escala 1: Meteor 1.6.1.1 -> 1.8.3

meteor update --release 1.8.3 + Babel beta->stable fix.

- Core packages bumped (meteor 1.9.3, ecmascript 0.13.2, mongo 1.7.0,
  npm-mongo 3.2.0 driver — still compatible with Mongo 3.2 server).
- Fix boot failure 'Cannot find @babel/runtime/helpers/objectSpread2':
  upgraded @babel/runtime 7.0.0-beta.44 -> ^7.29.7 (stable 7.x; not 8.x).
- underscore auto-added, fetch/modern-browsers added by the release.

REST smoke test byte-identical to baseline. See UPGRADE.md.

.meteor/.finished-upgraders

@@ -15,3 +15,5 @@ notices-for-facebook-graph-api-2
 1.4.1-add-shell-server-package
 1.4.3-split-account-service-packages
 1.5-add-dynamic-import-package
+1.7-split-underscore-from-meteor-base
+1.8.3-split-jquery-from-blaze

.meteor/packages

@@ -4,33 +4,33 @@
 # 'meteor add' and 'meteor remove' will edit this file for you,
 # but you can also edit it by hand.
 
-meteor-base@1.3.0             # Packages every Meteor app needs to have
+meteor-base@1.4.0             # Packages every Meteor app needs to have
 mobile-experience@1.0.5       # Packages for a great mobile UX
-mongo@1.4.7                   # The database Meteor supports right now
+mongo@1.7.0                   # The database Meteor supports right now
 reactive-var@1.0.11            # Reactive variable for tracker
-tracker@1.1.3                 # Meteor's client-side reactive programming library
+tracker@1.2.0                 # Meteor's client-side reactive programming library
 
-standard-minifier-css@1.4.0   # CSS minifier run for production mode
-standard-minifier-js@2.3.1    # JS minifier run for production mode
-es5-shim@4.7.0                # ECMAScript 5 compatibility for older browsers.
-ecmascript@0.10.6              # Enable ECMAScript2015+ syntax in app code
-shell-server@0.3.1            # Server-side component of the `meteor shell` command
+standard-minifier-css@1.5.4   # CSS minifier run for production mode
+standard-minifier-js@2.5.2    # JS minifier run for production mode
+es5-shim@4.8.0                # ECMAScript 5 compatibility for older browsers.
+ecmascript@0.13.2              # Enable ECMAScript2015+ syntax in app code
+shell-server@0.4.0            # Server-side component of the `meteor shell` command
 
 react-meteor-data
 alanning:roles
 fourseven:scss
-accounts-base@1.4.2
-accounts-password@1.5.0
+accounts-base@1.4.5
+accounts-password@1.5.2
 service-configuration@1.0.11
-accounts-facebook@1.3.1
-accounts-github@1.4.1
-accounts-google@1.3.1
+accounts-facebook@1.3.2
+accounts-github@1.4.2
+accounts-google@1.3.3
 themeteorchef:bert
 fortawesome:fontawesome
 aldeed:collection2-core@2.0.1
 audit-argument-checks@1.0.7
 ddp-rate-limiter@1.0.7
-dynamic-import@0.3.0
+dynamic-import@0.5.1
 static-html
 alexwine:bootstrap-4
 
@@ -67,3 +67,4 @@ saucecode:timezoned-synced-cron
 meteorhacks:zones
 nimble:restivus
 xolvio:cleaner
+underscore

.meteor/release

@@ -1 +1 @@
-METEOR@1.6.1.1
+METEOR@1.8.3

.meteor/versions

@@ -1,10 +1,10 @@
 255kb:meteor-status@1.5.0
-accounts-base@1.4.2
-accounts-facebook@1.3.1
-accounts-github@1.4.1
-accounts-google@1.3.1
-accounts-oauth@1.1.15
-accounts-password@1.5.1
+accounts-base@1.4.5
+accounts-facebook@1.3.2
+accounts-github@1.4.2
+accounts-google@1.3.3
+accounts-oauth@1.1.16
+accounts-password@1.5.2
 alanning:roles@1.2.16
 aldeed:collection2-core@2.1.2
 aldeed:schema-deny@2.0.1
@@ -13,43 +13,44 @@ alexwine:bootstrap-4@4.1.0
 allow-deny@1.1.0
 arkham:comments-ui@1.4.4
 audit-argument-checks@1.0.7
-autoupdate@1.4.0
-babel-compiler@7.0.7
-babel-runtime@1.2.2
+autoupdate@1.6.0
+babel-compiler@7.4.2
+babel-runtime@1.4.0
 barbatus:stars-rating@1.1.1
-base64@1.0.11
-binary-heap@1.0.10
-blaze@2.3.2
+base64@1.0.12
+binary-heap@1.0.11
+blaze@2.3.3
 blaze-tools@1.0.10
-boilerplate-generator@1.4.0
+boilerplate-generator@1.6.0
 browser-policy@1.1.0
 browser-policy-common@1.0.11
 browser-policy-content@1.1.0
 browser-policy-framing@1.1.0
-caching-compiler@1.1.11
+caching-compiler@1.2.1
 caching-html-compiler@1.1.2
-callback-hook@1.1.0
+callback-hook@1.2.0
 check@1.3.1
 coffeescript@1.0.17
 dburles:collection-helpers@1.1.0
 dburles:mongo-collection-instances@0.3.5
 ddp@1.4.0
-ddp-client@2.3.2
+ddp-client@2.3.3
 ddp-common@1.4.0
 ddp-rate-limiter@1.0.7
-ddp-server@2.1.2
+ddp-server@2.3.0
 deps@1.0.12
-diff-sequence@1.1.0
-dynamic-import@0.3.0
-ecmascript@0.10.7
-ecmascript-runtime@0.5.0
-ecmascript-runtime-client@0.6.2
-ecmascript-runtime-server@0.5.0
+diff-sequence@1.1.1
+dynamic-import@0.5.1
+ecmascript@0.13.2
+ecmascript-runtime@0.7.0
+ecmascript-runtime-client@0.9.0
+ecmascript-runtime-server@0.8.0
 ejson@1.1.0
 email@1.2.3
-es5-shim@4.7.3
-facebook-oauth@1.4.0
+es5-shim@4.8.0
+facebook-oauth@1.6.0
 facts@1.0.9
+fetch@0.1.1
 flowkey:raven@1.1.0
 fortawesome:fontawesome@4.7.0
 fourseven:scss@4.5.4
@@ -57,13 +58,14 @@ gadicc:blaze-react-component@1.4.0
 gadicohen:robots-txt@0.0.10
 gadicohen:sitemaps@0.0.26
 geojson-utils@1.0.10
-github-oauth@1.2.0
-google-oauth@1.2.5
+github-oauth@1.2.2
+google-oauth@1.2.6
 hot-code-push@1.0.4
 html-tools@1.0.11
 htmljs@1.0.11
-http@1.4.0
+http@1.4.2
 id-map@1.1.0
+inter-process-messaging@0.1.0
 jquery@1.11.11
 lai:collection-extensions@0.2.1_1
 launch-screen@1.1.1
@@ -75,20 +77,22 @@ markdown@1.0.12
 maximum:package-base@1.1.2
 maximum:server-transform@0.5.0
 mdg:geolocation@1.3.0
-meteor@1.8.6
-meteor-base@1.3.0
+meteor@1.9.3
+meteor-base@1.4.0
 meteorhacks:inject-initial@1.0.4
 meteorhacks:zones@1.6.0
 meteortesting:browser-tests@0.2.0
 meteortesting:mocha@0.5.1
-minifier-css@1.3.1
-minifier-js@2.3.4
-minimongo@1.4.4
+minifier-css@1.4.3
+minifier-js@2.5.1
+minimongo@1.4.5
 mobile-experience@1.0.5
 mobile-status-bar@1.0.14
-modules@0.11.6
-modules-runtime@0.9.2
-mongo@1.4.7
+modern-browsers@0.1.5
+modules@0.14.0
+modules-runtime@0.11.0
+mongo@1.7.0
+mongo-decimal@0.1.1
 mongo-dev-server@1.1.0
 mongo-id@1.0.7
 mongo-livedata@1.0.12
@@ -96,10 +100,10 @@ mys:fonts@0.0.2
 natestrauser:publish-performant-counts@0.1.2
 nimble:restivus@0.8.12
 npm-bcrypt@0.9.3
-npm-mongo@2.2.34
+npm-mongo@3.2.0
 nspangler:autoreconnect@0.0.1
-oauth@1.2.3
-oauth2@1.2.0
+oauth@1.2.8
+oauth2@1.2.1
 observe-sequence@1.0.16
 ordered-dict@1.1.0
 ostrio:cookies@2.1.3
@@ -112,32 +116,30 @@ peerlibrary:server-autorun@0.5.2
 percolate:migrations@1.0.2
 practicalmeteor:chai@2.1.0_1
 practicalmeteor:mocha-core@1.0.1
-promise@0.10.2
+promise@0.11.2
 raix:eventemitter@0.1.3
 random@1.1.0
 rate-limit@1.0.9
 react-meteor-data@0.2.16
-reactive-dict@1.2.0
+reactive-dict@1.3.0
 reactive-var@1.0.11
-reload@1.2.0
+reload@1.3.0
 retry@1.1.0
 reywood:publish-composite@1.6.0
-routepolicy@1.0.13
+routepolicy@1.1.0
 saucecode:timezoned-synced-cron@1.2.11
 selaias:cookie-consent@0.4.0
-server-render@0.3.0
 service-configuration@1.0.11
-session@1.1.7
+session@1.2.0
 sha@1.0.9
-shell-server@0.3.1
-shim-common@0.1.0
+shell-server@0.4.0
 simple:json-routes@2.1.0
-socket-stream-client@0.1.0
+socket-stream-client@0.2.2
 spacebars@1.0.15
 spacebars-compiler@1.1.3
-srp@1.0.10
-standard-minifier-css@1.4.1
-standard-minifier-js@2.3.3
+srp@1.0.12
+standard-minifier-css@1.5.4
+standard-minifier-js@2.5.2
 static-html@1.2.2
 templating@1.3.2
 templating-compiler@1.3.3
@@ -145,11 +147,11 @@ templating-runtime@1.3.2
 templating-tools@1.1.2
 themeteorchef:bert@2.1.3
 tmeasday:check-npm-versions@0.3.2
-tracker@1.1.3
+tracker@1.2.0
 ui@1.0.13
 underscore@1.0.10
 url@1.2.0
 vjrj:piwik@0.3.1
-webapp@1.5.0
+webapp@1.7.5
 webapp-hashing@1.0.9
 xolvio:cleaner@0.3.3

UPGRADE.md

@@ -0,0 +1,91 @@
+# Meteor upgrade — 1.6.1.1 → 2.x (→ 3.x blocked)
+
+Incremental, verified upgrade of `todos-contra-el-fuego-web`. Branch:
+`meteor3-upgrade` (base `tcef-master`). Local commits only — no push until
+authorized.
+
+## ⚠️ Hard blocker for the final 3.x jump: MongoDB 3.2
+
+Production runs against the shared replica set **rsmain on MongoDB 3.2.11**.
+Meteor 3 ships the modern `mongodb` Node driver, which requires a server
+**≥ 4.2/4.4**. Meteor **2.x still works against Mongo 3.2**.
+
+Therefore this branch stops at the **highest stable 2.x** with everything green,
+and the `meteor update --release 3.x` step is **deliberately not taken** until
+the Comunes infra team upgrades rsmain (shared infra — coordinated in a separate
+phase, not unilaterally). The 2.x server code is migrated to async/await ahead
+of time so the final 3.x jump is mechanical.
+
+## ⚠️ Deploy-ordering dependency: notifications cutover
+
+The old push/email notification code was removed from the web (see the
+notifications commit) because it now lives in the **tcef-notifications**
+microservice. **Production must not run this build until tcef-notifications is
+emitting in prod** — otherwise users stop receiving notifications. The web
+deploy and the notifications cutover must be coordinated.
+
+## Safety net: REST smoke test
+
+`smoke/` is a standalone Node harness that calls every REST endpoint the Flutter
+app consumes, against a seeded local dev server, and diffs the responses against
+committed snapshots (`smoke/snapshots/`). See `smoke/README.md`.
+
+**Run after every escala — it must stay byte-identical:**
+
+```bash
+docker run -d --name tcef-mongo32 -p 27018:27017 mongo:3.2   # once
+export PATH="$HOME/.meteor:$PATH" MONGO_URL="mongodb://localhost:27018/fuegos"
+meteor --settings settings-development.json --port 3100 &     # dev server
+./smoke/smoke.sh                                              # seed + compare
+```
+
+## Escalas
+
+### Baseline — Meteor 1.6.1.1 (starting point)
+
+- Boots against Mongo 3.2 with `settings-development.json`.
+- Dev-enabling changes (do not affect production behavior):
+  - `IPGeocoder.js`: degrade gracefully when the MaxMind GeoLite2 DB is absent
+    (provisioned by cron in prod) instead of crashing at boot.
+  - `settings-development.json`: added dev-only `private.internalApiToken`
+    (`dev-smoke-token`) — the REST API only registers its routes when this is
+    set.
+- **Notifications code removed** (migrated to tcef-notifications): deleted
+  `notificationsObserver.js`, `notificationsProcess.js`, the "Process pending
+  notif" SyncedCron job, and the `node-gcm` dependency. `subsUnion.js` kept (it
+  feeds `subs-public-union`, consumed by the app).
+- REST smoke baseline captured here. ✅ green.
+
+### Escala 1 — 1.6.1.1 → 1.8.3  ✅ green
+
+```bash
+meteor update --release 1.8.3
+meteor npm install --save @babel/runtime@^7.26.0
+```
+
+Core packages bumped (highlights): `meteor` 1.8.6→1.9.3, `ecmascript`
+0.10.7→0.13.2, `modules` 0.11.6→0.14.0, `mongo` 1.4.7→1.7.0, `npm-mongo`
+2.2.34→**3.2.0** (mongodb driver 3.x — still fine against Mongo 3.2 server),
+`webapp` 1.5.0→1.7.5, `standard-minifier-js` →2.5.2. `underscore` auto-added
+(1.7 dropped it from meteor-base), `fetch` + `modern-browsers` added.
+
+**Breaking change — Babel beta → stable.** Boot failed with
+`Cannot find module '@babel/runtime/helpers/objectSpread2'`: the pinned
+`@babel/runtime@7.0.0-beta.44` predates helpers that 1.8's `ecmascript` emits.
+Fixed by upgrading to stable **7.x** (`@babel/runtime@^7.29.7`). Note: `@latest`
+resolves to `8.x`, which is too new for Meteor's 7-style helper layout — pin to
+`^7`.
+
+REST smoke test: **byte-identical to baseline.** ✅
+
+## Dependency debt (tracked, to resolve in the noted escala)
+
+| Dep | From | Target | Status |
+|---|---|---|---|
+| React / react-dom | 16.0 | 18 | pending (escala 1.11) |
+| raven / flowkey:raven | 2.4 | @sentry/node + @sentry/react | pending — DSN off until GlitchTip/Sentry back |
+| nodemailer | 4 | 6+ | pending |
+| Babel | 7 beta | 7 stable | pending (first escala that allows) |
+| i18next | 10 | current | evaluate cost; pin + note as debt if it breaks a lot |
+| Leaflet | 1.3.1 | current | evaluate cost; pin + note as debt if it breaks a lot |
+| node-gcm | 1.0.2 | — | ✅ removed (dead API, moved to microservice) |

package.json

@@ -6,7 +6,7 @@
     "test": "jest"
   },
   "dependencies": {
-    "@babel/runtime": "^7.0.0-beta.44",
+    "@babel/runtime": "^7.29.7",
     "@cleverbeagle/dates": "^0.5.1",
     "@cleverbeagle/seeder": "^1.3.1",
     "@turf/buffer": "^5.1.5",