
+                  border: '1px solid rgba(255,255,255,0.12)', color: 'white',
+                  display: 'flex', flexDirection: 'column', gap: 14, maxHeight: '100%', overflowY: 'auto',
+                }}>
+                  {exifContent}
+                </div>
+              )}
+
+              {!isMobile && lightboxInfoLoading && (
+                <div style={{ width: 240, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+                  <div className="w-6 h-6 border-2 rounded-full animate-spin" style={{ borderColor: 'rgba(255,255,255,0.2)', borderTopColor: 'white' }} />
+                </div>
+              )}
+            </div>
+
+            {/* Mobile bottom sheet */}
+            {isMobile && showMobileInfo && lightboxInfo && (
+              <div onClick={e => e.stopPropagation()} style={{
+                position: 'absolute', bottom: 0, left: 0, right: 0, zIndex: 5,
+                maxHeight: '60vh', overflowY: 'auto',
+                borderRadius: '16px 16px 0 0', padding: 18,
+                background: 'rgba(0,0,0,0.85)', backdropFilter: 'blur(20px)', WebkitBackdropFilter: 'blur(20px)',
+                border: '1px solid rgba(255,255,255,0.12)', borderBottom: 'none',
+                color: 'white', display: 'flex', flexDirection: 'column', gap: 14,
+              }}>
+                {exifContent}
               </div>
             )}
           </div>
-        </div>
-      )}
+        )
+      })()}
     </div>
   )
 }

client/src/components/Notifications/InAppNotificationItem.tsx

@@ -59,10 +59,6 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
         borderBottom: '1px solid var(--border-secondary)',
       }}
     >
-      {/* Unread dot */}
-      {!notification.is_read && (
-        <div className="absolute left-2 top-1/2 -translate-y-1/2 w-1.5 h-1.5 rounded-full" style={{ background: '#6366f1' }} />
-      )}
 
       <div className="flex gap-3 items-start">
         {/* Sender avatar */}
@@ -102,7 +98,7 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
                   title={t('notifications.markRead')}
                   className="p-1 rounded transition-colors"
                   style={{ color: 'var(--text-faint)' }}
-                  onMouseEnter={e => { e.currentTarget.style.background = 'var(--bg-hover)'; e.currentTarget.style.color = '#6366f1' }}
+                  onMouseEnter={e => { e.currentTarget.style.background = 'var(--bg-hover)'; e.currentTarget.style.color = 'var(--text-primary)' }}
                   onMouseLeave={e => { e.currentTarget.style.background = 'transparent'; e.currentTarget.style.color = 'var(--text-faint)' }}
                 >
                   <CheckCheck className="w-3.5 h-3.5" />
@@ -134,7 +130,7 @@ export default function InAppNotificationItem({ notification, onClose }: Notific
                 className="flex items-center gap-1 px-2.5 py-1 rounded-lg text-xs font-medium transition-colors"
                 style={{
                   background: notification.response === 'positive'
-                    ? '#6366f1'
+                    ? 'var(--text-primary)'
                     : notification.response === 'negative'
                       ? (dark ? '#27272a' : '#f1f5f9')
                       : (dark ? '#27272a' : '#f1f5f9'),

client/src/components/PDF/TripPDF.tsx

@@ -1,22 +1,33 @@
 // Trip PDF via browser print window
 import { createElement } from 'react'
 import { getCategoryIcon } from '../shared/categoryIcons'
-import { FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark } from 'lucide-react'
-import { mapsApi } from '../../api/client'
+import { FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark, Hotel, LogIn, LogOut, KeyRound, BedDouble, LucideIcon } from 'lucide-react'
+import { accommodationsApi, mapsApi } from '../../api/client'
 import type { Trip, Day, Place, Category, AssignmentsMap, DayNotesMap } from '../../types'
 
+function renderLucideIcon(icon:LucideIcon, props = {}) {
+  if (!_renderToStaticMarkup) return ''
+  return _renderToStaticMarkup(
+    createElement(icon, props)
+  );
+}
+
 const NOTE_ICON_MAP = { FileText, Info, Clock, MapPin, Navigation, Train, Plane, Bus, Car, Ship, Coffee, Ticket, Star, Heart, Camera, Flag, Lightbulb, AlertTriangle, ShoppingBag, Bookmark }
 function noteIconSvg(iconId) {
-  if (!_renderToStaticMarkup) return ''
   const Icon = NOTE_ICON_MAP[iconId] || FileText
-  return _renderToStaticMarkup(createElement(Icon, { size: 14, strokeWidth: 1.8, color: '#94a3b8' }))
+  return renderLucideIcon(Icon, { size: 14, strokeWidth: 1.8, color: '#94a3b8' })
 }
 
 const TRANSPORT_ICON_MAP = { flight: Plane, train: Train, bus: Bus, car: Car, cruise: Ship }
 function transportIconSvg(type) {
-  if (!_renderToStaticMarkup) return ''
   const Icon = TRANSPORT_ICON_MAP[type] || Ticket
-  return _renderToStaticMarkup(createElement(Icon, { size: 14, strokeWidth: 1.8, color: '#3b82f6' }))
+  return renderLucideIcon(Icon, { size: 14, strokeWidth: 1.8, color: '#3b82f6' })
+}
+
+const ACCOMMODATION_ICON_MAP = { accommodation: Hotel, checkin: LogIn, checkout: LogOut, location: MapPin, note: FileText, confirmation: KeyRound }
+function accommodationIconSvg(type) {
+  const Icon = ACCOMMODATION_ICON_MAP[type] || BedDouble
+  return renderLucideIcon(Icon, { size: 14, strokeWidth: 1.8, color: '#03398f', className: 'accommodation-icon' })
 }
 
 // ── SVG inline icons (for chips) ─────────────────────────────────────────────
@@ -115,6 +126,8 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
   const sorted = [...(days || [])].sort((a, b) => a.day_number - b.day_number)
   const range = longDateRange(sorted, loc)
   const coverImg = safeImg(trip?.cover_image)
+  //retrieve accommodations for the trip to display on the day sections and prefetch their photos if needed
+  const accommodations = await accommodationsApi.list(trip.id);
 
   // Pre-fetch place photos from Google
   const photoMap = await fetchPlacePhotos(assignments)
@@ -223,7 +236,41 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
                 ${place.notes ? `<div class="info-row"><span class="info-spacer"></span><span class="info-text muted italic">${escHtml(place.notes)}</span></div>` : ''}
               </div>
             </div>`
-        }).join('')
+      }).join('')
+
+    const accommodationsForDay = (accommodations.accommodations || []).filter(a =>
+      days.some(d => d.id >= a.start_day_id && d.id <= a.end_day_id && d.id === day?.id)
+    ).sort((a, b) => a.start_day_id - b.start_day_id)
+
+    const accommodationDetails = accommodationsForDay.map(item => {
+      const isCheckIn = day.id === item.start_day_id
+      const isCheckOut = day.id === item.end_day_id
+      const actionLabel = isCheckIn ? tr('reservations.meta.checkIn')
+        : isCheckOut ? tr('reservations.meta.checkOut')
+        : tr('reservations.meta.linkAccommodation')
+      const actionIcon = isCheckIn ? accommodationIconSvg('checkin')
+        : isCheckOut ? accommodationIconSvg('checkout')
+        : accommodationIconSvg('accommodation')
+      const timeStr = isCheckIn ? (item.check_in || '')
+        : isCheckOut ? (item.check_out || '')
+        : ''
+
+      return `
+        <div class="day-accommodation">
+          <div class="day-accommodation-title accommodation-center-icon">${actionIcon} ${escHtml(actionLabel)}</div>
+          ${timeStr ? `<div class="accommodation-center-icon">${accommodationIconSvg('checkin')} <b>${escHtml(timeStr)}</b></div>` : ''}
+          <div class="accommodation-center-icon">${accommodationIconSvg('accommodation')} ${escHtml(item.place_name)}</div>
+          ${item.place_address ? `<div class="accommodation-center-icon">${accommodationIconSvg('location')} ${escHtml(item.place_address)}</div>` : ''}
+          ${item.notes ? `<div class="accommodation-center-icon">${accommodationIconSvg('note')} ${escHtml(item.notes)}</div>` : ''}
+          ${isCheckIn && item.confirmation ? `<div class="accommodation-center-icon">${accommodationIconSvg('confirmation')} ${escHtml(item.confirmation)}</div>` : ''}
+        </div>`
+    }).join('')
+
+    const accommodationsHtml = accommodationsForDay.length > 0
+      ? `<div class="day-accommodations-overview">
+          <div class="day-accommodations ${accommodationsForDay.length === 1 ? 'single' : ''}">${accommodationDetails}</div>
+        </div>`
+      : ''
 
     return `
       <div class="day-section${di > 0 ? ' page-break' : ''}">
@@ -233,8 +280,8 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
           ${day.date ? `<span class="day-date">${shortDate(day.date, loc)}</span>` : ''}
           ${cost ? `<span class="day-cost">${cost}</span>` : ''}
         </div>
-        <div class="day-body">${itemsHtml}</div>
-      </div>`
+        <div class="day-body">${accommodationsHtml}${itemsHtml}</div>
+      </div>`  
   }).join('')
 
   const html = `<!DOCTYPE html>
@@ -317,6 +364,22 @@ export async function downloadTripPDF({ trip, days, places, assignments, categor
   .day-cost  { font-size: 9px; font-weight: 600; color: rgba(255,255,255,0.65); }
   .day-body  { padding: 12px 28px 6px; }
 
+  /* accommodation info */
+  .day-accommodations-overview { font-size: 12px; }
+  .day-accommodations { display: flex; flex-wrap: wrap; gap: 8px; justify-content: space-between; }
+  .day-accommodations.single { justify-content: center; }
+  .day-accommodation {
+    flex: 1 1 45%; min-width: 200px; margin: 4px 0; padding: 10px;
+    border: 2px solid #e2e8f0; border-radius: 12px;
+    display: flex; flex-direction: column;
+  }
+  .day-accommodation-title {
+    font-size: 16px; font-weight: 600; text-align: center;
+    margin-bottom: 4px; align-self: center;
+  }
+  .accommodation-center-icon { display: flex; align-items: center; gap: 4px; }
+
+
   /* ── Place card ────────────────────────────────── */
   .place-card {
     display: flex; align-items: stretch;

client/src/components/Planner/DayPlanSidebar.tsx

@@ -136,6 +136,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
   const [dragOverDayId, setDragOverDayId] = useState(null)
   const [hoveredId, setHoveredId] = useState(null)
   const [transportDetail, setTransportDetail] = useState(null)
+  const [transportPosVersion, setTransportPosVersion] = useState(0)
   const [timeConfirm, setTimeConfirm] = useState<{
     dayId: number; fromId: number; time: string;
     // For drag & drop reorder
@@ -211,13 +212,67 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
 
   const TRANSPORT_TYPES = new Set(['flight', 'train', 'bus', 'car', 'cruise'])
 
+  // Determine if a reservation's end_time represents a different date (multi-day)
+  const getEndDate = (r: Reservation) => {
+    const endStr = r.reservation_end_time || ''
+    return endStr.includes('T') ? endStr.split('T')[0] : null
+  }
+
+  // Get span phase: how a reservation relates to a specific day's date
+  const getSpanPhase = (r: Reservation, dayDate: string): 'single' | 'start' | 'middle' | 'end' => {
+    if (!r.reservation_time) return 'single'
+    const startDate = r.reservation_time.split('T')[0]
+    const endDate = getEndDate(r) || startDate
+    if (startDate === endDate) return 'single'
+    if (dayDate === startDate) return 'start'
+    if (dayDate === endDate) return 'end'
+    return 'middle'
+  }
+
+  // Get the appropriate display time for a reservation on a specific day
+  const getDisplayTimeForDay = (r: Reservation, dayDate: string): string | null => {
+    const phase = getSpanPhase(r, dayDate)
+    if (phase === 'end') return r.reservation_end_time || null
+    if (phase === 'middle') return null
+    return r.reservation_time || null
+  }
+
+  // Get phase label for multi-day badge
+  const getSpanLabel = (r: Reservation, phase: string): string | null => {
+    if (phase === 'single') return null
+    if (r.type === 'flight') return t(`reservations.span.${phase === 'start' ? 'departure' : phase === 'end' ? 'arrival' : 'inTransit'}`)
+    if (r.type === 'car') return t(`reservations.span.${phase === 'start' ? 'pickup' : phase === 'end' ? 'return' : 'active'}`)
+    return t(`reservations.span.${phase === 'start' ? 'start' : phase === 'end' ? 'end' : 'ongoing'}`)
+  }
+
   const getTransportForDay = (dayId: number) => {
     const day = days.find(d => d.id === dayId)
     if (!day?.date) return []
     return reservations.filter(r => {
-      if (!r.reservation_time || !TRANSPORT_TYPES.has(r.type)) return false
-      const resDate = r.reservation_time.split('T')[0]
-      return resDate === day.date
+      if (!r.reservation_time || r.type === 'hotel') return false
+      const startDate = r.reservation_time.split('T')[0]
+      const endDate = getEndDate(r)
+
+      if (endDate && endDate !== startDate) {
+        // Multi-day: show on any day in range (car middle handled elsewhere)
+        return day.date >= startDate && day.date <= endDate
+      } else {
+        // Single-day: show all non-hotel reservations that match this day's date
+        return startDate === day.date
+      }
+    })
+  }
+
+  // Get car rentals that are in "active" (middle) phase for a day — shown in day header, not timeline
+  const getActiveRentalsForDay = (dayId: number) => {
+    const day = days.find(d => d.id === dayId)
+    if (!day?.date) return []
+    return reservations.filter(r => {
+      if (r.type !== 'car' || !r.reservation_time) return false
+      const startDate = r.reservation_time.split('T')[0]
+      const endDate = getEndDate(r)
+      if (!endDate || endDate === startDate) return false
+      return day.date > startDate && day.date < endDate
     })
   }
 
@@ -279,47 +334,45 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
     const da = getDayAssignments(dayId)
     const dn = (dayNotes[String(dayId)] || []).slice().sort((a, b) => a.sort_order - b.sort_order)
     const transport = getTransportForDay(dayId)
+    const dayDate = days.find(d => d.id === dayId)?.date || ''
 
     // Initialize positions for transports that don't have one yet
     if (transport.some(r => r.day_plan_position == null)) {
       initTransportPositions(dayId)
     }
 
-    // Build base list: untimed places + notes sorted by order_index/sort_order
-    const timedPlaces = da.filter(a => parseTimeToMinutes(a.place?.place_time) !== null)
-    const freePlaces = da.filter(a => parseTimeToMinutes(a.place?.place_time) === null)
-
+    // Build base list: ALL places (timed and untimed) + notes sorted by order_index/sort_order
+    // Places keep their order_index ordering — only transports are inserted based on time.
     const baseItems = [
-      ...freePlaces.map(a => ({ type: 'place' as const, sortKey: a.order_index, data: a })),
+      ...da.map(a => ({ type: 'place' as const, sortKey: a.order_index, data: a })),
       ...dn.map(n => ({ type: 'note' as const, sortKey: n.sort_order, data: n })),
     ].sort((a, b) => a.sortKey - b.sortKey)
 
-    // Timed places + transports: compute sortKeys based on time, inserted among base items
-    const allTimed = [
-      ...timedPlaces.map(a => ({ type: 'place' as const, data: a, minutes: parseTimeToMinutes(a.place?.place_time)! })),
-      ...transport.map(r => ({ type: 'transport' as const, data: r, minutes: parseTimeToMinutes(r.reservation_time) ?? 0 })),
-    ].sort((a, b) => a.minutes - b.minutes)
+    // Only transports are inserted among base items based on time/position
+    const timedTransports = transport.map(r => ({
+      type: 'transport' as const,
+      data: r,
+      minutes: parseTimeToMinutes(getDisplayTimeForDay(r, dayDate)) ?? 0,
+    })).sort((a, b) => a.minutes - b.minutes)
 
-    if (allTimed.length === 0) return baseItems
+    if (timedTransports.length === 0) return baseItems
     if (baseItems.length === 0) {
-      return allTimed.map((item, i) => ({ ...item, sortKey: i }))
+      return timedTransports.map((item, i) => ({ ...item, sortKey: i }))
     }
 
-    // Insert timed items among base items using time-to-position mapping.
-    // Each timed item finds the last base place whose order_index corresponds
-    // to a reasonable position, then gets a fractional sortKey after it.
+    // Insert transports among base items using persisted position or time-to-position mapping.
     const result = [...baseItems]
-    for (let ti = 0; ti < allTimed.length; ti++) {
-      const timed = allTimed[ti]
+    for (let ti = 0; ti < timedTransports.length; ti++) {
+      const timed = timedTransports[ti]
       const minutes = timed.minutes
 
-      // For transports, use persisted position if available
-      if (timed.type === 'transport' && timed.data.day_plan_position != null) {
+      // Use persisted position if available
+      if (timed.data.day_plan_position != null) {
         result.push({ type: timed.type, sortKey: timed.data.day_plan_position, data: timed.data })
         continue
       }
 
-      // Find insertion position: after the last base item with time <= this item's time
+      // Find insertion position: after the last base item with time <= this transport's time
       let insertAfterKey = -Infinity
       for (const item of result) {
         if (item.type === 'place') {
@@ -350,7 +403,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
     return map
   // getMergedItems is redefined each render but captures assignments/dayNotes/reservations/days via closure
   // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [days, assignments, dayNotes, reservations])
+  }, [days, assignments, dayNotes, reservations, transportPosVersion])
 
   const openAddNote = (dayId, e) => {
     e?.stopPropagation()
@@ -449,6 +502,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
           const res = reservations.find(r => r.id === tu.id)
           if (res) res.day_plan_position = tu.day_plan_position
         }
+        setTransportPosVersion(v => v + 1)
         await reservationsApi.updatePositions(tripId, transportUpdates)
       }
       if (prevAssignmentIds.length) {
@@ -968,6 +1022,17 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                           )
                         })
                       })()}
+                      {/* Active rental car badges */}
+                      {(() => {
+                        const activeRentals = getActiveRentalsForDay(day.id)
+                        if (activeRentals.length === 0) return null
+                        return activeRentals.map(r => (
+                          <span key={`rental-${r.id}`} onClick={e => { e.stopPropagation(); setTransportDetail(r) }} style={{ display: 'inline-flex', alignItems: 'center', gap: 3, padding: '2px 7px', borderRadius: 5, background: 'rgba(59,130,246,0.08)', border: '1px solid rgba(59,130,246,0.2)', flexShrink: 1, minWidth: 0, maxWidth: '40%', cursor: 'pointer' }}>
+                            <Car size={8} style={{ color: '#3b82f6', flexShrink: 0 }} />
+                            <span style={{ fontSize: 9, color: 'var(--text-muted)', fontWeight: 600, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>{r.title}</span>
+                          </span>
+                        ))
+                      })()}
                     </div>
                   )}
                   <div style={{ display: 'flex', alignItems: 'center', gap: 8, marginTop: 2, flexWrap: 'wrap' }}>
@@ -1010,18 +1075,20 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                     const { placeId, assignmentId, noteId, fromDayId } = getDragData(e)
                     // Drop on transport card (detected via dropTargetRef for sync accuracy)
                     if (dropTargetRef.current?.startsWith('transport-')) {
-                      const transportId = Number(dropTargetRef.current.replace('transport-', ''))
+                      const isAfter = dropTargetRef.current.startsWith('transport-after-')
+                      const parts = dropTargetRef.current.replace('transport-after-', '').replace('transport-', '').split('-')
+                      const transportId = Number(parts[0])
 
                       if (placeId) {
                         onAssignToDay?.(parseInt(placeId), day.id)
                       } else if (assignmentId && fromDayId !== day.id) {
                         tripActions.moveAssignment(tripId, Number(assignmentId), fromDayId, day.id).catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
                       } else if (assignmentId) {
-                        handleMergedDrop(day.id, 'place', Number(assignmentId), 'transport', transportId)
+                        handleMergedDrop(day.id, 'place', Number(assignmentId), 'transport', transportId, isAfter)
                       } else if (noteId && fromDayId !== day.id) {
                         tripActions.moveDayNote(tripId, fromDayId, day.id, Number(noteId)).catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
                       } else if (noteId) {
-                        handleMergedDrop(day.id, 'note', Number(noteId), 'transport', transportId)
+                        handleMergedDrop(day.id, 'note', Number(noteId), 'transport', transportId, isAfter)
                       }
                       setDraggingId(null); setDropTargetKey(null); dragDataRef.current = null; window.__dragData = null
                       return
@@ -1062,8 +1129,9 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                     </div>
                   ) : (
                     merged.map((item, idx) => {
-                      const itemKey = item.type === 'transport' ? `transport-${item.data.id}` : (item.type === 'place' ? `place-${item.data.id}` : `note-${item.data.id}`)
+                      const itemKey = item.type === 'transport' ? `transport-${item.data.id}-${day.id}` : (item.type === 'place' ? `place-${item.data.id}` : `note-${item.data.id}`)
                       const showDropLine = (!!draggingId || !!dropTargetKey) && dropTargetKey === itemKey
+                      const showDropLineAfter = item.type === 'transport' && (!!draggingId || !!dropTargetKey) && dropTargetKey === `transport-after-${item.data.id}-${day.id}`
 
                       if (item.type === 'place') {
                         const assignment = item.data
@@ -1291,6 +1359,11 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                       // Transport booking (flight, train, bus, car, cruise)
                       if (item.type === 'transport') {
                         const res = item.data
+                        const spanPhase = getSpanPhase(res, day.date)
+
+                        // Car "active" (middle) days are shown in the day header, skip here
+                        if (res.type === 'car' && spanPhase === 'middle') return null
+
                         const TransportIcon = RES_ICONS[res.type] || Ticket
                         const color = '#3b82f6'
                         const meta = typeof res.metadata === 'string' ? JSON.parse(res.metadata || '{}') : (res.metadata || {})
@@ -1307,25 +1380,37 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                           subtitle = [meta.train_number, meta.platform ? `Gl. ${meta.platform}` : '', meta.seat ? `Sitz ${meta.seat}` : ''].filter(Boolean).join(' · ')
                         }
 
+                        // Multi-day span phase
+                        const spanLabel = getSpanLabel(res, spanPhase)
+                        const displayTime = getDisplayTimeForDay(res, day.date)
+
                         return (
-                          <React.Fragment key={`transport-${res.id}`}>
+                          <React.Fragment key={`transport-${res.id}-${day.id}`}>
                           {showDropLine && <div style={{ height: 2, background: 'var(--text-primary)', borderRadius: 1, margin: '2px 8px' }} />}
                           <div
                             onClick={() => setTransportDetail(res)}
-                            onDragOver={e => { e.preventDefault(); e.stopPropagation(); setDropTargetKey(`transport-${res.id}`) }}
+                            onDragOver={e => {
+                              e.preventDefault(); e.stopPropagation()
+                              const rect = e.currentTarget.getBoundingClientRect()
+                              const inBottom = e.clientY > rect.top + rect.height / 2
+                              const key = inBottom ? `transport-after-${res.id}-${day.id}` : `transport-${res.id}-${day.id}`
+                              if (dropTargetRef.current !== key) setDropTargetKey(key)
+                            }}
                             onDrop={e => {
                               e.preventDefault(); e.stopPropagation()
+                              const rect = e.currentTarget.getBoundingClientRect()
+                              const insertAfter = e.clientY > rect.top + rect.height / 2
                               const { placeId, assignmentId: fromAssignmentId, noteId, fromDayId } = getDragData(e)
                               if (placeId) {
                                 onAssignToDay?.(parseInt(placeId), day.id)
                               } else if (fromAssignmentId && fromDayId !== day.id) {
                                 tripActions.moveAssignment(tripId, Number(fromAssignmentId), fromDayId, day.id).catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
                               } else if (fromAssignmentId) {
-                                handleMergedDrop(day.id, 'place', Number(fromAssignmentId), 'transport', res.id)
+                                handleMergedDrop(day.id, 'place', Number(fromAssignmentId), 'transport', res.id, insertAfter)
                               } else if (noteId && fromDayId !== day.id) {
                                 tripActions.moveDayNote(tripId, fromDayId, day.id, Number(noteId)).catch((err: unknown) => toast.error(err instanceof Error ? err.message : 'Unknown error'))
                               } else if (noteId) {
-                                handleMergedDrop(day.id, 'note', Number(noteId), 'transport', res.id)
+                                handleMergedDrop(day.id, 'note', Number(noteId), 'transport', res.id, insertAfter)
                               }
                               setDraggingId(null); setDropTargetKey(null); dragDataRef.current = null; window.__dragData = null
                             }}
@@ -1340,6 +1425,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                               background: isTransportHovered ? `${color}12` : `${color}08`,
                               cursor: 'pointer', userSelect: 'none',
                               transition: 'background 0.1s',
+                              opacity: spanPhase === 'middle' ? 0.65 : 1,
                             }}
                           >
                             <div style={{
@@ -1350,14 +1436,27 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                             </div>
                             <div style={{ flex: 1, minWidth: 0 }}>
                               <div style={{ display: 'flex', alignItems: 'center', gap: 4 }}>
+                                {spanLabel && (
+                                  <span style={{
+                                    fontSize: 9, fontWeight: 700, padding: '1px 5px', borderRadius: 4, flexShrink: 0,
+                                    background: `${color}20`, color: color, textTransform: 'uppercase', letterSpacing: '0.03em',
+                                  }}>
+                                    {spanLabel}
+                                  </span>
+                                )}
                                 <span style={{ fontSize: 12.5, fontWeight: 500, color: 'var(--text-primary)', overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }}>
                                   {res.title}
                                 </span>
-                                {res.reservation_time?.includes('T') && (
+                                {displayTime?.includes('T') && (
                                   <span style={{ display: 'inline-flex', alignItems: 'center', gap: 3, flexShrink: 0, fontSize: 10, color: 'var(--text-faint)', fontWeight: 400, marginLeft: 6 }}>
                                     <Clock size={9} strokeWidth={2} />
-                                    {new Date(res.reservation_time).toLocaleTimeString(locale, { hour: '2-digit', minute: '2-digit', hour12: timeFormat === '12h' })}
-                                    {res.reservation_end_time?.includes('T') && ` – ${new Date(res.reservation_end_time).toLocaleTimeString(locale, { hour: '2-digit', minute: '2-digit', hour12: timeFormat === '12h' })}`}
+                                    {new Date(displayTime).toLocaleTimeString(locale, { hour: '2-digit', minute: '2-digit', hour12: timeFormat === '12h' })}
+                                    {spanPhase === 'single' && res.reservation_end_time && (() => {
+                                      const endStr = res.reservation_end_time.includes('T') ? res.reservation_end_time : (displayTime.split('T')[0] + 'T' + res.reservation_end_time)
+                                      return ` – ${new Date(endStr).toLocaleTimeString(locale, { hour: '2-digit', minute: '2-digit', hour12: timeFormat === '12h' })}`
+                                    })()}
+                                    {meta.departure_timezone && spanPhase === 'start' && ` ${meta.departure_timezone}`}
+                                    {meta.arrival_timezone && spanPhase === 'end' && ` ${meta.arrival_timezone}`}
                                   </span>
                                 )}
                               </div>
@@ -1368,6 +1467,7 @@ const DayPlanSidebar = React.memo(function DayPlanSidebar({
                               )}
                             </div>
                           </div>
+                          {showDropLineAfter && <div style={{ height: 2, background: 'var(--text-primary)', borderRadius: 1, margin: '2px 8px' }} />}
                           </React.Fragment>
                         )
                       }

client/src/components/Planner/ReservationModal.tsx

@@ -73,9 +73,10 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
 
   const [form, setForm] = useState({
     title: '', type: 'other', status: 'pending',
-    reservation_time: '', reservation_end_time: '', location: '', confirmation_number: '',
+    reservation_time: '', reservation_end_time: '', end_date: '', location: '', confirmation_number: '',
     notes: '', assignment_id: '', accommodation_id: '',
     meta_airline: '', meta_flight_number: '', meta_departure_airport: '', meta_arrival_airport: '',
+    meta_departure_timezone: '', meta_arrival_timezone: '',
     meta_train_number: '', meta_platform: '', meta_seat: '',
     meta_check_in_time: '', meta_check_out_time: '',
     hotel_place_id: '', hotel_start_day: '', hotel_end_day: '',
@@ -95,12 +96,21 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
   useEffect(() => {
     if (reservation) {
       const meta = typeof reservation.metadata === 'string' ? JSON.parse(reservation.metadata || '{}') : (reservation.metadata || {})
+      // Parse end_date from reservation_end_time if it's a full ISO datetime
+      const rawEnd = reservation.reservation_end_time || ''
+      let endDate = ''
+      let endTime = rawEnd
+      if (rawEnd.includes('T')) {
+        endDate = rawEnd.split('T')[0]
+        endTime = rawEnd.split('T')[1]?.slice(0, 5) || ''
+      }
       setForm({
         title: reservation.title || '',
         type: reservation.type || 'other',
         status: reservation.status || 'pending',
         reservation_time: reservation.reservation_time ? reservation.reservation_time.slice(0, 16) : '',
-        reservation_end_time: reservation.reservation_end_time || '',
+        reservation_end_time: endTime,
+        end_date: endDate,
         location: reservation.location || '',
         confirmation_number: reservation.confirmation_number || '',
         notes: reservation.notes || '',
@@ -110,6 +120,8 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
         meta_flight_number: meta.flight_number || '',
         meta_departure_airport: meta.departure_airport || '',
         meta_arrival_airport: meta.arrival_airport || '',
+        meta_departure_timezone: meta.departure_timezone || '',
+        meta_arrival_timezone: meta.arrival_timezone || '',
         meta_train_number: meta.train_number || '',
         meta_platform: meta.platform || '',
         meta_seat: meta.seat || '',
@@ -122,9 +134,10 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
     } else {
       setForm({
         title: '', type: 'other', status: 'pending',
-        reservation_time: '', reservation_end_time: '', location: '', confirmation_number: '',
+        reservation_time: '', reservation_end_time: '', end_date: '', location: '', confirmation_number: '',
         notes: '', assignment_id: '', accommodation_id: '',
         meta_airline: '', meta_flight_number: '', meta_departure_airport: '', meta_arrival_airport: '',
+        meta_departure_timezone: '', meta_arrival_timezone: '',
         meta_train_number: '', meta_platform: '', meta_seat: '',
         meta_check_in_time: '', meta_check_out_time: '',
       })
@@ -134,9 +147,21 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
 
   const set = (field, value) => setForm(prev => ({ ...prev, [field]: value }))
 
+  // Validate that end datetime is after start datetime
+  const isEndBeforeStart = (() => {
+    if (!form.end_date || !form.reservation_time) return false
+    const startDate = form.reservation_time.split('T')[0]
+    const startTime = form.reservation_time.split('T')[1] || '00:00'
+    const endTime = form.reservation_end_time || '00:00'
+    const startFull = `${startDate}T${startTime}`
+    const endFull = `${form.end_date}T${endTime}`
+    return endFull <= startFull
+  })()
+
   const handleSubmit = async (e) => {
     e.preventDefault()
     if (!form.title.trim()) return
+    if (isEndBeforeStart) { toast.error(t('reservations.validation.endBeforeStart')); return }
     setIsSaving(true)
     try {
       const metadata: Record<string, string> = {}
@@ -145,6 +170,8 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
         if (form.meta_flight_number) metadata.flight_number = form.meta_flight_number
         if (form.meta_departure_airport) metadata.departure_airport = form.meta_departure_airport
         if (form.meta_arrival_airport) metadata.arrival_airport = form.meta_arrival_airport
+        if (form.meta_departure_timezone) metadata.departure_timezone = form.meta_departure_timezone
+        if (form.meta_arrival_timezone) metadata.arrival_timezone = form.meta_arrival_timezone
       } else if (form.type === 'hotel') {
         if (form.meta_check_in_time) metadata.check_in_time = form.meta_check_in_time
         if (form.meta_check_out_time) metadata.check_out_time = form.meta_check_out_time
@@ -153,9 +180,14 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
         if (form.meta_platform) metadata.platform = form.meta_platform
         if (form.meta_seat) metadata.seat = form.meta_seat
       }
+      // Combine end_date + end_time into reservation_end_time
+      let combinedEndTime = form.reservation_end_time
+      if (form.end_date) {
+        combinedEndTime = form.reservation_end_time ? `${form.end_date}T${form.reservation_end_time}` : form.end_date
+      }
       const saveData: Record<string, any> = {
         title: form.title, type: form.type, status: form.status,
-        reservation_time: form.reservation_time, reservation_end_time: form.reservation_end_time,
+        reservation_time: form.reservation_time, reservation_end_time: combinedEndTime,
         location: form.location, confirmation_number: form.confirmation_number,
         notes: form.notes,
         assignment_id: form.assignment_id || null,
@@ -257,10 +289,9 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
             placeholder={t('reservations.titlePlaceholder')} style={inputStyle} />
         </div>
 
-        {/* Assignment Picker + Date (hidden for hotels) */}
-        {form.type !== 'hotel' && (
-        <div style={{ display: 'flex', gap: 8 }}>
-          {assignmentOptions.length > 0 && (
+        {/* Assignment Picker (hidden for hotels) */}
+        {form.type !== 'hotel' && assignmentOptions.length > 0 && (
+        <div>
             <div style={{ flex: 1, minWidth: 0 }}>
               <label style={labelStyle}>
                 <Link2 size={10} style={{ display: 'inline', verticalAlign: '-1px', marginRight: 3 }} />
@@ -287,54 +318,81 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
                 size="sm"
               />
             </div>
-          )}
-          <div style={{ flex: 1, minWidth: 0 }}>
-            <label style={labelStyle}>{t('reservations.date')}</label>
-            <CustomDatePicker
-              value={(() => { const [d] = (form.reservation_time || '').split('T'); return d || '' })()}
-              onChange={d => {
-                const [, t] = (form.reservation_time || '').split('T')
-                set('reservation_time', d ? (t ? `${d}T${t}` : d) : '')
-              }}
-            />
-          </div>
         </div>
         )}
 
-        {/* Start Time + End Time + Status */}
-        <div style={{ display: 'flex', gap: 8 }}>
-          {form.type !== 'hotel' && (
-            <>
+        {/* Start Date/Time + End Date/Time + Status (hidden for hotels) */}
+        {form.type !== 'hotel' && (
+        <>
+          <div style={{ display: 'flex', gap: 8 }}>
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <label style={labelStyle}>{form.type === 'flight' ? t('reservations.departureDate') : form.type === 'car' ? t('reservations.pickupDate') : t('reservations.date')}</label>
+              <CustomDatePicker
+                value={(() => { const [d] = (form.reservation_time || '').split('T'); return d || '' })()}
+                onChange={d => {
+                  const [, t] = (form.reservation_time || '').split('T')
+                  set('reservation_time', d ? (t ? `${d}T${t}` : d) : '')
+                }}
+              />
+            </div>
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <label style={labelStyle}>{form.type === 'flight' ? t('reservations.departureTime') : form.type === 'car' ? t('reservations.pickupTime') : t('reservations.startTime')}</label>
+              <CustomTimePicker
+                value={(() => { const [, t] = (form.reservation_time || '').split('T'); return t || '' })()}
+                onChange={t => {
+                  const [d] = (form.reservation_time || '').split('T')
+                  const date = d || new Date().toISOString().split('T')[0]
+                  set('reservation_time', t ? `${date}T${t}` : date)
+                }}
+              />
+            </div>
+            {form.type === 'flight' && (
               <div style={{ flex: 1, minWidth: 0 }}>
-                <label style={labelStyle}>{t('reservations.startTime')}</label>
-                <CustomTimePicker
-                  value={(() => { const [, t] = (form.reservation_time || '').split('T'); return t || '' })()}
-                  onChange={t => {
-                    const [d] = (form.reservation_time || '').split('T')
-                    const date = d || new Date().toISOString().split('T')[0]
-                    set('reservation_time', t ? `${date}T${t}` : date)
-                  }}
-                />
+                <label style={labelStyle}>{t('reservations.meta.departureTimezone')}</label>
+                <input type="text" value={form.meta_departure_timezone} onChange={e => set('meta_departure_timezone', e.target.value)}
+                  placeholder="e.g. CET, UTC+1" style={inputStyle} />
               </div>
-              <div style={{ flex: 1, minWidth: 0 }}>
-                <label style={labelStyle}>{t('reservations.endTime')}</label>
-                <CustomTimePicker value={form.reservation_end_time} onChange={v => set('reservation_end_time', v)} />
-              </div>
-            </>
-          )}
-          <div style={{ flex: 1, minWidth: 0 }}>
-            <label style={labelStyle}>{t('reservations.status')}</label>
-            <CustomSelect
-              value={form.status}
-              onChange={value => set('status', value)}
-              options={[
-                { value: 'pending', label: t('reservations.pending') },
-                { value: 'confirmed', label: t('reservations.confirmed') },
-              ]}
-              size="sm"
-            />
+            )}
           </div>
-        </div>
+          <div style={{ display: 'flex', gap: 8 }}>
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <label style={labelStyle}>{form.type === 'flight' ? t('reservations.arrivalDate') : form.type === 'car' ? t('reservations.returnDate') : t('reservations.endDate')}</label>
+              <CustomDatePicker
+                value={form.end_date}
+                onChange={d => set('end_date', d || '')}
+              />
+            </div>
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <label style={labelStyle}>{form.type === 'flight' ? t('reservations.arrivalTime') : form.type === 'car' ? t('reservations.returnTime') : t('reservations.endTime')}</label>
+              <CustomTimePicker value={form.reservation_end_time} onChange={v => set('reservation_end_time', v)} />
+            </div>
+            {form.type === 'flight' && (
+              <div style={{ flex: 1, minWidth: 0 }}>
+                <label style={labelStyle}>{t('reservations.meta.arrivalTimezone')}</label>
+                <input type="text" value={form.meta_arrival_timezone} onChange={e => set('meta_arrival_timezone', e.target.value)}
+                  placeholder="e.g. JST, UTC+9" style={inputStyle} />
+              </div>
+            )}
+          </div>
+          {isEndBeforeStart && (
+            <div style={{ fontSize: 11, color: '#ef4444', marginTop: -6 }}>{t('reservations.validation.endBeforeStart')}</div>
+          )}
+          <div style={{ display: 'flex', gap: 8 }}>
+            <div style={{ flex: 1, minWidth: 0 }}>
+              <label style={labelStyle}>{t('reservations.status')}</label>
+              <CustomSelect
+                value={form.status}
+                onChange={value => set('status', value)}
+                options={[
+                  { value: 'pending', label: t('reservations.pending') },
+                  { value: 'confirmed', label: t('reservations.confirmed') },
+                ]}
+                size="sm"
+              />
+            </div>
+          </div>
+        </>
+        )}
 
         {/* Location + Booking Code */}
         <div className="grid grid-cols-1 sm:grid-cols-2 gap-3">
@@ -422,8 +480,8 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
                 />
               </div>
             </div>
-            {/* Check-in/out times */}
-            <div className="grid grid-cols-2 gap-3">
+            {/* Check-in/out times + Status */}
+            <div className="grid grid-cols-3 gap-3">
               <div>
                 <label style={labelStyle}>{t('reservations.meta.checkIn')}</label>
                 <CustomTimePicker value={form.meta_check_in_time} onChange={v => set('meta_check_in_time', v)} />
@@ -432,6 +490,18 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
                 <label style={labelStyle}>{t('reservations.meta.checkOut')}</label>
                 <CustomTimePicker value={form.meta_check_out_time} onChange={v => set('meta_check_out_time', v)} />
               </div>
+              <div>
+                <label style={labelStyle}>{t('reservations.status')}</label>
+                <CustomSelect
+                  value={form.status}
+                  onChange={value => set('status', value)}
+                  options={[
+                    { value: 'pending', label: t('reservations.pending') },
+                    { value: 'confirmed', label: t('reservations.confirmed') },
+                  ]}
+                  size="sm"
+                />
+              </div>
             </div>
           </>
         )}
@@ -561,7 +631,7 @@ export function ReservationModal({ isOpen, onClose, onSave, reservation, days, p
           <button type="button" onClick={onClose} style={{ padding: '8px 16px', borderRadius: 10, border: '1px solid var(--border-primary)', background: 'none', fontSize: 12, cursor: 'pointer', fontFamily: 'inherit', color: 'var(--text-muted)' }}>
             {t('common.cancel')}
           </button>
-          <button type="submit" disabled={isSaving || !form.title.trim()} style={{ padding: '8px 20px', borderRadius: 10, border: 'none', background: 'var(--text-primary)', color: 'var(--bg-primary)', fontSize: 12, fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: isSaving || !form.title.trim() ? 0.5 : 1 }}>
+          <button type="submit" disabled={isSaving || !form.title.trim() || isEndBeforeStart} style={{ padding: '8px 20px', borderRadius: 10, border: 'none', background: 'var(--text-primary)', color: 'var(--bg-primary)', fontSize: 12, fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit', opacity: isSaving || !form.title.trim() || isEndBeforeStart ? 0.5 : 1 }}>
             {isSaving ? t('common.saving') : reservation ? t('common.update') : t('common.add')}
           </button>
         </div>

client/src/components/Planner/ReservationsPanel.tsx

@@ -136,7 +136,12 @@ function ReservationCard({ r, tripId, onEdit, onDelete, files = [], onNavigateTo
               {r.reservation_time && (
                 <div style={{ flex: 1, padding: '5px 10px', textAlign: 'center', borderRight: '1px solid var(--border-faint)' }}>
                   <div style={{ fontSize: 9, fontWeight: 600, color: 'var(--text-faint)', textTransform: 'uppercase', letterSpacing: '0.03em' }}>{t('reservations.date')}</div>
-                  <div style={{ fontSize: 11, fontWeight: 600, color: 'var(--text-primary)', marginTop: 1 }}>{fmtDate(r.reservation_time)}</div>
+                  <div style={{ fontSize: 11, fontWeight: 600, color: 'var(--text-primary)', marginTop: 1 }}>
+                    {fmtDate(r.reservation_time)}
+                    {r.reservation_end_time?.includes('T') && r.reservation_end_time.split('T')[0] !== r.reservation_time.split('T')[0] && (
+                      <> – {fmtDate(r.reservation_end_time)}</>
+                    )}
+                  </div>
                 </div>
               )}
               {r.reservation_time?.includes('T') && (

client/src/components/Todo/TodoListPanel.tsx

@@ -0,0 +1,778 @@
+import { useState, useMemo, useEffect } from 'react'
+import { useTripStore } from '../../store/tripStore'
+import { useCanDo } from '../../store/permissionsStore'
+import { useToast } from '../shared/Toast'
+import { useTranslation } from '../../i18n'
+import { tripsApi } from '../../api/client'
+import apiClient from '../../api/client'
+import CustomSelect from '../shared/CustomSelect'
+import { CustomDatePicker } from '../shared/CustomDateTimePicker'
+import { formatDate as fmtDate } from '../../utils/formatters'
+import {
+  CheckSquare, Square, Plus, ChevronRight, Flag,
+  X, Check, Calendar, User, FolderPlus, AlertCircle, ListChecks, Inbox, CheckCheck, Trash2,
+} from 'lucide-react'
+import type { TodoItem } from '../../types'
+
+const KAT_COLORS = [
+  '#3b82f6', '#a855f7', '#ec4899', '#22c55e', '#f97316',
+  '#06b6d4', '#ef4444', '#eab308', '#8b5cf6', '#14b8a6',
+]
+
+const PRIO_CONFIG: Record<number, { label: string; color: string }> = {
+  1: { label: 'P1', color: '#ef4444' },
+  2: { label: 'P2', color: '#f59e0b' },
+  3: { label: 'P3', color: '#3b82f6' },
+}
+
+function katColor(kat: string, allCategories: string[]) {
+  const idx = allCategories.indexOf(kat)
+  if (idx >= 0) return KAT_COLORS[idx % KAT_COLORS.length]
+  let h = 0
+  for (let i = 0; i < kat.length; i++) h = ((h << 5) - h + kat.charCodeAt(i)) | 0
+  return KAT_COLORS[Math.abs(h) % KAT_COLORS.length]
+}
+
+type FilterType = 'all' | 'my' | 'overdue' | 'done' | string
+
+interface Member { id: number; username: string; avatar: string | null }
+
+export default function TodoListPanel({ tripId, items }: { tripId: number; items: TodoItem[] }) {
+  const { addTodoItem, updateTodoItem, deleteTodoItem, toggleTodoItem } = useTripStore()
+  const canEdit = useCanDo('packing_edit')
+  const toast = useToast()
+  const { t, locale } = useTranslation()
+  const formatDate = (d: string) => fmtDate(d, locale) || d
+
+  const [isMobile, setIsMobile] = useState(() => window.innerWidth < 768)
+  useEffect(() => {
+    const mq = window.matchMedia('(max-width: 767px)')
+    const handler = (e: MediaQueryListEvent) => setIsMobile(e.matches)
+    mq.addEventListener('change', handler)
+    return () => mq.removeEventListener('change', handler)
+  }, [])
+
+  const [filter, setFilter] = useState<FilterType>('all')
+  const [selectedId, setSelectedId] = useState<number | null>(null)
+  const [isAddingNew, setIsAddingNew] = useState(false)
+  const [sortByPrio, setSortByPrio] = useState(false)
+  const [addingCategory, setAddingCategory] = useState(false)
+  const [newCategoryName, setNewCategoryName] = useState('')
+  const [members, setMembers] = useState<Member[]>([])
+  const [currentUserId, setCurrentUserId] = useState<number | null>(null)
+
+  useEffect(() => {
+    apiClient.get(`/trips/${tripId}/members`).then(r => {
+      const owner = r.data?.owner
+      const mems = r.data?.members || []
+      const all = owner ? [owner, ...mems] : mems
+      setMembers(all)
+      setCurrentUserId(r.data?.current_user_id || null)
+    }).catch(() => {})
+  }, [tripId])
+
+  const categories = useMemo(() => {
+    const cats = new Set<string>()
+    items.forEach(i => { if (i.category) cats.add(i.category) })
+    return Array.from(cats).sort()
+  }, [items])
+
+  const today = new Date().toISOString().split('T')[0]
+
+  const filtered = useMemo(() => {
+    let result: TodoItem[]
+    if (filter === 'all') result = items.filter(i => !i.checked)
+    else if (filter === 'done') result = items.filter(i => !!i.checked)
+    else if (filter === 'my') result = items.filter(i => !i.checked && i.assigned_user_id === currentUserId)
+    else if (filter === 'overdue') result = items.filter(i => !i.checked && i.due_date && i.due_date < today)
+    else result = items.filter(i => i.category === filter)
+    if (sortByPrio) result = [...result].sort((a, b) => {
+      const ap = a.priority || 99
+      const bp = b.priority || 99
+      return ap - bp
+    })
+    return result
+  }, [items, filter, currentUserId, today, sortByPrio])
+
+  const selectedItem = items.find(i => i.id === selectedId) || null
+  const totalCount = items.length
+  const doneCount = items.filter(i => !!i.checked).length
+  const overdueCount = items.filter(i => !i.checked && i.due_date && i.due_date < today).length
+  const myCount = currentUserId ? items.filter(i => !i.checked && i.assigned_user_id === currentUserId).length : 0
+
+  const addCategory = () => {
+    const name = newCategoryName.trim()
+    if (!name || categories.includes(name)) { setAddingCategory(false); setNewCategoryName(''); return }
+    addTodoItem(tripId, { name: t('todo.newItem'), category: name } as any)
+      .then(() => { setAddingCategory(false); setNewCategoryName(''); setFilter(name) })
+      .catch(err => toast.error(err instanceof Error ? err.message : 'Error'))
+  }
+
+  // Get category count (non-done items)
+  const catCount = (cat: string) => items.filter(i => i.category === cat && !i.checked).length
+
+  // Sidebar filter item
+  const SidebarItem = ({ id, icon: Icon, label, count, color }: { id: string; icon: any; label: string; count: number; color?: string }) => (
+    <button onClick={() => setFilter(id as FilterType)}
+      title={isMobile ? label : undefined}
+      style={{
+        display: 'flex', alignItems: 'center', justifyContent: isMobile ? 'center' : 'flex-start',
+        gap: isMobile ? 0 : 8, width: '100%', padding: isMobile ? '8px 0' : '7px 12px',
+        border: 'none', borderRadius: 8, cursor: 'pointer', fontFamily: 'inherit', fontSize: 13,
+        background: filter === id ? 'var(--bg-hover)' : 'transparent',
+        color: filter === id ? 'var(--text-primary)' : 'var(--text-secondary)',
+        fontWeight: filter === id ? 600 : 400, transition: 'all 0.1s',
+        position: 'relative',
+      }}
+      onMouseEnter={e => { if (filter !== id) e.currentTarget.style.background = 'var(--bg-hover)' }}
+      onMouseLeave={e => { if (filter !== id) e.currentTarget.style.background = 'transparent' }}>
+      {color ? (
+        <span style={{ width: isMobile ? 12 : 10, height: isMobile ? 12 : 10, borderRadius: '50%', background: color, flexShrink: 0 }} />
+      ) : (
+        <Icon size={isMobile ? 18 : 15} style={{ flexShrink: 0, opacity: 0.7 }} />
+      )}
+      {!isMobile && <span style={{ flex: 1, textAlign: 'left' }}>{label}</span>}
+      {!isMobile && count > 0 && (
+        <span style={{ fontSize: 11, color: 'var(--text-faint)', background: 'var(--bg-hover)', borderRadius: 10, padding: '1px 7px', minWidth: 20, textAlign: 'center' }}>
+          {count}
+        </span>
+      )}
+      {isMobile && count > 0 && (
+        <span style={{ position: 'absolute', top: 2, right: 2, fontSize: 8, fontWeight: 700, color: 'var(--bg-primary)', background: 'var(--text-faint)', borderRadius: '50%', width: 14, height: 14, display: 'flex', alignItems: 'center', justifyContent: 'center' }}>
+          {count}
+        </span>
+      )}
+    </button>
+  )
+
+  // Filter title
+  const filterTitle = (() => {
+    if (filter === 'all') return t('todo.filter.all')
+    if (filter === 'done') return t('todo.filter.done')
+    if (filter === 'my') return t('todo.filter.my')
+    if (filter === 'overdue') return t('todo.filter.overdue')
+    return filter
+  })()
+
+  return (
+    <div style={{ display: 'flex', height: 'calc(100vh - 180px)', minHeight: 400 }}>
+
+      {/* ── Left Sidebar ── */}
+      <div style={{
+        width: isMobile ? 52 : 220, flexShrink: 0, borderRight: '1px solid var(--border-faint)',
+        padding: isMobile ? '12px 6px' : '16px 10px', display: 'flex', flexDirection: 'column', gap: 2, overflowY: 'auto',
+        transition: 'width 0.2s',
+      }}>
+        {/* Progress Card */}
+        {!isMobile && <div style={{
+          margin: '0 6px 12px', padding: '14px 14px 12px', borderRadius: 14,
+          background: 'var(--bg-hover)',
+          border: '1px solid var(--border-primary)',
+          boxShadow: '0 1px 2px rgba(0,0,0,0.02)',
+        }}>
+          <div style={{ display: 'flex', alignItems: 'baseline', gap: 4, marginBottom: 8 }}>
+            <span style={{ fontSize: 18, fontWeight: 700, color: 'var(--text-primary)', lineHeight: 1, letterSpacing: '-0.02em' }}>
+              {totalCount > 0 ? Math.round((doneCount / totalCount) * 100) : 0}%
+            </span>
+          </div>
+          <div style={{ height: 4, background: 'var(--border-faint)', borderRadius: 2, overflow: 'hidden', marginBottom: 6 }}>
+            <div style={{ height: '100%', width: totalCount > 0 ? `${Math.round((doneCount / totalCount) * 100)}%` : '0%', background: '#22c55e', borderRadius: 2, transition: 'width 0.3s' }} />
+          </div>
+          <div style={{ fontSize: 11, color: 'var(--text-faint)' }}>
+            {doneCount} / {totalCount} {t('todo.completed')}
+          </div>
+        </div>}
+
+        {/* Smart filters */}
+        {!isMobile && <div style={{ fontSize: 10, fontWeight: 600, color: 'var(--text-faint)', padding: '8px 12px 4px', textTransform: 'uppercase', letterSpacing: '0.05em' }}>
+          {t('todo.sidebar.tasks')}
+        </div>}
+        <SidebarItem id="all" icon={Inbox} label={t('todo.filter.all')} count={items.filter(i => !i.checked).length} />
+        <SidebarItem id="my" icon={User} label={t('todo.filter.my')} count={myCount} />
+        <SidebarItem id="overdue" icon={AlertCircle} label={t('todo.filter.overdue')} count={overdueCount} />
+        <SidebarItem id="done" icon={CheckCheck} label={t('todo.filter.done')} count={doneCount} />
+
+        {/* Sort by priority */}
+        <button onClick={() => setSortByPrio(v => !v)}
+          title={isMobile ? t('todo.sortByPrio') : undefined}
+          style={{
+            display: 'flex', alignItems: 'center', justifyContent: isMobile ? 'center' : 'flex-start',
+            gap: isMobile ? 0 : 8, width: '100%', padding: isMobile ? '8px 0' : '7px 12px',
+            border: 'none', borderRadius: 8, cursor: 'pointer', fontFamily: 'inherit', fontSize: 13,
+            background: sortByPrio ? '#f59e0b12' : 'transparent',
+            color: sortByPrio ? '#f59e0b' : 'var(--text-secondary)',
+            fontWeight: sortByPrio ? 600 : 400, transition: 'all 0.1s',
+          }}
+          onMouseEnter={e => { if (!sortByPrio) e.currentTarget.style.background = 'var(--bg-hover)' }}
+          onMouseLeave={e => { if (!sortByPrio) e.currentTarget.style.background = 'transparent' }}>
+          <Flag size={isMobile ? 18 : 15} style={{ flexShrink: 0, opacity: 0.7 }} />
+          {!isMobile && <span style={{ flex: 1, textAlign: 'left' }}>{t('todo.sortByPrio')}</span>}
+        </button>
+
+        {/* Categories */}
+        {!isMobile && <div style={{ fontSize: 10, fontWeight: 600, color: 'var(--text-faint)', padding: '16px 12px 4px', textTransform: 'uppercase', letterSpacing: '0.05em' }}>
+          {t('todo.sidebar.categories')}
+        </div>}
+        {isMobile && <div style={{ height: 1, background: 'var(--border-faint)', margin: '8px 4px' }} />}
+        {categories.map(cat => (
+          <SidebarItem key={cat} id={cat} icon={null} label={cat} count={catCount(cat)} color={katColor(cat, categories)} />
+        ))}
+
+        {canEdit && (
+          addingCategory && !isMobile ? (
+            <div style={{ display: 'flex', alignItems: 'center', gap: 4, padding: '4px 12px' }}>
+              <input autoFocus value={newCategoryName} onChange={e => setNewCategoryName(e.target.value)}
+                onKeyDown={e => { if (e.key === 'Enter') addCategory(); if (e.key === 'Escape') { setAddingCategory(false); setNewCategoryName('') } }}
+                placeholder={t('todo.newCategory')}
+                style={{ flex: 1, fontSize: 12, padding: '4px 6px', border: '1px solid var(--border-primary)', borderRadius: 5, background: 'var(--bg-hover)', color: 'var(--text-primary)', fontFamily: 'inherit', minWidth: 0 }} />
+              <button onClick={addCategory} style={{ background: 'none', border: 'none', cursor: 'pointer', color: '#22c55e', padding: 2 }}><Check size={13} /></button>
+            </div>
+          ) : (
+            <button onClick={() => setAddingCategory(true)}
+              title={isMobile ? t('todo.addCategory') : undefined}
+              style={{ display: 'flex', alignItems: 'center', justifyContent: isMobile ? 'center' : 'flex-start', gap: isMobile ? 0 : 6, padding: isMobile ? '8px 0' : '7px 12px', fontSize: 12, color: 'var(--text-faint)', background: 'none', border: 'none', cursor: 'pointer', fontFamily: 'inherit', width: '100%', textAlign: 'left' }}>
+              <Plus size={isMobile ? 18 : 13} /> {!isMobile && t('todo.addCategory')}
+            </button>
+          )
+        )}
+      </div>
+
+      {/* ── Middle: Task List ── */}
+      <div style={{ flex: 1, display: 'flex', flexDirection: 'column', minWidth: 0 }}>
+        {/* Header */}
+        <div style={{ padding: '16px 20px 12px', borderBottom: '1px solid var(--border-faint)' }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: 10 }}>
+            <h2 style={{ margin: 0, fontSize: 22, fontWeight: 700, color: 'var(--text-primary)', letterSpacing: '-0.02em' }}>
+              {filterTitle}
+            </h2>
+            <span style={{ fontSize: 13, color: 'var(--text-faint)', background: 'var(--bg-hover)', borderRadius: 6, padding: '2px 8px', fontWeight: 600 }}>
+              {filtered.length}
+            </span>
+          </div>
+        </div>
+
+        {/* Add task */}
+        {canEdit && (
+          <div style={{ padding: '10px 20px', borderBottom: '1px solid var(--border-faint)' }}>
+            <button
+              onClick={() => { setSelectedId(null); setIsAddingNew(true) }}
+              style={{
+                display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 6,
+                width: '100%', padding: '9px 16px', borderRadius: 8,
+                background: isAddingNew ? 'var(--text-primary)' : 'var(--bg-hover)',
+                color: isAddingNew ? 'var(--bg-primary)' : 'var(--text-primary)',
+                border: '1px solid var(--border-primary)', cursor: 'pointer', fontFamily: 'inherit',
+                fontSize: 13, fontWeight: 600, transition: 'all 0.15s',
+              }}
+              onMouseEnter={e => { if (!isAddingNew) { e.currentTarget.style.background = 'var(--text-primary)'; e.currentTarget.style.color = 'var(--bg-primary)'; e.currentTarget.style.borderColor = 'var(--text-primary)' } }}
+              onMouseLeave={e => { if (!isAddingNew) { e.currentTarget.style.background = 'var(--bg-hover)'; e.currentTarget.style.color = 'var(--text-primary)'; e.currentTarget.style.borderColor = 'var(--border-primary)' } }}>
+              <Plus size={14} />
+              {t('todo.addItem')}
+            </button>
+          </div>
+        )}
+
+        {/* Task list */}
+        <div style={{ flex: 1, overflowY: 'auto', padding: '4px 0' }}>
+          {filtered.length === 0 ? null : (
+            filtered.map(item => {
+              const done = !!item.checked
+              const assignedUser = members.find(m => m.id === item.assigned_user_id)
+              const isOverdue = item.due_date && !done && item.due_date < today
+              const isSelected = selectedId === item.id
+              const catColor = item.category ? katColor(item.category, categories) : null
+
+              return (
+                <div key={item.id}
+                  onClick={() => { setSelectedId(isSelected ? null : item.id); setIsAddingNew(false) }}
+                  style={{
+                    display: 'flex', alignItems: 'center', gap: 10, padding: '10px 20px',
+                    borderBottom: '1px solid var(--border-faint)', cursor: 'pointer',
+                    background: isSelected ? 'var(--bg-hover)' : 'transparent',
+                    transition: 'background 0.1s',
+                  }}
+                  onMouseEnter={e => { if (!isSelected) e.currentTarget.style.background = 'rgba(0,0,0,0.02)' }}
+                  onMouseLeave={e => { if (!isSelected) e.currentTarget.style.background = 'transparent' }}>
+
+                  {/* Checkbox */}
+                  <button onClick={e => { e.stopPropagation(); canEdit && toggleTodoItem(tripId, item.id, !done) }}
+                    style={{ background: 'none', border: 'none', cursor: canEdit ? 'pointer' : 'default', padding: 0, flexShrink: 0,
+                      color: done ? '#22c55e' : 'var(--border-primary)' }}>
+                    {done ? <CheckSquare size={18} /> : <Square size={18} />}
+                  </button>
+
+                  {/* Content */}
+                  <div style={{ flex: 1, minWidth: 0 }}>
+                    <div style={{
+                      fontSize: 14, color: done ? 'var(--text-faint)' : 'var(--text-primary)',
+                      textDecoration: done ? 'line-through' : 'none', lineHeight: 1.4,
+                      overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap',
+                    }}>
+                      {item.name}
+                    </div>
+                    {/* Description preview */}
+                    {item.description && (
+                      <div style={{ fontSize: 12, color: 'var(--text-faint)', marginTop: 2, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap', lineHeight: 1.4 }}>
+                        {item.description}
+                      </div>
+                    )}
+                    {/* Inline badges */}
+                    {(item.priority || item.due_date || catColor || assignedUser) && (
+                    <div style={{ display: 'flex', gap: 5, marginTop: 5, flexWrap: 'wrap' }}>
+                      {item.priority > 0 && PRIO_CONFIG[item.priority] && (
+                        <span style={{
+                          fontSize: 10, display: 'inline-flex', alignItems: 'center', gap: 3,
+                          padding: '2px 7px', borderRadius: 5, fontWeight: 600,
+                          color: PRIO_CONFIG[item.priority].color,
+                          background: `${PRIO_CONFIG[item.priority].color}10`,
+                          border: `1px solid ${PRIO_CONFIG[item.priority].color}25`,
+                        }}>
+                          <Flag size={9} />{PRIO_CONFIG[item.priority].label}
+                        </span>
+                      )}
+                      {item.due_date && (
+                        <span style={{
+                          fontSize: 10, display: 'inline-flex', alignItems: 'center', gap: 3,
+                          padding: '2px 7px', borderRadius: 5, fontWeight: 500,
+                          color: isOverdue ? '#ef4444' : 'var(--text-secondary)',
+                          background: isOverdue ? 'rgba(239,68,68,0.08)' : 'var(--bg-hover)',
+                          border: `1px solid ${isOverdue ? 'rgba(239,68,68,0.15)' : 'var(--border-faint)'}`,
+                        }}>
+                          <Calendar size={9} />{formatDate(item.due_date)}
+                        </span>
+                      )}
+                      {catColor && (
+                        <span style={{
+                          fontSize: 10, display: 'inline-flex', alignItems: 'center', gap: 4,
+                          padding: '2px 7px', borderRadius: 5, fontWeight: 500,
+                          color: 'var(--text-secondary)', background: 'var(--bg-hover)',
+                          border: '1px solid var(--border-faint)',
+                        }}>
+                          <span style={{ width: 6, height: 6, borderRadius: '50%', background: catColor, flexShrink: 0 }} />
+                          {item.category}
+                        </span>
+                      )}
+                      {assignedUser && (
+                        <span style={{
+                          fontSize: 10, display: 'inline-flex', alignItems: 'center', gap: 4,
+                          padding: '2px 7px', borderRadius: 5, fontWeight: 500,
+                          color: 'var(--text-secondary)', background: 'var(--bg-hover)',
+                          border: '1px solid var(--border-faint)',
+                        }}>
+                          {assignedUser.avatar ? (
+                            <img src={`/uploads/avatars/${assignedUser.avatar}`} style={{ width: 13, height: 13, borderRadius: '50%', objectFit: 'cover' }} alt="" />
+                          ) : (
+                            <span style={{ width: 13, height: 13, borderRadius: '50%', background: 'var(--border-primary)', display: 'inline-flex', alignItems: 'center', justifyContent: 'center', fontSize: 7, color: 'var(--text-faint)', fontWeight: 700 }}>
+                              {assignedUser.username.charAt(0).toUpperCase()}
+                            </span>
+                          )}
+                          {assignedUser.username}
+                        </span>
+                      )}
+                    </div>
+                    )}
+                  </div>
+
+                  {/* Chevron */}
+                  <ChevronRight size={16} color="var(--text-faint)" style={{ flexShrink: 0, opacity: 0.4 }} />
+                </div>
+              )
+            })
+          )}
+        </div>
+      </div>
+
+      {/* ── Right: Detail Pane ── */}
+      {selectedItem && !isAddingNew && !isMobile && (
+        <DetailPane
+          item={selectedItem}
+          tripId={tripId}
+          categories={categories}
+          members={members}
+          onClose={() => setSelectedId(null)}
+        />
+      )}
+      {selectedItem && !isAddingNew && isMobile && (
+        <div onClick={e => { if (e.target === e.currentTarget) setSelectedId(null) }}
+          style={{ position: 'fixed', inset: 0, zIndex: 1000, background: 'rgba(0,0,0,0.4)', display: 'flex', justifyContent: 'center', alignItems: 'flex-end' }}>
+          <div style={{ width: '100%', maxHeight: '85vh', borderRadius: '16px 16px 0 0', overflow: 'auto' }}
+            ref={el => { if (el) { const child = el.firstElementChild as HTMLElement; if (child) { child.style.width = '100%'; child.style.borderLeft = 'none'; child.style.borderRadius = '16px 16px 0 0' } } }}>
+            <DetailPane
+              item={selectedItem}
+              tripId={tripId}
+              categories={categories}
+              members={members}
+              onClose={() => setSelectedId(null)}
+            />
+          </div>
+        </div>
+      )}
+      {isAddingNew && !selectedItem && !isMobile && (
+        <NewTaskPane
+          tripId={tripId}
+          categories={categories}
+          members={members}
+          defaultCategory={typeof filter === 'string' && categories.includes(filter) ? filter : null}
+          onCreated={(id) => { setIsAddingNew(false); setSelectedId(id) }}
+          onClose={() => setIsAddingNew(false)}
+        />
+      )}
+      {isAddingNew && !selectedItem && isMobile && (
+        <div onClick={e => { if (e.target === e.currentTarget) setIsAddingNew(false) }}
+          style={{ position: 'fixed', inset: 0, zIndex: 1000, background: 'rgba(0,0,0,0.4)', display: 'flex', justifyContent: 'center', alignItems: 'flex-end' }}>
+          <div style={{ width: '100%', maxHeight: '85vh', borderRadius: '16px 16px 0 0', overflow: 'auto' }}
+            ref={el => { if (el) { const child = el.firstElementChild as HTMLElement; if (child) { child.style.width = '100%'; child.style.borderLeft = 'none'; child.style.borderRadius = '16px 16px 0 0' } } }}>
+            <NewTaskPane
+              tripId={tripId}
+              categories={categories}
+              members={members}
+              defaultCategory={typeof filter === 'string' && categories.includes(filter) ? filter : null}
+              onCreated={(id) => { setIsAddingNew(false); setSelectedId(id) }}
+              onClose={() => setIsAddingNew(false)}
+            />
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
+
+// ── Detail Pane (right side) ──────────────────────────────────────────────
+
+function DetailPane({ item, tripId, categories, members, onClose }: {
+  item: TodoItem; tripId: number; categories: string[]; members: Member[];
+  onClose: () => void;
+}) {
+  const { updateTodoItem, deleteTodoItem } = useTripStore()
+  const canEdit = useCanDo('packing_edit')
+  const toast = useToast()
+  const { t } = useTranslation()
+
+  const [name, setName] = useState(item.name)
+  const [desc, setDesc] = useState(item.description || '')
+  const [dueDate, setDueDate] = useState(item.due_date || '')
+  const [category, setCategory] = useState(item.category || '')
+  const [assignedUserId, setAssignedUserId] = useState<number | null>(item.assigned_user_id)
+  const [priority, setPriority] = useState(item.priority || 0)
+  const [saving, setSaving] = useState(false)
+
+  // Sync when selected item changes
+  useEffect(() => {
+    setName(item.name)
+    setDesc(item.description || '')
+    setDueDate(item.due_date || '')
+    setCategory(item.category || '')
+    setAssignedUserId(item.assigned_user_id)
+    setPriority(item.priority || 0)
+  }, [item.id, item.name, item.description, item.due_date, item.category, item.assigned_user_id, item.priority])
+
+  const hasChanges = name !== item.name || desc !== (item.description || '') ||
+    dueDate !== (item.due_date || '') || category !== (item.category || '') ||
+    assignedUserId !== item.assigned_user_id || priority !== (item.priority || 0)
+
+  const save = async () => {
+    if (!name.trim() || !hasChanges) return
+    setSaving(true)
+    try {
+      await updateTodoItem(tripId, item.id, {
+        name: name.trim(), description: desc || null,
+        due_date: dueDate || null, category: category || null,
+        assigned_user_id: assignedUserId, priority,
+      } as any)
+    } catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Error') }
+    setSaving(false)
+  }
+
+  const handleDelete = async () => {
+    try {
+      await deleteTodoItem(tripId, item.id)
+      onClose()
+    } catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Error') }
+  }
+
+  const labelStyle: React.CSSProperties = { fontSize: 12, fontWeight: 500, color: 'var(--text-secondary)', marginBottom: 4, display: 'block' }
+  const inputStyle: React.CSSProperties = {
+    width: '100%', fontSize: 13, padding: '8px 10px', border: '1px solid var(--border-primary)',
+    borderRadius: 8, background: 'var(--bg-primary)', color: 'var(--text-primary)', fontFamily: 'inherit',
+  }
+
+  return (
+    <div style={{
+      width: 320, flexShrink: 0, borderLeft: '1px solid var(--border-faint)',
+      display: 'flex', flexDirection: 'column', background: 'var(--bg-primary)',
+    }}>
+      {/* Header */}
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '16px 20px 12px', borderBottom: '1px solid var(--border-faint)' }}>
+        <span style={{ fontSize: 14, fontWeight: 700, color: 'var(--text-primary)' }}>{t('todo.detail.title')}</span>
+        <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4 }}>
+          <X size={16} />
+        </button>
+      </div>
+
+      {/* Form */}
+      <div style={{ flex: 1, overflowY: 'auto', padding: '16px 20px', display: 'flex', flexDirection: 'column', gap: 14 }}>
+        {/* Name */}
+        <div>
+          <input value={name} onChange={e => setName(e.target.value)} disabled={!canEdit}
+            style={{ ...inputStyle, fontSize: 15, fontWeight: 600, border: 'none', padding: '4px 0', background: 'transparent' }}
+            placeholder={t('todo.namePlaceholder')} />
+        </div>
+
+        {/* Description */}
+        <div>
+          <label style={labelStyle}>{t('todo.detail.description')}</label>
+          <textarea value={desc} onChange={e => setDesc(e.target.value)} disabled={!canEdit} rows={4}
+            placeholder={t('todo.descriptionPlaceholder')}
+            style={{ ...inputStyle, resize: 'vertical', minHeight: 80 }} />
+        </div>
+
+        {/* Priority */}
+        <div>
+          <label style={labelStyle}>{t('todo.detail.priority')}</label>
+          <div style={{ display: 'flex', gap: 4 }}>
+            {[0, 1, 2, 3].map(p => {
+              const cfg = PRIO_CONFIG[p]
+              const isActive = priority === p
+              return (
+                <button key={p} onClick={() => canEdit && setPriority(p)}
+                  style={{
+                    flex: 1, padding: '6px 0', borderRadius: 6, fontSize: 11, fontWeight: 600, cursor: canEdit ? 'pointer' : 'default',
+                    fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 4,
+                    border: `1px solid ${isActive && cfg ? cfg.color + '40' : 'var(--border-primary)'}`,
+                    background: isActive && cfg ? cfg.color + '12' : 'transparent',
+                    color: isActive && cfg ? cfg.color : isActive ? 'var(--text-primary)' : 'var(--text-faint)',
+                    transition: 'all 0.1s',
+                  }}>
+                  {cfg ? <><Flag size={10} />{cfg.label}</> : t('todo.detail.noPriority')}
+                </button>
+              )
+            })}
+          </div>
+        </div>
+
+        {/* Category */}
+        <div>
+          <label style={labelStyle}>{t('todo.detail.category')}</label>
+          <CustomSelect
+            value={category}
+            onChange={v => setCategory(v)}
+            options={[
+              { value: '', label: t('todo.noCategory') },
+              ...categories.map(c => ({
+                value: c,
+                label: c,
+                icon: <span style={{ width: 8, height: 8, borderRadius: '50%', background: katColor(c, categories), display: 'inline-block' }} />,
+              })),
+            ]}
+            placeholder={t('todo.noCategory')}
+            size="sm"
+            disabled={!canEdit}
+          />
+        </div>
+
+        {/* Due date */}
+        <div>
+          <label style={labelStyle}>{t('todo.detail.dueDate')}</label>
+          <CustomDatePicker
+            value={dueDate}
+            onChange={v => setDueDate(v)}
+          />
+        </div>
+
+        {/* Assigned to */}
+        <div>
+          <label style={labelStyle}>{t('todo.detail.assignedTo')}</label>
+          <CustomSelect
+            value={String(assignedUserId ?? '')}
+            onChange={v => setAssignedUserId(v ? Number(v) : null)}
+            options={[
+              { value: '', label: t('todo.unassigned'), icon: <User size={14} style={{ color: 'var(--text-faint)' }} /> },
+              ...members.map(m => ({
+                value: String(m.id),
+                label: m.username,
+                icon: m.avatar ? (
+                  <img src={`/uploads/avatars/${m.avatar}`} style={{ width: 18, height: 18, borderRadius: '50%', objectFit: 'cover' as const }} alt="" />
+                ) : (
+                  <span style={{ width: 18, height: 18, borderRadius: '50%', background: 'var(--border-primary)', display: 'inline-flex', alignItems: 'center', justifyContent: 'center', fontSize: 10, color: 'var(--text-faint)', fontWeight: 600 }}>
+                    {m.username.charAt(0).toUpperCase()}
+                  </span>
+                ),
+              })),
+            ]}
+            placeholder={t('todo.unassigned')}
+            size="sm"
+            disabled={!canEdit}
+          />
+        </div>
+      </div>
+
+      {/* Footer actions */}
+      {canEdit && (
+        <div style={{ padding: '12px 20px', borderTop: '1px solid var(--border-faint)', display: 'flex', gap: 8 }}>
+          <button onClick={handleDelete}
+            style={{
+              flex: 1, padding: '9px 16px', borderRadius: 8, fontSize: 12, fontWeight: 600, cursor: 'pointer', fontFamily: 'inherit',
+              border: '1px solid var(--border-primary)', background: 'transparent', color: 'var(--text-secondary)',
+              display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 5,
+            }}>
+            <Trash2 size={13} />
+            {t('todo.detail.delete')}
+          </button>
+          <button onClick={save} disabled={!hasChanges || saving}
+            style={{
+              flex: 1, padding: '9px 16px', borderRadius: 8, fontSize: 12, fontWeight: 600, cursor: hasChanges ? 'pointer' : 'default', fontFamily: 'inherit',
+              border: 'none', background: hasChanges ? 'var(--text-primary)' : 'var(--border-faint)',
+              color: hasChanges ? 'var(--bg-primary)' : 'var(--text-faint)',
+              transition: 'all 0.15s',
+            }}>
+            {saving ? '...' : t('todo.detail.save')}
+          </button>
+        </div>
+      )}
+    </div>
+  )
+}
+
+// ── New Task Pane (right side, for creating) ──────────────────────────────
+
+function NewTaskPane({ tripId, categories, members, defaultCategory, onCreated, onClose }: {
+  tripId: number; categories: string[]; members: Member[]; defaultCategory: string | null;
+  onCreated: (id: number) => void; onClose: () => void;
+}) {
+  const { addTodoItem } = useTripStore()
+  const toast = useToast()
+  const { t } = useTranslation()
+
+  const [name, setName] = useState('')
+  const [desc, setDesc] = useState('')
+  const [dueDate, setDueDate] = useState('')
+  const [category, setCategory] = useState(defaultCategory || '')
+  const [assignedUserId, setAssignedUserId] = useState<number | null>(null)
+  const [priority, setPriority] = useState(0)
+  const [saving, setSaving] = useState(false)
+
+  const labelStyle: React.CSSProperties = { fontSize: 12, fontWeight: 500, color: 'var(--text-secondary)', marginBottom: 4, display: 'block' }
+
+  const create = async () => {
+    if (!name.trim()) return
+    setSaving(true)
+    try {
+      const item = await addTodoItem(tripId, {
+        name: name.trim(), description: desc || null, priority,
+        due_date: dueDate || null, category: category || null,
+        assigned_user_id: assignedUserId,
+      } as any)
+      if (item?.id) onCreated(item.id)
+    } catch (err: unknown) { toast.error(err instanceof Error ? err.message : 'Error') }
+    setSaving(false)
+  }
+
+  return (
+    <div style={{
+      width: 320, flexShrink: 0, borderLeft: '1px solid var(--border-faint)',
+      display: 'flex', flexDirection: 'column', background: 'var(--bg-primary)',
+    }}>
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', padding: '16px 20px 12px', borderBottom: '1px solid var(--border-faint)' }}>
+        <span style={{ fontSize: 14, fontWeight: 700, color: 'var(--text-primary)' }}>{t('todo.newItem')}</span>
+        <button onClick={onClose} style={{ background: 'none', border: 'none', cursor: 'pointer', color: 'var(--text-faint)', padding: 4 }}>
+          <X size={16} />
+        </button>
+      </div>
+
+      <div style={{ flex: 1, overflowY: 'auto', padding: '16px 20px', display: 'flex', flexDirection: 'column', gap: 14 }}>
+        <div>
+          <input autoFocus value={name} onChange={e => setName(e.target.value)}
+            onKeyDown={e => { if (e.key === 'Enter' && name.trim()) create() }}
+            style={{ width: '100%', fontSize: 15, fontWeight: 600, border: 'none', padding: '4px 0', background: 'transparent', color: 'var(--text-primary)', outline: 'none', fontFamily: 'inherit' }}
+            placeholder={t('todo.namePlaceholder')} />
+        </div>
+
+        <div>
+          <label style={labelStyle}>{t('todo.detail.description')}</label>
+          <textarea value={desc} onChange={e => setDesc(e.target.value)} rows={4}
+            placeholder={t('todo.descriptionPlaceholder')}
+            style={{ width: '100%', fontSize: 13, padding: '8px 10px', border: '1px solid var(--border-primary)', borderRadius: 8, background: 'var(--bg-primary)', color: 'var(--text-primary)', fontFamily: 'inherit', resize: 'vertical', minHeight: 80 }} />
+        </div>
+
+        <div>
+          <label style={labelStyle}>{t('todo.detail.category')}</label>
+          <CustomSelect
+            value={category}
+            onChange={v => setCategory(v)}
+            options={[
+              { value: '', label: t('todo.noCategory') },
+              ...categories.map(c => ({
+                value: c, label: c,
+                icon: <span style={{ width: 8, height: 8, borderRadius: '50%', background: katColor(c, categories), display: 'inline-block' }} />,
+              })),
+            ]}
+            placeholder={t('todo.noCategory')}
+            size="sm"
+          />
+        </div>
+
+        <div>
+          <label style={labelStyle}>{t('todo.detail.priority')}</label>
+          <div style={{ display: 'flex', gap: 4 }}>
+            {[0, 1, 2, 3].map(p => {
+              const cfg = PRIO_CONFIG[p]
+              const isActive = priority === p
+              return (
+                <button key={p} onClick={() => setPriority(p)}
+                  style={{
+                    flex: 1, padding: '6px 0', borderRadius: 6, fontSize: 11, fontWeight: 600, cursor: 'pointer',
+                    fontFamily: 'inherit', display: 'flex', alignItems: 'center', justifyContent: 'center', gap: 4,
+                    border: `1px solid ${isActive && cfg ? cfg.color + '40' : 'var(--border-primary)'}`,
+                    background: isActive && cfg ? cfg.color + '12' : 'transparent',
+                    color: isActive && cfg ? cfg.color : isActive ? 'var(--text-primary)' : 'var(--text-faint)',
+                    transition: 'all 0.1s',
+                  }}>
+                  {cfg ? <><Flag size={10} />{cfg.label}</> : t('todo.detail.noPriority')}
+                </button>
+              )
+            })}
+          </div>
+        </div>
+
+        <div>
+          <label style={labelStyle}>{t('todo.detail.dueDate')}</label>
+          <CustomDatePicker value={dueDate} onChange={v => setDueDate(v)} />
+        </div>
+
+        <div>
+          <label style={labelStyle}>{t('todo.detail.assignedTo')}</label>
+          <CustomSelect
+            value={String(assignedUserId ?? '')}
+            onChange={v => setAssignedUserId(v ? Number(v) : null)}
+            options={[
+              { value: '', label: t('todo.unassigned'), icon: <User size={14} style={{ color: 'var(--text-faint)' }} /> },
+              ...members.map(m => ({
+                value: String(m.id), label: m.username,
+                icon: m.avatar ? (
+                  <img src={`/uploads/avatars/${m.avatar}`} style={{ width: 18, height: 18, borderRadius: '50%', objectFit: 'cover' as const }} alt="" />
+                ) : (
+                  <span style={{ width: 18, height: 18, borderRadius: '50%', background: 'var(--border-primary)', display: 'inline-flex', alignItems: 'center', justifyContent: 'center', fontSize: 10, color: 'var(--text-faint)', fontWeight: 600 }}>
+                    {m.username.charAt(0).toUpperCase()}
+                  </span>
+                ),
+              })),
+            ]}
+            placeholder={t('todo.unassigned')}
+            size="sm"
+          />
+        </div>
+      </div>
+
+      <div style={{ padding: '12px 20px', borderTop: '1px solid var(--border-faint)' }}>
+        <button onClick={create} disabled={!name.trim() || saving}
+          style={{
+            width: '100%', padding: '9px 16px', borderRadius: 8, fontSize: 12, fontWeight: 600, cursor: name.trim() ? 'pointer' : 'default', fontFamily: 'inherit',
+            border: 'none', background: name.trim() ? 'var(--text-primary)' : 'var(--border-faint)',
+            color: name.trim() ? 'var(--bg-primary)' : 'var(--text-faint)', transition: 'all 0.15s',
+          }}>
+          {saving ? '...' : t('todo.detail.create')}
+        </button>
+      </div>
+    </div>
+  )
+}

client/src/i18n/translations/ar.ts

@@ -513,8 +513,8 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
   'admin.addons.catalog.memories.description': 'شارك صور رحلتك عبر Immich',
   'admin.addons.catalog.mcp.name': 'MCP',
   'admin.addons.catalog.mcp.description': 'بروتوكول سياق النموذج لتكامل مساعد الذكاء الاصطناعي',
-  'admin.addons.catalog.packing.name': 'التعبئة',
-  'admin.addons.catalog.packing.description': 'قوائم تحقق لإعداد أمتعتك لكل رحلة',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'الميزانية',
   'admin.addons.catalog.budget.description': 'تتبع النفقات وخطط ميزانية الرحلة',
   'admin.addons.catalog.documents.name': 'المستندات',
@@ -741,6 +741,8 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'حجز',
   'trip.tabs.packing': 'قائمة التجهيز',
   'trip.tabs.packingShort': 'تجهيز',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'الميزانية',
   'trip.tabs.files': 'الملفات',
   'trip.loading': 'جارٍ تحميل الرحلة...',
@@ -936,6 +938,27 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'ربط بخطة اليوم',
   'reservations.pickAssignment': 'اختر عنصرًا من خطتك...',
   'reservations.noAssignment': 'بلا ربط',
+  'reservations.departureDate': 'المغادرة',
+  'reservations.arrivalDate': 'الوصول',
+  'reservations.departureTime': 'وقت المغادرة',
+  'reservations.arrivalTime': 'وقت الوصول',
+  'reservations.pickupDate': 'الاستلام',
+  'reservations.returnDate': 'الإرجاع',
+  'reservations.pickupTime': 'وقت الاستلام',
+  'reservations.returnTime': 'وقت الإرجاع',
+  'reservations.endDate': 'تاريخ الانتهاء',
+  'reservations.meta.departureTimezone': 'TZ المغادرة',
+  'reservations.meta.arrivalTimezone': 'TZ الوصول',
+  'reservations.span.departure': 'المغادرة',
+  'reservations.span.arrival': 'الوصول',
+  'reservations.span.inTransit': 'في الطريق',
+  'reservations.span.pickup': 'الاستلام',
+  'reservations.span.return': 'الإرجاع',
+  'reservations.span.active': 'نشط',
+  'reservations.span.start': 'البداية',
+  'reservations.span.end': 'النهاية',
+  'reservations.span.ongoing': 'جارٍ',
+  'reservations.validation.endBeforeStart': 'يجب أن يكون تاريخ/وقت الانتهاء بعد تاريخ/وقت البدء',
 
   // Budget
   'budget.title': 'الميزانية',
@@ -1544,6 +1567,41 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': 'أرسل {actor} إشعاراً تجريبياً لجميع المسؤولين.',
   'notifications.test.tripTitle': 'نشر {actor} في رحلتك',
   'notifications.test.tripText': 'إشعار تجريبي للرحلة "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default ar
+export default ar
+

client/src/i18n/translations/br.ts

@@ -490,8 +490,8 @@ const br: Record<string, string | { name: string; category: string }[]> = {
   'admin.addons.subtitle': 'Ative ou desative recursos para personalizar sua experiência no TREK.',
   'admin.addons.catalog.memories.name': 'Memórias',
   'admin.addons.catalog.memories.description': 'Álbuns de fotos compartilhados em cada viagem',
-  'admin.addons.catalog.packing.name': 'Mala',
-  'admin.addons.catalog.packing.description': 'Listas para preparar a bagagem de cada viagem',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Orçamento',
   'admin.addons.catalog.budget.description': 'Acompanhe despesas e planeje o orçamento da viagem',
   'admin.addons.catalog.documents.name': 'Documentos',
@@ -723,6 +723,8 @@ const br: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Reservas',
   'trip.tabs.packing': 'Lista de mala',
   'trip.tabs.packingShort': 'Mala',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Orçamento',
   'trip.tabs.files': 'Arquivos',
   'trip.loading': 'Carregando viagem...',
@@ -917,6 +919,27 @@ const br: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Vincular à atribuição do dia',
   'reservations.pickAssignment': 'Selecione uma atribuição do seu plano...',
   'reservations.noAssignment': 'Sem vínculo (avulsa)',
+  'reservations.departureDate': 'Partida',
+  'reservations.arrivalDate': 'Chegada',
+  'reservations.departureTime': 'Hora partida',
+  'reservations.arrivalTime': 'Hora chegada',
+  'reservations.pickupDate': 'Retirada',
+  'reservations.returnDate': 'Devolução',
+  'reservations.pickupTime': 'Hora retirada',
+  'reservations.returnTime': 'Hora devolução',
+  'reservations.endDate': 'Data final',
+  'reservations.meta.departureTimezone': 'TZ partida',
+  'reservations.meta.arrivalTimezone': 'TZ chegada',
+  'reservations.span.departure': 'Partida',
+  'reservations.span.arrival': 'Chegada',
+  'reservations.span.inTransit': 'Em trânsito',
+  'reservations.span.pickup': 'Retirada',
+  'reservations.span.return': 'Devolução',
+  'reservations.span.active': 'Ativo',
+  'reservations.span.start': 'Início',
+  'reservations.span.end': 'Fim',
+  'reservations.span.ongoing': 'Em andamento',
+  'reservations.validation.endBeforeStart': 'A data/hora final deve ser posterior à data/hora inicial',
 
   // Budget
   'budget.title': 'Orçamento',
@@ -1539,6 +1562,41 @@ const br: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} enviou uma notificação de teste para todos os admins.',
   'notifications.test.tripTitle': '{actor} postou na sua viagem',
   'notifications.test.tripText': 'Notificação de teste para a viagem "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default br
+export default br
+

client/src/i18n/translations/cs.ts

@@ -490,8 +490,8 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
   'admin.addons.subtitle': 'Zapněte nebo vypněte funkce a přizpůsobte si TREK.',
   'admin.addons.catalog.memories.name': 'Fotky (Immich)',
   'admin.addons.catalog.memories.description': 'Sdílejte cestovní fotky přes vaši instanci Immich',
-  'admin.addons.catalog.packing.name': 'Balení',
-  'admin.addons.catalog.packing.description': 'Seznamy věcí pro přípravu na cestu',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Rozpočet',
   'admin.addons.catalog.budget.description': 'Sledování výdajů a plánování rozpočtu cesty',
   'admin.addons.catalog.documents.name': 'Dokumenty',
@@ -739,6 +739,8 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Rez.',
   'trip.tabs.packing': 'Seznam věcí',
   'trip.tabs.packingShort': 'Balení',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Rozpočet',
   'trip.tabs.files': 'Soubory',
   'trip.loading': 'Načítání cesty...',
@@ -934,6 +936,27 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Propojit s přiřazením dne',
   'reservations.pickAssignment': 'Vyberte přiřazení z vašeho plánu...',
   'reservations.noAssignment': 'Bez propojení (samostatné)',
+  'reservations.departureDate': 'Odlet',
+  'reservations.arrivalDate': 'Přílet',
+  'reservations.departureTime': 'Čas odletu',
+  'reservations.arrivalTime': 'Čas příletu',
+  'reservations.pickupDate': 'Vyzvednutí',
+  'reservations.returnDate': 'Vrácení',
+  'reservations.pickupTime': 'Čas vyzvednutí',
+  'reservations.returnTime': 'Čas vrácení',
+  'reservations.endDate': 'Datum konce',
+  'reservations.meta.departureTimezone': 'TZ odletu',
+  'reservations.meta.arrivalTimezone': 'TZ příletu',
+  'reservations.span.departure': 'Odlet',
+  'reservations.span.arrival': 'Přílet',
+  'reservations.span.inTransit': 'Na cestě',
+  'reservations.span.pickup': 'Vyzvednutí',
+  'reservations.span.return': 'Vrácení',
+  'reservations.span.active': 'Aktivní',
+  'reservations.span.start': 'Začátek',
+  'reservations.span.end': 'Konec',
+  'reservations.span.ongoing': 'Probíhá',
+  'reservations.validation.endBeforeStart': 'Datum/čas konce musí být po datu/čase začátku',
 
   // Rozpočet (Budget)
   'budget.title': 'Rozpočet',
@@ -1544,6 +1567,41 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} odeslal testovací oznámení všem správcům.',
   'notifications.test.tripTitle': '{actor} přispěl do vašeho výletu',
   'notifications.test.tripText': 'Testovací oznámení pro výlet "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default cs
+export default cs
+

client/src/i18n/translations/de.ts

@@ -489,8 +489,8 @@ const de: Record<string, string | { name: string; category: string }[]> = {
   'admin.tabs.addons': 'Addons',
   'admin.addons.title': 'Addons',
   'admin.addons.subtitle': 'Aktiviere oder deaktiviere Funktionen, um TREK nach deinen Wünschen anzupassen.',
-  'admin.addons.catalog.packing.name': 'Packliste',
-  'admin.addons.catalog.packing.description': 'Checklisten zum Kofferpacken für jede Reise',
+  'admin.addons.catalog.packing.name': 'Listen',
+  'admin.addons.catalog.packing.description': 'Packlisten und To-Do-Aufgaben für deine Reisen',
   'admin.addons.catalog.budget.name': 'Budget',
   'admin.addons.catalog.budget.description': 'Ausgaben verfolgen und Reisebudget planen',
   'admin.addons.catalog.documents.name': 'Dokumente',
@@ -739,6 +739,8 @@ const de: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Buchung',
   'trip.tabs.packing': 'Liste',
   'trip.tabs.packingShort': 'Liste',
+  'trip.tabs.lists': 'Listen',
+  'trip.tabs.listsShort': 'Listen',
   'trip.tabs.budget': 'Budget',
   'trip.tabs.files': 'Dateien',
   'trip.loading': 'Reise wird geladen...',
@@ -933,6 +935,27 @@ const de: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Mit Tagesplanung verknüpfen',
   'reservations.pickAssignment': 'Zuordnung aus dem Plan wählen...',
   'reservations.noAssignment': 'Keine Verknüpfung',
+  'reservations.departureDate': 'Abflug',
+  'reservations.arrivalDate': 'Ankunft',
+  'reservations.departureTime': 'Abflugzeit',
+  'reservations.arrivalTime': 'Ankunftszeit',
+  'reservations.pickupDate': 'Abholung',
+  'reservations.returnDate': 'Rückgabe',
+  'reservations.pickupTime': 'Abholzeit',
+  'reservations.returnTime': 'Rückgabezeit',
+  'reservations.endDate': 'Enddatum',
+  'reservations.meta.departureTimezone': 'Abfl. TZ',
+  'reservations.meta.arrivalTimezone': 'Ank. TZ',
+  'reservations.span.departure': 'Abflug',
+  'reservations.span.arrival': 'Ankunft',
+  'reservations.span.inTransit': 'Unterwegs',
+  'reservations.span.pickup': 'Abholung',
+  'reservations.span.return': 'Rückgabe',
+  'reservations.span.active': 'Aktiv',
+  'reservations.span.start': 'Start',
+  'reservations.span.end': 'Ende',
+  'reservations.span.ongoing': 'Laufend',
+  'reservations.validation.endBeforeStart': 'Enddatum/-zeit muss nach dem Startdatum/-zeit liegen',
 
   // Budget
   'budget.title': 'Budget',
@@ -1541,6 +1564,41 @@ const de: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} hat eine Testbenachrichtigung an alle Admins gesendet.',
   'notifications.test.tripTitle': '{actor} hat in Ihrer Reise gepostet',
   'notifications.test.tripText': 'Testbenachrichtigung für Reise "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packliste',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'erledigt',
+  'todo.filter.all': 'Alle',
+  'todo.filter.open': 'Offen',
+  'todo.filter.done': 'Erledigt',
+  'todo.uncategorized': 'Ohne Kategorie',
+  'todo.namePlaceholder': 'Aufgabenname',
+  'todo.descriptionPlaceholder': 'Beschreibung (optional)',
+  'todo.unassigned': 'Nicht zugewiesen',
+  'todo.noCategory': 'Keine Kategorie',
+  'todo.hasDescription': 'Hat Beschreibung',
+  'todo.addItem': 'Neue Aufgabe hinzufügen...',
+  'todo.newCategory': 'Kategoriename',
+  'todo.addCategory': 'Kategorie hinzufügen',
+  'todo.newItem': 'Neue Aufgabe',
+  'todo.empty': 'Noch keine Aufgaben. Erstelle eine Aufgabe um loszulegen!',
+  'todo.filter.my': 'Meine Aufgaben',
+  'todo.filter.overdue': 'Überfällig',
+  'todo.sidebar.tasks': 'Aufgaben',
+  'todo.sidebar.categories': 'Kategorien',
+  'todo.detail.title': 'Aufgabe',
+  'todo.detail.description': 'Beschreibung',
+  'todo.detail.category': 'Kategorie',
+  'todo.detail.dueDate': 'Fällig am',
+  'todo.detail.assignedTo': 'Zuständig',
+  'todo.detail.delete': 'Löschen',
+  'todo.detail.save': 'Speichern',
+  'todo.sortByPrio': 'Priorität',
+  'todo.detail.priority': 'Priorität',
+  'todo.detail.noPriority': 'Keine',
+  'todo.detail.create': 'Aufgabe erstellen',
 }
 
-export default de
+export default de
+

client/src/i18n/translations/en.ts

@@ -489,8 +489,8 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'admin.tabs.addons': 'Addons',
   'admin.addons.title': 'Addons',
   'admin.addons.subtitle': 'Enable or disable features to customize your TREK experience.',
-  'admin.addons.catalog.packing.name': 'Packing',
-  'admin.addons.catalog.packing.description': 'Checklists to prepare your luggage for each trip',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Budget',
   'admin.addons.catalog.budget.description': 'Track expenses and plan your trip budget',
   'admin.addons.catalog.documents.name': 'Documents',
@@ -736,6 +736,8 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Book',
   'trip.tabs.packing': 'Packing List',
   'trip.tabs.packingShort': 'Packing',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Budget',
   'trip.tabs.files': 'Files',
   'trip.loading': 'Loading trip...',
@@ -930,6 +932,27 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Link to day assignment',
   'reservations.pickAssignment': 'Select an assignment from your plan...',
   'reservations.noAssignment': 'No link (standalone)',
+  'reservations.departureDate': 'Departure',
+  'reservations.arrivalDate': 'Arrival',
+  'reservations.departureTime': 'Dep. time',
+  'reservations.arrivalTime': 'Arr. time',
+  'reservations.pickupDate': 'Pickup',
+  'reservations.returnDate': 'Return',
+  'reservations.pickupTime': 'Pickup time',
+  'reservations.returnTime': 'Return time',
+  'reservations.endDate': 'End date',
+  'reservations.meta.departureTimezone': 'Dep. TZ',
+  'reservations.meta.arrivalTimezone': 'Arr. TZ',
+  'reservations.span.departure': 'Departure',
+  'reservations.span.arrival': 'Arrival',
+  'reservations.span.inTransit': 'In transit',
+  'reservations.span.pickup': 'Pickup',
+  'reservations.span.return': 'Return',
+  'reservations.span.active': 'Active',
+  'reservations.span.start': 'Start',
+  'reservations.span.end': 'End',
+  'reservations.span.ongoing': 'Ongoing',
+  'reservations.validation.endBeforeStart': 'End date/time must be after start date/time',
 
   // Budget
   'budget.title': 'Budget',
@@ -1541,6 +1564,40 @@ const en: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} sent a test notification to all admins.',
   'notifications.test.tripTitle': '{actor} posted in your trip',
   'notifications.test.tripText': 'Test notification for trip "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.sortByPrio': 'Priority',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.detail.create': 'Create task',
 }
 
 export default en

client/src/i18n/translations/es.ts

@@ -715,6 +715,8 @@ const es: Record<string, string> = {
   'trip.tabs.reservationsShort': 'Reservas',
   'trip.tabs.packing': 'Lista de equipaje',
   'trip.tabs.packingShort': 'Equipaje',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Presupuesto',
   'trip.tabs.files': 'Archivos',
   'trip.loading': 'Cargando viaje...',
@@ -893,6 +895,27 @@ const es: Record<string, string> = {
   'reservations.linkAssignment': 'Vincular a una asignación del día',
   'reservations.pickAssignment': 'Selecciona una asignación de tu plan...',
   'reservations.noAssignment': 'Sin vínculo (independiente)',
+  'reservations.departureDate': 'Salida',
+  'reservations.arrivalDate': 'Llegada',
+  'reservations.departureTime': 'Hora salida',
+  'reservations.arrivalTime': 'Hora llegada',
+  'reservations.pickupDate': 'Recogida',
+  'reservations.returnDate': 'Devolución',
+  'reservations.pickupTime': 'Hora recogida',
+  'reservations.returnTime': 'Hora devolución',
+  'reservations.endDate': 'Fecha fin',
+  'reservations.meta.departureTimezone': 'TZ salida',
+  'reservations.meta.arrivalTimezone': 'TZ llegada',
+  'reservations.span.departure': 'Salida',
+  'reservations.span.arrival': 'Llegada',
+  'reservations.span.inTransit': 'En tránsito',
+  'reservations.span.pickup': 'Recogida',
+  'reservations.span.return': 'Devolución',
+  'reservations.span.active': 'Activo',
+  'reservations.span.start': 'Inicio',
+  'reservations.span.end': 'Fin',
+  'reservations.span.ongoing': 'En curso',
+  'reservations.validation.endBeforeStart': 'La fecha/hora de fin debe ser posterior a la de inicio',
 
   // Budget
   'budget.title': 'Presupuesto',
@@ -1163,8 +1186,8 @@ const es: Record<string, string> = {
   'admin.addons.catalog.memories.description': 'Comparte fotos de viaje a través de tu instancia de Immich',
   'admin.addons.catalog.mcp.name': 'MCP',
   'admin.addons.catalog.mcp.description': 'Protocolo de contexto de modelo para integración con asistentes de IA',
-  'admin.addons.catalog.packing.name': 'Equipaje',
-  'admin.addons.catalog.packing.description': 'Prepara tu equipaje con listas de comprobación para cada viaje',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Presupuesto',
   'admin.addons.catalog.budget.description': 'Controla los gastos y planifica el presupuesto del viaje',
   'admin.addons.catalog.documents.name': 'Documentos',
@@ -1546,6 +1569,41 @@ const es: Record<string, string> = {
   'notifications.test.adminText': '{actor} envió una notificación de prueba a todos los administradores.',
   'notifications.test.tripTitle': '{actor} publicó en tu viaje',
   'notifications.test.tripText': 'Notificación de prueba para el viaje "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default es
+export default es
+

client/src/i18n/translations/fr.ts

@@ -491,8 +491,8 @@ const fr: Record<string, string> = {
   'admin.addons.catalog.memories.description': 'Partagez vos photos de voyage via votre instance Immich',
   'admin.addons.catalog.mcp.name': 'MCP',
   'admin.addons.catalog.mcp.description': 'Protocole de contexte de modèle pour l\'intégration d\'assistants IA',
-  'admin.addons.catalog.packing.name': 'Bagages',
-  'admin.addons.catalog.packing.description': 'Listes de contrôle pour préparer vos bagages pour chaque voyage',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Budget',
   'admin.addons.catalog.budget.description': 'Suivez les dépenses et planifiez votre budget de voyage',
   'admin.addons.catalog.documents.name': 'Documents',
@@ -738,6 +738,8 @@ const fr: Record<string, string> = {
   'trip.tabs.reservationsShort': 'Résa',
   'trip.tabs.packing': 'Liste de bagages',
   'trip.tabs.packingShort': 'Bagages',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Budget',
   'trip.tabs.files': 'Fichiers',
   'trip.loading': 'Chargement du voyage…',
@@ -932,6 +934,27 @@ const fr: Record<string, string> = {
   'reservations.linkAssignment': 'Lier à l\'affectation du jour',
   'reservations.pickAssignment': 'Sélectionnez une affectation de votre plan…',
   'reservations.noAssignment': 'Aucun lien (autonome)',
+  'reservations.departureDate': 'Départ',
+  'reservations.arrivalDate': 'Arrivée',
+  'reservations.departureTime': 'Heure dép.',
+  'reservations.arrivalTime': 'Heure arr.',
+  'reservations.pickupDate': 'Prise en charge',
+  'reservations.returnDate': 'Restitution',
+  'reservations.pickupTime': 'Heure prise en charge',
+  'reservations.returnTime': 'Heure restitution',
+  'reservations.endDate': 'Date de fin',
+  'reservations.meta.departureTimezone': 'TZ dép.',
+  'reservations.meta.arrivalTimezone': 'TZ arr.',
+  'reservations.span.departure': 'Départ',
+  'reservations.span.arrival': 'Arrivée',
+  'reservations.span.inTransit': 'En transit',
+  'reservations.span.pickup': 'Prise en charge',
+  'reservations.span.return': 'Restitution',
+  'reservations.span.active': 'Actif',
+  'reservations.span.start': 'Début',
+  'reservations.span.end': 'Fin',
+  'reservations.span.ongoing': 'En cours',
+  'reservations.validation.endBeforeStart': 'La date/heure de fin doit être postérieure à la date/heure de début',
 
   // Budget
   'budget.title': 'Budget',
@@ -1540,6 +1563,41 @@ const fr: Record<string, string> = {
   'notifications.test.adminText': '{actor} a envoyé une notification de test à tous les admins.',
   'notifications.test.tripTitle': '{actor} a publié dans votre voyage',
   'notifications.test.tripText': 'Notification de test pour le voyage "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default fr
+export default fr
+

client/src/i18n/translations/hu.ts

@@ -488,8 +488,8 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
   'admin.tabs.addons': 'Bővítmények',
   'admin.addons.title': 'Bővítmények',
   'admin.addons.subtitle': 'Funkciók engedélyezése vagy letiltása a TREK testreszabásához.',
-  'admin.addons.catalog.packing.name': 'Csomagolás',
-  'admin.addons.catalog.packing.description': 'Ellenőrzőlisták a poggyász előkészítéséhez minden utazáshoz',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Költségvetés',
   'admin.addons.catalog.budget.description': 'Kiadások nyomon követése és az utazási költségvetés tervezése',
   'admin.addons.catalog.documents.name': 'Dokumentumok',
@@ -739,6 +739,8 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Foglalás',
   'trip.tabs.packing': 'Csomagolási lista',
   'trip.tabs.packingShort': 'Csomag',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Költségvetés',
   'trip.tabs.files': 'Fájlok',
   'trip.loading': 'Utazás betöltése...',
@@ -933,6 +935,27 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Összekapcsolás napi tervvel',
   'reservations.pickAssignment': 'Válassz hozzárendelést a tervedből...',
   'reservations.noAssignment': 'Nincs összekapcsolás (önálló)',
+  'reservations.departureDate': 'Indulás',
+  'reservations.arrivalDate': 'Érkezés',
+  'reservations.departureTime': 'Indulási idő',
+  'reservations.arrivalTime': 'Érkezési idő',
+  'reservations.pickupDate': 'Felvétel',
+  'reservations.returnDate': 'Visszaadás',
+  'reservations.pickupTime': 'Felvétel ideje',
+  'reservations.returnTime': 'Visszaadás ideje',
+  'reservations.endDate': 'Befejezés dátuma',
+  'reservations.meta.departureTimezone': 'TZ indulás',
+  'reservations.meta.arrivalTimezone': 'TZ érkezés',
+  'reservations.span.departure': 'Indulás',
+  'reservations.span.arrival': 'Érkezés',
+  'reservations.span.inTransit': 'Úton',
+  'reservations.span.pickup': 'Felvétel',
+  'reservations.span.return': 'Visszaadás',
+  'reservations.span.active': 'Aktív',
+  'reservations.span.start': 'Kezdés',
+  'reservations.span.end': 'Vége',
+  'reservations.span.ongoing': 'Folyamatban',
+  'reservations.validation.endBeforeStart': 'A befejezés dátuma/időpontja a kezdés utáni kell legyen',
 
   // Költségvetés
   'budget.title': 'Költségvetés',
@@ -1541,6 +1564,41 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} teszt értesítést küldött az összes adminisztrátornak.',
   'notifications.test.tripTitle': '{actor} üzenetet küldött az utazásodba',
   'notifications.test.tripText': 'Teszt értesítés a(z) "{trip}" utazáshoz.',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default hu
+export default hu
+

client/src/i18n/translations/it.ts

@@ -487,8 +487,8 @@ const it: Record<string, string | { name: string; category: string }[]> = {
   'admin.tabs.addons': 'Moduli',
   'admin.addons.title': 'Moduli',
   'admin.addons.subtitle': 'Abilita o disabilita le funzionalità per personalizzare la tua esperienza TREK.',
-  'admin.addons.catalog.packing.name': 'Lista valigia',
-  'admin.addons.catalog.packing.description': 'Checklist per preparare la valigia per ogni viaggio',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Budget',
   'admin.addons.catalog.budget.description': 'Tieni traccia delle spese e pianifica il budget del tuo viaggio',
   'admin.addons.catalog.documents.name': 'Documenti',
@@ -739,6 +739,8 @@ const it: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Pren.',
   'trip.tabs.packing': 'Lista valigia',
   'trip.tabs.packingShort': 'Valigia',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Budget',
   'trip.tabs.files': 'File',
   'trip.loading': 'Caricamento viaggio...',
@@ -933,6 +935,27 @@ const it: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Collega all\'assegnazione del giorno',
   'reservations.pickAssignment': 'Seleziona un\'assegnazione dal tuo programma...',
   'reservations.noAssignment': 'Nessun collegamento (autonomo)',
+  'reservations.departureDate': 'Partenza',
+  'reservations.arrivalDate': 'Arrivo',
+  'reservations.departureTime': 'Ora part.',
+  'reservations.arrivalTime': 'Ora arr.',
+  'reservations.pickupDate': 'Ritiro',
+  'reservations.returnDate': 'Riconsegna',
+  'reservations.pickupTime': 'Ora ritiro',
+  'reservations.returnTime': 'Ora riconsegna',
+  'reservations.endDate': 'Data fine',
+  'reservations.meta.departureTimezone': 'TZ part.',
+  'reservations.meta.arrivalTimezone': 'TZ arr.',
+  'reservations.span.departure': 'Partenza',
+  'reservations.span.arrival': 'Arrivo',
+  'reservations.span.inTransit': 'In transito',
+  'reservations.span.pickup': 'Ritiro',
+  'reservations.span.return': 'Riconsegna',
+  'reservations.span.active': 'Attivo',
+  'reservations.span.start': 'Inizio',
+  'reservations.span.end': 'Fine',
+  'reservations.span.ongoing': 'In corso',
+  'reservations.validation.endBeforeStart': 'La data/ora di fine deve essere successiva alla data/ora di inizio',
 
   // Budget
   'budget.title': 'Budget',
@@ -1541,6 +1564,41 @@ const it: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} ha inviato una notifica di test a tutti gli amministratori.',
   'notifications.test.tripTitle': '{actor} ha pubblicato nel tuo viaggio',
   'notifications.test.tripText': 'Notifica di test per il viaggio "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default it
+export default it
+

client/src/i18n/translations/nl.ts

@@ -492,8 +492,8 @@ const nl: Record<string, string> = {
   'admin.addons.catalog.memories.description': 'Deel reisfoto\'s via je Immich-instantie',
   'admin.addons.catalog.mcp.name': 'MCP',
   'admin.addons.catalog.mcp.description': 'Model Context Protocol voor AI-assistent integratie',
-  'admin.addons.catalog.packing.name': 'Inpakken',
-  'admin.addons.catalog.packing.description': 'Checklists om je bagage voor elke reis voor te bereiden',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Budget',
   'admin.addons.catalog.budget.description': 'Houd uitgaven bij en plan je reisbudget',
   'admin.addons.catalog.documents.name': 'Documenten',
@@ -738,6 +738,8 @@ const nl: Record<string, string> = {
   'trip.tabs.reservationsShort': 'Boek',
   'trip.tabs.packing': 'Paklijst',
   'trip.tabs.packingShort': 'Inpakken',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Budget',
   'trip.tabs.files': 'Bestanden',
   'trip.loading': 'Reis laden...',
@@ -932,6 +934,27 @@ const nl: Record<string, string> = {
   'reservations.linkAssignment': 'Koppelen aan dagtoewijzing',
   'reservations.pickAssignment': 'Selecteer een toewijzing uit je plan...',
   'reservations.noAssignment': 'Geen koppeling (zelfstandig)',
+  'reservations.departureDate': 'Vertrek',
+  'reservations.arrivalDate': 'Aankomst',
+  'reservations.departureTime': 'Vertrektijd',
+  'reservations.arrivalTime': 'Aankomsttijd',
+  'reservations.pickupDate': 'Ophalen',
+  'reservations.returnDate': 'Inleveren',
+  'reservations.pickupTime': 'Ophaaltijd',
+  'reservations.returnTime': 'Inlevertijd',
+  'reservations.endDate': 'Einddatum',
+  'reservations.meta.departureTimezone': 'TZ vertrek',
+  'reservations.meta.arrivalTimezone': 'TZ aankomst',
+  'reservations.span.departure': 'Vertrek',
+  'reservations.span.arrival': 'Aankomst',
+  'reservations.span.inTransit': 'Onderweg',
+  'reservations.span.pickup': 'Ophalen',
+  'reservations.span.return': 'Inleveren',
+  'reservations.span.active': 'Actief',
+  'reservations.span.start': 'Start',
+  'reservations.span.end': 'Einde',
+  'reservations.span.ongoing': 'Lopend',
+  'reservations.validation.endBeforeStart': 'Einddatum/-tijd moet na de startdatum/-tijd liggen',
 
   // Budget
   'budget.title': 'Budget',
@@ -1540,6 +1563,41 @@ const nl: Record<string, string> = {
   'notifications.test.adminText': '{actor} heeft een testmelding naar alle admins gestuurd.',
   'notifications.test.tripTitle': '{actor} heeft gepost in uw reis',
   'notifications.test.tripText': 'Testmelding voor reis "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default nl
+export default nl
+

client/src/i18n/translations/pl.ts

@@ -455,8 +455,8 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
   'admin.tabs.addons': 'Dodatki',
   'admin.addons.title': 'Dodatki',
   'admin.addons.subtitle': 'Włączaj lub wyłączaj funkcje, aby dostosować swoje doświadczenie w TREK.',
-  'admin.addons.catalog.packing.name': 'Pakowanie',
-  'admin.addons.catalog.packing.description': 'Listy do przygotowania bagażu na każdą podróż',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Budżet',
   'admin.addons.catalog.budget.description': 'Śledź wydatki i planuj budżet podróży',
   'admin.addons.catalog.documents.name': 'Dokumenty',
@@ -701,6 +701,8 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
   'trip.tabs.reservationsShort': 'Rezerwacje',
   'trip.tabs.packing': 'Lista pakowania',
   'trip.tabs.packingShort': 'Pakowanie',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Budżet',
   'trip.tabs.files': 'Pliki',
   'trip.loading': 'Ładowanie podróży...',
@@ -888,6 +890,27 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
   'reservations.linkAssignment': 'Przypisz do miejsca',
   'reservations.pickAssignment': 'Wybierz miejsce z planu...',
   'reservations.noAssignment': 'Brak przypisania (samodzielna)',
+  'reservations.departureDate': 'Wylot',
+  'reservations.arrivalDate': 'Przylot',
+  'reservations.departureTime': 'Godz. wylotu',
+  'reservations.arrivalTime': 'Godz. przylotu',
+  'reservations.pickupDate': 'Odbiór',
+  'reservations.returnDate': 'Zwrot',
+  'reservations.pickupTime': 'Godz. odbioru',
+  'reservations.returnTime': 'Godz. zwrotu',
+  'reservations.endDate': 'Data końca',
+  'reservations.meta.departureTimezone': 'TZ wylotu',
+  'reservations.meta.arrivalTimezone': 'TZ przylotu',
+  'reservations.span.departure': 'Wylot',
+  'reservations.span.arrival': 'Przylot',
+  'reservations.span.inTransit': 'W tranzycie',
+  'reservations.span.pickup': 'Odbiór',
+  'reservations.span.return': 'Zwrot',
+  'reservations.span.active': 'Aktywny',
+  'reservations.span.start': 'Start',
+  'reservations.span.end': 'Koniec',
+  'reservations.span.ongoing': 'W trakcie',
+  'reservations.validation.endBeforeStart': 'Data/godzina zakończenia musi być późniejsza niż data/godzina rozpoczęcia',
 
   // Budget
   'budget.title': 'Budżet',
@@ -1533,6 +1556,40 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
   'notifications.test.adminText': '{actor} wysłał testowe powiadomienie.',
   'notifications.test.tripTitle': '{actor} opublikował w Twojej podróży',
   'notifications.test.tripText': 'Testowe powiadomienie dla podróży "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
 export default pl

client/src/i18n/translations/ru.ts

@@ -492,8 +492,8 @@ const ru: Record<string, string> = {
   'admin.addons.catalog.memories.description': 'Делитесь фотографиями из поездок через Immich',
   'admin.addons.catalog.mcp.name': 'MCP',
   'admin.addons.catalog.mcp.description': 'Протокол контекста модели для интеграции с ИИ-ассистентами',
-  'admin.addons.catalog.packing.name': 'Сборы',
-  'admin.addons.catalog.packing.description': 'Чек-листы для подготовки багажа к каждой поездке',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': 'Бюджет',
   'admin.addons.catalog.budget.description': 'Отслеживайте расходы и планируйте бюджет поездки',
   'admin.addons.catalog.documents.name': 'Документы',
@@ -738,6 +738,8 @@ const ru: Record<string, string> = {
   'trip.tabs.reservationsShort': 'Брони',
   'trip.tabs.packing': 'Список вещей',
   'trip.tabs.packingShort': 'Вещи',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': 'Бюджет',
   'trip.tabs.files': 'Файлы',
   'trip.loading': 'Загрузка поездки...',
@@ -932,6 +934,27 @@ const ru: Record<string, string> = {
   'reservations.linkAssignment': 'Привязать к назначению дня',
   'reservations.pickAssignment': 'Выберите назначение из вашего плана...',
   'reservations.noAssignment': 'Без привязки (самостоятельное)',
+  'reservations.departureDate': 'Вылет',
+  'reservations.arrivalDate': 'Прилёт',
+  'reservations.departureTime': 'Время вылета',
+  'reservations.arrivalTime': 'Время прилёта',
+  'reservations.pickupDate': 'Получение',
+  'reservations.returnDate': 'Возврат',
+  'reservations.pickupTime': 'Время получения',
+  'reservations.returnTime': 'Время возврата',
+  'reservations.endDate': 'Дата окончания',
+  'reservations.meta.departureTimezone': 'TZ вылета',
+  'reservations.meta.arrivalTimezone': 'TZ прилёта',
+  'reservations.span.departure': 'Вылет',
+  'reservations.span.arrival': 'Прилёт',
+  'reservations.span.inTransit': 'В пути',
+  'reservations.span.pickup': 'Получение',
+  'reservations.span.return': 'Возврат',
+  'reservations.span.active': 'Активно',
+  'reservations.span.start': 'Начало',
+  'reservations.span.end': 'Конец',
+  'reservations.span.ongoing': 'Продолжается',
+  'reservations.validation.endBeforeStart': 'Дата/время окончания должны быть позже даты/времени начала',
 
   // Budget
   'budget.title': 'Бюджет',
@@ -1540,6 +1563,41 @@ const ru: Record<string, string> = {
   'notifications.test.adminText': '{actor} отправил тестовое уведомление всем администраторам.',
   'notifications.test.tripTitle': '{actor} написал в вашей поездке',
   'notifications.test.tripText': 'Тестовое уведомление для поездки "{trip}".',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default ru
+export default ru
+

client/src/i18n/translations/zh.ts

@@ -492,8 +492,8 @@ const zh: Record<string, string> = {
   'admin.addons.catalog.memories.description': '通过 Immich 实例分享旅行照片',
   'admin.addons.catalog.mcp.name': 'MCP',
   'admin.addons.catalog.mcp.description': '用于 AI 助手集成的模型上下文协议',
-  'admin.addons.catalog.packing.name': '行李',
-  'admin.addons.catalog.packing.description': '每次旅行的行李准备清单',
+  'admin.addons.catalog.packing.name': 'Lists',
+  'admin.addons.catalog.packing.description': 'Packing lists and to-do tasks for your trips',
   'admin.addons.catalog.budget.name': '预算',
   'admin.addons.catalog.budget.description': '跟踪支出并规划旅行预算',
   'admin.addons.catalog.documents.name': '文档',
@@ -738,6 +738,8 @@ const zh: Record<string, string> = {
   'trip.tabs.reservationsShort': '预订',
   'trip.tabs.packing': '行李清单',
   'trip.tabs.packingShort': '行李',
+  'trip.tabs.lists': 'Lists',
+  'trip.tabs.listsShort': 'Lists',
   'trip.tabs.budget': '预算',
   'trip.tabs.files': '文件',
   'trip.loading': '加载旅行中...',
@@ -932,6 +934,27 @@ const zh: Record<string, string> = {
   'reservations.linkAssignment': '关联日程分配',
   'reservations.pickAssignment': '从计划中选择一个分配...',
   'reservations.noAssignment': '无关联（独立）',
+  'reservations.departureDate': '出发',
+  'reservations.arrivalDate': '到达',
+  'reservations.departureTime': '出发时间',
+  'reservations.arrivalTime': '到达时间',
+  'reservations.pickupDate': '取车',
+  'reservations.returnDate': '还车',
+  'reservations.pickupTime': '取车时间',
+  'reservations.returnTime': '还车时间',
+  'reservations.endDate': '结束日期',
+  'reservations.meta.departureTimezone': '出发时区',
+  'reservations.meta.arrivalTimezone': '到达时区',
+  'reservations.span.departure': '出发',
+  'reservations.span.arrival': '到达',
+  'reservations.span.inTransit': '途中',
+  'reservations.span.pickup': '取车',
+  'reservations.span.return': '还车',
+  'reservations.span.active': '使用中',
+  'reservations.span.start': '开始',
+  'reservations.span.end': '结束',
+  'reservations.span.ongoing': '进行中',
+  'reservations.validation.endBeforeStart': '结束日期/时间必须晚于开始日期/时间',
 
   // Budget
   'budget.title': '预算',
@@ -1540,6 +1563,41 @@ const zh: Record<string, string> = {
   'notifications.test.adminText': '{actor} 向所有管理员发送了测试通知。',
   'notifications.test.tripTitle': '{actor} 在您的行程中发帖',
   'notifications.test.tripText': '行程"{trip}"的测试通知。',
+
+  // Todo
+  'todo.subtab.packing': 'Packing List',
+  'todo.subtab.todo': 'To-Do',
+  'todo.completed': 'completed',
+  'todo.filter.all': 'All',
+  'todo.filter.open': 'Open',
+  'todo.filter.done': 'Done',
+  'todo.uncategorized': 'Uncategorized',
+  'todo.namePlaceholder': 'Task name',
+  'todo.descriptionPlaceholder': 'Description (optional)',
+  'todo.unassigned': 'Unassigned',
+  'todo.noCategory': 'No category',
+  'todo.hasDescription': 'Has description',
+  'todo.addItem': 'Add new task...',
+  'todo.newCategory': 'Category name',
+  'todo.addCategory': 'Add category',
+  'todo.newItem': 'New task',
+  'todo.empty': 'No tasks yet. Add a task to get started!',
+  'todo.filter.my': 'My Tasks',
+  'todo.filter.overdue': 'Overdue',
+  'todo.sidebar.tasks': 'Tasks',
+  'todo.sidebar.categories': 'Categories',
+  'todo.detail.title': 'Task',
+  'todo.detail.description': 'Description',
+  'todo.detail.category': 'Category',
+  'todo.detail.dueDate': 'Due date',
+  'todo.detail.assignedTo': 'Assigned to',
+  'todo.detail.delete': 'Delete',
+  'todo.detail.save': 'Save changes',
+  'todo.detail.create': 'Create task',
+  'todo.detail.priority': 'Priority',
+  'todo.detail.noPriority': 'None',
+  'todo.sortByPrio': 'Priority',
 }
 
-export default zh
+export default zh
+

client/src/pages/InAppNotificationsPage.tsx

@@ -54,8 +54,8 @@ export default function InAppNotificationsPage(): React.ReactElement {
               <h1 className="text-xl font-semibold" style={{ color: 'var(--text-primary)' }}>
                 {t('notifications.title')}
                 {unreadCount > 0 && (
-                  <span className="ml-2 px-2 py-0.5 rounded-full text-xs font-medium"
-                    style={{ background: '#6366f1', color: '#fff' }}>
+                  <span className="ml-2 px-2 py-0.5 rounded-full text-xs font-medium align-middle inline-flex items-center justify-center"
+                    style={{ background: 'var(--text-primary)', color: 'var(--bg-primary)' }}>
                     {unreadCount}
                   </span>
                 )}
@@ -97,8 +97,8 @@ export default function InAppNotificationsPage(): React.ReactElement {
               onClick={() => setUnreadOnly(false)}
               className="px-3 py-1.5 rounded-lg text-sm font-medium transition-colors"
               style={{
-                background: !unreadOnly ? '#6366f1' : 'var(--bg-hover)',
-                color: !unreadOnly ? '#fff' : 'var(--text-secondary)',
+                background: !unreadOnly ? 'var(--text-primary)' : 'var(--bg-hover)',
+                color: !unreadOnly ? 'var(--bg-primary)' : 'var(--text-secondary)',
               }}
             >
               {t('notifications.all')}
@@ -107,8 +107,8 @@ export default function InAppNotificationsPage(): React.ReactElement {
               onClick={() => setUnreadOnly(true)}
               className="px-3 py-1.5 rounded-lg text-sm font-medium transition-colors"
               style={{
-                background: unreadOnly ? '#6366f1' : 'var(--bg-hover)',
-                color: unreadOnly ? '#fff' : 'var(--text-secondary)',
+                background: unreadOnly ? 'var(--text-primary)' : 'var(--bg-hover)',
+                color: unreadOnly ? 'var(--bg-primary)' : 'var(--text-secondary)',
               }}
             >
               {t('notifications.unreadOnly')}
@@ -122,7 +122,7 @@ export default function InAppNotificationsPage(): React.ReactElement {
           >
             {isLoading && displayed.length === 0 ? (
               <div className="flex items-center justify-center py-16">
-                <div className="w-6 h-6 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />
+                <div className="w-6 h-6 border-2 border-slate-200 border-t-current rounded-full animate-spin" />
               </div>
             ) : displayed.length === 0 ? (
               <div className="flex flex-col items-center justify-center py-16 px-4 text-center gap-3">
@@ -139,7 +139,7 @@ export default function InAppNotificationsPage(): React.ReactElement {
             {/* Infinite scroll trigger */}
             {hasMore && (
               <div ref={loaderRef} className="flex items-center justify-center py-4">
-                {isLoading && <div className="w-5 h-5 border-2 border-slate-200 border-t-indigo-500 rounded-full animate-spin" />}
+                {isLoading && <div className="w-5 h-5 border-2 border-slate-200 border-t-current rounded-full animate-spin" />}
               </div>
             )}
           </div>

client/src/pages/SettingsPage.tsx

@@ -704,7 +704,7 @@ export default function SettingsPage(): React.ReactElement {
             {/* Dark Mode Toggle */}
             <div>
               <label className="block text-sm font-medium mb-2" style={{ color: 'var(--text-secondary)' }}>{t('settings.colorMode')}</label>
-              <div className="flex gap-3">
+              <div className="flex gap-3" style={{ flexWrap: 'wrap' }}>
                 {[
                   { value: 'light', label: t('settings.light'), icon: Sun },
                   { value: 'dark', label: t('settings.dark'), icon: Moon },
@@ -721,8 +721,8 @@ export default function SettingsPage(): React.ReactElement {
                         } catch (e: unknown) { toast.error(e instanceof Error ? e.message : 'Error') }
                       }}
                       style={{
-                        display: 'flex', alignItems: 'center', gap: 8,
-                        padding: '10px 20px', borderRadius: 10, cursor: 'pointer',
+                        display: 'flex', alignItems: 'center', gap: 6,
+                        padding: '10px 14px', borderRadius: 10, cursor: 'pointer', flex: '1 1 0', justifyContent: 'center', minWidth: 0,
                         fontFamily: 'inherit', fontSize: 14, fontWeight: 500,
                         border: isActive ? '2px solid var(--text-primary)' : '2px solid var(--border-primary)',
                         background: isActive ? 'var(--bg-hover)' : 'var(--bg-card)',
@@ -1391,7 +1391,8 @@ export default function SettingsPage(): React.ReactElement {
                 className="flex items-center gap-2 px-4 py-2 bg-slate-900 text-white rounded-lg text-sm hover:bg-slate-700 disabled:bg-slate-400"
               >
                 {saving.profile ? <div className="w-4 h-4 border-2 border-white/30 border-t-white rounded-full animate-spin" /> : <Save className="w-4 h-4" />}
-                {t('settings.saveProfile')}
+                <span className="hidden sm:inline">{t('settings.saveProfile')}</span>
+                <span className="sm:hidden">{t('common.save')}</span>
               </button>
               <button
                 onClick={async () => {
@@ -1411,7 +1412,8 @@ export default function SettingsPage(): React.ReactElement {
                 style={{ border: '1px solid #fecaca' }}
               >
                 <Trash2 size={14} />
-                {t('settings.deleteAccount')}
+                <span className="hidden sm:inline">{t('settings.deleteAccount')}</span>
+                <span className="sm:hidden">{t('common.delete')}</span>
               </button>
             </div>
           </Section>

client/src/pages/TripPlannerPage.tsx

@@ -17,6 +17,7 @@ import { ReservationModal } from '../components/Planner/ReservationModal'
 import MemoriesPanel from '../components/Memories/MemoriesPanel'
 import ReservationsPanel from '../components/Planner/ReservationsPanel'
 import PackingListPanel from '../components/Packing/PackingListPanel'
+import TodoListPanel from '../components/Todo/TodoListPanel'
 import FileManager from '../components/Files/FileManager'
 import BudgetPanel from '../components/Budget/BudgetPanel'
 import CollabPanel from '../components/Collab/CollabPanel'
@@ -31,7 +32,40 @@ import { useTripWebSocket } from '../hooks/useTripWebSocket'
 import { useRouteCalculation } from '../hooks/useRouteCalculation'
 import { usePlaceSelection } from '../hooks/usePlaceSelection'
 import { usePlannerHistory } from '../hooks/usePlannerHistory'
-import type { Accommodation, TripMember, Day, Place, Reservation } from '../types'
+import type { Accommodation, TripMember, Day, Place, Reservation, PackingItem, TodoItem } from '../types'
+import { ListTodo } from 'lucide-react'
+
+function ListsContainer({ tripId, packingItems, todoItems }: { tripId: number; packingItems: PackingItem[]; todoItems: TodoItem[] }) {
+  const [subTab, setSubTab] = useState<'packing' | 'todo'>(() => {
+    return (sessionStorage.getItem(`trip-lists-subtab-${tripId}`) as 'packing' | 'todo') || 'packing'
+  })
+  const setSubTabPersist = (tab: 'packing' | 'todo') => { setSubTab(tab); sessionStorage.setItem(`trip-lists-subtab-${tripId}`, tab) }
+  const { t } = useTranslation()
+  return (
+    <div>
+      <div style={{ display: 'flex', gap: 4, padding: '4px 16px 0', borderBottom: '1px solid var(--border-faint)', marginBottom: 8 }}>
+        {([
+          { id: 'packing' as const, label: t('todo.subtab.packing'), icon: PackageCheck },
+          { id: 'todo' as const, label: t('todo.subtab.todo'), icon: ListTodo },
+        ]).map(tab => (
+          <button key={tab.id} onClick={() => setSubTabPersist(tab.id)}
+            style={{
+              display: 'flex', alignItems: 'center', gap: 5, fontSize: 12, fontWeight: 500, padding: '8px 14px',
+              border: 'none', cursor: 'pointer', fontFamily: 'inherit', background: 'none',
+              color: subTab === tab.id ? 'var(--text-primary)' : 'var(--text-faint)',
+              borderBottom: subTab === tab.id ? '2px solid var(--text-primary)' : '2px solid transparent',
+              marginBottom: -1, transition: 'color 0.15s',
+            }}>
+            <tab.icon size={14} />
+            {tab.label}
+          </button>
+        ))}
+      </div>
+      {subTab === 'packing' && <PackingListPanel tripId={tripId} items={packingItems} />}
+      {subTab === 'todo' && <TodoListPanel tripId={tripId} items={todoItems} />}
+    </div>
+  )
+}
 
 export default function TripPlannerPage(): React.ReactElement | null {
   const { id: tripId } = useParams<{ id: string }>()
@@ -44,6 +78,7 @@ export default function TripPlannerPage(): React.ReactElement | null {
   const places = useTripStore(s => s.places)
   const assignments = useTripStore(s => s.assignments)
   const packingItems = useTripStore(s => s.packingItems)
+  const todoItems = useTripStore(s => s.todoItems)
   const categories = useTripStore(s => s.categories)
   const reservations = useTripStore(s => s.reservations)
   const budgetItems = useTripStore(s => s.budgetItems)
@@ -90,7 +125,7 @@ export default function TripPlannerPage(): React.ReactElement | null {
   const TRIP_TABS = [
     { id: 'plan', label: t('trip.tabs.plan'), icon: Map },
     { id: 'buchungen', label: t('trip.tabs.reservations'), shortLabel: t('trip.tabs.reservationsShort'), icon: Ticket },
-    ...(enabledAddons.packing ? [{ id: 'packliste', label: t('trip.tabs.packing'), shortLabel: t('trip.tabs.packingShort'), icon: PackageCheck }] : []),
+    ...(enabledAddons.packing ? [{ id: 'listen', label: t('trip.tabs.lists'), shortLabel: t('trip.tabs.listsShort'), icon: PackageCheck }] : []),
     ...(enabledAddons.budget ? [{ id: 'finanzplan', label: t('trip.tabs.budget'), icon: Wallet }] : []),
     ...(enabledAddons.documents ? [{ id: 'dateien', label: t('trip.tabs.files'), icon: FolderOpen }] : []),
     ...(enabledAddons.memories ? [{ id: 'memories', label: t('memories.title'), icon: Camera }] : []),
@@ -863,9 +898,9 @@ export default function TripPlannerPage(): React.ReactElement | null {
           </div>
         )}
 
-        {activeTab === 'packliste' && (
-          <div style={{ height: '100%', overflowY: 'auto', overscrollBehavior: 'contain', maxWidth: 1200, margin: '0 auto', width: '100%', padding: '8px 0' }}>
-            <PackingListPanel tripId={tripId} items={packingItems} />
+        {activeTab === 'listen' && (
+          <div style={{ height: '100%', overflowY: 'auto', overscrollBehavior: 'contain', maxWidth: 1800, margin: '0 auto', width: '100%', padding: '8px 0' }}>
+            <ListsContainer tripId={tripId} packingItems={packingItems} todoItems={todoItems} />
           </div>
         )}
 

client/src/store/slices/remoteEventHandler.ts

@@ -1,6 +1,6 @@
 import type { StoreApi } from 'zustand'
 import type { TripStoreState } from '../tripStore'
-import type { Assignment, Place, Day, DayNote, PackingItem, BudgetItem, BudgetMember, Reservation, Trip, TripFile, WebSocketEvent } from '../../types'
+import type { Assignment, Place, Day, DayNote, PackingItem, TodoItem, BudgetItem, BudgetMember, Reservation, Trip, TripFile, WebSocketEvent } from '../../types'
 
 type SetState = StoreApi<TripStoreState>['setState']
 
@@ -175,6 +175,19 @@ export function handleRemoteEvent(set: SetState, event: WebSocketEvent): void {
           packingItems: state.packingItems.filter(i => i.id !== payload.itemId),
         }
 
+      // Todo
+      case 'todo:created':
+        if (state.todoItems.some(i => i.id === (payload.item as TodoItem).id)) return {}
+        return { todoItems: [...state.todoItems, payload.item as TodoItem] }
+      case 'todo:updated':
+        return {
+          todoItems: state.todoItems.map(i => i.id === (payload.item as TodoItem).id ? payload.item as TodoItem : i),
+        }
+      case 'todo:deleted':
+        return {
+          todoItems: state.todoItems.filter(i => i.id !== payload.itemId),
+        }
+
       // Budget
       case 'budget:created':
         if (state.budgetItems.some(i => i.id === (payload.item as BudgetItem).id)) return {}

client/src/store/slices/todoSlice.ts

@@ -0,0 +1,67 @@
+import { todoApi } from '../../api/client'
+import type { StoreApi } from 'zustand'
+import type { TripStoreState } from '../tripStore'
+import type { TodoItem } from '../../types'
+import { getApiErrorMessage } from '../../types'
+
+type SetState = StoreApi<TripStoreState>['setState']
+type GetState = StoreApi<TripStoreState>['getState']
+
+export interface TodoSlice {
+  addTodoItem: (tripId: number | string, data: Partial<TodoItem>) => Promise<TodoItem>
+  updateTodoItem: (tripId: number | string, id: number, data: Partial<TodoItem>) => Promise<TodoItem>
+  deleteTodoItem: (tripId: number | string, id: number) => Promise<void>
+  toggleTodoItem: (tripId: number | string, id: number, checked: boolean) => Promise<void>
+}
+
+export const createTodoSlice = (set: SetState, get: GetState): TodoSlice => ({
+  addTodoItem: async (tripId, data) => {
+    try {
+      const result = await todoApi.create(tripId, data)
+      set(state => ({ todoItems: [...state.todoItems, result.item] }))
+      return result.item
+    } catch (err: unknown) {
+      throw new Error(getApiErrorMessage(err, 'Error adding todo'))
+    }
+  },
+
+  updateTodoItem: async (tripId, id, data) => {
+    try {
+      const result = await todoApi.update(tripId, id, data)
+      set(state => ({
+        todoItems: state.todoItems.map(item => item.id === id ? result.item : item)
+      }))
+      return result.item
+    } catch (err: unknown) {
+      throw new Error(getApiErrorMessage(err, 'Error updating todo'))
+    }
+  },
+
+  deleteTodoItem: async (tripId, id) => {
+    const prev = get().todoItems
+    set(state => ({ todoItems: state.todoItems.filter(item => item.id !== id) }))
+    try {
+      await todoApi.delete(tripId, id)
+    } catch (err: unknown) {
+      set({ todoItems: prev })
+      throw new Error(getApiErrorMessage(err, 'Error deleting todo'))
+    }
+  },
+
+  toggleTodoItem: async (tripId, id, checked) => {
+    set(state => ({
+      todoItems: state.todoItems.map(item =>
+        item.id === id ? { ...item, checked: checked ? 1 : 0 } : item
+      )
+    }))
+    try {
+      await todoApi.update(tripId, id, { checked })
+    } catch {
+      set(state => ({
+        todoItems: state.todoItems.map(item =>
+          item.id === id ? { ...item, checked: checked ? 0 : 1 } : item
+        )
+      }))
+    }
+  },
+})

client/src/store/tripStore.ts

@@ -1,16 +1,17 @@
 import { create } from 'zustand'
 import type { StoreApi } from 'zustand'
-import { tripsApi, daysApi, placesApi, packingApi, tagsApi, categoriesApi } from '../api/client'
+import { tripsApi, daysApi, placesApi, packingApi, todoApi, tagsApi, categoriesApi } from '../api/client'
 import { createPlacesSlice } from './slices/placesSlice'
 import { createAssignmentsSlice } from './slices/assignmentsSlice'
 import { createDayNotesSlice } from './slices/dayNotesSlice'
 import { createPackingSlice } from './slices/packingSlice'
+import { createTodoSlice } from './slices/todoSlice'
 import { createBudgetSlice } from './slices/budgetSlice'
 import { createReservationsSlice } from './slices/reservationsSlice'
 import { createFilesSlice } from './slices/filesSlice'
 import { handleRemoteEvent } from './slices/remoteEventHandler'
 import type {
-  Trip, Day, Place, Assignment, DayNote, PackingItem,
+  Trip, Day, Place, Assignment, DayNote, PackingItem, TodoItem,
   Tag, Category, BudgetItem, TripFile, Reservation,
   AssignmentsMap, DayNotesMap, WebSocketEvent,
 } from '../types'
@@ -19,6 +20,7 @@ import type { PlacesSlice } from './slices/placesSlice'
 import type { AssignmentsSlice } from './slices/assignmentsSlice'
 import type { DayNotesSlice } from './slices/dayNotesSlice'
 import type { PackingSlice } from './slices/packingSlice'
+import type { TodoSlice } from './slices/todoSlice'
 import type { BudgetSlice } from './slices/budgetSlice'
 import type { ReservationsSlice } from './slices/reservationsSlice'
 import type { FilesSlice } from './slices/filesSlice'
@@ -28,6 +30,7 @@ export interface TripStoreState
     AssignmentsSlice,
     DayNotesSlice,
     PackingSlice,
+    TodoSlice,
     BudgetSlice,
     ReservationsSlice,
     FilesSlice {
@@ -37,6 +40,7 @@ export interface TripStoreState
   assignments: AssignmentsMap
   dayNotes: DayNotesMap
   packingItems: PackingItem[]
+  todoItems: TodoItem[]
   tags: Tag[]
   categories: Category[]
   budgetItems: BudgetItem[]
@@ -62,6 +66,7 @@ export const useTripStore = create<TripStoreState>((set, get) => ({
   assignments: {},
   dayNotes: {},
   packingItems: [],
+  todoItems: [],
   tags: [],
   categories: [],
   budgetItems: [],
@@ -78,11 +83,12 @@ export const useTripStore = create<TripStoreState>((set, get) => ({
   loadTrip: async (tripId: number | string) => {
     set({ isLoading: true, error: null })
     try {
-      const [tripData, daysData, placesData, packingData, tagsData, categoriesData] = await Promise.all([
+      const [tripData, daysData, placesData, packingData, todoData, tagsData, categoriesData] = await Promise.all([
         tripsApi.get(tripId),
         daysApi.list(tripId),
         placesApi.list(tripId),
         packingApi.list(tripId),
+        todoApi.list(tripId),
         tagsApi.list(),
         categoriesApi.list(),
       ])
@@ -101,6 +107,7 @@ export const useTripStore = create<TripStoreState>((set, get) => ({
         assignments: assignmentsMap,
         dayNotes: dayNotesMap,
         packingItems: packingData.items,
+        todoItems: todoData.items,
         tags: tagsData.tags,
         categories: categoriesData.categories,
         isLoading: false,
@@ -169,6 +176,7 @@ export const useTripStore = create<TripStoreState>((set, get) => ({
   ...createAssignmentsSlice(set, get),
   ...createDayNotesSlice(set, get),
   ...createPackingSlice(set, get),
+  ...createTodoSlice(set, get),
   ...createBudgetSlice(set, get),
   ...createReservationsSlice(set, get),
   ...createFilesSlice(set, get),

client/src/types.ts

@@ -86,6 +86,19 @@ export interface PackingItem {
   quantity: number
 }
 
+export interface TodoItem {
+  id: number
+  trip_id: number
+  name: string
+  category: string | null
+  checked: number
+  sort_order: number
+  due_date: string | null
+  description: string | null
+  assigned_user_id: number | null
+  priority: number
+}
+
 export interface Tag {
   id: number
   name: string

docker-compose.yml

@@ -34,7 +34,7 @@ services:
 #      - OIDC_ONLY=false # Set true to disable local password auth entirely (SSO only)
 #      - OIDC_ADMIN_CLAIM=groups # OIDC claim used to identify admin users
 #      - OIDC_ADMIN_VALUE=app-trek-admins # Value of the OIDC claim that grants admin role
-#      - OIDC_SCOPE=openid email profile groups # Space-separated OIDC scopes to request (must include scopes for any claim used by OIDC_ADMIN_CLAIM)
+#      - OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes as needed (e.g. add groups if using OIDC_ADMIN_CLAIM)
 #      - OIDC_DISCOVERY_URL= # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik)
 #      - ADMIN_EMAIL=admin@trek.local # Initial admin e-mail — only used on first boot when no users exist
 #      - ADMIN_PASSWORD=changeme      # Initial admin password — only used on first boot when no users exist

server/.env.example

@@ -24,7 +24,7 @@ OIDC_ONLY=true # Disable local password auth entirely (SSO only)
 OIDC_ADMIN_CLAIM=groups # OIDC claim used to identify admin users
 OIDC_ADMIN_VALUE=app-trek-admins # Value of the OIDC claim that grants admin role
 OIDC_DISCOVERY_URL= # Override the auto-constructed OIDC discovery endpoint. Useful for providers (e.g. Authentik) that expose it at a non-standard path. Example: https://auth.example.com/application/o/trek/.well-known/openid-configuration
-OIDC_SCOPE=openid email profile groups # Space-separated OIDC scopes to request (must include scopes for any claim used by OIDC_ADMIN_CLAIM)
+OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes as needed (e.g. add groups if using OIDC_ADMIN_CLAIM)
 
 DEMO_MODE=false # Demo mode - resets data hourly
 

server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "trek-server",
-  "version": "2.7.2",
+  "version": "2.8.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trek-server",
-      "version": "2.7.2",
+      "version": "2.8.4",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.28.0",
         "archiver": "^6.0.1",
@@ -1224,9 +1224,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1241,9 +1238,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1258,9 +1252,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1275,9 +1266,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1292,9 +1280,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1309,9 +1294,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1326,9 +1308,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1343,9 +1322,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1360,9 +1336,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1377,9 +1350,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1394,9 +1364,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1411,9 +1378,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1428,9 +1392,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [

server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trek-server",
-  "version": "2.7.2",
+  "version": "2.8.4",
   "main": "src/index.ts",
   "scripts": {
     "start": "node --import tsx src/index.ts",

server/src/app.ts

@@ -18,6 +18,7 @@ import daysRoutes, { accommodationsRouter as accommodationsRoutes } from './rout
 import placesRoutes from './routes/places';
 import assignmentsRoutes from './routes/assignments';
 import packingRoutes from './routes/packing';
+import todoRoutes from './routes/todo';
 import tagsRoutes from './routes/tags';
 import categoriesRoutes from './routes/categories';
 import adminRoutes from './routes/admin';
@@ -180,6 +181,7 @@ export function createApp(): express.Application {
   app.use('/api/trips/:tripId/accommodations', accommodationsRoutes);
   app.use('/api/trips/:tripId/places', placesRoutes);
   app.use('/api/trips/:tripId/packing', packingRoutes);
+  app.use('/api/trips/:tripId/todo', todoRoutes);
   app.use('/api/trips/:tripId/files', filesRoutes);
   app.use('/api/trips/:tripId/budget', budgetRoutes);
   app.use('/api/trips/:tripId/collab', collabRoutes);

server/src/db/migrations.ts

@@ -701,6 +701,38 @@ function runMigrations(db: Database.Database): void {
       db.exec('ALTER TABLE `trip_album_links` ADD COLUMN provider TEXT NOT NULL DEFAULT "immich"');
       db.exec('ALTER TABLE `trip_album_links` RENAME COLUMN immich_album_id TO album_id');
     },
+    () => {
+      // Track which album link each photo was synced from
+      try { db.exec("ALTER TABLE trip_photos ADD COLUMN album_link_id INTEGER REFERENCES trip_album_links(id) ON DELETE SET NULL DEFAULT NULL"); } catch (err: any) { if (!err.message?.includes('duplicate column name')) throw err; }
+      db.exec('CREATE INDEX IF NOT EXISTS idx_trip_photos_album_link ON trip_photos(album_link_id)');
+    },
+    // Migration 68: Todo items
+    () => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS todo_items (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
+          name TEXT NOT NULL,
+          checked INTEGER DEFAULT 0,
+          category TEXT,
+          sort_order INTEGER DEFAULT 0,
+          due_date TEXT,
+          description TEXT,
+          assigned_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+          priority INTEGER DEFAULT 0,
+          created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE INDEX IF NOT EXISTS idx_todo_items_trip_id ON todo_items(trip_id);
+
+        CREATE TABLE IF NOT EXISTS todo_category_assignees (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          trip_id INTEGER NOT NULL REFERENCES trips(id) ON DELETE CASCADE,
+          category_name TEXT NOT NULL,
+          user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          UNIQUE(trip_id, category_name, user_id)
+        );
+      `);
+    },
   ];
 
   if (currentVersion < migrations.length) {

server/src/db/seeds.ts

@@ -82,7 +82,7 @@ function seedCategories(db: Database.Database): void {
 function seedAddons(db: Database.Database): void {
   try {
     const defaultAddons = [
-      { id: 'packing', name: 'Packing List', description: 'Pack your bags with checklists per trip', type: 'trip', icon: 'ListChecks', enabled: 1, sort_order: 0 },
+      { id: 'packing', name: 'Lists', description: 'Packing lists and to-do tasks for your trips', type: 'trip', icon: 'ListChecks', enabled: 1, sort_order: 0 },
       { id: 'budget', name: 'Budget Planner', description: 'Track expenses and plan your travel budget', type: 'trip', icon: 'Wallet', enabled: 1, sort_order: 1 },
       { id: 'documents', name: 'Documents', description: 'Store and manage travel documents', type: 'trip', icon: 'FileText', enabled: 1, sort_order: 2 },
       { id: 'vacay', name: 'Vacay', description: 'Personal vacation day planner with calendar view', type: 'global', icon: 'CalendarDays', enabled: 1, sort_order: 10 },

server/src/mcp/index.ts

@@ -1,11 +1,10 @@
 import { Request, Response } from 'express';
-import { randomUUID, createHash } from 'crypto';
-import jwt from 'jsonwebtoken';
+import { randomUUID } from 'crypto';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp';
-import { JWT_SECRET } from '../config';
-import { db } from '../db/database';
 import { User } from '../types';
+import { verifyMcpToken, verifyJwtToken } from '../services/authService';
+import { isAddonEnabled } from '../services/adminService';
 import { registerResources } from './resources';
 import { registerTools } from './tools';
 
@@ -74,36 +73,15 @@ function verifyToken(authHeader: string | undefined): User | null {
 
   // Long-lived MCP API token (trek_...)
   if (token.startsWith('trek_')) {
-    const hash = createHash('sha256').update(token).digest('hex');
-    const row = db.prepare(`
-      SELECT u.id, u.username, u.email, u.role
-      FROM mcp_tokens mt
-      JOIN users u ON mt.user_id = u.id
-      WHERE mt.token_hash = ?
-    `).get(hash) as User | undefined;
-    if (row) {
-      // Update last_used_at (fire-and-forget, non-blocking)
-      db.prepare('UPDATE mcp_tokens SET last_used_at = CURRENT_TIMESTAMP WHERE token_hash = ?').run(hash);
-      return row;
-    }
-    return null;
+    return verifyMcpToken(token);
   }
 
   // Short-lived JWT
-  try {
-    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
-    const user = db.prepare(
-      'SELECT id, username, email, role FROM users WHERE id = ?'
-    ).get(decoded.id) as User | undefined;
-    return user || null;
-  } catch {
-    return null;
-  }
+  return verifyJwtToken(token);
 }
 
 export async function mcpHandler(req: Request, res: Response): Promise<void> {
-  const mcpAddon = db.prepare("SELECT enabled FROM addons WHERE id = 'mcp'").get() as { enabled: number } | undefined;
-  if (!mcpAddon || !mcpAddon.enabled) {
+  if (!isAddonEnabled('mcp')) {
     res.status(403).json({ error: 'MCP is not enabled' });
     return;
   }

server/src/mcp/resources.ts

@@ -1,16 +1,15 @@
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp';
-import { db, canAccessTrip } from '../db/database';
-
-const TRIP_SELECT = `
-  SELECT t.*,
-    (SELECT COUNT(*) FROM days d WHERE d.trip_id = t.id) as day_count,
-    (SELECT COUNT(*) FROM places p WHERE p.trip_id = t.id) as place_count,
-    CASE WHEN t.user_id = :userId THEN 1 ELSE 0 END as is_owner,
-    u.username as owner_username,
-    (SELECT COUNT(*) FROM trip_members tm WHERE tm.trip_id = t.id) as shared_count
-  FROM trips t
-  JOIN users u ON u.id = t.user_id
-`;
+import { canAccessTrip } from '../db/database';
+import { listTrips, getTrip, getTripOwner, listMembers } from '../services/tripService';
+import { listDays, listAccommodations } from '../services/dayService';
+import { listPlaces } from '../services/placeService';
+import { listBudgetItems } from '../services/budgetService';
+import { listItems as listPackingItems } from '../services/packingService';
+import { listReservations } from '../services/reservationService';
+import { listNotes as listDayNotes } from '../services/dayNoteService';
+import { listNotes as listCollabNotes } from '../services/collabService';
+import { listCategories } from '../services/categoryService';
+import { listBucketList, listVisitedCountries } from '../services/atlasService';
 
 function parseId(value: string | string[]): number | null {
   const n = Number(Array.isArray(value) ? value[0] : value);
@@ -44,12 +43,7 @@ export function registerResources(server: McpServer, userId: number): void {
     'trek://trips',
     { description: 'All trips the user owns or is a member of' },
     async (uri) => {
-      const trips = db.prepare(`
-        ${TRIP_SELECT}
-        LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = :userId
-        WHERE (t.user_id = :userId OR m.user_id IS NOT NULL) AND t.is_archived = 0
-        ORDER BY t.created_at DESC
-      `).all({ userId });
+      const trips = listTrips(userId, 0);
       return jsonContent(uri.href, trips);
     }
   );
@@ -62,11 +56,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const trip = db.prepare(`
-        ${TRIP_SELECT}
-        LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = :userId
-        WHERE t.id = :tripId AND (t.user_id = :userId OR m.user_id IS NOT NULL)
-      `).get({ userId, tripId: id });
+      const trip = getTrip(id, userId);
       return jsonContent(uri.href, trip);
     }
   );
@@ -80,35 +70,8 @@ export function registerResources(server: McpServer, userId: number): void {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
 
-      const days = db.prepare(
-        'SELECT * FROM days WHERE trip_id = ? ORDER BY day_number ASC'
-      ).all(id) as { id: number; day_number: number; date: string | null; title: string | null; notes: string | null }[];
-
-      const dayIds = days.map(d => d.id);
-      const assignmentsByDay: Record<number, unknown[]> = {};
-
-      if (dayIds.length > 0) {
-        const placeholders = dayIds.map(() => '?').join(',');
-        const assignments = db.prepare(`
-          SELECT da.id, da.day_id, da.order_index, da.notes as assignment_notes,
-            p.id as place_id, p.name, p.address, p.lat, p.lng, p.category_id,
-            COALESCE(da.assignment_time, p.place_time) as place_time,
-            c.name as category_name, c.color as category_color, c.icon as category_icon
-          FROM day_assignments da
-          JOIN places p ON da.place_id = p.id
-          LEFT JOIN categories c ON p.category_id = c.id
-          WHERE da.day_id IN (${placeholders})
-          ORDER BY da.order_index ASC, da.created_at ASC
-        `).all(...dayIds) as (Record<string, unknown> & { day_id: number })[];
-
-        for (const a of assignments) {
-          if (!assignmentsByDay[a.day_id]) assignmentsByDay[a.day_id] = [];
-          assignmentsByDay[a.day_id].push(a);
-        }
-      }
-
-      const result = days.map(d => ({ ...d, assignments: assignmentsByDay[d.id] || [] }));
-      return jsonContent(uri.href, result);
+      const { days } = listDays(id);
+      return jsonContent(uri.href, days);
     }
   );
 
@@ -120,13 +83,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const places = db.prepare(`
-        SELECT p.*, c.name as category_name, c.color as category_color, c.icon as category_icon
-        FROM places p
-        LEFT JOIN categories c ON p.category_id = c.id
-        WHERE p.trip_id = ?
-        ORDER BY p.created_at DESC
-      `).all(id);
+      const places = listPlaces(String(id), {});
       return jsonContent(uri.href, places);
     }
   );
@@ -139,9 +96,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const items = db.prepare(
-        'SELECT * FROM budget_items WHERE trip_id = ? ORDER BY category ASC, created_at ASC'
-      ).all(id);
+      const items = listBudgetItems(id);
       return jsonContent(uri.href, items);
     }
   );
@@ -154,9 +109,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const items = db.prepare(
-        'SELECT * FROM packing_items WHERE trip_id = ? ORDER BY sort_order ASC, created_at ASC'
-      ).all(id);
+      const items = listPackingItems(id);
       return jsonContent(uri.href, items);
     }
   );
@@ -169,14 +122,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const reservations = db.prepare(`
-        SELECT r.*, d.day_number, p.name as place_name
-        FROM reservations r
-        LEFT JOIN days d ON r.day_id = d.id
-        LEFT JOIN places p ON r.place_id = p.id
-        WHERE r.trip_id = ?
-        ORDER BY r.reservation_time ASC, r.created_at ASC
-      `).all(id);
+      const reservations = listReservations(id);
       return jsonContent(uri.href, reservations);
     }
   );
@@ -190,9 +136,7 @@ export function registerResources(server: McpServer, userId: number): void {
       const tId = parseId(tripId);
       const dId = parseId(dayId);
       if (tId === null || dId === null || !canAccessTrip(tId, userId)) return accessDenied(uri.href);
-      const notes = db.prepare(
-        'SELECT * FROM day_notes WHERE day_id = ? AND trip_id = ? ORDER BY sort_order ASC, created_at ASC'
-      ).all(dId, tId);
+      const notes = listDayNotes(dId, tId);
       return jsonContent(uri.href, notes);
     }
   );
@@ -205,16 +149,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const accommodations = db.prepare(`
-        SELECT da.*, p.name as place_name, p.address as place_address, p.lat, p.lng,
-          ds.day_number as start_day_number, de.day_number as end_day_number
-        FROM day_accommodations da
-        JOIN places p ON da.place_id = p.id
-        LEFT JOIN days ds ON da.start_day_id = ds.id
-        LEFT JOIN days de ON da.end_day_id = de.id
-        WHERE da.trip_id = ?
-        ORDER BY ds.day_number ASC
-      `).all(id);
+      const accommodations = listAccommodations(id);
       return jsonContent(uri.href, accommodations);
     }
   );
@@ -227,20 +162,10 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const trip = db.prepare('SELECT user_id FROM trips WHERE id = ?').get(id) as { user_id: number } | undefined;
-      if (!trip) return accessDenied(uri.href);
-      const owner = db.prepare('SELECT id, username, avatar FROM users WHERE id = ?').get(trip.user_id) as Record<string, unknown> | undefined;
-      const members = db.prepare(`
-        SELECT u.id, u.username, u.avatar, tm.added_at
-        FROM trip_members tm
-        JOIN users u ON tm.user_id = u.id
-        WHERE tm.trip_id = ?
-        ORDER BY tm.added_at ASC
-      `).all(id);
-      return jsonContent(uri.href, {
-        owner: owner ? { ...owner, role: 'owner' } : null,
-        members,
-      });
+      const ownerRow = getTripOwner(id);
+      if (!ownerRow) return accessDenied(uri.href);
+      const { owner, members } = listMembers(id, ownerRow.user_id);
+      return jsonContent(uri.href, { owner, members });
     }
   );
 
@@ -252,13 +177,7 @@ export function registerResources(server: McpServer, userId: number): void {
     async (uri, { tripId }) => {
       const id = parseId(tripId);
       if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const notes = db.prepare(`
-        SELECT cn.*, u.username
-        FROM collab_notes cn
-        JOIN users u ON cn.user_id = u.id
-        WHERE cn.trip_id = ?
-        ORDER BY cn.pinned DESC, cn.updated_at DESC
-      `).all(id);
+      const notes = listCollabNotes(id);
       return jsonContent(uri.href, notes);
     }
   );
@@ -269,9 +188,7 @@ export function registerResources(server: McpServer, userId: number): void {
     'trek://categories',
     { description: 'All available place categories (id, name, color, icon) for use when creating places' },
     async (uri) => {
-      const categories = db.prepare(
-        'SELECT id, name, color, icon FROM categories ORDER BY name ASC'
-      ).all();
+      const categories = listCategories();
       return jsonContent(uri.href, categories);
     }
   );
@@ -282,9 +199,7 @@ export function registerResources(server: McpServer, userId: number): void {
     'trek://bucket-list',
     { description: 'Your personal travel bucket list' },
     async (uri) => {
-      const items = db.prepare(
-        'SELECT * FROM bucket_list WHERE user_id = ? ORDER BY created_at DESC'
-      ).all(userId);
+      const items = listBucketList(userId);
       return jsonContent(uri.href, items);
     }
   );
@@ -295,9 +210,7 @@ export function registerResources(server: McpServer, userId: number): void {
     'trek://visited-countries',
     { description: 'Countries you have marked as visited in Atlas' },
     async (uri) => {
-      const countries = db.prepare(
-        'SELECT country_code, created_at FROM visited_countries WHERE user_id = ? ORDER BY created_at DESC'
-      ).all(userId);
+      const countries = listVisitedCountries(userId);
       return jsonContent(uri.href, countries);
     }
   );

server/src/mcp/tools.ts

@@ -1,18 +1,29 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { z } from 'zod';
-import path from 'path';
-import fs from 'fs';
-import { db, canAccessTrip, isOwner } from '../db/database';
+import { canAccessTrip } from '../db/database';
 import { broadcast } from '../websocket';
+import { isDemoUser } from '../services/authService';
+import {
+  listTrips, createTrip, updateTrip, deleteTrip, getTripSummary,
+  isOwner, verifyTripAccess,
+} from '../services/tripService';
+import { listPlaces, createPlace, updatePlace, deletePlace } from '../services/placeService';
+import { listCategories } from '../services/categoryService';
+import {
+  dayExists, placeExists, createAssignment, assignmentExistsInDay,
+  deleteAssignment, reorderAssignments, getAssignmentForTrip, updateTime,
+} from '../services/assignmentService';
+import { createBudgetItem, updateBudgetItem, deleteBudgetItem } from '../services/budgetService';
+import { createItem as createPackingItem, updateItem as updatePackingItem, deleteItem as deletePackingItem } from '../services/packingService';
+import { createReservation, getReservation, updateReservation, deleteReservation } from '../services/reservationService';
+import { getDay, updateDay, validateAccommodationRefs } from '../services/dayService';
+import { createNote as createDayNote, getNote as getDayNote, updateNote as updateDayNote, deleteNote as deleteDayNote, dayExists as dayNoteExists } from '../services/dayNoteService';
+import { createNote as createCollabNote, updateNote as updateCollabNote, deleteNote as deleteCollabNote } from '../services/collabService';
+import {
+  markCountryVisited, unmarkCountryVisited, createBucketItem, deleteBucketItem,
+} from '../services/atlasService';
 
-const MS_PER_DAY = 86400000;
-const MAX_TRIP_DAYS = 90;
-
-function isDemoUser(userId: number): boolean {
-  if (process.env.DEMO_MODE !== 'true') return false;
-  const user = db.prepare('SELECT email FROM users WHERE id = ?').get(userId) as { email: string } | undefined;
-  return user?.email === 'demo@nomad.app';
-}
+const MAX_MCP_TRIP_DAYS = 90;
 
 function demoDenied() {
   return { content: [{ type: 'text' as const, text: 'Write operations are disabled in demo mode.' }], isError: true };
@@ -26,25 +37,6 @@ function ok(data: unknown) {
   return { content: [{ type: 'text' as const, text: JSON.stringify(data, null, 2) }] };
 }
 
-/** Create days for a newly created trip (fresh insert, no existing days). */
-function createDaysForNewTrip(tripId: number | bigint, startDate: string | null, endDate: string | null): void {
-  const insert = db.prepare('INSERT INTO days (trip_id, day_number, date) VALUES (?, ?, ?)');
-  if (startDate && endDate) {
-    const [sy, sm, sd] = startDate.split('-').map(Number);
-    const [ey, em, ed] = endDate.split('-').map(Number);
-    const startMs = Date.UTC(sy, sm - 1, sd);
-    const endMs = Date.UTC(ey, em - 1, ed);
-    const numDays = Math.min(Math.floor((endMs - startMs) / MS_PER_DAY) + 1, MAX_TRIP_DAYS);
-    for (let i = 0; i < numDays; i++) {
-      const d = new Date(startMs + i * MS_PER_DAY);
-      const date = `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}-${String(d.getUTCDate()).padStart(2, '0')}`;
-      insert.run(tripId, i + 1, date);
-    }
-  } else {
-    for (let i = 0; i < 7; i++) insert.run(tripId, i + 1, null);
-  }
-}
-
 export function registerTools(server: McpServer, userId: number): void {
   // --- TRIPS ---
 
@@ -75,14 +67,7 @@ export function registerTools(server: McpServer, userId: number): void {
       if (start_date && end_date && new Date(end_date) < new Date(start_date)) {
         return { content: [{ type: 'text' as const, text: 'End date must be after start date.' }], isError: true };
       }
-      const trip = db.transaction(() => {
-        const result = db.prepare(
-          'INSERT INTO trips (user_id, title, description, start_date, end_date, currency) VALUES (?, ?, ?, ?, ?, ?)'
-        ).run(userId, title, description || null, start_date || null, end_date || null, currency || 'EUR');
-        const tripId = result.lastInsertRowid as number;
-        createDaysForNewTrip(tripId, start_date || null, end_date || null);
-        return db.prepare('SELECT * FROM trips WHERE id = ?').get(tripId);
-      })();
+      const { trip } = createTrip(userId, { title, description, start_date, end_date, currency }, MAX_MCP_TRIP_DAYS);
       return ok({ trip });
     }
   );
@@ -113,21 +98,9 @@ export function registerTools(server: McpServer, userId: number): void {
         if (isNaN(d.getTime()) || d.toISOString().slice(0, 10) !== end_date)
           return { content: [{ type: 'text' as const, text: 'end_date is not a valid calendar date.' }], isError: true };
       }
-      const existing = db.prepare('SELECT * FROM trips WHERE id = ?').get(tripId) as Record<string, unknown> & { title: string; description: string; start_date: string; end_date: string; currency: string } | undefined;
-      if (!existing) return noAccess();
-      db.prepare(
-        'UPDATE trips SET title = ?, description = ?, start_date = ?, end_date = ?, currency = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?'
-      ).run(
-        title ?? existing.title,
-        description !== undefined ? description : existing.description,
-        start_date !== undefined ? start_date : existing.start_date,
-        end_date !== undefined ? end_date : existing.end_date,
-        currency ?? existing.currency,
-        tripId
-      );
-      const updated = db.prepare('SELECT * FROM trips WHERE id = ?').get(tripId);
-      broadcast(tripId, 'trip:updated', { trip: updated });
-      return ok({ trip: updated });
+      const { updatedTrip } = updateTrip(tripId, userId, { title, description, start_date, end_date, currency }, 'user');
+      broadcast(tripId, 'trip:updated', { trip: updatedTrip });
+      return ok({ trip: updatedTrip });
     }
   );
 
@@ -142,7 +115,7 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!isOwner(tripId, userId)) return noAccess();
-      db.prepare('DELETE FROM trips WHERE id = ?').run(tripId);
+      deleteTrip(tripId, userId, 'user');
       return ok({ success: true, tripId });
     }
   );
@@ -156,18 +129,7 @@ export function registerTools(server: McpServer, userId: number): void {
       },
     },
     async ({ include_archived }) => {
-      const trips = db.prepare(`
-        SELECT t.*, u.username as owner_username,
-          (SELECT COUNT(*) FROM days d WHERE d.trip_id = t.id) as day_count,
-          (SELECT COUNT(*) FROM places p WHERE p.trip_id = t.id) as place_count,
-          CASE WHEN t.user_id = ? THEN 1 ELSE 0 END as is_owner
-        FROM trips t
-        JOIN users u ON u.id = t.user_id
-        LEFT JOIN trip_members tm ON tm.trip_id = t.id AND tm.user_id = ?
-        WHERE (t.user_id = ? OR tm.user_id IS NOT NULL)
-          AND (? = 1 OR t.is_archived = 0)
-        ORDER BY t.updated_at DESC
-      `).all(userId, userId, userId, include_archived ? 1 : 0);
+      const trips = listTrips(userId, include_archived ? null : 0);
       return ok({ trips });
     }
   );
@@ -196,11 +158,7 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, name, description, lat, lng, address, category_id, google_place_id, osm_id, notes, website, phone }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const result = db.prepare(`
-        INSERT INTO places (trip_id, name, description, lat, lng, address, category_id, google_place_id, osm_id, notes, website, phone, transport_mode)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(tripId, name, description || null, lat ?? null, lng ?? null, address || null, category_id || null, google_place_id || null, osm_id || null, notes || null, website || null, phone || null, 'walking');
-      const place = db.prepare('SELECT * FROM places WHERE id = ?').get(result.lastInsertRowid);
+      const place = createPlace(String(tripId), { name, description, lat, lng, address, category_id, google_place_id, osm_id, notes, website, phone });
       broadcast(tripId, 'place:created', { place });
       return ok({ place });
     }
@@ -226,25 +184,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, placeId, name, description, lat, lng, address, notes, website, phone }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT * FROM places WHERE id = ? AND trip_id = ?').get(placeId, tripId) as Record<string, unknown> | undefined;
-      if (!existing) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
-      db.prepare(`
-        UPDATE places SET
-          name = ?, description = ?, lat = ?, lng = ?, address = ?, notes = ?, website = ?, phone = ?,
-          updated_at = CURRENT_TIMESTAMP
-        WHERE id = ?
-      `).run(
-        name ?? existing.name,
-        description !== undefined ? description : existing.description,
-        lat !== undefined ? lat : existing.lat,
-        lng !== undefined ? lng : existing.lng,
-        address !== undefined ? address : existing.address,
-        notes !== undefined ? notes : existing.notes,
-        website !== undefined ? website : existing.website,
-        phone !== undefined ? phone : existing.phone,
-        placeId
-      );
-      const place = db.prepare('SELECT * FROM places WHERE id = ?').get(placeId);
+      const place = updatePlace(String(tripId), String(placeId), { name, description, lat, lng, address, notes, website, phone });
+      if (!place) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
       broadcast(tripId, 'place:updated', { place });
       return ok({ place });
     }
@@ -262,9 +203,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, placeId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const place = db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(placeId, tripId);
-      if (!place) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
-      db.prepare('DELETE FROM places WHERE id = ?').run(placeId);
+      const deleted = deletePlace(String(tripId), String(placeId));
+      if (!deleted) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
       broadcast(tripId, 'place:deleted', { placeId });
       return ok({ success: true });
     }
@@ -279,7 +219,7 @@ export function registerTools(server: McpServer, userId: number): void {
       inputSchema: {},
     },
     async () => {
-      const categories = db.prepare('SELECT id, name, color, icon FROM categories ORDER BY name ASC').all();
+      const categories = listCategories();
       return ok({ categories });
     }
   );
@@ -333,20 +273,9 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, placeId, notes }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-      if (!day) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
-      const place = db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(placeId, tripId);
-      if (!place) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
-      const maxOrder = db.prepare('SELECT MAX(order_index) as max FROM day_assignments WHERE day_id = ?').get(dayId) as { max: number | null };
-      const orderIndex = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
-      const result = db.prepare(
-        'INSERT INTO day_assignments (day_id, place_id, order_index, notes) VALUES (?, ?, ?, ?)'
-      ).run(dayId, placeId, orderIndex, notes || null);
-      const assignment = db.prepare(`
-        SELECT da.*, p.name as place_name, p.address, p.lat, p.lng
-        FROM day_assignments da JOIN places p ON da.place_id = p.id
-        WHERE da.id = ?
-      `).get(result.lastInsertRowid);
+      if (!dayExists(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
+      if (!placeExists(placeId, tripId)) return { content: [{ type: 'text' as const, text: 'Place not found.' }], isError: true };
+      const assignment = createAssignment(dayId, placeId, notes || null);
       broadcast(tripId, 'assignment:created', { assignment });
       return ok({ assignment });
     }
@@ -365,11 +294,9 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, assignmentId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const assignment = db.prepare(
-        'SELECT da.id FROM day_assignments da JOIN days d ON da.day_id = d.id WHERE da.id = ? AND da.day_id = ? AND d.trip_id = ?'
-      ).get(assignmentId, dayId, tripId);
-      if (!assignment) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
-      db.prepare('DELETE FROM day_assignments WHERE id = ?').run(assignmentId);
+      if (!assignmentExistsInDay(assignmentId, dayId, tripId))
+        return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
+      deleteAssignment(assignmentId);
       broadcast(tripId, 'assignment:deleted', { assignmentId, dayId });
       return ok({ success: true });
     }
@@ -392,12 +319,7 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, name, category, total_price, note }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const maxOrder = db.prepare('SELECT MAX(sort_order) as max FROM budget_items WHERE trip_id = ?').get(tripId) as { max: number | null };
-      const sortOrder = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
-      const result = db.prepare(
-        'INSERT INTO budget_items (trip_id, category, name, total_price, note, sort_order) VALUES (?, ?, ?, ?, ?, ?)'
-      ).run(tripId, category || 'Other', name, total_price, note || null, sortOrder);
-      const item = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(result.lastInsertRowid);
+      const item = createBudgetItem(tripId, { category, name, total_price, note });
       broadcast(tripId, 'budget:created', { item });
       return ok({ item });
     }
@@ -415,9 +337,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, itemId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const item = db.prepare('SELECT id FROM budget_items WHERE id = ? AND trip_id = ?').get(itemId, tripId);
-      if (!item) return { content: [{ type: 'text' as const, text: 'Budget item not found.' }], isError: true };
-      db.prepare('DELETE FROM budget_items WHERE id = ?').run(itemId);
+      const deleted = deleteBudgetItem(itemId, tripId);
+      if (!deleted) return { content: [{ type: 'text' as const, text: 'Budget item not found.' }], isError: true };
       broadcast(tripId, 'budget:deleted', { itemId });
       return ok({ success: true });
     }
@@ -438,12 +359,7 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, name, category }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const maxOrder = db.prepare('SELECT MAX(sort_order) as max FROM packing_items WHERE trip_id = ?').get(tripId) as { max: number | null };
-      const sortOrder = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
-      const result = db.prepare(
-        'INSERT INTO packing_items (trip_id, name, checked, category, sort_order) VALUES (?, ?, ?, ?, ?)'
-      ).run(tripId, name, 0, category || 'General', sortOrder);
-      const item = db.prepare('SELECT * FROM packing_items WHERE id = ?').get(result.lastInsertRowid);
+      const item = createPackingItem(tripId, { name, category: category || 'General' });
       broadcast(tripId, 'packing:created', { item });
       return ok({ item });
     }
@@ -462,12 +378,10 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, itemId, checked }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const item = db.prepare('SELECT id FROM packing_items WHERE id = ? AND trip_id = ?').get(itemId, tripId);
+      const item = updatePackingItem(tripId, itemId, { checked: checked ? 1 : 0 }, ['checked']);
       if (!item) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
-      db.prepare('UPDATE packing_items SET checked = ? WHERE id = ?').run(checked ? 1 : 0, itemId);
-      const updated = db.prepare('SELECT * FROM packing_items WHERE id = ?').get(itemId);
-      broadcast(tripId, 'packing:updated', { item: updated });
-      return ok({ item: updated });
+      broadcast(tripId, 'packing:updated', { item });
+      return ok({ item });
     }
   );
 
@@ -483,9 +397,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, itemId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const item = db.prepare('SELECT id FROM packing_items WHERE id = ? AND trip_id = ?').get(itemId, tripId);
-      if (!item) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
-      db.prepare('DELETE FROM packing_items WHERE id = ?').run(itemId);
+      const deleted = deletePackingItem(tripId, itemId);
+      if (!deleted) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
       broadcast(tripId, 'packing:deleted', { itemId });
       return ok({ success: true });
     }
@@ -519,43 +432,28 @@ export function registerTools(server: McpServer, userId: number): void {
       if (!canAccessTrip(tripId, userId)) return noAccess();
 
       // Validate that all referenced IDs belong to this trip
-      if (day_id) {
-        if (!db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(day_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'day_id does not belong to this trip.' }], isError: true };
-      }
-      if (place_id) {
-        if (!db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(place_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'place_id does not belong to this trip.' }], isError: true };
-      }
-      if (start_day_id) {
-        if (!db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(start_day_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'start_day_id does not belong to this trip.' }], isError: true };
-      }
-      if (end_day_id) {
-        if (!db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(end_day_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'end_day_id does not belong to this trip.' }], isError: true };
-      }
-      if (assignment_id) {
-        if (!db.prepare('SELECT da.id FROM day_assignments da JOIN days d ON da.day_id = d.id WHERE da.id = ? AND d.trip_id = ?').get(assignment_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'assignment_id does not belong to this trip.' }], isError: true };
-      }
+      if (day_id && !getDay(day_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'day_id does not belong to this trip.' }], isError: true };
+      if (place_id && !placeExists(place_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'place_id does not belong to this trip.' }], isError: true };
+      if (start_day_id && !getDay(start_day_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'start_day_id does not belong to this trip.' }], isError: true };
+      if (end_day_id && !getDay(end_day_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'end_day_id does not belong to this trip.' }], isError: true };
+      if (assignment_id && !getAssignmentForTrip(assignment_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'assignment_id does not belong to this trip.' }], isError: true };
 
-      const reservation = db.transaction(() => {
-        let accommodationId: number | null = null;
-        if (type === 'hotel' && place_id && start_day_id && end_day_id) {
-          const accResult = db.prepare(
-            'INSERT INTO day_accommodations (trip_id, place_id, start_day_id, end_day_id, check_in, check_out, confirmation) VALUES (?, ?, ?, ?, ?, ?, ?)'
-          ).run(tripId, place_id, start_day_id, end_day_id, check_in || null, check_out || null, confirmation_number || null);
-          accommodationId = accResult.lastInsertRowid as number;
-        }
-        const result = db.prepare(`
-          INSERT INTO reservations (trip_id, title, type, reservation_time, location, confirmation_number, notes, day_id, place_id, assignment_id, accommodation_id, status)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(tripId, title, type, reservation_time || null, location || null, confirmation_number || null, notes || null, day_id || null, place_id || null, assignment_id || null, accommodationId, 'pending');
-        return db.prepare('SELECT * FROM reservations WHERE id = ?').get(result.lastInsertRowid);
-      })();
+      const createAccommodation = (type === 'hotel' && place_id && start_day_id && end_day_id)
+        ? { place_id, start_day_id, end_day_id, check_in: check_in || undefined, check_out: check_out || undefined, confirmation: confirmation_number || undefined }
+        : undefined;
 
-      if (type === 'hotel' && place_id && start_day_id && end_day_id) {
+      const { reservation, accommodationCreated } = createReservation(tripId, {
+        title, type, reservation_time, location, confirmation_number,
+        notes, day_id, place_id, assignment_id,
+        create_accommodation: createAccommodation,
+      });
+
+      if (accommodationCreated) {
         broadcast(tripId, 'accommodation:created', {});
       }
       broadcast(tripId, 'reservation:created', { reservation });
@@ -575,16 +473,10 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, reservationId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const reservation = db.prepare('SELECT id, accommodation_id FROM reservations WHERE id = ? AND trip_id = ?').get(reservationId, tripId) as { id: number; accommodation_id: number | null } | undefined;
-      if (!reservation) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
-      db.transaction(() => {
-        if (reservation.accommodation_id) {
-          db.prepare('DELETE FROM day_accommodations WHERE id = ?').run(reservation.accommodation_id);
-        }
-        db.prepare('DELETE FROM reservations WHERE id = ?').run(reservationId);
-      })();
-      if (reservation.accommodation_id) {
-        broadcast(tripId, 'accommodation:deleted', { accommodationId: reservation.accommodation_id });
+      const { deleted, accommodationDeleted } = deleteReservation(reservationId, tripId);
+      if (!deleted) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
+      if (accommodationDeleted) {
+        broadcast(tripId, 'accommodation:deleted', { accommodationId: deleted.accommodation_id });
       }
       broadcast(tripId, 'reservation:deleted', { reservationId });
       return ok({ success: true });
@@ -608,36 +500,28 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, reservationId, place_id, start_day_id, end_day_id, check_in, check_out }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const reservation = db.prepare('SELECT * FROM reservations WHERE id = ? AND trip_id = ?').get(reservationId, tripId) as Record<string, unknown> | undefined;
-      if (!reservation) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
-      if (reservation.type !== 'hotel') return { content: [{ type: 'text' as const, text: 'Reservation is not of type hotel.' }], isError: true };
+      const current = getReservation(reservationId, tripId);
+      if (!current) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
+      if (current.type !== 'hotel') return { content: [{ type: 'text' as const, text: 'Reservation is not of type hotel.' }], isError: true };
 
-      if (!db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(place_id, tripId))
+      if (!placeExists(place_id, tripId))
         return { content: [{ type: 'text' as const, text: 'place_id does not belong to this trip.' }], isError: true };
-      if (!db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(start_day_id, tripId))
+      if (!getDay(start_day_id, tripId))
         return { content: [{ type: 'text' as const, text: 'start_day_id does not belong to this trip.' }], isError: true };
-      if (!db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(end_day_id, tripId))
+      if (!getDay(end_day_id, tripId))
         return { content: [{ type: 'text' as const, text: 'end_day_id does not belong to this trip.' }], isError: true };
 
-      let accommodationId = reservation.accommodation_id as number | null;
-      const isNewAccommodation = !accommodationId;
-      db.transaction(() => {
-        if (accommodationId) {
-          db.prepare('UPDATE day_accommodations SET place_id = ?, start_day_id = ?, end_day_id = ?, check_in = COALESCE(?, check_in), check_out = COALESCE(?, check_out) WHERE id = ?')
-            .run(place_id, start_day_id, end_day_id, check_in || null, check_out || null, accommodationId);
-        } else {
-          const accResult = db.prepare(
-            'INSERT INTO day_accommodations (trip_id, place_id, start_day_id, end_day_id, check_in, check_out, confirmation) VALUES (?, ?, ?, ?, ?, ?, ?)'
-          ).run(tripId, place_id, start_day_id, end_day_id, check_in || null, check_out || null, reservation.confirmation_number || null);
-          accommodationId = accResult.lastInsertRowid as number;
-        }
-        db.prepare('UPDATE reservations SET place_id = ?, accommodation_id = ? WHERE id = ?')
-          .run(place_id, accommodationId, reservationId);
-      })();
+      const isNewAccommodation = !current.accommodation_id;
+      const { reservation } = updateReservation(reservationId, tripId, {
+        place_id,
+        type: current.type,
+        status: current.status as string,
+        create_accommodation: { place_id, start_day_id, end_day_id, check_in: check_in || undefined, check_out: check_out || undefined },
+      }, current);
+
       broadcast(tripId, isNewAccommodation ? 'accommodation:created' : 'accommodation:updated', {});
-      const updated = db.prepare('SELECT * FROM reservations WHERE id = ?').get(reservationId);
-      broadcast(tripId, 'reservation:updated', { reservation: updated });
-      return ok({ reservation: updated, accommodation_id: accommodationId });
+      broadcast(tripId, 'reservation:updated', { reservation });
+      return ok({ reservation, accommodation_id: (reservation as any).accommodation_id });
     }
   );
 
@@ -657,28 +541,15 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, assignmentId, place_time, end_time }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const assignment = db.prepare(`
-        SELECT da.* FROM day_assignments da
-        JOIN days d ON da.day_id = d.id
-        WHERE da.id = ? AND d.trip_id = ?
-      `).get(assignmentId, tripId) as Record<string, unknown> | undefined;
-      if (!assignment) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
-      db.prepare('UPDATE day_assignments SET assignment_time = ?, assignment_end_time = ? WHERE id = ?')
-        .run(
-          place_time !== undefined ? place_time : assignment.assignment_time,
-          end_time !== undefined ? end_time : assignment.assignment_end_time,
-          assignmentId
-        );
-      const updated = db.prepare(`
-        SELECT da.id, da.day_id, da.order_index, da.notes as assignment_notes,
-          da.assignment_time, da.assignment_end_time,
-          p.id as place_id, p.name, p.address
-        FROM day_assignments da
-        JOIN places p ON da.place_id = p.id
-        WHERE da.id = ?
-      `).get(assignmentId);
-      broadcast(tripId, 'assignment:updated', { assignment: updated });
-      return ok({ assignment: updated });
+      const existing = getAssignmentForTrip(assignmentId, tripId);
+      if (!existing) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
+      const assignment = updateTime(
+        assignmentId,
+        place_time !== undefined ? place_time : (existing as any).assignment_time,
+        end_time !== undefined ? end_time : (existing as any).assignment_end_time
+      );
+      broadcast(tripId, 'assignment:updated', { assignment });
+      return ok({ assignment });
     }
   );
 
@@ -695,10 +566,9 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, title }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-      if (!day) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
-      db.prepare('UPDATE days SET title = ? WHERE id = ?').run(title, dayId);
-      const updated = db.prepare('SELECT * FROM days WHERE id = ?').get(dayId);
+      const current = getDay(dayId, tripId);
+      if (!current) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
+      const updated = updateDay(dayId, current, title !== undefined ? { title } : {});
       broadcast(tripId, 'day:updated', { day: updated });
       return ok({ day: updated });
     }
@@ -727,39 +597,21 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, reservationId, title, type, reservation_time, location, confirmation_number, notes, status, place_id, assignment_id }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT * FROM reservations WHERE id = ? AND trip_id = ?').get(reservationId, tripId) as Record<string, unknown> | undefined;
+      const existing = getReservation(reservationId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Reservation not found.' }], isError: true };
 
-      if (place_id != null) {
-        if (!db.prepare('SELECT id FROM places WHERE id = ? AND trip_id = ?').get(place_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'place_id does not belong to this trip.' }], isError: true };
-      }
-      if (assignment_id != null) {
-        if (!db.prepare('SELECT da.id FROM day_assignments da JOIN days d ON da.day_id = d.id WHERE da.id = ? AND d.trip_id = ?').get(assignment_id, tripId))
-          return { content: [{ type: 'text' as const, text: 'assignment_id does not belong to this trip.' }], isError: true };
-      }
+      if (place_id != null && !placeExists(place_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'place_id does not belong to this trip.' }], isError: true };
+      if (assignment_id != null && !getAssignmentForTrip(assignment_id, tripId))
+        return { content: [{ type: 'text' as const, text: 'assignment_id does not belong to this trip.' }], isError: true };
 
-      db.prepare(`
-        UPDATE reservations SET
-          title = ?, type = ?, reservation_time = ?, location = ?,
-          confirmation_number = ?, notes = ?, status = ?,
-          place_id = ?, assignment_id = ?
-        WHERE id = ?
-      `).run(
-        title ?? existing.title,
-        type ?? existing.type,
-        reservation_time !== undefined ? reservation_time : existing.reservation_time,
-        location !== undefined ? location : existing.location,
-        confirmation_number !== undefined ? confirmation_number : existing.confirmation_number,
-        notes !== undefined ? notes : existing.notes,
-        status ?? existing.status,
-        place_id !== undefined ? place_id : existing.place_id,
-        assignment_id !== undefined ? assignment_id : existing.assignment_id,
-        reservationId
-      );
-      const updated = db.prepare('SELECT * FROM reservations WHERE id = ?').get(reservationId);
-      broadcast(tripId, 'reservation:updated', { reservation: updated });
-      return ok({ reservation: updated });
+      const { reservation } = updateReservation(reservationId, tripId, {
+        title, type, reservation_time, location, confirmation_number, notes, status,
+        place_id: place_id !== undefined ? place_id ?? undefined : undefined,
+        assignment_id: assignment_id !== undefined ? assignment_id ?? undefined : undefined,
+      }, existing);
+      broadcast(tripId, 'reservation:updated', { reservation });
+      return ok({ reservation });
     }
   );
 
@@ -783,24 +635,10 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, itemId, name, category, total_price, persons, days, note }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT * FROM budget_items WHERE id = ? AND trip_id = ?').get(itemId, tripId) as Record<string, unknown> | undefined;
-      if (!existing) return { content: [{ type: 'text' as const, text: 'Budget item not found.' }], isError: true };
-      db.prepare(`
-        UPDATE budget_items SET
-          name = ?, category = ?, total_price = ?, persons = ?, days = ?, note = ?
-        WHERE id = ?
-      `).run(
-        name ?? existing.name,
-        category ?? existing.category,
-        total_price !== undefined ? total_price : existing.total_price,
-        persons !== undefined ? persons : existing.persons,
-        days !== undefined ? days : existing.days,
-        note !== undefined ? note : existing.note,
-        itemId
-      );
-      const updated = db.prepare('SELECT * FROM budget_items WHERE id = ?').get(itemId);
-      broadcast(tripId, 'budget:updated', { item: updated });
-      return ok({ item: updated });
+      const item = updateBudgetItem(itemId, tripId, { name, category, total_price, persons, days, note });
+      if (!item) return { content: [{ type: 'text' as const, text: 'Budget item not found.' }], isError: true };
+      broadcast(tripId, 'budget:updated', { item });
+      return ok({ item });
     }
   );
 
@@ -820,16 +658,11 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, itemId, name, category }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT * FROM packing_items WHERE id = ? AND trip_id = ?').get(itemId, tripId) as Record<string, unknown> | undefined;
-      if (!existing) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
-      db.prepare('UPDATE packing_items SET name = ?, category = ? WHERE id = ?').run(
-        name ?? existing.name,
-        category ?? existing.category,
-        itemId
-      );
-      const updated = db.prepare('SELECT * FROM packing_items WHERE id = ?').get(itemId);
-      broadcast(tripId, 'packing:updated', { item: updated });
-      return ok({ item: updated });
+      const bodyKeys = ['name', 'category'].filter(k => k === 'name' ? name !== undefined : category !== undefined);
+      const item = updatePackingItem(tripId, itemId, { name, category }, bodyKeys);
+      if (!item) return { content: [{ type: 'text' as const, text: 'Packing item not found.' }], isError: true };
+      broadcast(tripId, 'packing:updated', { item });
+      return ok({ item });
     }
   );
 
@@ -848,13 +681,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, assignmentIds }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-      if (!day) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
-      const update = db.prepare('UPDATE day_assignments SET order_index = ? WHERE id = ? AND day_id = ?');
-      const updateMany = db.transaction((ids: number[]) => {
-        ids.forEach((id, index) => update.run(index, id, dayId));
-      });
-      updateMany(assignmentIds);
+      if (!getDay(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
+      reorderAssignments(dayId, assignmentIds);
       broadcast(tripId, 'assignment:reordered', { dayId, assignmentIds });
       return ok({ success: true, dayId, order: assignmentIds });
     }
@@ -872,106 +700,9 @@ export function registerTools(server: McpServer, userId: number): void {
     },
     async ({ tripId }) => {
       if (!canAccessTrip(tripId, userId)) return noAccess();
-
-      const trip = db.prepare('SELECT * FROM trips WHERE id = ?').get(tripId) as Record<string, unknown> | undefined;
-      if (!trip) return noAccess();
-
-      // Members
-      const owner = db.prepare('SELECT id, username, avatar FROM users WHERE id = ?').get(trip.user_id as number);
-      const members = db.prepare(`
-        SELECT u.id, u.username, u.avatar, tm.added_at
-        FROM trip_members tm JOIN users u ON tm.user_id = u.id
-        WHERE tm.trip_id = ?
-      `).all(tripId);
-
-      // Days with assignments
-      const days = db.prepare('SELECT * FROM days WHERE trip_id = ? ORDER BY day_number ASC').all(tripId) as (Record<string, unknown> & { id: number })[];
-      const dayIds = days.map(d => d.id);
-      const assignmentsByDay: Record<number, unknown[]> = {};
-      if (dayIds.length > 0) {
-        const placeholders = dayIds.map(() => '?').join(',');
-        const assignments = db.prepare(`
-          SELECT da.id, da.day_id, da.order_index, da.notes as assignment_notes,
-            p.id as place_id, p.name, p.address, p.lat, p.lng,
-            COALESCE(da.assignment_time, p.place_time) as place_time,
-            c.name as category_name, c.icon as category_icon
-          FROM day_assignments da
-          JOIN places p ON da.place_id = p.id
-          LEFT JOIN categories c ON p.category_id = c.id
-          WHERE da.day_id IN (${placeholders})
-          ORDER BY da.order_index ASC
-        `).all(...dayIds) as (Record<string, unknown> & { day_id: number })[];
-        for (const a of assignments) {
-          if (!assignmentsByDay[a.day_id]) assignmentsByDay[a.day_id] = [];
-          assignmentsByDay[a.day_id].push(a);
-        }
-      }
-      // Day notes
-      const dayNotesByDay: Record<number, unknown[]> = {};
-      if (dayIds.length > 0) {
-        const placeholders = dayIds.map(() => '?').join(',');
-        const dayNotes = db.prepare(`
-          SELECT * FROM day_notes WHERE day_id IN (${placeholders}) ORDER BY sort_order ASC
-        `).all(...dayIds) as (Record<string, unknown> & { day_id: number })[];
-        for (const n of dayNotes) {
-          if (!dayNotesByDay[n.day_id]) dayNotesByDay[n.day_id] = [];
-          dayNotesByDay[n.day_id].push(n);
-        }
-      }
-
-      const daysWithAssignments = days.map(d => ({
-        ...d,
-        assignments: assignmentsByDay[d.id] || [],
-        notes: dayNotesByDay[d.id] || [],
-      }));
-
-      // Accommodations
-      const accommodations = db.prepare(`
-        SELECT da.*, p.name as place_name, ds.day_number as start_day_number, de.day_number as end_day_number
-        FROM day_accommodations da
-        JOIN places p ON da.place_id = p.id
-        LEFT JOIN days ds ON da.start_day_id = ds.id
-        LEFT JOIN days de ON da.end_day_id = de.id
-        WHERE da.trip_id = ?
-        ORDER BY ds.day_number ASC
-      `).all(tripId);
-
-      // Budget summary
-      const budgetStats = db.prepare(`
-        SELECT COUNT(*) as item_count, COALESCE(SUM(total_price), 0) as total
-        FROM budget_items WHERE trip_id = ?
-      `).get(tripId) as { item_count: number; total: number };
-
-      // Packing summary
-      const packingStats = db.prepare(`
-        SELECT COUNT(*) as total, SUM(CASE WHEN checked = 1 THEN 1 ELSE 0 END) as checked
-        FROM packing_items WHERE trip_id = ?
-      `).get(tripId) as { total: number; checked: number };
-
-      // Upcoming reservations (all, sorted by time)
-      const reservations = db.prepare(`
-        SELECT r.*, d.day_number
-        FROM reservations r
-        LEFT JOIN days d ON r.day_id = d.id
-        WHERE r.trip_id = ?
-        ORDER BY r.reservation_time ASC, r.created_at ASC
-      `).all(tripId);
-
-      // Collab notes
-      const collabNotes = db.prepare(
-        'SELECT * FROM collab_notes WHERE trip_id = ? ORDER BY pinned DESC, updated_at DESC'
-      ).all(tripId);
-
-      return ok({
-        trip,
-        members: { owner, collaborators: members },
-        days: daysWithAssignments,
-        accommodations,
-        budget: { ...budgetStats, currency: trip.currency },
-        packing: packingStats,
-        reservations,
-        collab_notes: collabNotes,
-      });
+      const summary = getTripSummary(tripId);
+      if (!summary) return noAccess();
+      return ok(summary);
     }
   );
 
@@ -991,10 +722,7 @@ export function registerTools(server: McpServer, userId: number): void {
     },
     async ({ name, lat, lng, country_code, notes }) => {
       if (isDemoUser(userId)) return demoDenied();
-      const result = db.prepare(
-        'INSERT INTO bucket_list (user_id, name, lat, lng, country_code, notes) VALUES (?, ?, ?, ?, ?, ?)'
-      ).run(userId, name, lat ?? null, lng ?? null, country_code || null, notes || null);
-      const item = db.prepare('SELECT * FROM bucket_list WHERE id = ?').get(result.lastInsertRowid);
+      const item = createBucketItem(userId, { name, lat, lng, country_code, notes });
       return ok({ item });
     }
   );
@@ -1009,9 +737,8 @@ export function registerTools(server: McpServer, userId: number): void {
     },
     async ({ itemId }) => {
       if (isDemoUser(userId)) return demoDenied();
-      const item = db.prepare('SELECT id FROM bucket_list WHERE id = ? AND user_id = ?').get(itemId, userId);
-      if (!item) return { content: [{ type: 'text' as const, text: 'Bucket list item not found.' }], isError: true };
-      db.prepare('DELETE FROM bucket_list WHERE id = ?').run(itemId);
+      const deleted = deleteBucketItem(userId, itemId);
+      if (!deleted) return { content: [{ type: 'text' as const, text: 'Bucket list item not found.' }], isError: true };
       return ok({ success: true });
     }
   );
@@ -1028,7 +755,7 @@ export function registerTools(server: McpServer, userId: number): void {
     },
     async ({ country_code }) => {
       if (isDemoUser(userId)) return demoDenied();
-      db.prepare('INSERT OR IGNORE INTO visited_countries (user_id, country_code) VALUES (?, ?)').run(userId, country_code.toUpperCase());
+      markCountryVisited(userId, country_code.toUpperCase());
       return ok({ success: true, country_code: country_code.toUpperCase() });
     }
   );
@@ -1043,7 +770,7 @@ export function registerTools(server: McpServer, userId: number): void {
     },
     async ({ country_code }) => {
       if (isDemoUser(userId)) return demoDenied();
-      db.prepare('DELETE FROM visited_countries WHERE user_id = ? AND country_code = ?').run(userId, country_code.toUpperCase());
+      unmarkCountryVisited(userId, country_code.toUpperCase());
       return ok({ success: true, country_code: country_code.toUpperCase() });
     }
   );
@@ -1065,11 +792,7 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, title, content, category, color }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const result = db.prepare(`
-        INSERT INTO collab_notes (trip_id, user_id, title, content, category, color)
-        VALUES (?, ?, ?, ?, ?, ?)
-      `).run(tripId, userId, title, content || null, category || 'General', color || '#6366f1');
-      const note = db.prepare('SELECT * FROM collab_notes WHERE id = ?').get(result.lastInsertRowid);
+      const note = createCollabNote(tripId, userId, { title, content, category, color });
       broadcast(tripId, 'collab:note:created', { note });
       return ok({ note });
     }
@@ -1092,26 +815,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, noteId, title, content, category, color, pinned }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT * FROM collab_notes WHERE id = ? AND trip_id = ?').get(noteId, tripId);
-      if (!existing) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
-      db.prepare(`
-        UPDATE collab_notes SET
-          title = CASE WHEN ? THEN ? ELSE title END,
-          content = CASE WHEN ? THEN ? ELSE content END,
-          category = CASE WHEN ? THEN ? ELSE category END,
-          color = CASE WHEN ? THEN ? ELSE color END,
-          pinned = CASE WHEN ? THEN ? ELSE pinned END,
-          updated_at = CURRENT_TIMESTAMP
-        WHERE id = ?
-      `).run(
-        title !== undefined ? 1 : 0, title !== undefined ? title : null,
-        content !== undefined ? 1 : 0, content !== undefined ? content : null,
-        category !== undefined ? 1 : 0, category !== undefined ? category : null,
-        color !== undefined ? 1 : 0, color !== undefined ? color : null,
-        pinned !== undefined ? 1 : 0, pinned !== undefined ? (pinned ? 1 : 0) : null,
-        noteId
-      );
-      const note = db.prepare('SELECT * FROM collab_notes WHERE id = ?').get(noteId);
+      const note = updateCollabNote(tripId, noteId, { title, content, category, color, pinned });
+      if (!note) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
       broadcast(tripId, 'collab:note:updated', { note });
       return ok({ note });
     }
@@ -1129,19 +834,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, noteId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT id FROM collab_notes WHERE id = ? AND trip_id = ?').get(noteId, tripId);
-      if (!existing) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
-      const noteFiles = db.prepare('SELECT filename FROM trip_files WHERE note_id = ?').all(noteId) as { filename: string }[];
-      const uploadsDir = path.resolve(__dirname, '../../uploads');
-      for (const f of noteFiles) {
-        const resolved = path.resolve(path.join(uploadsDir, 'files', f.filename));
-        if (!resolved.startsWith(uploadsDir)) continue;
-        try { fs.unlinkSync(resolved); } catch {}
-      }
-      db.transaction(() => {
-        db.prepare('DELETE FROM trip_files WHERE note_id = ?').run(noteId);
-        db.prepare('DELETE FROM collab_notes WHERE id = ?').run(noteId);
-      })();
+      const deleted = deleteCollabNote(tripId, noteId);
+      if (!deleted) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
       broadcast(tripId, 'collab:note:deleted', { noteId });
       return ok({ success: true });
     }
@@ -1164,12 +858,8 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, text, time, icon }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const day = db.prepare('SELECT id FROM days WHERE id = ? AND trip_id = ?').get(dayId, tripId);
-      if (!day) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
-      const result = db.prepare(
-        'INSERT INTO day_notes (day_id, trip_id, text, time, icon, sort_order) VALUES (?, ?, ?, ?, ?, ?)'
-      ).run(dayId, tripId, text.trim(), time || null, icon || '📝', 9999);
-      const note = db.prepare('SELECT * FROM day_notes WHERE id = ?').get(result.lastInsertRowid);
+      if (!dayNoteExists(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
+      const note = createDayNote(dayId, tripId, text, time, icon);
       broadcast(tripId, 'dayNote:created', { dayId, note });
       return ok({ note });
     }
@@ -1191,17 +881,11 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, noteId, text, time, icon }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const existing = db.prepare('SELECT * FROM day_notes WHERE id = ? AND day_id = ? AND trip_id = ?').get(noteId, dayId, tripId) as Record<string, unknown> | undefined;
+      const existing = getDayNote(noteId, dayId, tripId);
       if (!existing) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
-      db.prepare('UPDATE day_notes SET text = ?, time = ?, icon = ? WHERE id = ?').run(
-        text !== undefined ? text.trim() : existing.text,
-        time !== undefined ? time : existing.time,
-        icon ?? existing.icon,
-        noteId
-      );
-      const updated = db.prepare('SELECT * FROM day_notes WHERE id = ?').get(noteId);
-      broadcast(tripId, 'dayNote:updated', { dayId, note: updated });
-      return ok({ note: updated });
+      const note = updateDayNote(noteId, existing, { text, time: time !== undefined ? time : undefined, icon });
+      broadcast(tripId, 'dayNote:updated', { dayId, note });
+      return ok({ note });
     }
   );
 
@@ -1218,9 +902,9 @@ export function registerTools(server: McpServer, userId: number): void {
     async ({ tripId, dayId, noteId }) => {
       if (isDemoUser(userId)) return demoDenied();
       if (!canAccessTrip(tripId, userId)) return noAccess();
-      const note = db.prepare('SELECT id FROM day_notes WHERE id = ? AND day_id = ? AND trip_id = ?').get(noteId, dayId, tripId);
+      const note = getDayNote(noteId, dayId, tripId);
       if (!note) return { content: [{ type: 'text' as const, text: 'Note not found.' }], isError: true };
-      db.prepare('DELETE FROM day_notes WHERE id = ?').run(noteId);
+      deleteDayNote(noteId);
       broadcast(tripId, 'dayNote:deleted', { noteId, dayId });
       return ok({ success: true });
     }

server/src/routes/oidc.ts

@@ -43,7 +43,7 @@ router.get('/login', async (req: Request, res: Response) => {
       response_type: 'code',
       client_id: config.clientId,
       redirect_uri: redirectUri,
-      scope: process.env.OIDC_SCOPE || 'openid email profile groups',
+      scope: process.env.OIDC_SCOPE || 'openid email profile',
       state,
     });
 

server/src/routes/todo.ts

@@ -0,0 +1,127 @@
+import express, { Request, Response } from 'express';
+import { authenticate } from '../middleware/auth';
+import { broadcast } from '../websocket';
+import { checkPermission } from '../services/permissions';
+import { AuthRequest } from '../types';
+import {
+  verifyTripAccess,
+  listItems,
+  createItem,
+  updateItem,
+  deleteItem,
+  getCategoryAssignees,
+  updateCategoryAssignees,
+  reorderItems,
+} from '../services/todoService';
+
+const router = express.Router({ mergeParams: true });
+
+router.get('/', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  const items = listItems(tripId);
+  res.json({ items });
+});
+
+router.post('/', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  const { name, category, due_date, description, assigned_user_id, priority } = req.body;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  if (!name) return res.status(400).json({ error: 'Item name is required' });
+
+  const item = createItem(tripId, { name, category, due_date, description, assigned_user_id, priority });
+  res.status(201).json({ item });
+  broadcast(tripId, 'todo:created', { item }, req.headers['x-socket-id'] as string);
+});
+
+router.put('/reorder', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  const { orderedIds } = req.body;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  reorderItems(tripId, orderedIds);
+  res.json({ success: true });
+});
+
+router.put('/:id', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, id } = req.params;
+  const { name, checked, category, due_date, description, assigned_user_id, priority } = req.body;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  const updated = updateItem(tripId, id, { name, checked, category, due_date, description, assigned_user_id, priority }, Object.keys(req.body));
+  if (!updated) return res.status(404).json({ error: 'Item not found' });
+
+  res.json({ item: updated });
+  broadcast(tripId, 'todo:updated', { item: updated }, req.headers['x-socket-id'] as string);
+});
+
+router.delete('/:id', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, id } = req.params;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  if (!deleteItem(tripId, id)) return res.status(404).json({ error: 'Item not found' });
+
+  res.json({ success: true });
+  broadcast(tripId, 'todo:deleted', { itemId: Number(id) }, req.headers['x-socket-id'] as string);
+});
+
+// ── Category assignees ──────────────────────────────────────────────────────
+
+router.get('/category-assignees', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId } = req.params;
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  const assignees = getCategoryAssignees(tripId);
+  res.json({ assignees });
+});
+
+router.put('/category-assignees/:categoryName', authenticate, (req: Request, res: Response) => {
+  const authReq = req as AuthRequest;
+  const { tripId, categoryName } = req.params;
+  const { user_ids } = req.body;
+
+  const trip = verifyTripAccess(tripId, authReq.user.id);
+  if (!trip) return res.status(404).json({ error: 'Trip not found' });
+
+  if (!checkPermission('packing_edit', authReq.user.role, trip.user_id, authReq.user.id, trip.user_id !== authReq.user.id))
+    return res.status(403).json({ error: 'No permission' });
+
+  const cat = decodeURIComponent(categoryName);
+  const rows = updateCategoryAssignees(tripId, cat, user_ids);
+
+  res.json({ assignees: rows });
+  broadcast(tripId, 'todo:assignees', { category: cat, assignees: rows }, req.headers['x-socket-id'] as string);
+});
+
+export default router;

server/src/services/adminService.ts

@@ -464,6 +464,11 @@ export function deleteTemplateItem(itemId: string) {
 
 // ── Addons ─────────────────────────────────────────────────────────────────
 
+export function isAddonEnabled(addonId: string): boolean {
+  const addon = db.prepare('SELECT enabled FROM addons WHERE id = ?').get(addonId) as { enabled: number } | undefined;
+  return !!addon?.enabled;
+}
+
 export function listAddons() {
   const addons = db.prepare('SELECT * FROM addons ORDER BY sort_order, id').all() as Addon[];
   const providers = db.prepare(`

server/src/services/assignmentService.ts

@@ -35,8 +35,11 @@ export function getAssignmentWithPlace(assignmentId: number | bigint) {
   return {
     id: a.id,
     day_id: a.day_id,
+    place_id: a.place_id,
     order_index: a.order_index,
     notes: a.notes,
+    assignment_time: a.assignment_time ?? null,
+    assignment_end_time: a.assignment_end_time ?? null,
     participants,
     created_at: a.created_at,
     place: {

server/src/services/atlasService.ts

@@ -327,6 +327,12 @@ export function getCountryPlaces(userId: number, code: string) {
 
 // ── Mark / unmark country ───────────────────────────────────────────────────
 
+export function listVisitedCountries(userId: number): { country_code: string; created_at: string }[] {
+  return db.prepare(
+    'SELECT country_code, created_at FROM visited_countries WHERE user_id = ? ORDER BY created_at DESC'
+  ).all(userId) as { country_code: string; created_at: string }[];
+}
+
 export function markCountryVisited(userId: number, code: string): void {
   db.prepare('INSERT OR IGNORE INTO visited_countries (user_id, country_code) VALUES (?, ?)').run(userId, code);
 }

server/src/services/authService.ts

@@ -988,3 +988,38 @@ export function createResourceToken(userId: number, purpose?: string): { error?:
   if (!token) return { error: 'Service unavailable', status: 503 };
   return { token };
 }
+
+// ---------------------------------------------------------------------------
+// MCP auth helpers
+// ---------------------------------------------------------------------------
+
+export function isDemoUser(userId: number): boolean {
+  if (process.env.DEMO_MODE !== 'true') return false;
+  const user = db.prepare('SELECT email FROM users WHERE id = ?').get(userId) as { email: string } | undefined;
+  return user?.email === 'demo@nomad.app';
+}
+
+export function verifyMcpToken(rawToken: string): User | null {
+  const hash = createHash('sha256').update(rawToken).digest('hex');
+  const row = db.prepare(`
+    SELECT u.id, u.username, u.email, u.role
+    FROM mcp_tokens mt
+    JOIN users u ON mt.user_id = u.id
+    WHERE mt.token_hash = ?
+  `).get(hash) as User | undefined;
+  if (row) {
+    db.prepare('UPDATE mcp_tokens SET last_used_at = CURRENT_TIMESTAMP WHERE token_hash = ?').run(hash);
+    return row;
+  }
+  return null;
+}
+
+export function verifyJwtToken(token: string): User | null {
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
+    const user = db.prepare('SELECT id, username, email, role FROM users WHERE id = ?').get(decoded.id) as User | undefined;
+    return user || null;
+  } catch {
+    return null;
+  }
+}

server/src/services/dayService.ts

@@ -145,10 +145,10 @@ export function getDay(id: string | number, tripId: string | number) {
   return db.prepare('SELECT * FROM days WHERE id = ? AND trip_id = ?').get(id, tripId) as Day | undefined;
 }
 
-export function updateDay(id: string | number, current: Day, fields: { notes?: string; title?: string }) {
+export function updateDay(id: string | number, current: Day, fields: { notes?: string; title?: string | null }) {
   db.prepare('UPDATE days SET notes = ?, title = ? WHERE id = ?').run(
     fields.notes || null,
-    fields.title !== undefined ? fields.title : current.title,
+    'title' in fields ? (fields.title ?? null) : current.title,
     id
   );
   const updatedDay = db.prepare('SELECT * FROM days WHERE id = ?').get(id) as Day;

server/src/services/memories/immichService.ts

@@ -309,6 +309,36 @@ export async function listAlbums(
   }
 }
 
+export function listAlbumLinks(tripId: string) {
+  return db.prepare(`
+    SELECT tal.*, u.username
+    FROM trip_album_links tal
+    JOIN users u ON tal.user_id = u.id
+    WHERE tal.trip_id = ?
+    ORDER BY tal.created_at ASC
+  `).all(tripId);
+}
+
+export function createAlbumLink(
+  tripId: string,
+  userId: number,
+  albumId: string,
+  albumName: string
+): { success: boolean; error?: string } {
+  try {
+    db.prepare(
+      'INSERT OR IGNORE INTO trip_album_links (trip_id, user_id, immich_album_id, album_name) VALUES (?, ?, ?, ?)'
+    ).run(tripId, userId, albumId, albumName || '');
+    return { success: true };
+  } catch {
+    return { success: false, error: 'Album already linked' };
+  }
+}
+
+export function deleteAlbumLink(linkId: string, tripId: string, userId: number) {
+  db.prepare('DELETE FROM trip_album_links WHERE id = ? AND trip_id = ? AND user_id = ?')
+    .run(linkId, tripId, userId);
+}
 
 export async function syncAlbumAssets(
   tripId: string,

server/src/services/queryHelpers.ts

@@ -56,8 +56,11 @@ function formatAssignmentWithPlace(a: AssignmentRow, tags: Partial<Tag>[], parti
   return {
     id: a.id,
     day_id: a.day_id,
+    place_id: a.place_id,
     order_index: a.order_index,
     notes: a.notes,
+    assignment_time: a.assignment_time ?? null,
+    assignment_end_time: a.assignment_end_time ?? null,
     participants: participants || [],
     created_at: a.created_at,
     place: {

server/src/services/todoService.ts

@@ -0,0 +1,122 @@
+import { db, canAccessTrip } from '../db/database';
+
+export function verifyTripAccess(tripId: string | number, userId: number) {
+  return canAccessTrip(tripId, userId);
+}
+
+// ── Items ──────────────────────────────────────────────────────────────────
+
+export function listItems(tripId: string | number) {
+  return db.prepare(
+    'SELECT * FROM todo_items WHERE trip_id = ? ORDER BY sort_order ASC, created_at ASC'
+  ).all(tripId);
+}
+
+export function createItem(tripId: string | number, data: {
+  name: string; category?: string; due_date?: string; description?: string; assigned_user_id?: number; priority?: number;
+}) {
+  const maxOrder = db.prepare('SELECT MAX(sort_order) as max FROM todo_items WHERE trip_id = ?').get(tripId) as { max: number | null };
+  const sortOrder = (maxOrder.max !== null ? maxOrder.max : -1) + 1;
+
+  const result = db.prepare(
+    'INSERT INTO todo_items (trip_id, name, checked, category, sort_order, due_date, description, assigned_user_id, priority) VALUES (?, ?, 0, ?, ?, ?, ?, ?, ?)'
+  ).run(
+    tripId, data.name, data.category || null, sortOrder,
+    data.due_date || null, data.description || null, data.assigned_user_id || null, data.priority || 0
+  );
+
+  return db.prepare('SELECT * FROM todo_items WHERE id = ?').get(result.lastInsertRowid);
+}
+
+export function updateItem(
+  tripId: string | number,
+  id: string | number,
+  data: { name?: string; checked?: number; category?: string; due_date?: string | null; description?: string | null; assigned_user_id?: number | null; priority?: number | null },
+  bodyKeys: string[]
+) {
+  const item = db.prepare('SELECT * FROM todo_items WHERE id = ? AND trip_id = ?').get(id, tripId);
+  if (!item) return null;
+
+  db.prepare(`
+    UPDATE todo_items SET
+      name = COALESCE(?, name),
+      checked = CASE WHEN ? IS NOT NULL THEN ? ELSE checked END,
+      category = COALESCE(?, category),
+      due_date = CASE WHEN ? THEN ? ELSE due_date END,
+      description = CASE WHEN ? THEN ? ELSE description END,
+      assigned_user_id = CASE WHEN ? THEN ? ELSE assigned_user_id END,
+      priority = CASE WHEN ? THEN ? ELSE priority END
+    WHERE id = ?
+  `).run(
+    data.name || null,
+    data.checked !== undefined ? 1 : null,
+    data.checked ? 1 : 0,
+    data.category || null,
+    bodyKeys.includes('due_date') ? 1 : 0,
+    data.due_date ?? null,
+    bodyKeys.includes('description') ? 1 : 0,
+    data.description ?? null,
+    bodyKeys.includes('assigned_user_id') ? 1 : 0,
+    data.assigned_user_id ?? null,
+    bodyKeys.includes('priority') ? 1 : 0,
+    data.priority ?? 0,
+    id
+  );
+
+  return db.prepare('SELECT * FROM todo_items WHERE id = ?').get(id);
+}
+
+export function deleteItem(tripId: string | number, id: string | number) {
+  const item = db.prepare('SELECT id FROM todo_items WHERE id = ? AND trip_id = ?').get(id, tripId);
+  if (!item) return false;
+
+  db.prepare('DELETE FROM todo_items WHERE id = ?').run(id);
+  return true;
+}
+
+// ── Category Assignees ─────────────────────────────────────────────────────
+
+export function getCategoryAssignees(tripId: string | number) {
+  const rows = db.prepare(`
+    SELECT tca.category_name, tca.user_id, u.username, u.avatar
+    FROM todo_category_assignees tca
+    JOIN users u ON tca.user_id = u.id
+    WHERE tca.trip_id = ?
+  `).all(tripId);
+
+  const assignees: Record<string, { user_id: number; username: string; avatar: string | null }[]> = {};
+  for (const row of rows as any[]) {
+    if (!assignees[row.category_name]) assignees[row.category_name] = [];
+    assignees[row.category_name].push({ user_id: row.user_id, username: row.username, avatar: row.avatar });
+  }
+
+  return assignees;
+}
+
+export function updateCategoryAssignees(tripId: string | number, categoryName: string, userIds: number[] | undefined) {
+  db.prepare('DELETE FROM todo_category_assignees WHERE trip_id = ? AND category_name = ?').run(tripId, categoryName);
+
+  if (Array.isArray(userIds) && userIds.length > 0) {
+    const insert = db.prepare('INSERT OR IGNORE INTO todo_category_assignees (trip_id, category_name, user_id) VALUES (?, ?, ?)');
+    for (const uid of userIds) insert.run(tripId, categoryName, uid);
+  }
+
+  return db.prepare(`
+    SELECT tca.user_id, u.username, u.avatar
+    FROM todo_category_assignees tca
+    JOIN users u ON tca.user_id = u.id
+    WHERE tca.trip_id = ? AND tca.category_name = ?
+  `).all(tripId, categoryName);
+}
+
+// ── Reorder ────────────────────────────────────────────────────────────────
+
+export function reorderItems(tripId: string | number, orderedIds: number[]) {
+  const update = db.prepare('UPDATE todo_items SET sort_order = ? WHERE id = ? AND trip_id = ?');
+  const updateMany = db.transaction((ids: number[]) => {
+    ids.forEach((id, index) => {
+      update.run(index, id, tripId);
+    });
+  });
+  updateMany(orderedIds);
+}

server/src/services/tripService.ts

@@ -2,6 +2,11 @@ import path from 'path';
 import fs from 'fs';
 import { db, canAccessTrip, isOwner } from '../db/database';
 import { Trip, User } from '../types';
+import { listDays, listAccommodations } from './dayService';
+import { listBudgetItems } from './budgetService';
+import { listItems as listPackingItems } from './packingService';
+import { listReservations } from './reservationService';
+import { listNotes as listCollabNotes } from './collabService';
 
 export const MS_PER_DAY = 86400000;
 export const MAX_TRIP_DAYS = 365;
@@ -27,7 +32,7 @@ export { isOwner };
 
 // ── Day generation ────────────────────────────────────────────────────────
 
-export function generateDays(tripId: number | bigint | string, startDate: string | null, endDate: string | null) {
+export function generateDays(tripId: number | bigint | string, startDate: string | null, endDate: string | null, maxDays?: number) {
   const existing = db.prepare('SELECT id, day_number, date FROM days WHERE trip_id = ?').all(tripId) as { id: number; day_number: number; date: string | null }[];
 
   if (!startDate || !endDate) {
@@ -56,7 +61,7 @@ export function generateDays(tripId: number | bigint | string, startDate: string
   const [ey, em, ed] = endDate.split('-').map(Number);
   const startMs = Date.UTC(sy, sm - 1, sd);
   const endMs = Date.UTC(ey, em - 1, ed);
-  const numDays = Math.min(Math.floor((endMs - startMs) / MS_PER_DAY) + 1, MAX_TRIP_DAYS);
+  const numDays = Math.min(Math.floor((endMs - startMs) / MS_PER_DAY) + 1, maxDays ?? MAX_TRIP_DAYS);
 
   const targetDates: string[] = [];
   for (let i = 0; i < numDays; i++) {
@@ -75,9 +80,13 @@ export function generateDays(tripId: number | bigint | string, startDate: string
   const targetDateSet = new Set(targetDates);
 
   const toDelete = existing.filter(d => d.date && !targetDateSet.has(d.date));
-  const datelessToDelete = existing.filter(d => !d.date);
+  const dateless = existing.filter(d => !d.date).sort((a, b) => a.day_number - b.day_number);
   const del = db.prepare('DELETE FROM days WHERE id = ?');
-  for (const d of [...toDelete, ...datelessToDelete]) del.run(d.id);
+  for (const d of toDelete) del.run(d.id);
+
+  // Reassign dateless days to the first unmatched target dates (preserves content)
+  const assignDate = db.prepare('UPDATE days SET date = ?, day_number = ? WHERE id = ?');
+  let datelessIdx = 0;
 
   const setTemp = db.prepare('UPDATE days SET day_number = ? WHERE id = ?');
   const kept = existing.filter(d => d.date && targetDateSet.has(d.date));
@@ -91,15 +100,30 @@ export function generateDays(tripId: number | bigint | string, startDate: string
     const ex = existingByDate.get(date);
     if (ex) {
       update.run(i + 1, ex.id);
+    } else if (datelessIdx < dateless.length) {
+      // Reuse a dateless day — keeps its assignments, notes, etc.
+      assignDate.run(date, i + 1, dateless[datelessIdx].id);
+      datelessIdx++;
     } else {
       insert.run(tripId, i + 1, date);
     }
   }
+
+  // Delete any remaining unused dateless days
+  for (let i = datelessIdx; i < dateless.length; i++) del.run(dateless[i].id);
 }
 
 // ── Trip CRUD ─────────────────────────────────────────────────────────────
 
-export function listTrips(userId: number, archived: number) {
+export function listTrips(userId: number, archived: number | null) {
+  if (archived === null) {
+    return db.prepare(`
+      ${TRIP_SELECT}
+      LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = :userId
+      WHERE (t.user_id = :userId OR m.user_id IS NOT NULL)
+      ORDER BY t.created_at DESC
+    `).all({ userId });
+  }
   return db.prepare(`
     ${TRIP_SELECT}
     LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = :userId
@@ -117,7 +141,7 @@ interface CreateTripData {
   reminder_days?: number;
 }
 
-export function createTrip(userId: number, data: CreateTripData) {
+export function createTrip(userId: number, data: CreateTripData, maxDays?: number) {
   const rd = data.reminder_days !== undefined
     ? (Number(data.reminder_days) >= 0 && Number(data.reminder_days) <= 30 ? Number(data.reminder_days) : 3)
     : 3;
@@ -128,7 +152,7 @@ export function createTrip(userId: number, data: CreateTripData) {
   `).run(userId, data.title, data.description || null, data.start_date || null, data.end_date || null, data.currency || 'EUR', rd);
 
   const tripId = result.lastInsertRowid;
-  generateDays(tripId, data.start_date || null, data.end_date || null);
+  generateDays(tripId, data.start_date || null, data.end_date || null, maxDays);
 
   const trip = db.prepare(`${TRIP_SELECT} WHERE t.id = :tripId`).get({ userId, tripId });
   return { trip, tripId: Number(tripId), reminderDays: rd };
@@ -398,6 +422,49 @@ export function exportICS(tripId: string | number): { ics: string; filename: str
   return { ics, filename: `${safeFilename}.ics` };
 }
 
+// ── Trip summary (used by MCP get_trip_summary tool) ──────────────────────
+
+export function getTripSummary(tripId: number) {
+  const trip = db.prepare('SELECT * FROM trips WHERE id = ?').get(tripId) as Record<string, unknown> | undefined;
+  if (!trip) return null;
+
+  const ownerRow = getTripOwner(tripId);
+  if (!ownerRow) return null;
+  const { owner, members } = listMembers(tripId, ownerRow.user_id);
+
+  const { days: rawDays } = listDays(tripId);
+  const days = rawDays.map(({ notes_items, ...day }) => ({ ...day, notes: notes_items }));
+
+  const accommodations = listAccommodations(tripId);
+
+  const budgetItems = listBudgetItems(tripId);
+  const budget = {
+    item_count: budgetItems.length,
+    total: budgetItems.reduce((sum, i) => sum + (i.total_price || 0), 0),
+    currency: trip.currency,
+  };
+
+  const packingItems = listPackingItems(tripId);
+  const packing = {
+    total: packingItems.length,
+    checked: (packingItems as { checked: number }[]).filter(i => i.checked).length,
+  };
+
+  const reservations = listReservations(tripId);
+  const collab_notes = listCollabNotes(tripId);
+
+  return {
+    trip,
+    members: { owner, collaborators: members },
+    days,
+    accommodations,
+    budget,
+    packing,
+    reservations,
+    collab_notes,
+  };
+}
+
 // ── Custom error types ────────────────────────────────────────────────────
 
 export class NotFoundError extends Error {

server/tests/helpers/factories.ts

@@ -259,6 +259,201 @@ export interface TestInviteToken {
   expires_at: string | null;
 }
 
+// ---------------------------------------------------------------------------
+// Day Notes
+// ---------------------------------------------------------------------------
+
+export interface TestDayNote {
+  id: number;
+  day_id: number;
+  trip_id: number;
+  text: string;
+  time: string | null;
+  icon: string;
+}
+
+export function createDayNote(
+  db: Database.Database,
+  dayId: number,
+  tripId: number,
+  overrides: Partial<{ text: string; time: string; icon: string }> = {}
+): TestDayNote {
+  const result = db.prepare(
+    'INSERT INTO day_notes (day_id, trip_id, text, time, icon, sort_order) VALUES (?, ?, ?, ?, ?, 9999)'
+  ).run(dayId, tripId, overrides.text ?? 'Test note', overrides.time ?? null, overrides.icon ?? '📝');
+  return db.prepare('SELECT * FROM day_notes WHERE id = ?').get(result.lastInsertRowid) as TestDayNote;
+}
+
+// ---------------------------------------------------------------------------
+// Collab Notes
+// ---------------------------------------------------------------------------
+
+export interface TestCollabNote {
+  id: number;
+  trip_id: number;
+  user_id: number;
+  title: string;
+  content: string | null;
+  category: string;
+  color: string;
+  pinned: number;
+}
+
+export function createCollabNote(
+  db: Database.Database,
+  tripId: number,
+  userId: number,
+  overrides: Partial<{ title: string; content: string; category: string; color: string }> = {}
+): TestCollabNote {
+  const result = db.prepare(
+    'INSERT INTO collab_notes (trip_id, user_id, title, content, category, color) VALUES (?, ?, ?, ?, ?, ?)'
+  ).run(
+    tripId,
+    userId,
+    overrides.title ?? 'Test Note',
+    overrides.content ?? null,
+    overrides.category ?? 'General',
+    overrides.color ?? '#6366f1'
+  );
+  return db.prepare('SELECT * FROM collab_notes WHERE id = ?').get(result.lastInsertRowid) as TestCollabNote;
+}
+
+// ---------------------------------------------------------------------------
+// Day Assignments
+// ---------------------------------------------------------------------------
+
+export interface TestDayAssignment {
+  id: number;
+  day_id: number;
+  place_id: number;
+  order_index: number;
+  notes: string | null;
+}
+
+export function createDayAssignment(
+  db: Database.Database,
+  dayId: number,
+  placeId: number,
+  overrides: Partial<{ order_index: number; notes: string }> = {}
+): TestDayAssignment {
+  const maxOrder = db.prepare('SELECT MAX(order_index) as max FROM day_assignments WHERE day_id = ?').get(dayId) as { max: number | null };
+  const orderIndex = overrides.order_index ?? (maxOrder.max !== null ? maxOrder.max + 1 : 0);
+  const result = db.prepare(
+    'INSERT INTO day_assignments (day_id, place_id, order_index, notes) VALUES (?, ?, ?, ?)'
+  ).run(dayId, placeId, orderIndex, overrides.notes ?? null);
+  return db.prepare('SELECT * FROM day_assignments WHERE id = ?').get(result.lastInsertRowid) as TestDayAssignment;
+}
+
+// ---------------------------------------------------------------------------
+// Bucket List
+// ---------------------------------------------------------------------------
+
+export interface TestBucketListItem {
+  id: number;
+  user_id: number;
+  name: string;
+  lat: number | null;
+  lng: number | null;
+  country_code: string | null;
+  notes: string | null;
+}
+
+export function createBucketListItem(
+  db: Database.Database,
+  userId: number,
+  overrides: Partial<{ name: string; lat: number; lng: number; country_code: string; notes: string }> = {}
+): TestBucketListItem {
+  const result = db.prepare(
+    'INSERT INTO bucket_list (user_id, name, lat, lng, country_code, notes) VALUES (?, ?, ?, ?, ?, ?)'
+  ).run(
+    userId,
+    overrides.name ?? 'Test Destination',
+    overrides.lat ?? null,
+    overrides.lng ?? null,
+    overrides.country_code ?? null,
+    overrides.notes ?? null
+  );
+  return db.prepare('SELECT * FROM bucket_list WHERE id = ?').get(result.lastInsertRowid) as TestBucketListItem;
+}
+
+// ---------------------------------------------------------------------------
+// Visited Countries
+// ---------------------------------------------------------------------------
+
+export function createVisitedCountry(
+  db: Database.Database,
+  userId: number,
+  countryCode: string
+): void {
+  db.prepare('INSERT OR IGNORE INTO visited_countries (user_id, country_code) VALUES (?, ?)').run(userId, countryCode.toUpperCase());
+}
+
+// ---------------------------------------------------------------------------
+// Day Accommodations
+// ---------------------------------------------------------------------------
+
+export interface TestDayAccommodation {
+  id: number;
+  trip_id: number;
+  place_id: number;
+  start_day_id: number;
+  end_day_id: number;
+  check_in: string | null;
+  check_out: string | null;
+}
+
+export function createDayAccommodation(
+  db: Database.Database,
+  tripId: number,
+  placeId: number,
+  startDayId: number,
+  endDayId: number,
+  overrides: Partial<{ check_in: string; check_out: string; confirmation: string }> = {}
+): TestDayAccommodation {
+  const result = db.prepare(
+    'INSERT INTO day_accommodations (trip_id, place_id, start_day_id, end_day_id, check_in, check_out, confirmation) VALUES (?, ?, ?, ?, ?, ?, ?)'
+  ).run(
+    tripId,
+    placeId,
+    startDayId,
+    endDayId,
+    overrides.check_in ?? null,
+    overrides.check_out ?? null,
+    overrides.confirmation ?? null
+  );
+  return db.prepare('SELECT * FROM day_accommodations WHERE id = ?').get(result.lastInsertRowid) as TestDayAccommodation;
+}
+
+// ---------------------------------------------------------------------------
+// MCP Tokens
+// ---------------------------------------------------------------------------
+
+import { createHash } from 'crypto';
+
+export interface TestMcpToken {
+  id: number;
+  tokenHash: string;
+  rawToken: string;
+}
+
+export function createMcpToken(
+  db: Database.Database,
+  userId: number,
+  overrides: Partial<{ name: string; rawToken: string }> = {}
+): TestMcpToken {
+  const rawToken = overrides.rawToken ?? `trek_test_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+  const tokenHash = createHash('sha256').update(rawToken).digest('hex');
+  const tokenPrefix = rawToken.slice(0, 12);
+  const result = db.prepare(
+    'INSERT INTO mcp_tokens (user_id, token_hash, token_prefix, name) VALUES (?, ?, ?, ?)'
+  ).run(userId, tokenHash, tokenPrefix, overrides.name ?? 'Test Token');
+  return { id: result.lastInsertRowid as number, tokenHash, rawToken };
+}
+
+// ---------------------------------------------------------------------------
+// Invite Tokens
+// ---------------------------------------------------------------------------
+
 export function createInviteToken(
   db: Database.Database,
   overrides: Partial<{ token: string; max_uses: number; expires_at: string; created_by: number }> = {}

server/tests/helpers/mcp-harness.ts

@@ -0,0 +1,68 @@
+/**
+ * MCP test harness.
+ *
+ * Creates an McpServer + MCP Client connected via InMemoryTransport for unit testing
+ * tools and resources without HTTP overhead.
+ *
+ * Usage:
+ *   const harness = await createMcpHarness({ userId, registerTools: true });
+ *   const result = await harness.client.callTool({ name: 'create_trip', arguments: { title: 'Test' } });
+ *   await harness.cleanup();
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
+import { Client } from '@modelcontextprotocol/sdk/client/index';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory';
+import { registerResources } from '../../src/mcp/resources';
+import { registerTools } from '../../src/mcp/tools';
+
+export interface McpHarness {
+  client: Client;
+  server: McpServer;
+  cleanup: () => Promise<void>;
+}
+
+export interface McpHarnessOptions {
+  userId: number;
+  /** Register read-only resources (default: true) */
+  withResources?: boolean;
+  /** Register read-write tools (default: true) */
+  withTools?: boolean;
+}
+
+export async function createMcpHarness(options: McpHarnessOptions): Promise<McpHarness> {
+  const { userId, withResources = true, withTools = true } = options;
+
+  const server = new McpServer({ name: 'trek-test', version: '1.0.0' });
+
+  if (withResources) registerResources(server, userId);
+  if (withTools) registerTools(server, userId);
+
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+
+  const client = new Client({ name: 'test-client', version: '1.0.0' });
+
+  await server.connect(serverTransport);
+  await client.connect(clientTransport);
+
+  const cleanup = async () => {
+    try { await client.close(); } catch { /* ignore */ }
+    try { await server.close(); } catch { /* ignore */ }
+  };
+
+  return { client, server, cleanup };
+}
+
+/** Parse JSON from a callTool result (first text content item). */
+export function parseToolResult(result: Awaited<ReturnType<Client['callTool']>>): unknown {
+  const text = result.content.find((c: { type: string }) => c.type === 'text') as { type: 'text'; text: string } | undefined;
+  if (!text) throw new Error('No text content in tool result');
+  return JSON.parse(text.text);
+}
+
+/** Parse JSON from a readResource result (first content item). */
+export function parseResourceResult(result: Awaited<ReturnType<Client['readResource']>>): unknown {
+  const item = result.contents[0] as { text?: string } | undefined;
+  if (!item?.text) throw new Error('No text content in resource result');
+  return JSON.parse(item.text);
+}

server/tests/helpers/test-db.ts

@@ -36,6 +36,8 @@ const RESET_TABLES = [
   'packing_items',
   'budget_item_members',
   'budget_items',
+  'trip_photos',
+  'trip_album_links',
   'trip_files',
   'share_tokens',
   'photos',

server/tests/integration/immich.test.ts

@@ -145,3 +145,98 @@ describe('Immich authentication', () => {
     expect(res.status).toBe(401);
   });
 });
+
+describe('Immich album links', () => {
+  it('IMMICH-020 — POST album-links creates a link', async () => {
+    const { user } = createUser(testDb);
+    const trip = testDb.prepare('INSERT INTO trips (user_id, title) VALUES (?, ?) RETURNING *').get(user.id, 'Test Trip') as any;
+
+    const res = await request(app)
+      .post(`/api/integrations/immich/trips/${trip.id}/album-links`)
+      .set('Cookie', authCookie(user.id))
+      .send({ album_id: 'album-uuid-123', album_name: 'Vacation 2024' });
+
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+
+    const link = testDb.prepare('SELECT * FROM trip_album_links WHERE trip_id = ? AND user_id = ?').get(trip.id, user.id) as any;
+    expect(link).toBeDefined();
+    expect(link.immich_album_id).toBe('album-uuid-123');
+    expect(link.album_name).toBe('Vacation 2024');
+  });
+
+  it('IMMICH-021 — GET album-links returns linked albums', async () => {
+    const { user } = createUser(testDb);
+    const trip = testDb.prepare('INSERT INTO trips (user_id, title) VALUES (?, ?) RETURNING *').get(user.id, 'Test Trip') as any;
+    testDb.prepare('INSERT INTO trip_album_links (trip_id, user_id, immich_album_id, album_name) VALUES (?, ?, ?, ?)').run(trip.id, user.id, 'album-abc', 'My Album');
+
+    const res = await request(app)
+      .get(`/api/integrations/immich/trips/${trip.id}/album-links`)
+      .set('Cookie', authCookie(user.id));
+
+    expect(res.status).toBe(200);
+    expect(res.body.links).toBeDefined();
+    expect(res.body.links.length).toBe(1);
+    expect(res.body.links[0].immich_album_id).toBe('album-abc');
+  });
+
+  it('IMMICH-022 — DELETE album-links removes associated photos but not individually-added ones', async () => {
+    const { user } = createUser(testDb);
+    const trip = testDb.prepare('INSERT INTO trips (user_id, title) VALUES (?, ?) RETURNING *').get(user.id, 'Test Trip') as any;
+
+    // Create album link
+    const linkResult = testDb.prepare('INSERT INTO trip_album_links (trip_id, user_id, immich_album_id, album_name) VALUES (?, ?, ?, ?) RETURNING *')
+      .get(trip.id, user.id, 'album-xyz', 'Album XYZ') as any;
+
+    // Insert photos synced from the album
+    testDb.prepare('INSERT INTO trip_photos (trip_id, user_id, immich_asset_id, shared, album_link_id) VALUES (?, ?, ?, 1, ?)').run(trip.id, user.id, 'asset-001', linkResult.id);
+    testDb.prepare('INSERT INTO trip_photos (trip_id, user_id, immich_asset_id, shared, album_link_id) VALUES (?, ?, ?, 1, ?)').run(trip.id, user.id, 'asset-002', linkResult.id);
+
+    // Insert an individually-added photo (no album_link_id)
+    testDb.prepare('INSERT INTO trip_photos (trip_id, user_id, immich_asset_id, shared) VALUES (?, ?, ?, 1)').run(trip.id, user.id, 'asset-manual');
+
+    const res = await request(app)
+      .delete(`/api/integrations/immich/trips/${trip.id}/album-links/${linkResult.id}`)
+      .set('Cookie', authCookie(user.id));
+
+    expect(res.status).toBe(200);
+    expect(res.body.success).toBe(true);
+
+    // Album-linked photos should be gone
+    const remainingPhotos = testDb.prepare('SELECT * FROM trip_photos WHERE trip_id = ?').all(trip.id) as any[];
+    expect(remainingPhotos.length).toBe(1);
+    expect(remainingPhotos[0].immich_asset_id).toBe('asset-manual');
+
+    // Album link itself should be gone
+    const link = testDb.prepare('SELECT * FROM trip_album_links WHERE id = ?').get(linkResult.id);
+    expect(link).toBeUndefined();
+  });
+
+  it('IMMICH-023 — DELETE album-link by non-owner is a no-op', async () => {
+    const { user: owner } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = testDb.prepare('INSERT INTO trips (user_id, title) VALUES (?, ?) RETURNING *').get(owner.id, 'Test Trip') as any;
+
+    const linkResult = testDb.prepare('INSERT INTO trip_album_links (trip_id, user_id, immich_album_id, album_name) VALUES (?, ?, ?, ?) RETURNING *')
+      .get(trip.id, owner.id, 'album-secret', 'Secret Album') as any;
+    testDb.prepare('INSERT INTO trip_photos (trip_id, user_id, immich_asset_id, shared, album_link_id) VALUES (?, ?, ?, 1, ?)').run(trip.id, owner.id, 'asset-owned', linkResult.id);
+
+    // Other user tries to delete owner's album link
+    const res = await request(app)
+      .delete(`/api/integrations/immich/trips/${trip.id}/album-links/${linkResult.id}`)
+      .set('Cookie', authCookie(other.id));
+
+    expect(res.status).toBe(200); // endpoint returns 200 even when no row matched
+
+    // Link and photos should still exist
+    const link = testDb.prepare('SELECT * FROM trip_album_links WHERE id = ?').get(linkResult.id);
+    expect(link).toBeDefined();
+    const photo = testDb.prepare('SELECT * FROM trip_photos WHERE immich_asset_id = ?').get('asset-owned');
+    expect(photo).toBeDefined();
+  });
+
+  it('IMMICH-024 — DELETE album-link without auth returns 401', async () => {
+    const res = await request(app).delete('/api/integrations/immich/trips/1/album-links/1');
+    expect(res.status).toBe(401);
+  });
+});

server/tests/integration/mcp.test.ts

@@ -3,7 +3,7 @@
  * Covers MCP-001 to MCP-013.
  *
  * The MCP endpoint uses JWT auth and server-sent events / streaming HTTP.
- * Tests focus on authentication and basic rejection behavior.
+ * Tests cover authentication, session management, rate limiting, and API token auth.
  */
 import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
 import request from 'supertest';
@@ -47,6 +47,8 @@ import { resetTestDb } from '../helpers/test-db';
 import { createUser } from '../helpers/factories';
 import { generateToken } from '../helpers/auth';
 import { loginAttempts, mfaAttempts } from '../../src/routes/auth';
+import { createMcpToken } from '../helpers/factories';
+import { closeMcpSessions } from '../../src/mcp/index';
 
 const app: Application = createApp();
 
@@ -62,6 +64,7 @@ beforeEach(() => {
 });
 
 afterAll(() => {
+  closeMcpSessions();
   testDb.close();
 });
 
@@ -130,3 +133,160 @@ describe('MCP session init', () => {
     expect(res.status).toBe(401);
   });
 });
+
+describe('MCP API token auth', () => {
+  it('MCP-002 — POST /mcp with valid trek_ API token authenticates successfully', async () => {
+    const { user } = createUser(testDb);
+    const { rawToken } = createMcpToken(testDb, user.id);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+
+    const res = await request(app)
+      .post('/mcp')
+      .set('Authorization', `Bearer ${rawToken}`)
+      .set('Accept', 'application/json, text/event-stream')
+      .send({ jsonrpc: '2.0', method: 'initialize', id: 1, params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'test', version: '1' } } });
+    expect(res.status).toBe(200);
+  });
+
+  it('MCP-002 — last_used_at is updated on token use', async () => {
+    const { user } = createUser(testDb);
+    const { rawToken, id: tokenId } = createMcpToken(testDb, user.id);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+
+    const before = (testDb.prepare('SELECT last_used_at FROM mcp_tokens WHERE id = ?').get(tokenId) as { last_used_at: string | null }).last_used_at;
+
+    await request(app)
+      .post('/mcp')
+      .set('Authorization', `Bearer ${rawToken}`)
+      .set('Accept', 'application/json, text/event-stream')
+      .send({ jsonrpc: '2.0', method: 'initialize', id: 1, params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'test', version: '1' } } });
+
+    const after = (testDb.prepare('SELECT last_used_at FROM mcp_tokens WHERE id = ?').get(tokenId) as { last_used_at: string | null }).last_used_at;
+    expect(after).not.toBeNull();
+    expect(after).not.toBe(before);
+  });
+
+  it('MCP — POST /mcp with unknown trek_ token returns 401', async () => {
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+
+    const res = await request(app)
+      .post('/mcp')
+      .set('Authorization', 'Bearer trek_totally_fake_token_not_in_db')
+      .send({ jsonrpc: '2.0', method: 'initialize', id: 1 });
+    expect(res.status).toBe(401);
+  });
+
+  it('MCP — POST /mcp with no Authorization header returns 401', async () => {
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+
+    const res = await request(app)
+      .post('/mcp')
+      .send({ jsonrpc: '2.0', method: 'initialize', id: 1 });
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('MCP session management', () => {
+  async function createSession(userId: number): Promise<string> {
+    const token = generateToken(userId);
+    const res = await request(app)
+      .post('/mcp')
+      .set('Authorization', `Bearer ${token}`)
+      .set('Accept', 'application/json, text/event-stream')
+      .send({ jsonrpc: '2.0', method: 'initialize', id: 1, params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'test', version: '1' } } });
+    expect(res.status).toBe(200);
+    const sessionId = res.headers['mcp-session-id'];
+    expect(sessionId).toBeTruthy();
+    return sessionId as string;
+  }
+
+  it('MCP-003 — session limit of 5 per user', async () => {
+    const { user } = createUser(testDb);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+
+    // Create 5 sessions
+    for (let i = 0; i < 5; i++) {
+      await createSession(user.id);
+    }
+
+    // 6th should fail
+    const token = generateToken(user.id);
+    const res = await request(app)
+      .post('/mcp')
+      .set('Authorization', `Bearer ${token}`)
+      .set('Accept', 'application/json, text/event-stream')
+      .send({ jsonrpc: '2.0', method: 'initialize', id: 1, params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'test', version: '1' } } });
+    expect(res.status).toBe(429);
+    expect(res.body.error).toMatch(/session limit/i);
+  });
+
+  it('MCP — session resumption with valid mcp-session-id', async () => {
+    const { user } = createUser(testDb);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+    const sessionId = await createSession(user.id);
+    const token = generateToken(user.id);
+
+    const res = await request(app)
+      .post('/mcp')
+      .set('Authorization', `Bearer ${token}`)
+      .set('mcp-session-id', sessionId)
+      .set('Accept', 'application/json, text/event-stream')
+      .send({ jsonrpc: '2.0', method: 'tools/list', id: 2, params: {} });
+    expect(res.status).toBe(200);
+  });
+
+  it('MCP — session belongs to different user returns 403', async () => {
+    const { user: user1 } = createUser(testDb);
+    const { user: user2 } = createUser(testDb);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+
+    const sessionId = await createSession(user1.id);
+    const token2 = generateToken(user2.id);
+
+    const res = await request(app)
+      .post('/mcp')
+      .set('Authorization', `Bearer ${token2}`)
+      .set('mcp-session-id', sessionId)
+      .send({ jsonrpc: '2.0', method: 'tools/list', id: 2 });
+    expect(res.status).toBe(403);
+  });
+
+  it('MCP — GET without mcp-session-id returns 400', async () => {
+    const { user } = createUser(testDb);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+    const token = generateToken(user.id);
+
+    const res = await request(app)
+      .get('/mcp')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(400);
+  });
+});
+
+describe('MCP rate limiting', () => {
+  it('MCP-005 — requests below limit succeed', async () => {
+    const { user } = createUser(testDb);
+    testDb.prepare("UPDATE addons SET enabled = 1 WHERE id = 'mcp'").run();
+    const token = generateToken(user.id);
+
+    // Set a very low rate limit via env for this test
+    const originalLimit = process.env.MCP_RATE_LIMIT;
+    process.env.MCP_RATE_LIMIT = '3';
+
+    try {
+      for (let i = 0; i < 3; i++) {
+        const res = await request(app)
+          .post('/mcp')
+          .set('Authorization', `Bearer ${token}`)
+          .set('Accept', 'application/json, text/event-stream')
+          .send({ jsonrpc: '2.0', method: 'initialize', id: i + 1, params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'test', version: '1' } } });
+        // Each should pass (no rate limit hit yet since limit is read at module init,
+        // but we can verify that the responses are not 429)
+        expect(res.status).not.toBe(429);
+      }
+    } finally {
+      if (originalLimit === undefined) delete process.env.MCP_RATE_LIMIT;
+      else process.env.MCP_RATE_LIMIT = originalLimit;
+    }
+  });
+});

server/tests/unit/mcp/resources.test.ts

@@ -0,0 +1,489 @@
+/**
+ * Unit tests for MCP resources (resources.ts).
+ * Tests all 14 resources via InMemoryTransport + Client.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll, afterEach } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: (placeId: number) => {
+      const place: any = db.prepare(`SELECT p.*, c.name as category_name, c.color as category_color, c.icon as category_icon FROM places p LEFT JOIN categories c ON p.category_id = c.id WHERE p.id = ?`).get(placeId);
+      if (!place) return null;
+      const tags = db.prepare(`SELECT t.* FROM tags t JOIN place_tags pt ON t.id = pt.tag_id WHERE pt.place_id = ?`).all(placeId);
+      return { ...place, category: place.category_id ? { id: place.category_id, name: place.category_name, color: place.category_color, icon: place.category_icon } : null, tags };
+    },
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createDay, createPlace, addTripMember, createBudgetItem, createPackingItem, createReservation, createDayNote, createCollabNote, createBucketListItem, createVisitedCountry, createDayAssignment, createDayAccommodation } from '../../helpers/factories';
+import { createMcpHarness, parseResourceResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (harness: McpHarness) => Promise<void>) {
+  const harness = await createMcpHarness({ userId, withTools: false, withResources: true });
+  try {
+    await fn(harness);
+  } finally {
+    await harness.cleanup();
+  }
+}
+
+describe('Resource: trek://trips', () => {
+  it('returns all trips the user owns or is a member of', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    createTrip(testDb, user.id, { title: 'My Trip' });
+    const sharedTrip = createTrip(testDb, other.id, { title: 'Shared Trip' });
+    addTripMember(testDb, sharedTrip.id, user.id);
+    // Trip from another user (not accessible)
+    createTrip(testDb, other.id, { title: 'Other Trip' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://trips' });
+      const trips = parseResourceResult(result) as any[];
+      expect(trips).toHaveLength(2);
+      const titles = trips.map((t) => t.title);
+      expect(titles).toContain('My Trip');
+      expect(titles).toContain('Shared Trip');
+      expect(titles).not.toContain('Other Trip');
+    });
+  });
+
+  it('excludes archived trips', async () => {
+    const { user } = createUser(testDb);
+    createTrip(testDb, user.id, { title: 'Active Trip' });
+    const archived = createTrip(testDb, user.id, { title: 'Archived Trip' });
+    testDb.prepare('UPDATE trips SET is_archived = 1 WHERE id = ?').run(archived.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://trips' });
+      const trips = parseResourceResult(result) as any[];
+      expect(trips).toHaveLength(1);
+      expect(trips[0].title).toBe('Active Trip');
+    });
+  });
+
+  it('returns empty array when user has no trips', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://trips' });
+      const trips = parseResourceResult(result) as any[];
+      expect(trips).toEqual([]);
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}', () => {
+  it('returns trip data for an accessible trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id, { title: 'Paris Trip' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}` });
+      const data = parseResourceResult(result) as any;
+      expect(data.title).toBe('Paris Trip');
+      expect(data.id).toBe(trip.id);
+    });
+  });
+
+  it('returns access denied for inaccessible trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const otherTrip = createTrip(testDb, other.id, { title: 'Private' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${otherTrip.id}` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+
+  it('returns access denied for non-existent ID', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://trips/99999' });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/days', () => {
+  it('returns days with assignments in order', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const place = createPlace(testDb, trip.id);
+    createDayAssignment(testDb, day1.id, place.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/days` });
+      const days = parseResourceResult(result) as any[];
+      expect(days).toHaveLength(2);
+      expect(days[0].day_number).toBe(1);
+      expect(days[0].assignments).toHaveLength(1);
+      expect(days[1].day_number).toBe(2);
+      expect(days[1].assignments).toHaveLength(0);
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/days` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/places', () => {
+  it('returns all places for a trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    createPlace(testDb, trip.id, { name: 'Eiffel Tower' });
+    createPlace(testDb, trip.id, { name: 'Louvre' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/places` });
+      const places = parseResourceResult(result) as any[];
+      expect(places).toHaveLength(2);
+      const names = places.map((p) => p.name);
+      expect(names).toContain('Eiffel Tower');
+      expect(names).toContain('Louvre');
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/places` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/budget', () => {
+  it('returns budget items for a trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    createBudgetItem(testDb, trip.id, { name: 'Hotel', category: 'Accommodation', total_price: 200 });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/budget` });
+      const items = parseResourceResult(result) as any[];
+      expect(items).toHaveLength(1);
+      expect(items[0].name).toBe('Hotel');
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/budget` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/packing', () => {
+  it('returns packing items for a trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    createPackingItem(testDb, trip.id, { name: 'Passport' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/packing` });
+      const items = parseResourceResult(result) as any[];
+      expect(items).toHaveLength(1);
+      expect(items[0].name).toBe('Passport');
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/packing` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/reservations', () => {
+  it('returns reservations for a trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    createReservation(testDb, trip.id, { title: 'Flight to Paris', type: 'flight' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/reservations` });
+      const items = parseResourceResult(result) as any[];
+      expect(items).toHaveLength(1);
+      expect(items[0].title).toBe('Flight to Paris');
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/reservations` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/days/{dayId}/notes', () => {
+  it('returns notes for a specific day', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    createDayNote(testDb, day.id, trip.id, { text: 'Check in at noon' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/days/${day.id}/notes` });
+      const notes = parseResourceResult(result) as any[];
+      expect(notes).toHaveLength(1);
+      expect(notes[0].text).toBe('Check in at noon');
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/days/${day.id}/notes` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+
+  it('returns access denied for invalid dayId', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/days/abc/notes` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/accommodations', () => {
+  it('returns accommodations for a trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const place = createPlace(testDb, trip.id, { name: 'Grand Hotel' });
+    createDayAccommodation(testDb, trip.id, place.id, day1.id, day2.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/accommodations` });
+      const items = parseResourceResult(result) as any[];
+      expect(items).toHaveLength(1);
+      expect(items[0].place_name).toBe('Grand Hotel');
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/accommodations` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/members', () => {
+  it('returns owner and collaborators', async () => {
+    const { user } = createUser(testDb);
+    const { user: member } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    addTripMember(testDb, trip.id, member.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/members` });
+      const data = parseResourceResult(result) as any;
+      expect(data.owner).toBeTruthy();
+      expect(data.owner.id).toBe(user.id);
+      expect(data.members).toHaveLength(1);
+      expect(data.members[0].id).toBe(member.id);
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/members` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://trips/{tripId}/collab-notes', () => {
+  it('returns collab notes with username', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    createCollabNote(testDb, trip.id, user.id, { title: 'Ideas' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/collab-notes` });
+      const notes = parseResourceResult(result) as any[];
+      expect(notes).toHaveLength(1);
+      expect(notes[0].title).toBe('Ideas');
+      expect(notes[0].username).toBeTruthy();
+    });
+  });
+
+  it('returns access denied for unauthorized trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/collab-notes` });
+      const data = parseResourceResult(result) as any;
+      expect(data.error).toBeTruthy();
+    });
+  });
+});
+
+describe('Resource: trek://categories', () => {
+  it('returns all categories', async () => {
+    const { user } = createUser(testDb);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://categories' });
+      const categories = parseResourceResult(result) as any[];
+      expect(categories.length).toBeGreaterThan(0);
+      expect(categories[0]).toHaveProperty('id');
+      expect(categories[0]).toHaveProperty('name');
+      expect(categories[0]).toHaveProperty('color');
+      expect(categories[0]).toHaveProperty('icon');
+    });
+  });
+});
+
+describe('Resource: trek://bucket-list', () => {
+  it('returns only the current user\'s bucket list items', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    createBucketListItem(testDb, user.id, { name: 'Tokyo' });
+    createBucketListItem(testDb, other.id, { name: 'Rome' });
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://bucket-list' });
+      const items = parseResourceResult(result) as any[];
+      expect(items).toHaveLength(1);
+      expect(items[0].name).toBe('Tokyo');
+    });
+  });
+
+  it('returns empty array for user with no items', async () => {
+    const { user } = createUser(testDb);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://bucket-list' });
+      const items = parseResourceResult(result) as any[];
+      expect(items).toEqual([]);
+    });
+  });
+});
+
+describe('Resource: trek://visited-countries', () => {
+  it('returns only the current user\'s visited countries', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    createVisitedCountry(testDb, user.id, 'FR');
+    createVisitedCountry(testDb, user.id, 'JP');
+    createVisitedCountry(testDb, other.id, 'DE');
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://visited-countries' });
+      const countries = parseResourceResult(result) as any[];
+      expect(countries).toHaveLength(2);
+      const codes = countries.map((c) => c.country_code);
+      expect(codes).toContain('FR');
+      expect(codes).toContain('JP');
+      expect(codes).not.toContain('DE');
+    });
+  });
+
+  it('returns empty array for user with no visited countries', async () => {
+    const { user } = createUser(testDb);
+
+    await withHarness(user.id, async (harness) => {
+      const result = await harness.client.readResource({ uri: 'trek://visited-countries' });
+      const countries = parseResourceResult(result) as any[];
+      expect(countries).toEqual([]);
+    });
+  });
+});

server/tests/unit/mcp/tools-assignments.test.ts

@@ -0,0 +1,358 @@
+/**
+ * Unit tests for MCP assignment tools: assign_place_to_day, unassign_place,
+ * reorder_day_assignments, update_assignment_time.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createDay, createPlace, createDayAssignment } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// assign_place_to_day
+// ---------------------------------------------------------------------------
+
+describe('Tool: assign_place_to_day', () => {
+  it('assigns a place to a day', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'assign_place_to_day',
+        arguments: { tripId: trip.id, dayId: day.id, placeId: place.id },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.assignment).toBeTruthy();
+      expect(data.assignment.day_id).toBe(day.id);
+      expect(data.assignment.place_id).toBe(place.id);
+      expect(data.assignment.order_index).toBe(0);
+    });
+  });
+
+  it('auto-increments order_index for subsequent assignments', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place1 = createPlace(testDb, trip.id, { name: 'P1' });
+    const place2 = createPlace(testDb, trip.id, { name: 'P2' });
+    createDayAssignment(testDb, day.id, place1.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'assign_place_to_day',
+        arguments: { tripId: trip.id, dayId: day.id, placeId: place2.id },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.assignment.order_index).toBe(1);
+    });
+  });
+
+  it('broadcasts assignment:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'assign_place_to_day', arguments: { tripId: trip.id, dayId: day.id, placeId: place.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'assignment:created', expect.any(Object));
+    });
+  });
+
+  it('returns error when day does not belong to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const dayFromTrip2 = createDay(testDb, trip2.id);
+    const place = createPlace(testDb, trip1.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'assign_place_to_day',
+        arguments: { tripId: trip1.id, dayId: dayFromTrip2.id, placeId: place.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns error when place does not belong to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip1.id);
+    const placeFromTrip2 = createPlace(testDb, trip2.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'assign_place_to_day',
+        arguments: { tripId: trip1.id, dayId: day.id, placeId: placeFromTrip2.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'assign_place_to_day', arguments: { tripId: trip.id, dayId: day.id, placeId: place.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// unassign_place
+// ---------------------------------------------------------------------------
+
+describe('Tool: unassign_place', () => {
+  it('removes a place assignment from a day', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'unassign_place',
+        arguments: { tripId: trip.id, dayId: day.id, assignmentId: assignment.id },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM day_assignments WHERE id = ?').get(assignment.id)).toBeUndefined();
+    });
+  });
+
+  it('broadcasts assignment:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'unassign_place', arguments: { tripId: trip.id, dayId: day.id, assignmentId: assignment.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'assignment:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error when assignment is not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'unassign_place', arguments: { tripId: trip.id, dayId: day.id, assignmentId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'unassign_place', arguments: { tripId: trip.id, dayId: day.id, assignmentId: assignment.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// reorder_day_assignments
+// ---------------------------------------------------------------------------
+
+describe('Tool: reorder_day_assignments', () => {
+  it('reorders assignments by updating order_index', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place1 = createPlace(testDb, trip.id, { name: 'First' });
+    const place2 = createPlace(testDb, trip.id, { name: 'Second' });
+    const a1 = createDayAssignment(testDb, day.id, place1.id, { order_index: 0 });
+    const a2 = createDayAssignment(testDb, day.id, place2.id, { order_index: 1 });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'reorder_day_assignments',
+        arguments: { tripId: trip.id, dayId: day.id, assignmentIds: [a2.id, a1.id] },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+
+      const a1Updated = testDb.prepare('SELECT order_index FROM day_assignments WHERE id = ?').get(a1.id) as { order_index: number };
+      const a2Updated = testDb.prepare('SELECT order_index FROM day_assignments WHERE id = ?').get(a2.id) as { order_index: number };
+      expect(a2Updated.order_index).toBe(0);
+      expect(a1Updated.order_index).toBe(1);
+    });
+  });
+
+  it('broadcasts assignment:reordered event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const a = createDayAssignment(testDb, day.id, place.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'reorder_day_assignments', arguments: { tripId: trip.id, dayId: day.id, assignmentIds: [a.id] } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'assignment:reordered', expect.any(Object));
+    });
+  });
+
+  it('returns error when day does not belong to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip2.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'reorder_day_assignments', arguments: { tripId: trip1.id, dayId: day.id, assignmentIds: [1] } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'reorder_day_assignments', arguments: { tripId: trip.id, dayId: day.id, assignmentIds: [1] } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_assignment_time
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_assignment_time', () => {
+  it('sets start and end times for an assignment', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_assignment_time',
+        arguments: { tripId: trip.id, assignmentId: assignment.id, place_time: '09:00', end_time: '11:30' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.assignment.assignment_time).toBe('09:00');
+      expect(data.assignment.assignment_end_time).toBe('11:30');
+    });
+  });
+
+  it('clears times with null', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+    testDb.prepare('UPDATE day_assignments SET assignment_time = ?, assignment_end_time = ? WHERE id = ?').run('09:00', '11:00', assignment.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_assignment_time',
+        arguments: { tripId: trip.id, assignmentId: assignment.id, place_time: null, end_time: null },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.assignment.assignment_time).toBeNull();
+      expect(data.assignment.assignment_end_time).toBeNull();
+    });
+  });
+
+  it('broadcasts assignment:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_assignment_time', arguments: { tripId: trip.id, assignmentId: assignment.id, place_time: '10:00' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'assignment:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error when assignment not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_assignment_time', arguments: { tripId: trip.id, assignmentId: 99999, place_time: '09:00' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id);
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_assignment_time', arguments: { tripId: trip.id, assignmentId: assignment.id, place_time: '09:00' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-atlas.test.ts

@@ -0,0 +1,218 @@
+/**
+ * Unit tests for MCP atlas and bucket list tools:
+ * mark_country_visited, unmark_country_visited, create_bucket_list_item, delete_bucket_list_item.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+vi.mock('../../../src/websocket', () => ({ broadcast: vi.fn() }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createBucketListItem, createVisitedCountry } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// mark_country_visited
+// ---------------------------------------------------------------------------
+
+describe('Tool: mark_country_visited', () => {
+  it('marks a country as visited', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'mark_country_visited', arguments: { country_code: 'FR' } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(data.country_code).toBe('FR');
+      const row = testDb.prepare('SELECT country_code FROM visited_countries WHERE user_id = ? AND country_code = ?').get(user.id, 'FR');
+      expect(row).toBeTruthy();
+    });
+  });
+
+  it('is idempotent — marking twice does not error', async () => {
+    const { user } = createUser(testDb);
+    createVisitedCountry(testDb, user.id, 'JP');
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'mark_country_visited', arguments: { country_code: 'JP' } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      const count = (testDb.prepare('SELECT COUNT(*) as c FROM visited_countries WHERE user_id = ? AND country_code = ?').get(user.id, 'JP') as { c: number }).c;
+      expect(count).toBe(1);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'mark_country_visited', arguments: { country_code: 'DE' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// unmark_country_visited
+// ---------------------------------------------------------------------------
+
+describe('Tool: unmark_country_visited', () => {
+  it('removes a visited country', async () => {
+    const { user } = createUser(testDb);
+    createVisitedCountry(testDb, user.id, 'ES');
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'unmark_country_visited', arguments: { country_code: 'ES' } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      const row = testDb.prepare('SELECT country_code FROM visited_countries WHERE user_id = ? AND country_code = ?').get(user.id, 'ES');
+      expect(row).toBeUndefined();
+    });
+  });
+
+  it('succeeds even when country was not marked (no-op)', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'unmark_country_visited', arguments: { country_code: 'AU' } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    createVisitedCountry(testDb, user.id, 'IT');
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'unmark_country_visited', arguments: { country_code: 'IT' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// create_bucket_list_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_bucket_list_item', () => {
+  it('creates a bucket list item with all fields', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_bucket_list_item',
+        arguments: { name: 'Kyoto', lat: 35.0116, lng: 135.7681, country_code: 'JP', notes: 'Cherry blossom season' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.name).toBe('Kyoto');
+      expect(data.item.country_code).toBe('JP');
+      expect(data.item.notes).toBe('Cherry blossom season');
+    });
+  });
+
+  it('creates a minimal item (name only)', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_bucket_list_item', arguments: { name: 'Antarctica' } });
+      const data = parseToolResult(result) as any;
+      expect(data.item.name).toBe('Antarctica');
+      expect(data.item.user_id).toBe(user.id);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_bucket_list_item', arguments: { name: 'Nowhere' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_bucket_list_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_bucket_list_item', () => {
+  it('deletes a bucket list item owned by the user', async () => {
+    const { user } = createUser(testDb);
+    const item = createBucketListItem(testDb, user.id, { name: 'Machu Picchu' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_bucket_list_item', arguments: { itemId: item.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM bucket_list WHERE id = ?').get(item.id)).toBeUndefined();
+    });
+  });
+
+  it('returns error for item not found (wrong user)', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const item = createBucketListItem(testDb, other.id, { name: "Other's Wish" });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_bucket_list_item', arguments: { itemId: item.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns error for non-existent item', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_bucket_list_item', arguments: { itemId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const item = createBucketListItem(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_bucket_list_item', arguments: { itemId: item.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-budget.test.ts

@@ -0,0 +1,223 @@
+/**
+ * Unit tests for MCP budget tools: create_budget_item, update_budget_item, delete_budget_item.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createBudgetItem } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// create_budget_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_budget_item', () => {
+  it('creates a budget item with all fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_budget_item',
+        arguments: { tripId: trip.id, name: 'Hotel Paris', category: 'Accommodation', total_price: 500, note: 'Prepaid' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.name).toBe('Hotel Paris');
+      expect(data.item.category).toBe('Accommodation');
+      expect(data.item.total_price).toBe(500);
+      expect(data.item.note).toBe('Prepaid');
+    });
+  });
+
+  it('defaults category to "Other" when not specified', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_budget_item',
+        arguments: { tripId: trip.id, name: 'Misc', total_price: 10 },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.category).toBe('Other');
+    });
+  });
+
+  it('broadcasts budget:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'create_budget_item', arguments: { tripId: trip.id, name: 'Taxi', total_price: 25 } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'budget:created', expect.any(Object));
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_budget_item', arguments: { tripId: trip.id, name: 'Hack', total_price: 0 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_budget_item', arguments: { tripId: trip.id, name: 'X', total_price: 0 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_budget_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_budget_item', () => {
+  it('updates budget item fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createBudgetItem(testDb, trip.id, { name: 'Old', category: 'Food', total_price: 50 });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_budget_item',
+        arguments: { tripId: trip.id, itemId: item.id, name: 'New Name', total_price: 75 },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.name).toBe('New Name');
+      expect(data.item.total_price).toBe(75);
+      expect(data.item.category).toBe('Food'); // preserved
+    });
+  });
+
+  it('broadcasts budget:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createBudgetItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_budget_item', arguments: { tripId: trip.id, itemId: item.id, name: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'budget:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error for item not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_budget_item', arguments: { tripId: trip.id, itemId: 99999, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const item = createBudgetItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_budget_item', arguments: { tripId: trip.id, itemId: item.id, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_budget_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_budget_item', () => {
+  it('deletes an existing budget item', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createBudgetItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_budget_item', arguments: { tripId: trip.id, itemId: item.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM budget_items WHERE id = ?').get(item.id)).toBeUndefined();
+    });
+  });
+
+  it('broadcasts budget:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createBudgetItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_budget_item', arguments: { tripId: trip.id, itemId: item.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'budget:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error for item not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_budget_item', arguments: { tripId: trip.id, itemId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const item = createBudgetItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_budget_item', arguments: { tripId: trip.id, itemId: item.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-days.test.ts

@@ -0,0 +1,142 @@
+/**
+ * Unit tests for MCP day tools: update_day.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createDay } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// update_day
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_day', () => {
+  it('sets a day title', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_day',
+        arguments: { tripId: trip.id, dayId: day.id, title: 'Arrival in Paris' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.day.title).toBe('Arrival in Paris');
+    });
+  });
+
+  it('clears a day title with null', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id, { title: 'Old Title' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_day',
+        arguments: { tripId: trip.id, dayId: day.id, title: null },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.day.title).toBeNull();
+    });
+  });
+
+  it('broadcasts day:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_day', arguments: { tripId: trip.id, dayId: day.id, title: 'Day 1' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'day:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error when day does not belong to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const dayFromTrip2 = createDay(testDb, trip2.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_day',
+        arguments: { tripId: trip1.id, dayId: dayFromTrip2.id, title: 'X' },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_day', arguments: { tripId: trip.id, dayId: day.id, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_day', arguments: { tripId: trip.id, dayId: day.id, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-notes.test.ts

@@ -0,0 +1,431 @@
+/**
+ * Unit tests for MCP note tools: create_day_note, update_day_note, delete_day_note,
+ * create_collab_note, update_collab_note, delete_collab_note.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock, unlinkSyncMock } = vi.hoisted(() => ({
+  broadcastMock: vi.fn(),
+  unlinkSyncMock: vi.fn(),
+}));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+vi.mock('fs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('fs')>();
+  return { ...actual, unlinkSync: unlinkSyncMock };
+});
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createDay, createDayNote, createCollabNote } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  unlinkSyncMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// create_day_note
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_day_note', () => {
+  it('creates a note on a day', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_day_note',
+        arguments: { tripId: trip.id, dayId: day.id, text: 'Check in at noon', time: '12:00', icon: '🏨' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.note.text).toBe('Check in at noon');
+      expect(data.note.time).toBe('12:00');
+      expect(data.note.icon).toBe('🏨');
+    });
+  });
+
+  it('defaults icon to 📝', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_day_note',
+        arguments: { tripId: trip.id, dayId: day.id, text: 'A note' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.note.icon).toBe('📝');
+    });
+  });
+
+  it('broadcasts dayNote:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'create_day_note', arguments: { tripId: trip.id, dayId: day.id, text: 'Note' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'dayNote:created', expect.any(Object));
+    });
+  });
+
+  it('returns error when day does not belong to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const dayFromTrip2 = createDay(testDb, trip2.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_day_note', arguments: { tripId: trip1.id, dayId: dayFromTrip2.id, text: 'Note' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_day_note', arguments: { tripId: trip.id, dayId: day.id, text: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_day_note
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_day_note', () => {
+  it('updates note text, time, icon', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id, { text: 'Old text', time: '09:00', icon: '📝' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_day_note',
+        arguments: { tripId: trip.id, dayId: day.id, noteId: note.id, text: 'New text', time: '14:00', icon: '🍽️' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.note.text).toBe('New text');
+      expect(data.note.time).toBe('14:00');
+      expect(data.note.icon).toBe('🍽️');
+    });
+  });
+
+  it('trims text whitespace', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_day_note',
+        arguments: { tripId: trip.id, dayId: day.id, noteId: note.id, text: '  Trimmed  ' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.note.text).toBe('Trimmed');
+    });
+  });
+
+  it('broadcasts dayNote:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: note.id, text: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'dayNote:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error when note not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: 99999, text: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: note.id, text: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_day_note
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_day_note', () => {
+  it('deletes a day note', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: note.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM day_notes WHERE id = ?').get(note.id)).toBeUndefined();
+    });
+  });
+
+  it('broadcasts dayNote:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: note.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'dayNote:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error when note not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day = createDay(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day = createDay(testDb, trip.id);
+    const note = createDayNote(testDb, day.id, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_day_note', arguments: { tripId: trip.id, dayId: day.id, noteId: note.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// create_collab_note
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_collab_note', () => {
+  it('creates a collab note with all fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_collab_note',
+        arguments: { tripId: trip.id, title: 'Ideas', content: 'Visit museums', category: 'Culture', color: '#3b82f6' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.note.title).toBe('Ideas');
+      expect(data.note.content).toBe('Visit museums');
+      expect(data.note.category).toBe('Culture');
+      expect(data.note.color).toBe('#3b82f6');
+    });
+  });
+
+  it('defaults category to "General" and color to "#6366f1"', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_collab_note', arguments: { tripId: trip.id, title: 'Quick note' } });
+      const data = parseToolResult(result) as any;
+      expect(data.note.category).toBe('General');
+      expect(data.note.color).toBe('#6366f1');
+    });
+  });
+
+  it('broadcasts collab:note:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'create_collab_note', arguments: { tripId: trip.id, title: 'Note' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'collab:note:created', expect.any(Object));
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_collab_note', arguments: { tripId: trip.id, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_collab_note
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_collab_note', () => {
+  it('updates collab note fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const note = createCollabNote(testDb, trip.id, user.id, { title: 'Old', color: '#6366f1' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_collab_note',
+        arguments: { tripId: trip.id, noteId: note.id, title: 'New Title', pinned: true, color: '#3b82f6' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.note.title).toBe('New Title');
+      expect(data.note.pinned).toBe(1);
+      expect(data.note.color).toBe('#3b82f6');
+    });
+  });
+
+  it('broadcasts collab:note:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const note = createCollabNote(testDb, trip.id, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_collab_note', arguments: { tripId: trip.id, noteId: note.id, title: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'collab:note:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error when note not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_collab_note', arguments: { tripId: trip.id, noteId: 99999, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const note = createCollabNote(testDb, trip.id, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_collab_note', arguments: { tripId: trip.id, noteId: note.id, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_collab_note
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_collab_note', () => {
+  it('deletes a collab note', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const note = createCollabNote(testDb, trip.id, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_collab_note', arguments: { tripId: trip.id, noteId: note.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM collab_notes WHERE id = ?').get(note.id)).toBeUndefined();
+    });
+  });
+
+  it('deletes associated trip_files records from the database', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const note = createCollabNote(testDb, trip.id, user.id);
+    // Insert a trip_file linked to this note
+    testDb.prepare(
+      `INSERT INTO trip_files (trip_id, note_id, filename, original_name, mime_type, file_size) VALUES (?, ?, ?, ?, ?, ?)`
+    ).run(trip.id, note.id, 'test-file.pdf', 'document.pdf', 'application/pdf', 1024);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_collab_note', arguments: { tripId: trip.id, noteId: note.id } });
+      expect((parseToolResult(result) as any).success).toBe(true);
+    });
+
+    // trip_files rows are deleted as part of the transaction
+    expect(testDb.prepare('SELECT id FROM trip_files WHERE note_id = ?').all(note.id)).toHaveLength(0);
+    // note itself is deleted
+    expect(testDb.prepare('SELECT id FROM collab_notes WHERE id = ?').get(note.id)).toBeUndefined();
+  });
+
+  it('broadcasts collab:note:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const note = createCollabNote(testDb, trip.id, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_collab_note', arguments: { tripId: trip.id, noteId: note.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'collab:note:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error when note not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_collab_note', arguments: { tripId: trip.id, noteId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const note = createCollabNote(testDb, trip.id, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_collab_note', arguments: { tripId: trip.id, noteId: note.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-packing.test.ts

@@ -0,0 +1,287 @@
+/**
+ * Unit tests for MCP packing tools: create_packing_item, update_packing_item,
+ * toggle_packing_item, delete_packing_item.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createPackingItem } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// create_packing_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_packing_item', () => {
+  it('creates a packing item', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_packing_item',
+        arguments: { tripId: trip.id, name: 'Passport', category: 'Documents' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.name).toBe('Passport');
+      expect(data.item.category).toBe('Documents');
+      expect(data.item.checked).toBe(0);
+    });
+  });
+
+  it('defaults category to "General"', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_packing_item',
+        arguments: { tripId: trip.id, name: 'Sunscreen' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.category).toBe('General');
+    });
+  });
+
+  it('broadcasts packing:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'create_packing_item', arguments: { tripId: trip.id, name: 'Hat' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'packing:created', expect.any(Object));
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_packing_item', arguments: { tripId: trip.id, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_packing_item', arguments: { tripId: trip.id, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_packing_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_packing_item', () => {
+  it('updates packing item name and category', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id, { name: 'Old', category: 'Clothes' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_packing_item',
+        arguments: { tripId: trip.id, itemId: item.id, name: 'New Name', category: 'Electronics' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.name).toBe('New Name');
+      expect(data.item.category).toBe('Electronics');
+    });
+  });
+
+  it('broadcasts packing:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_packing_item', arguments: { tripId: trip.id, itemId: item.id, name: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'packing:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error for item not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_packing_item', arguments: { tripId: trip.id, itemId: 99999, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_packing_item', arguments: { tripId: trip.id, itemId: item.id, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// toggle_packing_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: toggle_packing_item', () => {
+  it('checks a packing item', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'toggle_packing_item',
+        arguments: { tripId: trip.id, itemId: item.id, checked: true },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.checked).toBe(1);
+    });
+  });
+
+  it('unchecks a packing item', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id);
+    testDb.prepare('UPDATE packing_items SET checked = 1 WHERE id = ?').run(item.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'toggle_packing_item',
+        arguments: { tripId: trip.id, itemId: item.id, checked: false },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.item.checked).toBe(0);
+    });
+  });
+
+  it('broadcasts packing:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'toggle_packing_item', arguments: { tripId: trip.id, itemId: item.id, checked: true } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'packing:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error for item not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'toggle_packing_item', arguments: { tripId: trip.id, itemId: 99999, checked: true } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'toggle_packing_item', arguments: { tripId: trip.id, itemId: item.id, checked: true } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_packing_item
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_packing_item', () => {
+  it('deletes an existing packing item', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_packing_item', arguments: { tripId: trip.id, itemId: item.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM packing_items WHERE id = ?').get(item.id)).toBeUndefined();
+    });
+  });
+
+  it('broadcasts packing:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_packing_item', arguments: { tripId: trip.id, itemId: item.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'packing:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error for item not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_packing_item', arguments: { tripId: trip.id, itemId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const item = createPackingItem(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_packing_item', arguments: { tripId: trip.id, itemId: item.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-places.test.ts

@@ -0,0 +1,310 @@
+/**
+ * Unit tests for MCP place tools: create_place, update_place, delete_place, list_categories, search_place.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: (placeId: number) => {
+      const place: any = db.prepare(`SELECT p.*, c.name as category_name, c.color as category_color, c.icon as category_icon FROM places p LEFT JOIN categories c ON p.category_id = c.id WHERE p.id = ?`).get(placeId);
+      if (!place) return null;
+      const tags = db.prepare(`SELECT t.* FROM tags t JOIN place_tags pt ON t.id = pt.tag_id WHERE pt.place_id = ?`).all(placeId);
+      return { ...place, category: place.category_id ? { id: place.category_id, name: place.category_name, color: place.category_color, icon: place.category_icon } : null, tags };
+    },
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createPlace } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// create_place
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_place', () => {
+  it('creates a place with all fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const cat = testDb.prepare('SELECT id FROM categories LIMIT 1').get() as { id: number };
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_place',
+        arguments: {
+          tripId: trip.id,
+          name: 'Eiffel Tower',
+          lat: 48.8584,
+          lng: 2.2945,
+          address: 'Champ de Mars, Paris',
+          category_id: cat.id,
+          notes: 'Must visit',
+          website: 'https://toureiffel.paris',
+          phone: '+33 892 70 12 39',
+        },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.place.name).toBe('Eiffel Tower');
+      expect(data.place.lat).toBeCloseTo(48.8584);
+      expect(data.place.category_id).toBe(cat.id);
+    });
+  });
+
+  it('creates a place with minimal fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_place',
+        arguments: { tripId: trip.id, name: 'Mystery Spot' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.place.name).toBe('Mystery Spot');
+      expect(data.place.trip_id).toBe(trip.id);
+    });
+  });
+
+  it('broadcasts place:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'create_place', arguments: { tripId: trip.id, name: 'Cafe' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'place:created', expect.any(Object));
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_place', arguments: { tripId: trip.id, name: 'Hack' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_place', arguments: { tripId: trip.id, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_place
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_place', () => {
+  it('updates specific fields and preserves others', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const place = createPlace(testDb, trip.id, { name: 'Old Name' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_place',
+        arguments: { tripId: trip.id, placeId: place.id, name: 'New Name' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.place.name).toBe('New Name');
+      // lat/lng preserved from original
+      expect(data.place.lat).toBeCloseTo(place.lat ?? 48.8566);
+    });
+  });
+
+  it('broadcasts place:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_place', arguments: { tripId: trip.id, placeId: place.id, name: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'place:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error for place not found in trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_place', arguments: { tripId: trip.id, placeId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_place', arguments: { tripId: trip.id, placeId: place.id, name: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_place
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_place', () => {
+  it('deletes an existing place', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_place', arguments: { tripId: trip.id, placeId: place.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM places WHERE id = ?').get(place.id)).toBeUndefined();
+    });
+  });
+
+  it('broadcasts place:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_place', arguments: { tripId: trip.id, placeId: place.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'place:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error for place not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_place', arguments: { tripId: trip.id, placeId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const place = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_place', arguments: { tripId: trip.id, placeId: place.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// list_categories
+// ---------------------------------------------------------------------------
+
+describe('Tool: list_categories', () => {
+  it('returns all categories with id, name, color, icon', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'list_categories', arguments: {} });
+      const data = parseToolResult(result) as any;
+      expect(data.categories).toBeDefined();
+      expect(data.categories.length).toBeGreaterThan(0);
+      const cat = data.categories[0];
+      expect(cat).toHaveProperty('id');
+      expect(cat).toHaveProperty('name');
+      expect(cat).toHaveProperty('color');
+      expect(cat).toHaveProperty('icon');
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// search_place
+// ---------------------------------------------------------------------------
+
+describe('Tool: search_place', () => {
+  it('returns formatted results from Nominatim', async () => {
+    const { user } = createUser(testDb);
+    const mockFetch = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => [
+        {
+          osm_type: 'node',
+          osm_id: 12345,
+          name: 'Eiffel Tower',
+          display_name: 'Eiffel Tower, Paris, France',
+          lat: '48.8584',
+          lon: '2.2945',
+        },
+      ],
+    });
+    vi.stubGlobal('fetch', mockFetch);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'search_place', arguments: { query: 'Eiffel Tower' } });
+      const data = parseToolResult(result) as any;
+      expect(data.places).toHaveLength(1);
+      expect(data.places[0].name).toBe('Eiffel Tower');
+      expect(data.places[0].osm_id).toBe('node:12345');
+      expect(data.places[0].lat).toBeCloseTo(48.8584);
+    });
+
+    vi.unstubAllGlobals();
+  });
+
+  it('returns error when Nominatim API fails', async () => {
+    const { user } = createUser(testDb);
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false }));
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'search_place', arguments: { query: 'something' } });
+      expect(result.isError).toBe(true);
+    });
+
+    vi.unstubAllGlobals();
+  });
+});

server/tests/unit/mcp/tools-reservations.test.ts

@@ -0,0 +1,434 @@
+/**
+ * Unit tests for MCP reservation tools: create_reservation, update_reservation,
+ * delete_reservation, link_hotel_accommodation.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createDay, createPlace, createReservation, createDayAssignment } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// create_reservation
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_reservation', () => {
+  it('creates a basic flight reservation', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_reservation',
+        arguments: { tripId: trip.id, title: 'Flight to Rome', type: 'flight' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.reservation.title).toBe('Flight to Rome');
+      expect(data.reservation.type).toBe('flight');
+      expect(data.reservation.status).toBe('pending');
+    });
+  });
+
+  it('creates a hotel reservation and links accommodation', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const hotel = createPlace(testDb, trip.id, { name: 'Grand Hotel' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_reservation',
+        arguments: {
+          tripId: trip.id,
+          title: 'Grand Hotel Stay',
+          type: 'hotel',
+          place_id: hotel.id,
+          start_day_id: day1.id,
+          end_day_id: day2.id,
+          check_in: '15:00',
+          check_out: '11:00',
+        },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.reservation.type).toBe('hotel');
+      expect(data.reservation.accommodation_id).not.toBeNull();
+      // accommodation was created
+      const acc = testDb.prepare('SELECT * FROM day_accommodations WHERE id = ?').get(data.reservation.accommodation_id) as any;
+      expect(acc.place_id).toBe(hotel.id);
+      expect(acc.check_in).toBe('15:00');
+    });
+  });
+
+  it('validates day_id belongs to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const dayFromTrip2 = createDay(testDb, trip2.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_reservation',
+        arguments: { tripId: trip1.id, title: 'Flight', type: 'flight', day_id: dayFromTrip2.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('validates assignment_id belongs to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const day2 = createDay(testDb, trip2.id);
+    const place2 = createPlace(testDb, trip2.id);
+    const assignment = createDayAssignment(testDb, day2.id, place2.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_reservation',
+        arguments: { tripId: trip1.id, title: 'Dinner', type: 'restaurant', assignment_id: assignment.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('broadcasts reservation:created event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'create_reservation', arguments: { tripId: trip.id, title: 'Bus', type: 'other' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'reservation:created', expect.any(Object));
+    });
+  });
+
+  it('broadcasts accommodation:created for hotel type', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const hotel = createPlace(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({
+        name: 'create_reservation',
+        arguments: { tripId: trip.id, title: 'Hotel', type: 'hotel', place_id: hotel.id, start_day_id: day1.id, end_day_id: day2.id },
+      });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'accommodation:created', expect.any(Object));
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_reservation', arguments: { tripId: trip.id, title: 'X', type: 'flight' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_reservation
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_reservation', () => {
+  it('updates reservation fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const reservation = createReservation(testDb, trip.id, { title: 'Old Title', type: 'flight' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_reservation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, title: 'New Title' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.reservation.title).toBe('New Title');
+      expect(data.reservation.type).toBe('flight'); // preserved
+    });
+  });
+
+  it('updates reservation status to confirmed', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const reservation = createReservation(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_reservation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, status: 'confirmed' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.reservation.status).toBe('confirmed');
+    });
+  });
+
+  it('broadcasts reservation:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const reservation = createReservation(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_reservation', arguments: { tripId: trip.id, reservationId: reservation.id, title: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'reservation:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error for reservation not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_reservation', arguments: { tripId: trip.id, reservationId: 99999, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('validates place_id belongs to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const reservation = createReservation(testDb, trip1.id);
+    const placeFromTrip2 = createPlace(testDb, trip2.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'update_reservation',
+        arguments: { tripId: trip1.id, reservationId: reservation.id, place_id: placeFromTrip2.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const reservation = createReservation(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_reservation', arguments: { tripId: trip.id, reservationId: reservation.id, title: 'X' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_reservation
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_reservation', () => {
+  it('deletes a reservation', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const reservation = createReservation(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_reservation', arguments: { tripId: trip.id, reservationId: reservation.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      expect(testDb.prepare('SELECT id FROM reservations WHERE id = ?').get(reservation.id)).toBeUndefined();
+    });
+  });
+
+  it('cascades to accommodation when linked', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const hotel = createPlace(testDb, trip.id);
+    // Create reservation via tool so accommodation is linked
+    let reservationId: number;
+    await withHarness(user.id, async (h) => {
+      const r = await h.client.callTool({
+        name: 'create_reservation',
+        arguments: { tripId: trip.id, title: 'Hotel', type: 'hotel', place_id: hotel.id, start_day_id: day1.id, end_day_id: day2.id },
+      });
+      reservationId = (parseToolResult(r) as any).reservation.id;
+    });
+
+    const accId = (testDb.prepare('SELECT accommodation_id FROM reservations WHERE id = ?').get(reservationId!) as any).accommodation_id;
+    expect(accId).not.toBeNull();
+
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_reservation', arguments: { tripId: trip.id, reservationId } });
+    });
+
+    expect(testDb.prepare('SELECT id FROM day_accommodations WHERE id = ?').get(accId)).toBeUndefined();
+  });
+
+  it('broadcasts reservation:deleted event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const reservation = createReservation(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'delete_reservation', arguments: { tripId: trip.id, reservationId: reservation.id } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'reservation:deleted', expect.any(Object));
+    });
+  });
+
+  it('returns error for reservation not found', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_reservation', arguments: { tripId: trip.id, reservationId: 99999 } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const reservation = createReservation(testDb, trip.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_reservation', arguments: { tripId: trip.id, reservationId: reservation.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// link_hotel_accommodation
+// ---------------------------------------------------------------------------
+
+describe('Tool: link_hotel_accommodation', () => {
+  it('creates new accommodation link for a hotel reservation', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const hotel = createPlace(testDb, trip.id, { name: 'Ritz' });
+    const reservation = createReservation(testDb, trip.id, { type: 'hotel' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'link_hotel_accommodation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, place_id: hotel.id, start_day_id: day1.id, end_day_id: day2.id, check_in: '14:00', check_out: '12:00' },
+      });
+      const data = parseToolResult(result) as any;
+      expect(data.reservation.accommodation_id).not.toBeNull();
+      expect(data.accommodation_id).not.toBeNull();
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'accommodation:created', expect.any(Object));
+    });
+  });
+
+  it('updates existing accommodation link', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const day3 = createDay(testDb, trip.id, { day_number: 3 });
+    const hotel = createPlace(testDb, trip.id, { name: 'Hotel A' });
+    const hotel2 = createPlace(testDb, trip.id, { name: 'Hotel B' });
+    const reservation = createReservation(testDb, trip.id, { type: 'hotel' });
+
+    // First link
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({
+        name: 'link_hotel_accommodation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, place_id: hotel.id, start_day_id: day1.id, end_day_id: day2.id },
+      });
+    });
+
+    // Update link
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({
+        name: 'link_hotel_accommodation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, place_id: hotel2.id, start_day_id: day2.id, end_day_id: day3.id },
+      });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'accommodation:updated', expect.any(Object));
+    });
+  });
+
+  it('returns error for non-hotel reservation', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const place = createPlace(testDb, trip.id);
+    const reservation = createReservation(testDb, trip.id, { type: 'flight' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'link_hotel_accommodation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, place_id: place.id, start_day_id: day1.id, end_day_id: day2.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('validates place_id belongs to trip', async () => {
+    const { user } = createUser(testDb);
+    const trip1 = createTrip(testDb, user.id);
+    const trip2 = createTrip(testDb, user.id);
+    const day1 = createDay(testDb, trip1.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip1.id, { day_number: 2 });
+    const placeFromTrip2 = createPlace(testDb, trip2.id);
+    const reservation = createReservation(testDb, trip1.id, { type: 'hotel' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'link_hotel_accommodation',
+        arguments: { tripId: trip1.id, reservationId: reservation.id, place_id: placeFromTrip2.id, start_day_id: day1.id, end_day_id: day2.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    const day1 = createDay(testDb, trip.id, { day_number: 1 });
+    const day2 = createDay(testDb, trip.id, { day_number: 2 });
+    const place = createPlace(testDb, trip.id);
+    const reservation = createReservation(testDb, trip.id, { type: 'hotel' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'link_hotel_accommodation',
+        arguments: { tripId: trip.id, reservationId: reservation.id, place_id: place.id, start_day_id: day1.id, end_day_id: day2.id },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+});

server/tests/unit/mcp/tools-trips.test.ts

@@ -0,0 +1,340 @@
+/**
+ * Unit tests for MCP trip tools: create_trip, update_trip, delete_trip, list_trips, get_trip_summary.
+ */
+import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
+
+const { testDb, dbMock } = vi.hoisted(() => {
+  const Database = require('better-sqlite3');
+  const db = new Database(':memory:');
+  db.exec('PRAGMA journal_mode = WAL');
+  db.exec('PRAGMA foreign_keys = ON');
+  db.exec('PRAGMA busy_timeout = 5000');
+  const mock = {
+    db,
+    closeDb: () => {},
+    reinitialize: () => {},
+    getPlaceWithTags: () => null,
+    canAccessTrip: (tripId: any, userId: number) =>
+      db.prepare(`SELECT t.id, t.user_id FROM trips t LEFT JOIN trip_members m ON m.trip_id = t.id AND m.user_id = ? WHERE t.id = ? AND (t.user_id = ? OR m.user_id IS NOT NULL)`).get(userId, tripId, userId),
+    isOwner: (tripId: any, userId: number) =>
+      !!db.prepare('SELECT id FROM trips WHERE id = ? AND user_id = ?').get(tripId, userId),
+  };
+  return { testDb: db, dbMock: mock };
+});
+
+vi.mock('../../../src/db/database', () => dbMock);
+vi.mock('../../../src/config', () => ({
+  JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
+  ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
+  updateJwtSecret: () => {},
+}));
+
+const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
+vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
+
+import { createTables } from '../../../src/db/schema';
+import { runMigrations } from '../../../src/db/migrations';
+import { resetTestDb } from '../../helpers/test-db';
+import { createUser, createTrip, createDay, createPlace, addTripMember, createBudgetItem, createPackingItem, createReservation, createDayNote, createCollabNote, createDayAssignment, createDayAccommodation } from '../../helpers/factories';
+import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
+
+beforeAll(() => {
+  createTables(testDb);
+  runMigrations(testDb);
+});
+
+beforeEach(() => {
+  resetTestDb(testDb);
+  broadcastMock.mockClear();
+  delete process.env.DEMO_MODE;
+});
+
+afterAll(() => {
+  testDb.close();
+});
+
+async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
+  const h = await createMcpHarness({ userId, withResources: false });
+  try { await fn(h); } finally { await h.cleanup(); }
+}
+
+// ---------------------------------------------------------------------------
+// create_trip
+// ---------------------------------------------------------------------------
+
+describe('Tool: create_trip', () => {
+  it('creates a trip with title only and generates 7 default days', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Summer Escape' } });
+      const data = parseToolResult(result) as any;
+      expect(data.trip).toBeTruthy();
+      expect(data.trip.title).toBe('Summer Escape');
+      const days = testDb.prepare('SELECT COUNT(*) as c FROM days WHERE trip_id = ?').get(data.trip.id) as { c: number };
+      expect(days.c).toBe(7);
+    });
+  });
+
+  it('creates a trip with dates and auto-generates correct number of days', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_trip',
+        arguments: { title: 'Paris Trip', start_date: '2026-07-01', end_date: '2026-07-05' },
+      });
+      const data = parseToolResult(result) as any;
+      const days = testDb.prepare('SELECT COUNT(*) as c FROM days WHERE trip_id = ?').get(data.trip.id) as { c: number };
+      expect(days.c).toBe(5);
+    });
+  });
+
+  it('caps days at 90 for very long trips', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_trip',
+        arguments: { title: 'Long Trip', start_date: '2026-01-01', end_date: '2027-12-31' },
+      });
+      const data = parseToolResult(result) as any;
+      const days = testDb.prepare('SELECT COUNT(*) as c FROM days WHERE trip_id = ?').get(data.trip.id) as { c: number };
+      expect(days.c).toBe(90);
+    });
+  });
+
+  it('returns error for invalid start_date format', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Trip', start_date: 'not-a-date' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('returns error when end_date is before start_date', async () => {
+    const { user } = createUser(testDb);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({
+        name: 'create_trip',
+        arguments: { title: 'Trip', start_date: '2026-07-05', end_date: '2026-07-01' },
+      });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Demo Trip' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// update_trip
+// ---------------------------------------------------------------------------
+
+describe('Tool: update_trip', () => {
+  it('updates trip title', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id, { title: 'Old Title' });
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'New Title' } });
+      const data = parseToolResult(result) as any;
+      expect(data.trip.title).toBe('New Title');
+    });
+  });
+
+  it('partial update preserves unspecified fields', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id, { title: 'My Trip', description: 'A great trip' });
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Renamed' } });
+      const updated = testDb.prepare('SELECT * FROM trips WHERE id = ?').get(trip.id) as any;
+      expect(updated.title).toBe('Renamed');
+      expect(updated.description).toBe('A great trip');
+    });
+  });
+
+  it('broadcasts trip:updated event', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Updated' } });
+      expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'trip:updated', expect.any(Object));
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Hack' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'New' } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// delete_trip
+// ---------------------------------------------------------------------------
+
+describe('Tool: delete_trip', () => {
+  it('owner can delete trip', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.success).toBe(true);
+      const gone = testDb.prepare('SELECT id FROM trips WHERE id = ?').get(trip.id);
+      expect(gone).toBeUndefined();
+    });
+  });
+
+  it('non-owner member cannot delete trip', async () => {
+    const { user } = createUser(testDb);
+    const { user: owner } = createUser(testDb);
+    const trip = createTrip(testDb, owner.id);
+    addTripMember(testDb, trip.id, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
+      expect(result.isError).toBe(true);
+      const stillExists = testDb.prepare('SELECT id FROM trips WHERE id = ?').get(trip.id);
+      expect(stillExists).toBeTruthy();
+    });
+  });
+
+  it('blocks demo user', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id);
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// list_trips
+// ---------------------------------------------------------------------------
+
+describe('Tool: list_trips', () => {
+  it('returns owned and member trips', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    createTrip(testDb, user.id, { title: 'My Trip' });
+    const shared = createTrip(testDb, other.id, { title: 'Shared' });
+    addTripMember(testDb, shared.id, user.id);
+    createTrip(testDb, other.id, { title: 'Inaccessible' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'list_trips', arguments: {} });
+      const data = parseToolResult(result) as any;
+      expect(data.trips).toHaveLength(2);
+      const titles = data.trips.map((t: any) => t.title);
+      expect(titles).toContain('My Trip');
+      expect(titles).toContain('Shared');
+    });
+  });
+
+  it('excludes archived trips by default', async () => {
+    const { user } = createUser(testDb);
+    createTrip(testDb, user.id, { title: 'Active' });
+    const archived = createTrip(testDb, user.id, { title: 'Archived' });
+    testDb.prepare('UPDATE trips SET is_archived = 1 WHERE id = ?').run(archived.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'list_trips', arguments: {} });
+      const data = parseToolResult(result) as any;
+      expect(data.trips).toHaveLength(1);
+      expect(data.trips[0].title).toBe('Active');
+    });
+  });
+
+  it('includes archived trips when include_archived is true', async () => {
+    const { user } = createUser(testDb);
+    createTrip(testDb, user.id, { title: 'Active' });
+    const archived = createTrip(testDb, user.id, { title: 'Archived' });
+    testDb.prepare('UPDATE trips SET is_archived = 1 WHERE id = ?').run(archived.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'list_trips', arguments: { include_archived: true } });
+      const data = parseToolResult(result) as any;
+      expect(data.trips).toHaveLength(2);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// get_trip_summary
+// ---------------------------------------------------------------------------
+
+describe('Tool: get_trip_summary', () => {
+  it('returns full denormalized trip snapshot', async () => {
+    const { user } = createUser(testDb);
+    const { user: member } = createUser(testDb);
+    const trip = createTrip(testDb, user.id, { title: 'Full Trip' });
+    addTripMember(testDb, trip.id, member.id);
+    const day = createDay(testDb, trip.id);
+    const place = createPlace(testDb, trip.id, { name: 'Colosseum' });
+    const assignment = createDayAssignment(testDb, day.id, place.id);
+    createDayNote(testDb, day.id, trip.id, { text: 'Check in' });
+    createBudgetItem(testDb, trip.id, { name: 'Hotel', total_price: 300 });
+    createPackingItem(testDb, trip.id, { name: 'Passport' });
+    createReservation(testDb, trip.id, { title: 'Flight', type: 'flight' });
+    createCollabNote(testDb, trip.id, user.id, { title: 'Plan' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
+      const data = parseToolResult(result) as any;
+      expect(data.trip.title).toBe('Full Trip');
+      expect(data.members.owner.id).toBe(user.id);
+      expect(data.members.collaborators).toHaveLength(1);
+      expect(data.days).toHaveLength(1);
+      expect(data.days[0].assignments).toHaveLength(1);
+      expect(data.days[0].notes).toHaveLength(1);
+      expect(data.budget.item_count).toBe(1);
+      expect(data.budget.total).toBe(300);
+      expect(data.packing.total).toBe(1);
+      expect(data.reservations).toHaveLength(1);
+      expect(data.collab_notes).toHaveLength(1);
+    });
+  });
+
+  it('returns access denied for non-member', async () => {
+    const { user } = createUser(testDb);
+    const { user: other } = createUser(testDb);
+    const trip = createTrip(testDb, other.id);
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
+      expect(result.isError).toBe(true);
+    });
+  });
+
+  it('is not blocked for demo user (read-only tool)', async () => {
+    process.env.DEMO_MODE = 'true';
+    const { user } = createUser(testDb, { email: 'demo@nomad.app' });
+    const trip = createTrip(testDb, user.id, { title: 'Demo Trip' });
+
+    await withHarness(user.id, async (h) => {
+      const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
+      expect(result.isError).toBeFalsy();
+      const data = parseToolResult(result) as any;
+      expect(data.trip.title).toBe('Demo Trip');
+    });
+  });
+});

server/vitest.config.ts

@@ -28,6 +28,14 @@ export default defineConfig({
           './node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js',
           import.meta.url
       ).pathname,
+      '@modelcontextprotocol/sdk/inMemory': new URL(
+          './node_modules/@modelcontextprotocol/sdk/dist/cjs/inMemory.js',
+          import.meta.url
+      ).pathname,
+      '@modelcontextprotocol/sdk/client/index': new URL(
+          './node_modules/@modelcontextprotocol/sdk/dist/cjs/client/index.js',
+          import.meta.url
+      ).pathname,
     },
   },
 });

unraid-template.xml

@@ -52,7 +52,7 @@
   <Config Name="OIDC_ONLY" Target="OIDC_ONLY" Default="false" Mode="" Description="Set to true to disable local password auth entirely (SSO only). First SSO login becomes admin." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
   <Config Name="OIDC_ADMIN_CLAIM" Target="OIDC_ADMIN_CLAIM" Default="" Mode="" Description="OIDC claim used to identify admin users (e.g. groups)." Type="Variable" Display="advanced" Required="false" Mask="false"/>
   <Config Name="OIDC_ADMIN_VALUE" Target="OIDC_ADMIN_VALUE" Default="" Mode="" Description="Value of the OIDC claim that grants admin role (e.g. app-trek-admins)." Type="Variable" Display="advanced" Required="false" Mask="false"/>
-  <Config Name="OIDC_SCOPE" Target="OIDC_SCOPE" Default="openid email profile groups" Mode="" Description="Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM." Type="Variable" Display="advanced" Required="false" Mask="false">openid email profile groups</Config>
+  <Config Name="OIDC_SCOPE" Target="OIDC_SCOPE" Default="openid email profile" Mode="" Description="Space-separated OIDC scopes to request. Fully overrides the default — always include openid email profile plus any extra scopes you need (e.g. add groups when using OIDC_ADMIN_CLAIM)." Type="Variable" Display="advanced" Required="false" Mask="false">openid email profile</Config>
   <Config Name="OIDC_DISCOVERY_URL" Target="OIDC_DISCOVERY_URL" Default="" Mode="" Description="Override the auto-constructed OIDC discovery endpoint. Useful for providers with a non-standard path (e.g. Authentik)." Type="Variable" Display="advanced" Required="false" Mask="false"/>
 
   <!-- Other -->