step 10.16: done

HANDOFF.md

@@ -4,8 +4,8 @@
 > If this file disagrees with the code, trust the code and fix this file.
 
 ## 1. Where we are
-- **Last completed step:** 10.15 — Non-stackable items: one inventory row per unit (shared `grantItem` in `src/game/inventory.js`)
-- **Next step:** Phase 10.16 — Make `GET /api/leaderboard` and `GET /api/heroes/:name` public (no login)
+- **Last completed step:** 10.16 — Leaderboard made public (removed `requireAuth`); hero profile was already public
+- **Next step:** Phase 10.17 — Build `public/leaderboard.html` + `public/js/leaderboard.js`: tabs Level/Gold/Kills, rank, hero name (link to profile.html?name=...), class, value; `textContent` only. Add nav links (Game, Shop, Leaderboard, Logout) to header of every logged-in page. Remove temporary link-checker exception from 10.5.
 - **Updated:** 2026-10-23
 - **Was the last session cut off mid-task?** No
 
@@ -14,15 +14,15 @@
 |---|---|
 | `npm install` | succeeds |
 | `npm run migrate` | applies 001–007 / "nothing to do" |
-| `npm test` | **264 passing, 0 failing** (97 unit + 167 integration incl. 4 non-stackable buy tests) |
+| `npm test` | **273 passing, 0 failing** (97 unit + 176 integration incl. 9 public leaderboard/profile tests) |
 | `npm run seed:dev` | creates demo user "demo"/"demo123", hero "Aldric" (warrior), starter gear |
 | `npm start` + `curl localhost:3000/` | 200 HTML landing page |
+| `curl localhost:3000/api/leaderboard?type=level` | 200 JSON (no auth required) |
 
 ## 3. What exists now (files that matter)
-- `src/game/inventory.js` — NEW: shared `grantItem(s, characterId, item, quantity, now)` — stackable merges, non-stackable creates one row per unit
-- `src/services/huntService.js` — now imports `grantItem` from `src/game/inventory.js` (removed local copy)
-- `src/services/shopService.js` — now imports `grantItem` from `src/game/inventory.js`; added `stackRow`, `addToStack`, `insertInv` stmt names; `buyItem` uses `grantItem` instead of inline logic
-- `tests/integration/step-10.15.test.js` — NEW: 4 integration tests for non-stackable buy behavior
+- `src/app.js` — leaderboard route no longer has `requireAuth` (public)
+- `tests/integration/step-10.16.test.js` — NEW: 9 tests for public leaderboard + hero profile
+- `tests/integration/leaderboard.test.js` — updated "rejects request without authentication" → "is accessible without authentication"
 
 ## 4. Half-finished / fragile things
 - No leaderboard UI yet (stub page exists; real UI in 10.17).
@@ -33,7 +33,7 @@
 - Characters start with 50g default (DB constraint) — tests must account for this baseline.
 
 ## 5. Decisions & deviations from the docs
-- D-004..D-007, D-022 in `docs/DECISIONS.md` (combat rounds, equipment counted once, session store, clock, material sell prices)
+- D-004..D-007, D-014..D-021 in `docs/DECISIONS.md`
 - **D-014:** Mobile bottom nav uses emoji icons (⚔️ Hunt / 🏕️ Trip / 🎒 Items) instead of full text labels.
 - **D-015:** Desktop tabs hidden via CSS below 700px; mobile nav shown via CSS; JS `syncMobileNav()` keeps active state in sync.
 - **D-016:** `applyXpGain` in `src/game/leveling.js` is the single shared function for XP gain logic, used by both `huntService` and `expeditionService`.
@@ -87,6 +87,9 @@
 - **10.12:** Warrior maxHp at level 1 = 135 (50 + 8*10 + 1*5).
 - **10.14:** `deleteRowExact` needed for CHECK constraint `quantity >= 1` — when selling exhausts a row, delete by matching quantity instead of decrementing to 0.
 - **10.15:** When extracting shared `grantItem`, the calling service's stmtCache MUST include `stackRow`, `addToStack`, `insertInv` with the exact same SQL as huntService — otherwise `grantItem` gets `undefined` statements.
+- **10.16:** Leaderboard returns `{ ok: true, data: { entries: [...], pagination: {...} } }`.
 
 ## 7. Next-step briefing
-- **Next step: 10.16** — Make `GET /api/leaderboard` and `GET /api/heroes/:name` public (no login). Keep the `type` allowlist; reject bad `page` values with 400. Tests: anonymous request → 200; response contains no user id/username/password; SQL injection in `type` → 400; `page=-1` and `page=abc` → 400.
+- **Next step: 10.17** — Build `public/leaderboard.html` + `public/js/leaderboard.js`: tabs Level/Gold/Kills, rank, hero name (linking to `profile.html?name=...`), class, value; `textContent` only. Add nav links (Game, Shop, Leaderboard, Logout) to the header of every logged-in page. Remove any temporary link-checker exception from 10.5.
+- The leaderboard API (`GET /api/leaderboard?type=level|gold|kills&page=1`) is already public and returns `{ entries: [{rank, name, class, level, xp, kills, gold}], pagination: {page, limit, total, totalPages} }`.
+- The link-checker test currently has no exceptions (10.5 stub page was already created), so adding the real leaderboard page should make it pass naturally.