feat(scanner): server-side scan pipeline (convoy #2) #35

Merged

varutasu merged 2 commits from convoy/server-side-scan-pipeline into main

2026-05-27 09:47:05 -04:00

varutasu commented

2026-05-27 09:44:27 -04:00

(Migrated from github.com)

Summary

Adds POST /api/scan/identify with auth + checkScanRateLimit, server-side Gemini Vision (lib/scan-gemini.js), and catalog matching via lib/card-catalog-match.js.
Introduces card_submissions + scan_attempts tables (migration 1748365200000_add-scan-tables.js) and admin review at /admin/card-submissions.
Removes browser lib/ai-ocr.js; CameraScanner calls the server API and shows a disambiguation picker when needsUserSelection is returned.
Rewrites find-or-create to delegate to catalog matching — no user-writable INSERT INTO cards.
Extends CI forbidden-client-side-llm-keys to ban ai-ocr imports in components/ (grandfather removed).

Depends on #34 (merged).

Test plan

npm run test:run — 21/21 pass
npm run migrate up on preview/staging (new tables)
Scan a known catalog card → matched and added
Scan ambiguous name → disambiguation modal appears
Unknown high-confidence card → submission queued; admin approve promotes to cards
Confirm /api/config/gemini still 404 and no LLM URLs in browser bundle

Made with Cursor

## Summary - Adds `POST /api/scan/identify` with auth + `checkScanRateLimit`, server-side Gemini Vision (`lib/scan-gemini.js`), and catalog matching via `lib/card-catalog-match.js`. - Introduces `card_submissions` + `scan_attempts` tables (migration `1748365200000_add-scan-tables.js`) and admin review at `/admin/card-submissions`. - Removes browser `lib/ai-ocr.js`; `CameraScanner` calls the server API and shows a disambiguation picker when `needsUserSelection` is returned. - Rewrites `find-or-create` to delegate to catalog matching — no user-writable `INSERT INTO cards`. - Extends CI `forbidden-client-side-llm-keys` to ban `ai-ocr` imports in `components/` (grandfather removed). Depends on #34 (merged). ## Test plan - [x] `npm run test:run` — 21/21 pass - [ ] `npm run migrate up` on preview/staging (new tables) - [ ] Scan a known catalog card → matched and added - [ ] Scan ambiguous name → disambiguation modal appears - [ ] Unknown high-confidence card → submission queued; admin approve promotes to `cards` - [ ] Confirm `/api/config/gemini` still 404 and no LLM URLs in browser bundle Made with [Cursor](https://cursor.com)

vercel[bot] commented

2026-05-27 09:44:33 -04:00

(Migrated from github.com)

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tcg-vault	Ready	Preview, Comment	May 27, 2026 1:45pm

[vc]: #j2st4y81aS3TUGuUYTgZWDccbcZ1gnWNPVxuTeJv2RY=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJ0Y2ctdmF1bHQiLCJwcm9qZWN0SWQiOiJwcmpfRjZXOEVvRkd3Y0g3aWVGcnRvRlNlOXdVVkFhNSIsImluc3BlY3RvclVybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS9yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMvdGNnLXZhdWx0L0I1bThqWkdmc0J2SFRidDhETTdrZmc3VkJBeGsiLCJwcmV2aWV3VXJsIjoidGNnLXZhdWx0LWdpdC1jb252b3ktc2VydmVyLTcxNmNjOS1yYW5kYWxsLXN0aWxsd2VsbHMtcHJvamVjdHMudmVyY2VsLmFwcCIsIm5leHRDb21taXRTdGF0dXMiOiJERVBMT1lFRCIsImxpdmVGZWVkYmFjayI6eyJyZXNvbHZlZCI6MCwidW5yZXNvbHZlZCI6MCwidG90YWwiOjAsImxpbmsiOiJ0Y2ctdmF1bHQtZ2l0LWNvbnZveS1zZXJ2ZXItNzE2Y2M5LXJhbmRhbGwtc3RpbGx3ZWxscy1wcm9qZWN0cy52ZXJjZWwuYXBwIn0sInJvb3REaXJlY3RvcnkiOm51bGx9XSwicmVxdWVzdFJldmlld1VybCI6Imh0dHBzOi8vdmVyY2VsLmNvbS92ZXJjZWwtYWdlbnQvcmVxdWVzdC1yZXZpZXc/b3duZXI9dmFydXRhc3UmcmVwbz10Y2ctdmF1bHQmcHI9MzUifQ== The latest updates on your projects. Learn more about [Vercel for GitHub](https://vercel.link/github-learn-more). | Project | Deployment | Actions | Updated (UTC) | | :--- | :----- | :------ | :------ | | [tcg-vault](https://vercel.com/randall-stillwells-projects/tcg-vault) | ![Ready](https://vercel.com/static/status/ready.svg) [Ready](https://vercel.com/randall-stillwells-projects/tcg-vault/B5m8jZGfsBvHTbt8DM7kfg7VBAxk) | [Preview](https://tcg-vault-git-convoy-server-716cc9-randall-stillwells-projects.vercel.app), [Comment](https://vercel.live/open-feedback/tcg-vault-git-convoy-server-716cc9-randall-stillwells-projects.vercel.app?via=pr-comment-feedback-link) | May 27, 2026 1:45pm | <a href="https://vercel.com/vercel-agent/request-review?owner=varutasu&repo=tcg-vault&pr=35" rel="noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://agents-vade-review.vercel.sh/request-review-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://agents-vade-review.vercel.sh/request-review-light.svg"><img src="https://agents-vade-review.vercel.sh/request-review-light.svg" alt="Request Review"></picture></a>

github-actions[bot] commented

2026-05-27 09:44:49 -04:00

(Migrated from github.com)

Pipeline Health

Build + CI gates

Gate	Status
Vercel build (Preview)	✅ pass
CI: Lint	✅ pass
CI: Schema map fresh	❌ skipped
Preview smoke	✅ pass
Visual diff	✅ pass

Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build).

Role reports

Role	Status
Reviewer report	⏳ pending
A11y audit	⏳ pending
Design system audit	⏳ pending

See individual comments above for details. This rollup updates automatically.

## Pipeline Health ### Build + CI gates | Gate | Status | | --- | --- | | Vercel build (Preview) | ✅ pass | | CI: Lint | ✅ pass | | CI: Schema map fresh | ❌ skipped | | Preview smoke | ✅ pass | | Visual diff | ✅ pass | _Build runs on Vercel; this CI runs lint and schema-map drift only (no duplicate build)._ ### Role reports | Role | Status | | --- | --- | | Reviewer report | ⏳ pending | | A11y audit | ⏳ pending | | Design system audit | ⏳ pending | See individual comments above for details. This rollup updates automatically.

github-actions[bot] commented

2026-05-27 09:45:36 -04:00

(Migrated from github.com)

Visual Diff

Screenshots and diffs uploaded as artifacts: view run

If intentional changes: update snapshots locally with npx playwright test --project=visual --update-snapshots and commit.

## Visual Diff Screenshots and diffs uploaded as artifacts: [view run](https://github.com/varutasu/tcg-vault/actions/runs/26515027647) If intentional changes: update snapshots locally with `npx playwright test --project=visual --update-snapshots` and commit.

github-actions[bot] commented

2026-05-27 09:46:56 -04:00

(Migrated from github.com)

Visual Diff

Screenshots and diffs uploaded as artifacts: view run

If intentional changes: update snapshots locally with npx playwright test --project=visual --update-snapshots and commit.

## Visual Diff Screenshots and diffs uploaded as artifacts: [view run](https://github.com/varutasu/tcg-vault/actions/runs/26515066759) If intentional changes: update snapshots locally with `npx playwright test --project=visual --update-snapshots` and commit.