Exclude CODEOWNERS from language statistics

Add CODEOWNERS (one staff approval)
Fix card details import
2026-10-31 16:52:22 -04:00 · 2026-10-31 16:52:21 -04:00 · 2026-06-13 11:54:24 -04:00 · 2026-06-13 11:52:03 -04:00 · 2026-06-13 14:38:34 +00:00 · 2026-06-13 17:31:44 +03:00
1173 changed files with 289143 additions and 179130 deletions
@@ -251,7 +251,7 @@ gosu wekan:wekan /home/wekan/.meteor/meteor -- help
 # Build app (Development)
 cd /home/wekan/app
 gosu wekan:wekan /home/wekan/.meteor/meteor add standard-minifier-js
-gosu wekan:wekan /home/wekan/.meteor/meteor npm install
+gosu wekan:wekan /home/wekan/.meteor/meteor npm install --no-audit

 # Put back the original tar
 mv $(which tar)~ $(which tar)
@@ -20,7 +20,10 @@
    "strict": 0,
    "no-undef": 0,
    "accessor-pairs": 2,
-    "comma-dangle": [2, "always-multiline"],
+    "comma-dangle": [
+      2,
+      "always-multiline"
+    ],
    "consistent-return": 2,
    "dot-notation": 2,
    "eqeqeq": 2,
@@ -28,15 +31,28 @@
    "no-cond-assign": 2,
    "no-constant-condition": 2,
    "no-eval": 2,
-    "no-inner-declarations": [0],
+    "no-inner-declarations": [
+      0
+    ],
    "no-unneeded-ternary": 2,
    "radix": 2,
-    "semi": [2, "always"],
-    "camelcase": [2, { "properties": "never" }],
+    "semi": [
+      2,
+      "always"
+    ],
+    "camelcase": [
+      2,
+      {
+        "properties": "never"
+      }
+    ],
    "comma-spacing": 2,
    "comma-style": 2,
    "eol-last": 2,
-    "linebreak-style": [2, "unix"],
+    "linebreak-style": [
+      2,
+      "unix"
+    ],
    "meteor/audit-argument-checks": 0,
    "new-parens": 2,
    "no-lonely-if": 2,
@@ -45,7 +61,13 @@
    "no-spaced-func": 2,
    "no-trailing-spaces": 2,
    "operator-linebreak": 2,
-    "quotes": [2, "single", { "avoidEscape": true }],
+    "quotes": [
+      2,
+      "single",
+      {
+        "avoidEscape": true
+      }
+    ],
    "semi-spacing": 2,
    "space-unary-ops": 2,
    "arrow-spacing": 2,
@@ -57,6 +79,7 @@
    "prefer-spread": 2,
    "prefer-template": 2,
    "no-unused-vars": "warn",
+    "@typescript-eslint/no-floating-promises": "error",
    "prettier/prettier": [
      "error",
      {
@@ -72,11 +95,18 @@
  "settings": {
    "import/resolver": {
      "meteor": {
-        "extensions": [".js", ".jsx"]
+        "extensions": [
+          ".js",
+          ".jsx"
+        ]
      }
    }
  },
-  "plugins": ["prettier", "meteor"],
+  "plugins": [
+    "prettier",
+    "meteor",
+    "@typescript-eslint"
+  ],
  "globals": {
    "Meteor": false,
    "Session": false,
@@ -93,10 +123,8 @@
    "Template": false,
    "$": false,
    "_": false,
-    "autosize": false,
    "Avatar": true,
    "Avatars": true,
-
    "CollectionHooks": false,
    "ESSearchResults": false,
    "FastRender": false,
@@ -111,7 +139,6 @@
    "Ps": true,
    "Restivus": false,
    "SimpleSchema": false,
-    "SubsManager": false,
    "T9n": false,
    "TAPi18n": false,
    "AccountsTemplates": true,
@@ -146,7 +173,6 @@
    "Checklists": true,
    "Settings": true,
    "InvitationCodes": true,
-    "JsonRoutes": true,
    "Authentication": true,
    "Integrations": true,
    "HTTP": true,
@@ -1,3 +1,4 @@
 * text=auto eol=lf
 *.{cmd,[cC][mM][dD]} text eol=crlf
-*.{bat,[bB][aA][tT]} text eol=crlf
+*.{bat,[bB][aA][tT]} text eol=crlf
+.gitea/CODEOWNERS linguist-detectable=false
@@ -0,0 +1,3 @@
+# Pull requests request review from the eligible staff team(s).
+# One approval from either an Admin or Developer satisfies branch protection.
+*   @trueog/Admins @trueog/Developers
@@ -11,4 +11,4 @@ jobs:
      - name: 'Checkout Repository'
        uses: actions/checkout@v6
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
@@ -38,7 +38,7 @@ jobs:
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -48,14 +48,14 @@ jobs:
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
-        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -0,0 +1,251 @@
+name: Playwright E2E Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: playwright-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  unit-tests:
+    name: Meteor unit tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v5
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache Meteor build (.meteor/local)
+        uses: actions/cache@v5
+        with:
+          path: .meteor/local
+          key: meteor-local-unit-${{ hashFiles('.meteor/versions') }}
+          restore-keys: meteor-local-unit-
+
+      - name: Install Meteor
+        run: |
+          if [ ! -x ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Run Meteor unit tests
+        # First Meteor build is slow; allow time before the test driver starts.
+        timeout-minutes: 45
+        run: meteor test --once --driver-package meteortesting:mocha
+        env:
+          TEST_WATCH: '0'
+
+  e2e-tests:
+    name: Playwright E2E (${{ matrix.project }})
+    runs-on: ubuntu-24.04
+    needs: unit-tests
+    strategy:
+      fail-fast: false
+      matrix:
+        project: [chromium, firefox]
+        # webkit excluded from CI (requires macOS runner) — run locally with npm run test:e2e:all
+
+    services:
+      mongodb:
+        image: mongo:7
+        ports: ['27017:27017']
+        options: >-
+          --health-cmd "mongosh --eval 'db.adminCommand(\"ping\")'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v5
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache Meteor build (.meteor/local)
+        uses: actions/cache@v5
+        with:
+          path: .meteor/local
+          key: meteor-local-e2e-${{ hashFiles('.meteor/versions') }}
+          restore-keys: meteor-local-e2e-
+
+      - name: Install Meteor
+        run: |
+          if [ ! -x ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install app npm dependencies
+        run: npm ci
+
+      - name: Install Playwright test dependencies
+        run: npm ci
+        working-directory: tests/playwright
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps ${{ matrix.project }}
+        working-directory: tests/playwright
+
+      - name: Start WeKan in background
+        run: |
+          MONGO_URL=mongodb://localhost:27017/wekan_test \
+          ROOT_URL=http://localhost:3000 \
+          PORT=3000 \
+          meteor run --settings settings.json > wekan-run.log 2>&1 &
+          # The first Meteor build is slow, so wait up to 20 minutes for the
+          # server to start responding before giving up.
+          for i in $(seq 1 120); do
+            if curl -sf http://localhost:3000 > /dev/null; then
+              echo "WeKan is up after $((i * 10))s"
+              break
+            fi
+            echo "Waiting for WeKan... attempt $i/120"
+            sleep 10
+          done
+          if ! curl -sf http://localhost:3000 > /dev/null; then
+            echo "WeKan failed to start. Last 200 log lines:"
+            tail -n 200 wekan-run.log
+            exit 1
+          fi
+        env:
+          DISABLE_CAPTCHA: 'true'
+
+      - name: Run Playwright tests (${{ matrix.project }})
+        run: |
+          npx playwright test \
+            --project=${{ matrix.project }} \
+            --reporter=github
+        working-directory: tests/playwright
+        env:
+          WEKAN_BASE_URL: http://localhost:3000
+          WEKAN_MONGO_URL: mongodb://localhost:27017/wekan_test
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report-${{ matrix.project }}
+          path: tests/playwright/playwright-report/
+          retention-days: 14
+
+      - name: Upload test results (screenshots / videos)
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-${{ matrix.project }}
+          path: tests/playwright/test-results/
+          retention-days: 7
+
+  e2e-regression:
+    name: Puppeteer regression suite
+    runs-on: ubuntu-24.04
+    needs: unit-tests
+
+    services:
+      mongodb:
+        image: mongo:7
+        ports: ['27017:27017']
+        options: >-
+          --health-cmd "mongosh --eval 'db.adminCommand(\"ping\")'"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v5
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache Meteor build (.meteor/local)
+        uses: actions/cache@v5
+        with:
+          path: .meteor/local
+          key: meteor-local-regression-${{ hashFiles('.meteor/versions') }}
+          restore-keys: meteor-local-regression-
+
+      - name: Install Meteor
+        run: |
+          if [ ! -x ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> "$GITHUB_PATH"
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Install Chromium
+        run: sudo apt-get install -y chromium-browser
+
+      - name: Start WeKan in background
+        run: |
+          MONGO_URL=mongodb://localhost:27017/wekan_regression \
+          ROOT_URL=http://localhost:3000 \
+          PORT=3000 \
+          meteor run > wekan-run.log 2>&1 &
+          # The first Meteor build is slow, so wait up to 20 minutes.
+          for i in $(seq 1 120); do
+            if curl -sf http://localhost:3000 > /dev/null; then
+              echo "WeKan is up after $((i * 10))s"
+              break
+            fi
+            echo "Waiting for WeKan... attempt $i/120"
+            sleep 10
+          done
+          if ! curl -sf http://localhost:3000 > /dev/null; then
+            echo "WeKan failed to start. Last 200 log lines:"
+            tail -n 200 wekan-run.log
+            exit 1
+          fi
+        env:
+          DISABLE_CAPTCHA: 'true'
+
+      - name: Run list-regressions e2e
+        run: node tests/e2e/list-regressions.js
+        env:
+          WEKAN_BASE_URL: http://localhost:3000
+          WEKAN_MONGO_URL: mongodb://localhost:27017/wekan_regression
+          CHROMIUM_PATH: /usr/bin/chromium-browser
+          HEADLESS: 'true'
@@ -0,0 +1,633 @@
+name: Release All Platforms
+
+# Triggered manually via GitHub CLI or the Actions UI.
+# Usage:
+#   gh workflow run release-all.yml -f old_version=9.35 -f new_version=9.36
+#
+# Or use the convenience script (bumps versions, commits, pushes, then triggers):
+#   ./releases/release-all.sh 9.35 9.36
+#
+# Builds only the platforms MongoDB ships server binaries for (amd64, arm64,
+# win64, mac); MongoDB 7.x is the default database. s390x/ppc64le are not built
+# because MongoDB has no server binaries for them.
+#
+# This workflow does EVERYTHING for a release remotely (nothing is built or
+# pushed on the maintainer's machine), running jobs in parallel where possible:
+#   - bump:    runs releases/version.sh + releases/rebuild-docs.sh on the runner
+#              (bumps Node/MongoDB/WeKan versions, rebuilds API docs), then
+#              commits and pushes the bump to wekan/wekan main
+#   - prepare: tags the bumped main as v<new_version> and extracts release notes
+#   - website: updates the wekan/wekan.fi repo (install page + API docs) and pushes
+#   - charts:  updates and publishes the wekan/charts Helm chart and pushes
+#   - build-*: builds the amd64 bundle (full Meteor 3 build), then rebuilds native
+#              modules for arm64, win64, mac-arm64 from that amd64 base
+#   - release: creates the GitHub Release with the newest CHANGELOG.md notes and
+#              uploads every wekan-<version>-<platform>.zip bundle
+#   - docker:  builds and pushes the multi-arch image to Docker Hub, Quay.io, GHCR
+#   - snap:    builds the snap on Launchpad (amd64 + arm64), pushes it to the Snap
+#              Store and attaches the .snap files to the GitHub Release
+#
+# Required GitHub Secrets:
+#   GHCR_AUTH        - base64("username:token") for ghcr.io
+#   DOCKERHUB_AUTH   - base64("username:token") for Docker Hub
+#   QUAY_AUTH        - base64("username:token") for Quay.io
+#   SNAP_AUTH        - Snap Store credentials (output of `snapcraft export-login`)
+#   LP_CREDENTIALS   - base64 of the Launchpad credentials file used by
+#                      `snapcraft remote-build` (see releases/snap-build.sh notes)
+#   WEKAN_REPO_TOKEN - Personal Access Token with write access to wekan/wekan.fi
+#                      and wekan/charts, used by the website + charts jobs to push
+#                      to those repos (the built-in GITHUB_TOKEN only covers
+#                      wekan/wekan). See releases/create-github-secrets.sh.
+
+on:
+  workflow_dispatch:
+    inputs:
+      old_version:
+        description: 'Previous version number (e.g. 9.35, without v prefix)'
+        required: true
+        type: string
+      new_version:
+        description: 'New version number (e.g. 9.36, without v prefix)'
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  packages: write
+
+# Node.js major version that Meteor 3.5-beta bundles. Used for native module
+# rebuilds on every platform — it must match the amd64 build's Node ABI.
+env:
+  NODE_VERSION: '24'
+
+jobs:
+
+  # ─── 0. Bump versions + rebuild API docs, commit to main ────────────────────
+  # Runs releases/version.sh (probes upstream for the newest Node.js/MongoDB,
+  # bumps every version reference) and releases/rebuild-docs.sh (regenerates
+  # public/api/wekan.yml + wekan.html), then commits and pushes to main so the
+  # tag, builds, website and charts jobs all see the bumped sources.
+  bump:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install version-bump and docs build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3 python3-pip curl wget
+
+      - name: Bump versions and rebuild API docs
+        env:
+          # Builds fetch dependencies from upstream themselves, so skip the slow
+          # pre-download of Node/MongoDB tarballs that the local flow does.
+          RELEASE_SKIP_DEP_DOWNLOAD: '1'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          ./releases/version.sh "${{ inputs.old_version }}" "${{ inputs.new_version }}"
+          ./releases/rebuild-docs.sh "${{ inputs.new_version }}"
+
+      - name: Commit and push version bump
+        run: |
+          git add --all
+          if git diff --cached --quiet; then
+            echo "No version changes to commit."
+          else
+            git commit -m "Bump versions for v${{ inputs.new_version }}"
+            git push origin main
+          fi
+
+  # ─── 1. Tag the release and extract release notes ───────────────────────────
+  prepare:
+    needs: bump
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      changelog: ${{ steps.changelog.outputs.content }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Normalise version from input
+        id: version
+        run: |
+          VERSION="${{ inputs.new_version }}"
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create and push tag v${{ steps.version.outputs.version }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            echo "Tag v$VERSION already exists, leaving it as is."
+          else
+            git tag -a "v$VERSION" -m "v$VERSION"
+            git push origin "v$VERSION"
+          fi
+
+      - name: Extract release notes from CHANGELOG.md
+        id: changelog
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          # Prefer a version-specific "# v<version> ..." section, otherwise fall
+          # back to the topmost "# Upcoming/Upcomig WeKan ® release" section.
+          NOTES=$(python3 - <<PYEOF
+          import re, sys
+          version = "$VERSION"
+          with open("CHANGELOG.md", encoding="utf-8") as f:
+              content = f.read()
+          patterns = [
+              rf"(# v{re.escape(version)} .*?)(?=\n# v[0-9]|\Z)",
+              r"(# Upcom\w* WeKan.*?)(?=\n# v[0-9]|\Z)",
+          ]
+          for pat in patterns:
+              m = re.search(pat, content, re.DOTALL)
+              if m:
+                  print(m.group(1).strip())
+                  sys.exit(0)
+          print(f"WeKan v{version}")
+          PYEOF
+          )
+          {
+            echo "content<<GHEOF"
+            echo "$NOTES"
+            echo "GHEOF"
+          } >> "$GITHUB_OUTPUT"
+
+  # ─── 1b. Update the wekan.fi website repo (parallel) ────────────────────────
+  # Bumps the version/Meteor/Node/MongoDB strings on the install page and copies
+  # the freshly rebuilt API docs into wekan.fi/api/v<new>, then commits + pushes
+  # to wekan/wekan.fi. Runs as soon as `bump` has pushed the bumped sources.
+  website:
+    needs: bump
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout wekan repo (bumped main, with rebuilt API docs)
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          path: wekan
+
+      - name: Checkout wekan.fi website repo
+        uses: actions/checkout@v6
+        with:
+          repository: wekan/wekan.fi
+          token: ${{ secrets.WEKAN_REPO_TOKEN }}
+          path: wekan.fi
+
+      - name: Update and push website
+        env:
+          WEBDIR: ${{ github.workspace }}/wekan.fi
+          WEKANREPODIR: ${{ github.workspace }}/wekan
+          RELEASE_PUSH_WEBSITE: '1'
+        run: |
+          cd wekan.fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          cd ..
+          ./wekan/releases/release-website.sh "${{ inputs.old_version }}" "${{ inputs.new_version }}"
+
+  # ─── 1c. Update and publish the Helm chart repo (parallel) ──────────────────
+  # Bumps the WeKan version in wekan/charts, packages the chart and publishes it
+  # to the gh-pages Helm index, then pushes both branches. Runs in parallel with
+  # the platform builds; packaging the chart does not need the built artifacts.
+  charts:
+    needs: bump
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout wekan repo (for releases/release-charts.sh + version refs)
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          path: wekan
+
+      - name: Checkout wekan/charts repo (main + gh-pages)
+        uses: actions/checkout@v6
+        with:
+          repository: wekan/charts
+          token: ${{ secrets.WEKAN_REPO_TOKEN }}
+          fetch-depth: 0
+          path: charts
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+
+      - name: Fetch gh-pages branch (release-charts.sh switches to it)
+        run: |
+          cd charts
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git fetch origin '+refs/heads/*:refs/remotes/origin/*'
+          git branch --track gh-pages origin/gh-pages 2>/dev/null || true
+
+      - name: Release and publish chart
+        env:
+          CHARTS_DIR: ${{ github.workspace }}/charts
+        run: |
+          ./wekan/releases/release-charts.sh "${{ inputs.new_version }}"
+
+  # ─── 2. Build amd64 bundle (full Meteor 3 build) ────────────────────────────
+  # Meteor 3.5-beta installer supports only Linux x86_64/aarch64, macOS, Windows.
+  # The full Meteor build always runs here on x86_64; every other platform then
+  # only rebuilds the native npm modules from this bundle.
+  build-amd64:
+    needs: prepare
+    runs-on: ubuntu-24.04
+    timeout-minutes: 180
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
+
+      - name: Cache Meteor installation
+        uses: actions/cache@v5
+        with:
+          path: ~/.meteor
+          key: meteor-${{ hashFiles('.meteor/release') }}-${{ hashFiles('.meteor/packages') }}
+          restore-keys: meteor-
+
+      - name: Cache npm packages
+        uses: actions/cache@v5
+        with:
+          path: ~/.npm
+          key: npm-${{ hashFiles('package-lock.json') }}
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential g++ make python3 curl wget zip unzip
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install Meteor
+        run: |
+          if [ ! -f ~/.meteor/meteor ]; then
+            curl https://install.meteor.com/ | sh
+          fi
+          echo "$HOME/.meteor" >> $GITHUB_PATH
+
+      - name: Build WeKan bundle
+        run: |
+          rm -rf .build node_modules .meteor/local
+          (meteor update --npm 2>/dev/null || true) && meteor npm install
+          meteor build .build --directory
+
+      - name: Install server npm modules
+        run: |
+          cd .build/bundle/programs/server
+          npm install
+
+      - name: Create amd64 zip
+        run: |
+          cd .build
+          zip -r wekan-${VERSION}-amd64.zip bundle
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: bundle-amd64
+          path: .build/wekan-${{ needs.prepare.outputs.version }}-amd64.zip
+          retention-days: 1
+
+  # ─── 3. Build arm64 bundle (rebuild native modules natively) ─────────────────
+  build-arm64:
+    needs: [prepare, build-amd64]
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 60
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential g++ make python3 curl unzip zip
+
+      - name: Download amd64 bundle
+        uses: actions/download-artifact@v8
+        with:
+          name: bundle-amd64
+
+      - name: Rebuild native modules for arm64 in container
+        run: |
+          unzip wekan-${VERSION}-amd64.zip
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -a bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
+          docker run --rm --platform linux/arm64 \
+            -v "$(pwd)/bundle:/bundle" \
+            -w /bundle/programs/server \
+            node:${NODE_VERSION}-slim \
+            sh -c "apt-get update -qq && apt-get install -y -q build-essential python3 && npm install"
+
+      - name: Create arm64 zip
+        run: |
+          zip -r wekan-${VERSION}-arm64.zip bundle
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: bundle-arm64
+          path: wekan-${{ needs.prepare.outputs.version }}-arm64.zip
+          retention-days: 1
+
+  # ─── 5. Build win64 bundle (rebuild native modules on Windows) ───────────────
+  build-win64:
+    needs: [prepare, build-amd64]
+    runs-on: windows-latest
+    timeout-minutes: 60
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      # Checked out into src/ so start-wekan.bat and snapcraft.yaml (which pins
+      # the MongoDB tools/mongosh versions) are available; the downloaded bundle
+      # is extracted alongside it in the workspace root.
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
+          path: src
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install 7-zip
+        run: choco install -y 7zip
+
+      - name: Download amd64 bundle
+        uses: actions/download-artifact@v8
+        with:
+          name: bundle-amd64
+
+      - name: Fix bcrypt for Node.js 24
+        shell: bash
+        run: |
+          7z x wekan-${VERSION}-amd64.zip
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -r bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
+
+      - name: Rebuild native modules for Windows
+        shell: bash
+        run: |
+          cd bundle/programs/server
+          rm -rf node_modules
+          npm install
+
+      - name: Add MongoDB tools, mongosh and start-wekan.bat to the bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Use the same MongoDB tools/mongosh versions as the snap, which
+          # releases/version.sh keeps at the newest release for each bundle.
+          TOOLS_VER=$(grep -oE 'mongodb-database-tools-ubuntu2204-\$\{TOOLS_ARCH\}-[0-9]+\.[0-9]+\.[0-9]+' src/snapcraft.yaml \
+                       | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+          MONGOSH_VER=$(grep -oE 'mongosh-[0-9]+\.[0-9]+\.[0-9]+-linux' src/snapcraft.yaml \
+                         | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
+          echo "MongoDB Database Tools: $TOOLS_VER   mongosh: $MONGOSH_VER"
+
+          # MongoDB Database Tools (Windows): bsondump, mongodump, mongoexport,
+          # mongofiles, mongoimport, mongorestore, mongostat, mongotop.
+          TOOLS_DIR="mongodb-database-tools-windows-x86_64-${TOOLS_VER}"
+          curl -fL -o tools.zip \
+            "https://fastdl.mongodb.org/tools/db/${TOOLS_DIR}.zip"
+          7z x -y tools.zip > /dev/null
+          cp "${TOOLS_DIR}/bin/"*.exe bundle/
+
+          # mongosh (Windows): mongosh.exe + mongosh_crypt_v1.dll.
+          MONGOSH_DIR="mongosh-${MONGOSH_VER}-win32-x64"
+          curl -fL -o mongosh.zip \
+            "https://downloads.mongodb.com/compass/${MONGOSH_DIR}.zip"
+          7z x -y mongosh.zip > /dev/null
+          cp "${MONGOSH_DIR}/bin/mongosh.exe" bundle/
+          cp "${MONGOSH_DIR}/bin/mongosh_crypt_v1.dll" bundle/
+
+          # Windows launcher from the repo root.
+          cp src/start-wekan.bat bundle/
+
+          echo "=== bundle contents ==="
+          ls -1 bundle/
+
+      - name: Create win64 zip
+        shell: cmd
+        run: 7z a wekan-%VERSION%-win64.zip bundle
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: bundle-win64
+          path: wekan-${{ needs.prepare.outputs.version }}-win64.zip
+          retention-days: 1
+
+  # ─── 6. Build mac-arm64 bundle (rebuild native modules on Apple Silicon) ─────
+  build-mac-arm64:
+    needs: [prepare, build-amd64]
+    runs-on: macos-14   # macos-14 runners are Apple Silicon (arm64)
+    timeout-minutes: 60
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Download amd64 bundle
+        uses: actions/download-artifact@v8
+        with:
+          name: bundle-amd64
+
+      - name: Rebuild native modules for macOS arm64
+        run: |
+          unzip -q wekan-${VERSION}-amd64.zip
+          # Fix: bcrypt 5.0.1 (Meteor accounts-password) ships node-addon-api@3
+          # which fails to compile on Node.js 24. Replace with bcrypt 6.0.0.
+          BCRYPT_DIR="$(pwd)/bundle/programs/server/npm/node_modules/meteor/accounts-password/node_modules/bcrypt"
+          if [ -d "$BCRYPT_DIR" ]; then
+            rm -rf "$BCRYPT_DIR"
+            TMP=$(mktemp -d)
+            pushd "$TMP" > /dev/null
+            npm pack bcrypt@6.0.0
+            mkdir bcrypt && tar xzf bcrypt-*.tgz --strip-components=1 -C bcrypt
+            cd bcrypt && npm install --ignore-scripts && cd ..
+            cp -a bcrypt "$BCRYPT_DIR"
+            popd > /dev/null
+            rm -rf "$TMP"
+          fi
+          cd bundle/programs/server
+          rm -rf node_modules
+          npm install
+          cd ../../..
+
+      - name: Create mac-arm64 zip
+        run: zip -r wekan-${VERSION}-mac-arm64.zip bundle
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: bundle-mac-arm64
+          path: wekan-${{ needs.prepare.outputs.version }}-mac-arm64.zip
+          retention-days: 1
+
+  # ─── 7. Create GitHub Release and upload all bundles ────────────────────────
+  release:
+    needs:
+      - prepare
+      - build-amd64
+      - build-arm64
+      - build-win64
+      - build-mac-arm64
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - name: Download all bundles
+        uses: actions/download-artifact@v8
+        with:
+          pattern: bundle-*
+          merge-multiple: true
+
+      - name: Create GitHub Release with all bundles
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: v${{ needs.prepare.outputs.version }}
+          name: v${{ needs.prepare.outputs.version }}
+          body: ${{ needs.prepare.outputs.changelog }}
+          files: |
+            wekan-${{ needs.prepare.outputs.version }}-amd64.zip
+            wekan-${{ needs.prepare.outputs.version }}-arm64.zip
+            wekan-${{ needs.prepare.outputs.version }}-win64.zip
+            wekan-${{ needs.prepare.outputs.version }}-mac-arm64.zip
+
+  # ─── 8. Build and push the multi-arch Docker image to all registries ────────
+  # Mirrors releases/docker-build.sh step 3 (multi-arch buildx --push).
+  # Needs `release` because the Dockerfile downloads wekan-<version>-<arch>.zip
+  # from the GitHub Release; building before those assets exist 404s and (without
+  # set -e in the Dockerfile) shipped a broken image missing /build/main.js.
+  docker:
+    needs: [prepare, release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub, Quay.io and GHCR
+        env:
+          DOCKERHUB_AUTH: ${{ secrets.DOCKERHUB_AUTH }}
+          QUAY_AUTH: ${{ secrets.QUAY_AUTH }}
+          GHCR_AUTH: ${{ secrets.GHCR_AUTH }}
+        run: |
+          login() {
+            # $1 = registry host, $2 = base64("user:token")
+            local host="$1" creds user token
+            creds="$(printf '%s' "$2" | base64 -d)"
+            user="${creds%%:*}"
+            token="${creds#*:}"
+            printf '%s' "$token" | docker login "$host" -u "$user" --password-stdin
+          }
+          login docker.io "$DOCKERHUB_AUTH"
+          login quay.io   "$QUAY_AUTH"
+          login ghcr.io   "$GHCR_AUTH"
+
+      - name: Build and push multi-arch image
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            -t wekanteam/wekan:v${VERSION} \
+            -t wekanteam/wekan:latest \
+            -t quay.io/wekan/wekan:v${VERSION} \
+            -t quay.io/wekan/wekan:latest \
+            -t ghcr.io/wekan/wekan:v${VERSION} \
+            -t ghcr.io/wekan/wekan:latest \
+            --push \
+            .
+
+  # ─── 9. Build the snap on Launchpad, push to the store, attach to release ────
+  # The snap's `wekan` part downloads wekan-<version>-<arch>.zip from the GitHub
+  # Release, so this job runs only after `release` has published those assets.
+  # `snapcraft remote-build` builds every platform listed in snapcraft.yaml
+  # (amd64 + arm64) on Launchpad.
+  snap:
+    needs: [prepare, release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: refs/tags/v${{ needs.prepare.outputs.version }}
+          # remote-build (Launchpad) rejects shallow clones, so fetch full history
+          fetch-depth: 0
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Provide Launchpad credentials for remote-build
+        env:
+          LP_CREDENTIALS: ${{ secrets.LP_CREDENTIALS }}
+        run: |
+          mkdir -p ~/.local/share/snapcraft
+          printf '%s' "$LP_CREDENTIALS" | base64 -d > ~/.local/share/snapcraft/launchpad-credentials
+          chmod 600 ~/.local/share/snapcraft/launchpad-credentials
+
+      - name: Build snaps on Launchpad (amd64 + arm64)
+        run: |
+          snapcraft remote-build --launchpad-accept-public-upload
+
+      - name: Push snaps to the Snap Store (edge + beta channels)
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_AUTH }}
+        run: |
+          for f in wekan_${VERSION}_*.snap; do
+            echo "Uploading $f to the Snap Store (edge,beta)..."
+            snapcraft upload --release=edge,beta "$f"
+          done
+
+      - name: Attach snaps to the GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "v${VERSION}" wekan_${VERSION}_*.snap --clobber
@@ -1,163 +0,0 @@
-name: Test suite
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
-jobs:
-# the following are optional jobs and need to be configured according
-# to this project's settings:
-#
-#  lintcode:
-#    name: Javascript lint
-#    runs-on: ubuntu-latest
-#    steps:
-#    - name: checkout
-#      uses: actions/checkout@v6
-#
-#    - name: setup node
-#      uses: actions/setup-node@v1
-#      with:
-#        node-version: '12.x'
-#
-#    - name: cache dependencies
-#      uses: actions/cache@v1
-#      with:
-#        path: ~/.npm
-#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-#        restore-keys: |
-#          ${{ runner.os }}-node-
-#
-#    - run: npm install
-#    - run: npm run lint:code
-#
-#  lintstyle:
-#    name: SCSS lint
-#    runs-on: ubuntu-latest
-#    needs: [lintcode]
-#    steps:
-#    - name: checkout
-#      uses: actions/checkout@v6
-#
-#    - name: setup node
-#      uses: actions/setup-node@v1
-#      with:
-#        node-version: '12.x'
-#
-#    - name: cache dependencies
-#      uses: actions/cache@v1
-#      with:
-#        path: ~/.npm
-#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-#        restore-keys: |
-#          ${{ runner.os }}-node-
-#    - run: npm install
-#    - run: npm run lint:style
-#
-#  lintdocs:
-#    name: documentation lint
-#    runs-on: ubuntu-latest
-#    needs: [lintcode,lintstyle]
-#    steps:
-#    - name: checkout
-#      uses: actions/checkout@v6
-#
-#    - name: setup node
-#      uses: actions/setup-node@v1
-#      with:
-#        node-version: '12.x'
-#
-#    - name: cache dependencies
-#      uses: actions/cache@v1
-#      with:
-#        path: ~/.npm
-#        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-#        restore-keys: |
-#          ${{ runner.os }}-node-
-#
-#    - run: npm install
-#    - run: npm run lint:markdown
-
-  tests:
-    name: Meteor ${{ matrix.meteor }} tests
-    runs-on: ubuntu-latest
-    steps:
-
-      # CHECKOUTS
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      # CACHING
-      - name: Install Meteor
-        id: cache-meteor-install
-        uses: actions/cache@v5
-        with:
-          path: ~/.meteor
-          key: v1-meteor-${{ hashFiles('.meteor/versions') }}
-          restore-keys: |
-                v1-meteor-
-
-      - name: Cache NPM dependencies
-        id: cache-meteor-npm
-        uses: actions/cache@v5
-        with:
-          path: ~/.npm
-          key: v1-npm-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-                v1-npm-
-
-      - name: Cache Meteor build
-        id: cache-meteor-build
-        uses: actions/cache@v5
-        with:
-          path: |
-            .meteor/local/resolver-result-cache.json
-            .meteor/local/plugin-cache
-            .meteor/local/isopacks
-            .meteor/local/bundler-cache/scanner
-          key: v1-meteor_build_cache-${{ github.ref }}-${{ github.sha }}
-          restore-keys: |
-            v1-meteor_build_cache-
-
-      - name: Setup meteor
-        uses: meteorengineer/setup-meteor@v3
-        with:
-          meteor-release: '2.2'
-
-      - name: Install NPM Dependencies
-        run: meteor npm ci
-
-      - name: Run Tests
-        run: sh ./test-wekan.sh -cv
-
-      - name: Upload coverage
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage-folder
-          path: .coverage/
-
-  coverage:
-    name: Coverage report
-    runs-on: ubuntu-latest
-    needs: [tests]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Download coverage
-        uses: actions/download-artifact@v8
-        with:
-          name: coverage-folder
-          path: .coverage/
-
-
-      - name: Coverage Report
-        uses: VeryGoodOpenSource/very_good_coverage@v3.0.0
-        with:
-          path: ".coverage/lcov.info"
-          min_coverage: 1 # TODO add tests and increase to 95!
@@ -1,4 +1,5 @@
 *~
+/*.log
 *.sw*
 .meteor-spk
 *.sublime-workspace
@@ -35,7 +36,31 @@ ehthumbs.db
 .devcontainer/volumes*/
 .coverage

+# Rspack build artifacts
+_build/
+public/build-assets/
+public/build-chunks/
+private/build-assets/
+private/build-chunks/
+public/client-rspack.js.map
+
 # Helm chart
 # Chart dependencies
 /helm/wekan/**/*.tgz
 /helm/wekan/charts
+
+# Meteor Modern-Tools build context directories
+_build
+*/build-assets
+*/build-chunks
+.rsdoctor
+
+# Tests
+playwright-report/
+test-results/
+
+# Claude AI
+.claude/
+
+# Tools like mongosh etc so that they work inside Flatpak sandbox
+.tools/
@@ -3,28 +3,29 @@
 # 'meteor add' and 'meteor remove' will edit this file for you,
 # but you can also edit it by hand.

-meteor-base@1.5.1
+meteor-base@1.5.2

 # Build system
-ecmascript@0.16.8
-standard-minifier-js@2.8.1
-mquandalle:jade
-coffeescript@2.4.1!
+ecmascript@0.18.0
+standard-minifier-js@3.2.0
+rspack@1.1.0

-# Polyfills
-es5-shim@4.8.0
+blaze@3.0.2

 # Collections
 aldeed:collection2
+aldeed:schema-index@4.0.0-beta.5
 reywood:publish-composite
-dburles:collection-helpers
-mongo@1.16.8
+mongo@2.4.0-rc350.1

 # Account system
-accounts-password@2.4.0
-useraccounts:core
-useraccounts:unstyled
-simple:rest-accounts-password
+accounts-password@3.3.0-rc350.1
+accounts-express@1.0.0-rc350.1
+communitypackages:core
+communitypackages:unstyled
+communitypackages:flow-routing
+# Routing
+ostrio:flow-router-extra
 wekan-ldap
 wekan-accounts-cas
 wekan-accounts-sandstorm
@@ -33,47 +34,32 @@ wekan-oidc
 wekan-accounts-oidc

 # Utilities
-check@1.3.2
-jquery@3.0.0!
-random@1.2.1
-reactive-dict@1.3.1
-session@1.2.1
-tracker@1.3.3
-audit-argument-checks@1.0.7
-http@2.0.0! # force new http package
-
-# Datepicker (disabled - using native HTML inputs)
-# wekan-bootstrap-datepicker
+check@1.5.0
+random@1.2.2
+reactive-dict@1.3.2
+session@1.2.3-rc350.1
+tracker@1.3.4
+audit-argument-checks@1.0.8

 # UI components
 ostrio:i18n
-reactive-var@1.0.12
-meteor-autosize
-shell-server@0.5.0
-email@2.2.5
-dynamic-import@0.7.3
-msavin:usercache
-# Keep stylus in 1.1.0, because building v2 takes extra 52 minutes.
-meteorhacks:subs-manager
-meteorhacks:aggregate@1.3.0
+reactive-var@1.0.13
+shell-server@0.7.0
+email@3.2.0-rc350.1
+dynamic-import@0.7.4
 wekan-markdown
 quave:synced-cron
 ostrio:cookies
-ostrio:files@2.3.0
-lmieulet:meteor-coverage
-meteortesting:mocha@2.0.3
-aldeed:simple-schema
+ostrio:files
+# lmieulet:meteor-coverage
+meteortesting:mocha@3.0.0
 matb33:collection-hooks
-simple:json-routes
-spacebars
-service-configuration@1.3.2
-communitypackages:picker
-minifier-css@1.6.4
-blaze
-ejson@1.1.3
-logging@1.3.3
+service-configuration@1.3.5
+minifier-css@2.0.2-rc350.1
+ejson@1.2.0-rc350.1
+logging@1.3.6
 wekan-fullcalendar
 wekan-fontawesome
-
-useraccounts:flow-routing-extra
-ostrio:flow-router-extra
+jam:offline
+jam:method
+jam:pub-sub
@@ -1 +1 @@
-METEOR@2.16
+METEOR@3.5-rc.1
@@ -1,131 +1,114 @@
-accounts-base@2.2.11
-accounts-oauth@1.4.4
-accounts-password@2.4.0
-aldeed:collection2@2.10.0
-aldeed:collection2-core@1.2.0
-aldeed:schema-deny@1.1.0
-aldeed:schema-index@1.1.1
-aldeed:simple-schema@1.5.4
-allow-deny@1.1.1
-audit-argument-checks@1.0.7
-autoupdate@1.8.0
-babel-compiler@7.10.5
-babel-runtime@1.5.1
-base64@1.0.12
-binary-heap@1.0.11
-blaze@2.7.1
-blaze-tools@1.1.3
-boilerplate-generator@1.7.2
-caching-compiler@1.2.2
-caching-html-compiler@1.2.1
-callback-hook@1.5.1
-check@1.4.1
-coffeescript@2.7.0
-coffeescript-compiler@2.4.1
-communitypackages:picker@1.1.1
-dburles:collection-helpers@1.1.0
-ddp@1.4.1
-ddp-client@2.6.2
-ddp-common@1.4.1
-ddp-rate-limiter@1.2.1
-ddp-server@2.7.1
-deps@1.0.12
-diff-sequence@1.1.2
-dynamic-import@0.7.3
-ecmascript@0.16.8
-ecmascript-runtime@0.8.1
-ecmascript-runtime-client@0.12.1
-ecmascript-runtime-server@0.11.0
-ejson@1.1.3
-email@2.2.6
-es5-shim@4.8.0
-fetch@0.1.4
-geojson-utils@1.0.11
-hot-code-push@1.0.4
-html-tools@1.1.3
-htmljs@1.1.1
-http@2.0.0
-id-map@1.1.1
-inter-process-messaging@0.1.1
-jquery@3.0.0
-lmieulet:meteor-coverage@1.1.4
-localstorage@1.2.0
-logging@1.3.4
-matb33:collection-hooks@1.3.0
-mdg:validation-error@0.5.1
-meteor@1.11.5
-meteor-autosize@5.0.1
-meteor-base@1.5.1
-meteorhacks:aggregate@1.3.0
-meteorhacks:collection-utils@1.2.0
-meteorhacks:picker@1.0.3
-meteorhacks:subs-manager@1.6.4
-meteortesting:browser-tests@1.4.2
-meteortesting:mocha@2.1.0
-meteortesting:mocha-core@8.0.1
-minifier-css@1.6.4
-minifier-js@2.8.0
-minifiers@1.1.8-faster-rebuild.0
-minimongo@1.9.4
-modern-browsers@0.1.10
-modules@0.20.0
-modules-runtime@0.13.1
-mongo@1.16.10
-mongo-decimal@0.1.3
-mongo-dev-server@1.1.0
-mongo-id@1.0.8
-mongo-livedata@1.0.12
-mquandalle:jade@0.4.9
-mquandalle:jade-compiler@0.4.5
-msavin:usercache@1.8.0
-npm-mongo@4.17.2
-oauth@2.2.1
-oauth2@1.3.2
-observe-sequence@1.0.21
-ordered-dict@1.1.0
-ostrio:cookies@2.7.2
+accounts-base@3.3.0-rc350.1
+accounts-express@1.0.0-rc350.1
+accounts-oauth@1.4.7-rc350.1
+accounts-password@3.3.0-rc350.1
+aldeed:collection2@4.2.0
+aldeed:schema-index@4.0.0
+aldeed:simple-schema@1.13.1
+allow-deny@2.1.0
+audit-argument-checks@1.0.8
+autoupdate@2.0.1
+babel-compiler@7.14.0
+babel-runtime@1.5.2
+base64@1.0.14-rc350.1
+binary-heap@1.0.13-rc350.1
+blaze@3.0.3
+blaze-tools@2.0.1
+boilerplate-generator@2.1.0
+caching-compiler@2.0.1
+caching-html-compiler@2.0.1
+callback-hook@1.8.0-rc350.1
+check@1.5.0
+communitypackages:core@2.0.3
+communitypackages:flow-routing@2.1.0
+communitypackages:unstyled@2.0.1
+core-runtime@1.0.0
+ddp@1.4.2
+ddp-client@3.3.0-rc350.1
+ddp-common@1.4.5-rc350.1
+ddp-rate-limiter@1.3.0-rc350.1
+ddp-server@3.3.0-rc350.1
+diff-sequence@1.1.3
+dynamic-import@0.7.4
+ecmascript@0.18.0
+ecmascript-runtime@0.8.3
+ecmascript-runtime-client@0.13.0
+ecmascript-runtime-server@0.11.1
+ejson@1.2.0-rc350.1
+email@3.2.0-rc350.1
+es5-shim@4.8.1
+facts-base@1.0.2
+fetch@0.2.0-rc350.1
+geojson-utils@1.0.12
+hot-code-push@1.0.5
+html-tools@2.0.1
+htmljs@2.0.2
+id-map@1.2.0
+inter-process-messaging@0.1.2
+jam:method@1.9.1
+jam:offline@0.4.1
+jam:pub-sub@0.5.1
+jquery@3.0.2
+lai:collection-extensions@1.0.0
+localstorage@1.2.1
+logging@1.3.6
+matb33:collection-hooks@2.1.0
+meteor@2.3.1-rc350.1
+meteor-base@1.5.2
+meteortesting:browser-tests@1.8.0
+meteortesting:mocha@3.3.0
+meteortesting:mocha-core@8.2.0
+minifier-css@2.0.2-rc350.1
+minifier-js@3.2.0
+minimongo@2.2.0-rc350.1
+modern-browsers@0.2.3
+modules@0.20.3
+modules-runtime@0.13.2
+mongo@2.4.0-rc350.1
+mongo-decimal@0.2.0
+mongo-dev-server@1.1.1
+mongo-id@1.0.9
+npm-mongo@6.16.1
+oauth@3.0.4-rc350.1
+oauth2@1.3.3
+observe-sequence@2.0.1
+ordered-dict@1.2.0
+ostrio:cookies@2.9.2
 ostrio:cstorage@4.0.1
-ostrio:files@2.3.3
-ostrio:flow-router-extra@3.10.1
+ostrio:files@3.0.1
+ostrio:flow-router-extra@3.15.3
 ostrio:i18n@3.2.1
-promise@0.12.2
-quave:synced-cron@2.2.1
-raix:eventemitter@0.1.3
-random@1.2.1
-rate-limit@1.1.1
-react-fast-refresh@0.2.8
-reactive-dict@1.3.1
-reactive-var@1.0.12
-reload@1.3.1
-retry@1.1.0
+promise@1.0.0
+quave:synced-cron@2.4.0
+raix:eventemitter@1.0.0
+random@1.2.2
+rate-limit@1.2.0-rc350.1
+react-fast-refresh@0.3.0
+reactive-dict@1.3.2
+reactive-var@1.0.13
+reload@1.3.2
+retry@1.1.1
 reywood:publish-composite@1.9.0
-routepolicy@1.1.1
-service-configuration@1.3.4
-session@1.2.1
-sha@1.0.9
-shell-server@0.5.0
-simple:authenticate-user-by-token@1.2.1
-simple:json-routes@2.3.1
-simple:rest-accounts-password@1.2.2
-simple:rest-bearer-token-parser@1.1.1
-simple:rest-json-error-handler@1.1.1
-socket-stream-client@0.5.2
-spacebars@1.4.1
-spacebars-compiler@1.3.1
-standard-minifier-js@2.8.1
-templating@1.4.1
-templating-compiler@1.4.1
-templating-runtime@1.5.0
-templating-tools@1.2.2
-tracker@1.3.3
-typescript@4.9.5
-underscore@1.6.1
-url@1.3.2
-useraccounts:core@1.16.2
-useraccounts:flow-routing-extra@1.1.0
-useraccounts:unstyled@1.14.2
-webapp@1.13.8
-webapp-hashing@1.1.1
+routepolicy@1.1.2
+rspack@1.1.0
+service-configuration@1.3.5
+session@1.2.3-rc350.1
+sha@1.0.10
+shell-server@0.7.0
+socket-stream-client@0.7.0-rc350.1
+spacebars@2.0.1
+spacebars-compiler@2.0.1
+standard-minifier-js@3.2.0
+templating@1.4.5
+templating-compiler@2.0.1
+templating-runtime@2.0.2
+templating-tools@2.0.1
+tools-core@1.1.0
+tracker@1.3.4
+typescript@5.10.0
+url@1.3.6-rc350.1
+webapp@2.2.0-rc350.1
+webapp-hashing@1.1.2
 wekan-accounts-cas@0.2.0
 wekan-accounts-lockout@1.1.0
 wekan-accounts-oidc@1.0.10
@@ -1 +1,2 @@
 npm-packages/
+tests/
@@ -3,9 +3,14 @@
 For all code at WeKan GitHub Organization https://github.com/wekan

 - All code in pull requests need to have permission already to add it to WeKan with MIT license, and will become MIT license.
- All code xet7 add is MIT license.
 - For any dependencies, permissive licenses like https://copyfree.org are preferred
 - For anything currently that is non-permissive (like GPL, AGPL, SSPL), those will be replaced with permissive-licensed alternatives
+- Any intelligence allowed: Human, AI or any other. No discrimination, please have world peace. Mentioning participants optional.
+- All code is checked and validated by xet7 and many different security AI. If code is real working fix or feature, it usually will be merged.
+- All known vulnerabilities have been fixed at newest WeKan, please upgrade https://wekan.fi/upgrade/
+- There is no known backdoors. If WeKan is installed by someone else, first registered user is Admin and has Admin Panel access.
+- Maintainer of WeKan has no access to someone elses installed WeKan.
+- For someone elses installed WeKan, see [Forgot Password](https://github.com/wekan/wekan/blob/main/docs/Login/Forgot-Password.md)

 # Reporting about violations or something else

@@ -9,7 +9,7 @@ Not paid:
  - This is because full-featured WeKan FLOSS kanban with MIT license is free to use
    also for Commercial Use without any payment, with full source code at
    https://github.com/wekan/wekan for all platforms at https://wekan.fi/install/ .
-    There is nothing propietary. WeKan is NOT Big Tech.
+    There is nothing proprietary. WeKan is NOT Big Tech.
    WeKan is maintained by https://github.com/xet7 at Finland https://wekan.fi .     
 - Public FLOSS Developer Community Support:
  - https://github.com/wekan/wekan/issues
@@ -34,6 +34,16 @@ and click send PR.

 ## Contributing code

+Use rebuild-wekan.sh to run all tests to verify you don't break any features, before sending PR.
+
+Only send one feature or fix at one PR. Do not add many unrelated changes.
+
+Only send those changed code lines, that are related to your one feature or fix.
+
+Do not format unrelated code. Do not use code formatting or linting like eslist or prettier.
+
+Send your code ASAP, because there are daily releases of WeKan with major features and fixes added.
+
 [Building WeKan and sending PR](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md).

 WeKan code contributors Hall of Fame is at ChangeLog, where
@@ -49,10 +59,6 @@ Also see other docs:

 https://github.com/wekan/wekan/tree/main/docs/DeveloperDocs

-Do not use code formatting or linting like eslist or prettier.
-
-Only send minimal changed code lines, that are related to feature or fix.
-
 WeKan code has MIT license.

 About 300 persons have contributed to WeKan, stats at:
@@ -1,23 +1,23 @@
-FROM ubuntu:24.04
+FROM ubuntu:26.04
 LABEL maintainer="wekan"
 LABEL org.opencontainers.image.ref.name="ubuntu"
-LABEL org.opencontainers.image.version="24.04"
+LABEL org.opencontainers.image.version="26.04"
 LABEL org.opencontainers.image.source="https://github.com/wekan/wekan"

-# TARGETARCH is automatically provided by Docker Buildx
+# TARGETARCH and TARGETVARIANT are automatically provided by Docker Buildx
 ARG TARGETARCH
+ARG TARGETVARIANT
+ARG VERSION=9.42
 ARG DEBIAN_FRONTEND=noninteractive

 ENV BUILD_DEPS="apt-utils gnupg wget bzip2 g++ curl libarchive-tools build-essential git ca-certificates python3 unzip"

 ENV \
    DEBUG=false \
-    NODE_VERSION=v14.21.4 \
-    METEOR_RELEASE=METEOR@2.16 \
+    NODE_VERSION=v24.16.0 \
+    METEOR_RELEASE=METEOR@3.5-beta.12 \
    USE_EDGE=false \
-    METEOR_EDGE=1.5-beta.17 \
-    NPM_VERSION=6.14.17 \
-    FIBERS_VERSION=4.0.1 \
+    NPM_VERSION=11.11.0 \
    SRC_PATH=./ \
    WITH_API=true \
    MONGO_OPLOG_URL="" \
@@ -160,34 +160,42 @@ ENV \

 RUN <<EOR
 set -o xtrace
+# Fail hard on any error so a missing release zip / failed download can never
+# produce a "successful" image with an empty /build (Cannot find /build/main.js).
+set -eo pipefail

-# Create Wekan user
-useradd --user-group --system --home-dir /home/wekan wekan
+# Create Wekan user. --create-home is required because --system users do not
+# get a home directory by default; without it /home/wekan never exists and the
+# later `chown ... /home/wekan/` aborts the build (now that set -e is active).
+useradd --user-group --system --create-home --home-dir /home/wekan wekan

 # OS Updates
 apt-get update --assume-yes
 apt-get upgrade --assume-yes
 apt-get install --assume-yes --no-install-recommends ${BUILD_DEPS}

-# Multi-arch mapping logic
+# Multi-arch mapping: Docker TARGETARCH -> Node.js arch name + WeKan bundle name
+# arm/v7 uses TARGETARCH=arm; armhf has no MongoDB Community -> uses FerretDB
 case "${TARGETARCH}" in
-    "amd64")  NODE_ARCH="x64"  WEKAN_ARCH="amd64" ;;
-    "arm64")  NODE_ARCH="arm64" WEKAN_ARCH="arm64" ;;
-    "s390x")  NODE_ARCH="s390x" WEKAN_ARCH="s390x" ;;
+    "amd64")   NODE_ARCH="x64"     WEKAN_ARCH="amd64"   ;;
+    "arm64")   NODE_ARCH="arm64"   WEKAN_ARCH="arm64"   ;;
+    "arm")     NODE_ARCH="armv7l"  WEKAN_ARCH="armhf"   ;;
+    "ppc64le") NODE_ARCH="ppc64le" WEKAN_ARCH="ppc64le" ;;
+    "s390x")   NODE_ARCH="s390x"   WEKAN_ARCH="s390x"   ;;
    *) echo "Unsupported architecture: ${TARGETARCH}"; exit 1 ;;
 esac

-# Node.js Installation
+# Node.js Installation (official nodejs.org builds for Node 22)
 cd /tmp
-wget "https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
-wget "https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/SHASUMS256.txt"
-grep "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt | shasum -a 256 -c -
+wget "https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz"
+wget "https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc"
+grep "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc | shasum -a 256 -c -
 tar xzf "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" -C /usr/local --strip-components=1 --no-same-owner
-rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt
+rm -f "node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.gz" SHASUMS256.txt.asc
 ln -s "/usr/local/bin/node" "/usr/local/bin/nodejs"

 # NPM configuration
-npm install -g npm@${NPM_VERSION} --production
+npm install -g npm@${NPM_VERSION}
 chown --recursive wekan:wekan /home/wekan/

 # Temporary Tar swap for Meteor bundle
@@ -197,15 +205,19 @@ ln -sf $(which bsdtar) $(which tar)
 # WeKan Bundle Installation
 mkdir -p /home/wekan/app
 cd /home/wekan/app
-wget "https://github.com/wekan/wekan/releases/download/v8.40/wekan-8.40-${WEKAN_ARCH}.zip"
-unzip "wekan-8.40-${WEKAN_ARCH}.zip"
-rm "wekan-8.40-${WEKAN_ARCH}.zip"
+wget "https://github.com/wekan/wekan/releases/download/v${VERSION}/wekan-${VERSION}-${WEKAN_ARCH}.zip"
+unzip "wekan-${VERSION}-${WEKAN_ARCH}.zip"
+rm "wekan-${VERSION}-${WEKAN_ARCH}.zip"
+npm install --prefix ./bundle/programs/server
 mv /home/wekan/app/bundle /build

 # Restore original tar
 mv $(which tar)~ $(which tar)

 # Cleanup
+# Remove unused Go-based pebble binary shipped by base image to reduce CVE surface.
+apt-get remove --purge --assume-yes pebble || true
+rm -f /usr/bin/pebble
 apt-get remove --purge --assume-yes ${BUILD_DEPS}
 apt-get autoremove --assume-yes
 apt-get clean --assume-yes
@@ -1,98 +0,0 @@
-FROM arm64v8/ubuntu:23.04 AS builder
-#FROM amd64/alpine:latest AS builder
-
-# Set the environment variables for builder
-ENV QEMU_VERSION=v7.2.0-1 \
-    QEMU_ARCHITECTURE=aarch64 \
-    NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.4 \
-    WEKAN_VERSION=latest  \
-    WEKAN_ARCHITECTURE=arm64
-
-    # Install dependencies
-#RUN apk update && apk add ca-certificates outils-sha1 && \
-RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
-RUN apt update && apt install ca-certificates wget unzip -y && \
-    \
-    # Download qemu static for our architecture
-    wget https://github.com/multiarch/qemu-user-static/releases/download/${QEMU_VERSION}/qemu-${QEMU_ARCHITECTURE}-static.tar.gz -O - | tar -xz && \
-    \
-    # Download wekan and shasum
-    wget https://releases.wekan.team/raspi3/wekan-${WEKAN_VERSION}-${WEKAN_ARCHITECTURE}.zip && \
-    wget https://releases.wekan.team/raspi3/SHA256SUMS.txt && \
-    # Verify wekan
-    grep wekan-${WEKAN_VERSION}-${WEKAN_ARCHITECTURE}.zip SHA256SUMS.txt | sha256sum -c - && \
-    \
-    # Unzip wekan
-    unzip wekan-${WEKAN_VERSION}-${WEKAN_ARCHITECTURE}.zip && \
-    \
-    # Download node and shasums
-    wget https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz && \
-    wget https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/SHASUMS256.txt && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
-    \
-    # Verify nodejs authenticity
-    grep node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz SHASUMS256.txt | sha256sum -c - && \
-    \
-    # Extract node and remove tar.gz
-    tar xvzf node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz
-
-# Build wekan dockerfile
-FROM --platform=linux/arm64 arm64v8/ubuntu:23.04
-LABEL maintainer="wekan"
-
-# Set the environment variables (defaults where required)
-ENV QEMU_ARCHITECTURE=aarch64 \
-    NODE_ARCHITECTURE=linux-arm64 \
-    NODE_VERSION=v14.21.4 \
-    NODE_ENV=production \
-    NPM_VERSION=latest \
-    WITH_API=true \
-    PORT=8080 \
-    ROOT_URL=http://localhost \
-    MONGO_URL=mongodb://127.0.0.1:27017/wekan \
-    LDAP_AUTHENTIFICATION_PASSWORD_FILE="" \
-    OAUTH2_SECRET_FILE="" \
-    MAIL_SERVICE_PASSWORD_FILE="" \
-    MONGO_PASSWORD_FILE="" \
-    S3_SECRET_FILE=""
-
-# Copy qemu-static to image
-COPY --from=builder qemu-${QEMU_ARCHITECTURE}-static /usr/bin
-
-# Copy the app to the image
-COPY --from=builder bundle /home/wekan/bundle
-
-# Copy
-COPY --from=builder node-${NODE_VERSION}-${NODE_ARCHITECTURE} /opt/nodejs
-
-RUN \
-    set -o xtrace && \
-    # Add non-root user wekan
-    useradd --user-group --system --home-dir /home/wekan wekan && \
-    \
-    # Install Node
-    ln -s /opt/nodejs/bin/node /usr/bin/node && \
-    ln -s /opt/nodejs/bin/npm /usr/bin/npm && \
-    mkdir -p /opt/nodejs/lib/node_modules/fibers/.node-gyp /root/.node-gyp/8.16.1 /home/wekan/.config && \
-    chown wekan --recursive /home/wekan/.config
-
-#    \
-#    # Install Node dependencies
-#    #npm install -g npm@${NPM_VERSION} && \
-#    \
-#    # Install Health Check dependencies
-#    #apk add curl
-#
-#HEALTHCHECK --start-period=30s --interval=30s --timeout=10s --retries=3 \
-#  CMD curl --fail "http://localhost:$PORT" || exit 1
-
-EXPOSE $PORT
-USER wekan
-
-# CMD ["bash", "-c", "ulimit -s 65500; exec node --stack-size=65500 --max-old-space-size=8192 /home/wekan/bundle/main.js"]
-CMD ["bash", "-c", "ulimit -s 65500; exec node /home/wekan/bundle/main.js"]
-
@@ -1,99 +0,0 @@
-FROM arm64v8/ubuntu:23.04 AS builder
-#FROM --platform=linux/amd64 amd64/ubuntu:23.04 AS builder
-#FROM --platform=linux/amd64 ghcr.io/wekan/wekan:main AS builder
-#FROM arm64v8/ubuntu:23.04 AS builder
-#FROM amd64/alpine:latest AS builder
-
-# Set the environment variables for builder
-ENV QEMU_VERSION=v7.2.0-1 \
-    QEMU_ARCHITECTURE=s390x \
-    NODE_ARCHITECTURE=linux-s390x \
-    NODE_VERSION=v14.21.4 \
-    WEKAN_VERSION=latest  \
-    WEKAN_ARCHITECTURE=s390x
-
-    # Install dependencies
-#RUN apk update && apk add ca-certificates outils-sha1 && \
-RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections
-RUN apt update && apt install ca-certificates wget unzip -y && \
-    \
-    # Download qemu static for our architecture
-    wget https://github.com/multiarch/qemu-user-static/releases/download/${QEMU_VERSION}/qemu-${QEMU_ARCHITECTURE}-static.tar.gz -O - | tar -xz && \
-    \
-    # Download wekan and shasum
-    wget https://releases.wekan.team/${WEKAN_ARCHITECTURE}/wekan-${WEKAN_VERSION}-${WEKAN_ARCHITECTURE}.zip && \
-    wget https://releases.wekan.team/${WEKAN_ARCHITECTURE}/SHA256SUMS.txt && \
-    # Verify wekan
-    grep wekan-${WEKAN_VERSION}-${WEKAN_ARCHITECTURE}.zip SHA256SUMS.txt | sha256sum -c - && \
-    \
-    # Unzip wekan
-    unzip wekan-${WEKAN_VERSION}-${WEKAN_ARCHITECTURE}.zip && \
-    \
-    # Download node and shasums
-    wget https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz && \
-    wget https://github.com/wekan/node-v14-esm/releases/download/${NODE_VERSION}/SHASUMS256.txt && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz && \
-    #wget https://nodejs.org/dist/${NODE_VERSION}/SHASUMS256.txt.asc && \
-    \
-    # Verify nodejs authenticity
-    grep node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz SHASUMS256.txt | sha256sum -c - && \
-    \
-    # Extract node and remove tar.gz
-    tar xvzf node-${NODE_VERSION}-${NODE_ARCHITECTURE}.tar.gz
-
-# Build wekan dockerfile
-FROM --platform=linux/s390x s390x/ubuntu:23.04
-LABEL maintainer="wekan"
-
-# Set the environment variables (defaults where required)
-ENV QEMU_ARCHITECTURE=s390x \
-    NODE_ARCHITECTURE=linux-s390x \
-    NODE_VERSION=v14.21.4 \
-    NODE_ENV=production \
-    NPM_VERSION=latest \
-    WITH_API=true \
-    PORT=8080 \
-    ROOT_URL=http://localhost \
-    MONGO_URL=mongodb://127.0.0.1:27017/wekan \
-    LDAP_AUTHENTIFICATION_PASSWORD_FILE="" \
-    OAUTH2_SECRET_FILE="" \
-    MAIL_SERVICE_PASSWORD_FILE="" \
-    MONGO_PASSWORD_FILE="" \
-    S3_SECRET_FILE=""
-
-# Copy qemu-static to image
-COPY --from=builder qemu-${QEMU_ARCHITECTURE}-static /usr/bin
-
-# Copy the app to the image
-COPY --from=builder bundle /home/wekan/bundle
-
-# Copy
-COPY --from=builder node-${NODE_VERSION}-${NODE_ARCHITECTURE} /opt/nodejs
-
-RUN \
-    set -o xtrace && \
-    # Add non-root user wekan
-    useradd --user-group --system --home-dir /home/wekan wekan && \
-    \
-    # Install Node
-    ln -s /opt/nodejs/bin/node /usr/bin/node && \
-    ln -s /opt/nodejs/bin/npm /usr/bin/npm && \
-    mkdir -p /opt/nodejs/lib/node_modules/fibers/.node-gyp /root/.node-gyp/8.16.1 /home/wekan/.config && \
-    chown wekan --recursive /home/wekan/.config
-
-#    \
-#    # Install Node dependencies
-#    #npm install -g npm@${NPM_VERSION} && \
-#    \
-#    # Install Health Check dependencies
-#    #apk add curl
-#
-#HEALTHCHECK --start-period=30s --interval=30s --timeout=10s --retries=3 \
-#  CMD curl --fail "http://localhost:$PORT" || exit 1
-
-EXPOSE $PORT
-USER wekan
-
-CMD ["bash", "-c", "ulimit -s 65500; exec node /home/wekan/bundle/main.js"]
@@ -47,12 +47,13 @@ See bottom of https://github.com/wekan/wekan/issues/3874
 ## FAQ

 **NOTE**:
+
 - Please read the [FAQ](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md) first
 - Please don't feed the [trolls](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-troll) and [spammers](https://github.com/wekan/wekan/blob/main/docs/FAQ/FAQ.md#why-am-i-called-a-spammer) that are mentioned in the FAQ :)

 ## About WeKan ®

-WeKan ® is an completely [Open Source][open_source] and [Free software][free_software]
+WeKan ® is a completely [Open Source][open_source] and [Free software][free_software]
 collaborative kanban board application with MIT license.

 Whether you’re maintaining a personal todo list, planning your holidays with some friends,
@@ -76,15 +77,15 @@ that by providing one-click installation on various platforms.
 - 1 GB RAM minimum free for WeKan ®. Production server should have minimum total 4 GB RAM.
  For thousands of users, for example with [Docker](https://github.com/wekan/wekan/blob/main/docker-compose.yml): 3 frontend servers,
  each having 2 CPU and 2 wekan-app containers. One backend wekan-db server with many CPUs.
- Enough disk space and alerts about low disk space. If you run out disk space, MongoDB database gets corrupted.
+- Enough disk space and alerts about low disk space. If you run out of disk space, MongoDB database gets corrupted.
 - SECURITY: Updating to newest WeKan ® version very often. Please check you do not have automatic updates of Sandstorm or Snap turned off.
  Old versions have security issues because of old versions Node.js etc. Only newest WeKan ® is supported.
  WeKan ® on Sandstorm is not usually affected by any Standalone WeKan ® (Snap/Docker/Source) security issues.
 - [Reporting all new bugs immediately](https://github.com/wekan/wekan/issues).
  New features and fixes are added to WeKan ® [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day miminum.
+- [Backups](https://github.com/wekan/wekan/blob/main/docs/Backup/Backup.md) of WeKan ® database once a day minimum.
  Bugs, updates, users deleting list or card, harddrive full, harddrive crash etc can eat your data. There is no undo yet.
-  Some bug can cause WeKan ® board to not load at all, requiring manual fixing of database content.
+  Some bugs can cause WeKan ® board to not load at all, requiring manual fixing of database content.

 ## Roadmap and Demo

@@ -92,7 +93,7 @@ that by providing one-click installation on various platforms.

 [Developer Documentation][dev_docs]

- There is many companies and individuals contributing code to WeKan ®, to add features and bugfixes
+- There are many companies and individuals contributing code to WeKan ®, to add features and bugfixes
  [many times a day](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
 - [Please add Add new Feature Requests and Bug Reports immediately](https://github.com/wekan/wekan/issues).
 - [Commercial Support](https://wekan.fi/commercial-support/).
@@ -102,12 +103,75 @@ By working directly with WeKan ® you get the benefit of active maintenance and

 ## Getting Started with Development

-The default branch uses [Meteor 2 with Node.js 14](https://wekan.fi/install/).
+The default branch uses Meteor 3.5-beta.7 with Node.js 24.x.
+See [CHANGELOG.md](https://github.com/wekan/wekan/blob/main/CHANGELOG.md) for the latest runtime updates.

 To contribute, [create a fork](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#2-create-fork-of-httpsgithubcomwekanwekan-at-github-web-page) and run `./rebuild-wekan.sh` (or `./rebuild-wekan.bat` on Windows) as detailed [here](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#3-select-option-1-to-install-dependencies-and-then-enter). Once you're ready, please test your code and [submit a pull request (PR)](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Build-and-Create-Pull-Request.md#7-test).

 Please refer to the [developer documentation](https://github.com/wekan/wekan/blob/main/docs/DeveloperDocs/Developer-Documentation.md) for more information.

+## First-Time Setup for Development
+
+### Prerequisites
+
+Before building WeKan from source, ensure you have:
+
+- **Git** - for cloning the repository
+- **Node.js 24.x** - WeKan requires Node.js 24.x
+- **Meteor** - the JavaScript framework WeKan is built with
+
+### Installing Node.js 24.x
+
+```bash
+# Using nvm (recommended)
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+source ~/.zshrc  # or ~/.bashrc
+nvm install 24
+nvm use 24
+```
+
+### Installing Meteor
+
+```bash
+curl https://install.meteor.com/ | sh
+```
+
+### Building WeKan
+
+The `rebuild-wekan.sh` script guides you through a three-stage process:
+
+1. **Install dependencies (Option 1)** - Downloads all required Meteor packages and npm modules
+2. **Build WeKan (Option 2)** - Compiles the application
+3. **Run WeKan (Option 3)** - Starts the development server at http://localhost:4000
+
+```bash
+# Clone your fork
+git clone git@github.com:YOUR_USERNAME/wekan.git
+cd wekan
+
+# Make the script executable
+chmod +x rebuild-wekan.sh
+
+# Step 1: Install dependencies
+./rebuild-wekan.sh
+# Press 1 and Enter
+
+# Step 2: Build WeKan (after dependencies complete)
+./rebuild-wekan.sh
+# Press 2 and Enter
+
+# Step 3: Run WeKan in development mode
+./rebuild-wekan.sh
+# Press 3 and Enter
+```
+ 
+
+### WSL Users
+
+WSL users can use Snap Candidate. See [install docs](https://wekan.fi/install/).
+
+The development server will start at http://localhost:4000. Any changes you make to the source code will automatically trigger a rebuild and refresh your browser.
+
 ## Screenshot

 [More screenshots at Features page](https://github.com/wekan/wekan/tree/main/docs/Features)
@@ -1,38 +1,34 @@
-## About money
+## About Money: No bounty

-See [CONTRIBUTING](CONTRIBUTING.md)
+There is no bounty, like described at [CONTRIBUTING.md](CONTRIBUTING.md),
+because WeKan is NOT Big Tech. WeKan is FLOSS.

-## Responsible Security Disclosure
+## Steps for Coordinated Vulnerability Disclosure

-1. To send email, if possible, use PGP key [security-at-wekan.fi.asc](security-at-wekan.fi.asc)
-2. Send info about security issue ONLY to security@wekan.fi . NOT TO ANYWHERE ELSE. NO CC, NO BCC.
-3. Wait for new WeKan release that fixes security issue to appear to top of
-   https://github.com/wekan/wekan/blob/main/CHANGELOG.md
-4. We will thank you by adding you to Hall of Fame: https://wekan.fi/hall-of-fame/
-5. All vulnerability details will be private to security@wekan.fi ,
-   unless you help all WeKan platforms to have a way to upgrade, like sending
-   database migrations code to security@wekan.fi or PRs to https://github.com/wekan/wekan/pulls .
-   There is no benefit to Wordwide Security Community to have more details about vulnerabilities,
-   if Worldwide Security Community does not help to make upgrades possible.
-6. If there some day becomes available a way to upgrade all WeKan platforms,
-   this page will be updated to add permission for security researchers
-   to request new GHSA or CVE ID and publish your vulnerability details at your blog, talks, etc,
-   and send that info also to security@wekan.fi to be added to
-   Hall of Fame: https://wekan.fi/hall-of-fame/ to get Upgrade Bonus Point Stars.
-   In that case, it will become possible for security@wekan.fi to publish all
-   remaining private security details, and publicly thank Worldwide Security Community.
+### 1. Security Researcher:

-## Bonus Points
+- **Report**: Click "New draft security advisory" at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
+  More info at [GitHub Docs about reporting privately](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately).
+- **Proof of Concept (PoC)**: If possible, include a fix or a reproduction script/code.
+- **If GitHub does not work**: Please send report to **security@wekan.fi**
+- **Optional Email Encryption**: An optional PGP key is available at [security-at-wekan.fi.asc](security-at-wekan.fi.asc).

- If you include code for fixing security issue
+### 2. WeKan Security Team:

-## Losing Points
+- **Remediation**: Please wait for a new WeKan release that addresses the issue.
+  Fixes are announced at the top of the [ChangeLog](https://github.com/wekan/wekan/blob/main/CHANGELOG.md).
+- **Recognition**: We will acknowledge your contribution by adding you to our
+  [Hall of Fame](https://wekan.fi/hall-of-fame/).
+- **CVE Policy**: WeKan Security requests CVE at GitHub when releasing Security Advisory.

- If you ask about [bounty](CONTRIBUTING.md). There is no bounty. WeKan is NOT Big Tech. WeKan is FLOSS.
- If you forget to include vulnerability details.
- If you send info about security issue to somewhere else than security@wekan.fi
+### 3. Post-Release and Public Disclosure:

-## How should reports be formatted?
+- Publicity: If you publish blog posts, give talks, or write articles about the
+  reported vulnerabilities, please send the links to us. We will link them
+  to your entry in the [Hall of Fame](https://wekan.fi/hall-of-fame/) for additional context.
+- Advisories reported at GitHub are listed at [WeKan Security Advisories](https://github.com/wekan/wekan/security/advisories).
+
+## How Should Reports Be Formatted?

 ```
 Name: %name
@@ -54,31 +50,36 @@ added to the WeKan Hall of Fame https://wekan.fi/hall-of-fame/

 ## Which domains are in scope?

-No public domains, because all those are donated to Wekan Open Source project,
+No public domains, because all those are donated to WeKan Open Source project,
 and we don't have any permissions to do security scans on those donated servers.

-Please don't perform research that could impact other users. Secondly, please keep
-the reports short and succinct. If we fail to understand the logics of your bug, we will tell you.
+Please don't perform research that could impact other users. Second, please keep
+the reports short and succinct. If we fail to understand the logic of your bug, we will tell you.

-You can [Install Wekan](https://github.com/wekan/wekan/releases) to your own computer
+You can [Install WeKan](https://wekan.fi/install/) on your own computer
 and scan it's vulnerabilities there.

-## About Wekan versions
+## About WeKan Versions

-There are only 2 versions of Wekan: Standalone Wekan, and Sandstorm Wekan.
+There are 2 versions of WeKan: Standalone WeKan, and Sandstorm WeKan.

-### Standalone Wekan Security
+## Meteor Security

-Standalone Wekan includes all non-Sandstorm platforms. Some Standalone Wekan platforms
+https://guide.meteor.com/security
+
+### Standalone WeKan Security
+
+Standalone WeKan includes all non-Sandstorm platforms. Some Standalone WeKan platforms
 like Snap and Docker have their own specific sandboxing etc features.

-Standalone Wekan by default does not load any files from Internet, like fonts, CSS, etc.
-This also means all Standalone Wekan functionality works in offline local networks.
-WeKan is used at most countries of the world https://snapcraft.io/wekan
-and by by companies that have 30k users.
+Standalone WeKan by default does not load any files from Internet, like fonts, CSS, etc.
+This also means all Standalone WeKan functionality works in offline local networks.
+WeKan is used in most countries of the world https://snapcraft.io/wekan
+and by companies that have 30k users.

- Wekan private board attachments are not accessible without logging in.
- There is feature to set board public, so that board is visible without logging in in readonly mode, with realtime updates.
+- WeKan private board attachments are not accessible without logging in.
+- There is feature to set board public, so that board is visible without logging
+  in readonly mode, with realtime updates.
 - Admin Panel has feature to disable all public boards, so all boards are private.

 ## SSL/TLS
@@ -90,24 +91,25 @@ and by by companies that have 30k users.

 ## XSS

- Dompurify https://www.npmjs.com/package/dompurify
-  - WeKan uses dompurify npm package to filter for XSS at fields like cards, as you can see from
+- DOMPurify https://www.npmjs.com/package/dompurify
+  - WeKan uses DOMPurify npm package to filter for XSS at fields like cards, as you can see from
    [package.json](https://github.com/wekan/wekan/blob/main/package.json). Other used versions can be seen from
    [Meteor versions file](https://github.com/wekan/wekan/blob/main/.meteor/versions).
-  - Forms can include markdown links, html, image tags etc like you see at https://wekan.github.io .
+  - Forms can include markdown links, html, image tags etc like you see at https://wekan.fi .
  - It's possible to add attachments to cards, and markdown/html links to files.
-  - Dompurify cleans up viewed code, so Javascript in input fields does not execute
-    - https://wekan.github.io/hall-of-fame/fieldbleed/
+  - DOMPurify cleans up viewed code, so JavaScript in input fields does not execute
+    - https://wekan.fi/hall-of-fame/fieldbleed/
 - Reaction in comment is now checked, that it does not have extra added code
-  - https://wekan.github.io/hall-of-fame/reactionbleed/
+  - https://wekan.fi/hall-of-fame/reactionbleed/
 - https://github.com/wekan/wekan/blob/main/packages/markdown/src/template-integration.js#L76

-## QA about PubSub
+## QA About PubSub

 Q:

 Hello,
-I have just seen the Meteor DevTools Evolved extension and was wondering if anyone had asked themselves the question of security.
+I have just seen the Meteor DevTools Evolved extension and was wondering if anyone
+had asked themselves the question of security.
 Insofar as all data is shown in the minimongo tab in plain text.
 How can data be hidden from this extension?

@@ -115,32 +117,36 @@ A:

 ## PubSub

- It is not security issue to show some text or image, that user has permission to see. It is a security issue, if browserside is some text or image that user should not see.
- Meteor has browserside minimongo database, made with Javascript, updated with Publish/Subscribe, PubSub.
- Publish/Subscribe means, that realtime web framework reads database changes stream, and then immediately updates webpage,
-  like like dashboards, chat, kanban. That is the point in any realtime web framework in any programming language.
- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that at minimongo is only text that user has permission to see.
- Do checking as logged in user, and logged out user.
+- It is not a security issue to show text or images that the user has permission to see.
+  It is a security issue, if browserside is some text or image that user should not see.
+- Meteor has browserside minimongo database, made with JavaScript, updated with Publish/Subscribe, PubSub.
+- Publish/Subscribe means, that realtime web framework reads database changes stream,
+  and then immediately updates webpage, like dashboards, chat, kanban.
+  That is the point of any realtime web framework in any programming language.
+- Yes, you should check with Meteor DevTools Evolved Chromium/Firefox extension that
+  at minimongo is only text that user has permission to see.
+- Check as a logged-in user and as a logged-out user.
 - Check permissions and sanitize before allowing some change, because someone could modify content of input field,
  PubSub/websocket data (for example with Burp Suite Community Edition), etc.
- If you have REST API, also check that only those that have login token, and have permission, can view or edit text
+- If you have a REST API, also check that only those who have a login token and permission can view or edit text.
 - You should not include any data user is not allowed to see. Not to webpage text, not to websockets/PubSub, etc.
- Minimongo should not have password hashes PubSub https://wekan.github.io/hall-of-fame/userbleed/
- PubSub uses Websockets, so you need those to be enabled at webserver like Caddy/Nginx/Apache etc, examples of settings
+- Minimongo should not have password hashes PubSub https://wekan.fi/hall-of-fame/userbleed/
+- PubSub uses WebSockets, so you need those to be enabled on the webserver like Caddy/Nginx/Apache etc, examples of settings
  at right menu of https://github.com/wekan/wekan/wiki
- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to 
-  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods at https://github.com/wekan/wekan/tree/main/models
+- Clientside https://github.com/wekan/wekan/tree/main/client/components subscribes to
+  PubSub https://github.com/wekan/wekan/tree/main/server/publications or calls meteor methods
+  at https://github.com/wekan/wekan/tree/main/models
 - For Admin:
  - You can have input field for password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
  - You can save password to database https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
  - Check that only current user or Admin can change password https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
    - Note that currentUser uses code like Meteor.user() in .js file
-  - Do not have password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
+  - Do not include password hashes in PubSub https://github.com/wekan/wekan/blob/main/server/publications/users.js
  - Only show Admin Panel to Admin https://github.com/wekan/wekan/blob/main/client/components/settings/settingBody.jade#L3
- If there is a lot of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
- Only have limited amount of data published in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
- Use Environment variables for any email etc passwords.
- But what if you would like to remove minimongo? And only use Meteor methods for saving? In that case, you don't have realtime updates,
+- If there is a large amount of data, use pagination https://github.com/wekan/wekan/blob/main/client/components/settings/peopleBody.js
+- Only publish a limited amount of data in PubSub. Limit in MongoDB query in publications how much is published. Too much could make browser too slow.
+- Environment variables for email and other passwords.
+- But what if you would like to remove Minimongo and only use Meteor methods for saving? In that case, you don't have realtime updates,
  and you need to write much more code to load and save data yourself, handle any multi user data saving conflicts yourself,
  and many Meteor Atmospherejs.com PubSub using packages would not work anymore https://github.com/wekan/we

@@ -148,14 +154,14 @@ A:

 - With PubSub, there is checking, that someone modifying Websockets content, like permission isAdmin, can not change to Admin.
 - https://github.com/wekan/wekan/commit/cbad4cf5943d47b916f64b4582f8ca76a9dfd743
- https://wekan.github.io/hall-of-fame/adminbleed/
+- https://wekan.fi/hall-of-fame/adminbleed/

 ## Permissions and Roles

- For any user permissions, it's best to use Meteor package package https://github.com/Meteor-Community-Packages/meteor-roles .
- Currently WeKan has custom hardcoded permissions, WeKan does not yet use that meteor-roles package.
+- For any user permissions, it's best to use Meteor package https://github.com/Meteor-Community-Packages/meteor-roles .
+- Currently, WeKan has custom hardcoded permissions and does not yet use the meteor-roles package.
  - Using permissions at WeKan sidebar https://github.com/wekan/wekan/blob/main/client/components/sidebar/sidebar.js#L1854-L1875
-  - List of roles https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
+  - List of roles: https://github.com/wekan/wekan/wiki/REST-API-Role . Change at board or Admin Panel. Also Organizations/Teams.
  - Worker role: https://github.com/wekan/wekan/issues/2788
  - Not implemented yet: Granular Roles https://github.com/wekan/wekan/issues/3022
 - Check is user logged in, with `if (Meteor.user()) {`
@@ -164,8 +170,8 @@ A:

 ## Environment variables

- For any passwords, use environment variables, those are serverside
- Do not copy environment variable to public variable that is visible browserside https://github.com/wekan/wekan/blob/main/server/max-size.js
+- For any passwords, use environment variables; those are serverside
+- Do not copy environment variables to public variables that are visible on the browserside https://github.com/wekan/wekan/blob/main/server/max-size.js

 ```
 Meteor.startup(() => {
@@ -176,20 +182,20 @@ Meteor.startup(() => {
 ```

 - For serverside, you can set Meteor.settings.variablename, without text public
- For WeKan kanban, there is feature for setting board public, it can be viewed by anyone, there is realtime updates. But 
+- For WeKan kanban, there is a feature for setting a board to public; it can be viewed by anyone, with realtime updates. But
 - Some of those permissions are checked at users.js models at https://github.com/wekan/wekan/tree/main/models
 - Environment variables are used for email server passwords, etc, at all platforms https://github.com/wekan/wekan/commit/a781c0e7dcfdbe34c1483ee83cec12455b7026f7

 ## Escape HTML comment tags so that HTML comments are visible

- Someone reported, that it is problem that content of HTML comments in edit mode, are not visible at at view mode, so this makes HTML comments visible.
+- Someone reported that it was a problem that the content of HTML comments in edit mode was not visible in view mode, so this change makes HTML comments visible.
 - https://github.com/wekan/wekan/commit/167863d95711249e69bb3511175d73b34acbbdb3
- https://wekan.github.io/hall-of-fame/invisiblebleed/
+- https://wekan.fi/hall-of-fame/invisiblebleed/

 ## Attachments: XSS in filename is sanitized

 - https://github.com/wekan/wekan/blob/main/client/components/cards/attachments.js#L303-L312
- https://wekan.github.io/hall-of-fame/filebleed/
+- https://wekan.fi/hall-of-fame/filebleed/

 ### Attachments: Forced download to prevent stored XSS

@@ -247,22 +253,20 @@ Meteor.startup(() => {
 - https://github.com/wekan/wekan/commit/23e5e1e3bd081699ce39ce5887db7e612616014d
 - https://github.com/wekan/wekan/tree/main/packages/wekan-accounts-lockout

-### Sandstorm Wekan Security
+### Sandstorm WeKan Security

-On Sandstorm platform using environment variable Standalone Wekan features like Admin Panel etc are
-turned off, because Sandstorm platform provides SSO for all apps running on Sandstorm. 
+On the Sandstorm platform, Standalone WeKan features like the Admin Panel are turned off using environment variables, because Sandstorm platform provides SSO for all apps running on Sandstorm.

-[Sandstorm](https://sandstorm.io) is separate Open Source platform that has been
+[Sandstorm](https://sandstorm.io) is a separate Open Source platform that has been
 [security audited](https://sandstorm.io/news/2017-03-02-security-review) and found bugs fixed.
-Sandstorm also has passwordless login, LDAP, SAML, Google etc auth options already.
-At Sandstorm code is read-only and signed by app maintainers, only grain content can be modified.
-Wekan at Sandstorm runs in sandboxed grain, it does not have access elsewhere without user-visible
-PowerBox request or opening randomly-generated API key URL.
+Sandstorm also has passwordless login, LDAP, SAML, Google, and other auth options already.
+On Sandstorm, code is read-only and signed by app maintainers; only grain content can be modified.
+WeKan on Sandstorm runs in a sandboxed grain; it does not have access elsewhere without a user-visible PowerBox request or opening a randomly-generated API key URL.
 Also read [Sandstorm Security Practices](https://docs.sandstorm.io/en/latest/using/security-practices/) and
 [Sandstorm Security non-events](https://docs.sandstorm.io/en/latest/using/security-non-events/).
-For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email. 
+For Sandstorm specific security issues you can contact [kentonv](https://github.com/kentonv) by email.

-## What Wekan bugs are eligible?
+## What WeKan bugs are eligible?

 Any typical web security bugs. If any of the previously mentioned is somehow problematic and
 a security issue, we'd like to know about it, and also how to fix it:
@@ -274,18 +278,12 @@ a security issue, we'd like to know about it, and also how to fix it:
 - Authentication bypass
 - Server-side code execution

-## What Wekan bugs are NOT eligible?
+## What WeKan bugs are NOT eligible?

-Typical already known or "no impact" bugs such as:
+Typical already-known or 'no impact' bugs such as:

- [Wekan API old tokens not replaced correctly](https://github.com/wekan/wekan/issues/1437)
- Missing Cookie flags on non-session cookies or 3rd party cookies
- Logout CSRF
 - Social engineering
 - Denial of service
- SSL BEAST/CRIME/etc. Wekan does not have SSL built-in, it uses Caddy/Nginx/Apache etc at front.
-  Integrated Caddy support is updated often.
- Email spoofing, SPF, DMARC & DKIM. Wekan does not include email server.
+- SSL BEAST/CRIME/etc. WeKan does not have SSL built-in; it uses Caddy/Nginx/Apache on the front end.

-Wekan is Open Source with MIT license, and free to use also for commercial use.
-We welcome all fixes to improve security by email to security@wekan.fi
+WeKan is Open Source with MIT license, and free to use also for commercial use.
@@ -1,5 +1,5 @@
 appId: wekan-public/apps/77b94f60-dec9-0136-304e-16ff53095928
-appVersion: "v8.40.0"
+appVersion: "v9.42.0"
 files:
  userUploads:
    - README.md
@@ -25,19 +25,44 @@ syntax = """=== Wekan API Python CLI: Shows IDs for addcard ===
 # AUTHORID is USERID that writes card or custom field.
 If *nix:  chmod +x api.py => ./api.py users
  Syntax:
-    User API:
+        User API:
    python3 api.py user                 # Current user and list of current user boards
+        python3 api.py users                # All users
+        python3 api.py boards               # All Public Boards
    python3 api.py boards USERID        # Boards of USERID
+        python3 api.py board BOARDID        # Info of BOARDID
+
+        Board/List/Card API:
    python3 api.py swimlanes BOARDID    # Swimlanes of BOARDID
    python3 api.py lists BOARDID        # Lists of BOARDID
    python3 api.py list BOARDID LISTID  # Info of LISTID
    python3 api.py createlist BOARDID LISTTITLE # Create list
    python3 api.py addcard AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION
    python3 api.py editcard BOARDID LISTID CARDID NEWCARDTITLE NEWCARDDESCRIPTION
+        python3 api.py getcard BOARDID LISTID CARDID # Get card info
+        python3 api.py cardsbyswimlane BOARDID SWIMLANEID # Retrieve cards list on a swimlane
+        python3 api.py deleteallcards BOARDID SWIMLANEID ( * Be careful will delete ALL CARDS INSIDE the swimlanes automatically in every list * ) # Delete all cards on a swimlane
+        python3 api.py get_list_cards_count BOARDID LISTID # Retrieve how many cards in a list
+        python3 api.py get_board_cards_count BOARDID # Retrieve how many cards in a board
+        python3 api.py editboardtitle BOARDID NEWBOARDTITLE # Edit board title
+        python3 api.py copyboard BOARDID NEWBOARDTITLE # Copy a board
+
+        Custom Fields / Labels API:
    python3 api.py customfields BOARDID # Custom Fields of BOARDID
    python3 api.py customfield BOARDID CUSTOMFIELDID # Info of CUSTOMFIELDID
    python3 api.py addcustomfieldtoboard AUTHORID BOARDID NAME TYPE SETTINGS SHOWONCARD AUTOMATICALLYONCARD SHOWLABELONMINICARD SHOWSUMATTOPOFLIST # Add Custom Field to Board
    python3 api.py editcustomfield BOARDID LISTID CARDID CUSTOMFIELDID NEWCUSTOMFIELDVALUE # Edit Custom Field
+        python3 api.py createlabel BOARDID LABELCOLOR LABELNAME (Color available: `white`, `green`, `yellow`, `orange`, `red`, `purple`, `blue`, `sky`, `lime`, `pink`, `black`, `silver`, `peachpuff`, `crimson`, `plum`, `darkgreen`, `slateblue`, `magenta`, `gold`, `navy`, `gray`, `saddlebrown`, `paleturquoise`, `mistyrose`, `indigo`) # Create a new label
+        python3 api.py addlabel BOARDID LISTID CARDID LABELID # Add label to a card
+        python3 api.py addcardwithlabel AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION LABELIDS # Add a card and a label
+        python3 api.py editcardcolor BOARDID LISTID CARDID COLOR (Color available: `white`, `green`, `yellow`, `orange`, `red`, `purple`, `blue`, `sky`, `lime`, `pink`, `black`, `silver`, `peachpuff`, `crimson`, `plum`, `darkgreen`, `slateblue`, `magenta`, `gold`, `navy`, `gray`, `saddlebrown`, `paleturquoise`, `mistyrose`, `indigo`) # Edit card color
+
+        Checklist API:
+        python3 api.py addchecklist BOARDID CARDID TITLE ITEM1 ITEM2 ITEM3 ITEM4 (You can add multiple items or just one, or also without any item, just TITLE works as well. * If items or Title contains spaces, you should add ' between them.) # Add checklist + item on a card
+        python3 api.py checklistid BOARDID CARDID # Retrieve Checklist ID attached to a card
+        python3 api.py checklistinfo BOARDID CARDID CHECKLISTID # Get checklist info
+
+        Attachment API:
    python3 api.py listattachments BOARDID # List attachments
    python3 api.py uploadattachment BOARDID SWIMLANEID LISTID CARDID FILEPATH [STORAGE_BACKEND] # Upload attachment to card
    python3 api.py downloadattachment ATTACHMENTID OUTPUTPATH # Download attachment to local file
@@ -45,25 +70,54 @@ If *nix:  chmod +x api.py => ./api.py users
    python3 api.py listcardattachments BOARDID SWIMLANEID LISTID CARDID # List attachments for specific card
    python3 api.py copymoveattachment ATTACHMENTID TARGETBOARDID TARGETSWIMLANEID TARGETLISTID TARGETCARDID [copy|move] # Copy or move attachment
    python3 api.py deleteattachment ATTACHMENTID # Delete attachment
-    python3 api.py cardsbyswimlane SWIMLANEID LISTID # Retrieve cards list on a swimlane
-    python3 api.py getcard BOARDID LISTID CARDID # Get card info
-    python3 api.py addlabel BOARDID LISTID CARDID LABELID # Add label to a card
-    python3 api.py addcardwithlabel AUTHORID BOARDID SWIMLANEID LISTID CARDTITLE CARDDESCRIPTION LABELIDS # Add a card and a label
-    python3 api.py editboardtitle BOARDID NEWBOARDTITLE # Edit board title
-    python3 api.py copyboard BOARDID NEWBOARDTITLE # Copy a board
-    python3 api.py createlabel BOARDID LABELCOLOR LABELNAME (Color available: `white`, `green`, `yellow`, `orange`, `red`, `purple`, `blue`, `sky`, `lime`, `pink`, `black`, `silver`, `peachpuff`, `crimson`, `plum`, `darkgreen`, `slateblue`, `magenta`, `gold`, `navy`, `gray`, `saddlebrown`, `paleturquoise`, `mistyrose`, `indigo`) # Create a new label
-    python3 api.py editcardcolor BOARDID LISTID CARDID COLOR (Color available: `white`, `green`, `yellow`, `orange`, `red`, `purple`, `blue`, `sky`, `lime`, `pink`, `black`, `silver`, `peachpuff`, `crimson`, `plum`, `darkgreen`, `slateblue`, `magenta`, `gold`, `navy`, `gray`, `saddlebrown`, `paleturquoise`, `mistyrose`, `indigo`) # Edit card color
-    python3 api.py addchecklist BOARDID CARDID TITLE ITEM1 ITEM2 ITEM3 ITEM4 (You can add multiple items or just one, or also without any item, just TITLE works as well. * If items or Title contains spaces, you should add ' between them.) # Add checklist + item on a card
-    python3 api.py deleteallcards BOARDID SWIMLANEID ( * Be careful will delete ALL CARDS INSIDE the swimlanes automatically in every list * ) # Delete all cards on a swimlane
-    python3 api.py checklistid BOARDID CARDID # Retrieve Checklist ID attached to a card
-    python3 api.py checklistinfo BOARDID CARDID CHECKLISTID # Get checklist info
-    python3 api.py get_list_cards_count BOARDID LISTID # Retrieve how many cards in a list
-    python3 api.py get_board_cards_count BOARDID # Retrieve how many cards in a board

-    
+        Board Member API (Issue #5998):
+    python3 api.py addboardmember BOARDID USERID ROLE # Add/activate board member. ROLE: admin, normal, comment, readonly, worker, normalassignedonly, commentassignedonly, readassignedonly, nocomments
+    python3 api.py removeboardmember BOARDID USERID # Remove (deactivate) board member
+    python3 api.py setboardmemberrole BOARDID USERID ROLE # Change permission/role of existing board member
+
+        Card Member / Assignee API (board member -> card member/assignee):
+    python3 api.py setcardmembers BOARDID LISTID CARDID MEMBERIDS # Set card members. MEMBERIDS = comma-separated userIds, or '' to clear
+    python3 api.py setcardassignees BOARDID LISTID CARDID ASSIGNEEIDS # Set card assignees. ASSIGNEEIDS = comma-separated userIds, or '' to clear
+
+        Card Dates API (Issue #5846):
+    python3 api.py setcarddate BOARDID LISTID CARDID DATETYPE [DATEVALUE] # DATETYPE: received, start, due, end. DATEVALUE: ISO 8601, e.g. 2026-06-07T12:00:00.000Z. Omit DATEVALUE (or pass '') to clear the date.
+
+        Card Labels API (Issue #5819):
+    python3 api.py setcardlabels BOARDID LISTID CARDID LABELIDS # Set (replace) card labels. LABELIDS = comma-separated labelIds, or '' to clear
+
+        Card Copy/Move API:
+    python3 api.py movecard BOARDID LISTID CARDID NEWBOARDID NEWSWIMLANEID NEWLISTID # Move card to another board/swimlane/list
+
+        Bulk Card API (Issue #4743, #5819):
+    python3 api.py bulkaddcards BOARDID LISTID AUTHORID SWIMLANEID CARDSJSONFILE # Create many cards in one request. CARDSJSONFILE = JSON file with a list of titles, or a list of card objects {title,description,members,assignees,...}
+    python3 api.py bulkdeletecards BOARDID CARDIDS # Delete many cards in one request. CARDIDS = comma-separated cardIds
+    python3 api.py bulkcardlabels BOARDID CARDIDS ADDLABELIDS REMOVELABELIDS # Merge-add/remove labels across many cards. CARDIDS/ADDLABELIDS/REMOVELABELIDS = comma-separated, or '' for none
+
+        Linked Card API (Issue #5897):
+    python3 api.py linkcard BOARDID LISTID SWIMLANEID AUTHORID LINKEDCARDID # Create a linked card in BOARDID/LISTID that references LINKEDCARDID (may be on another board)
+
+        Card Member/Assignee Merge API (Issue #5998):
+    python3 api.py addcardmember BOARDID LISTID CARDID MEMBERID # Add one board member to a card (validated)
+    python3 api.py removecardmember BOARDID LISTID CARDID MEMBERID # Remove one member from a card
+    python3 api.py addcardassignee BOARDID LISTID CARDID ASSIGNEEID # Add one assignee to a card (validated)
+    python3 api.py removecardassignee BOARDID LISTID CARDID ASSIGNEEID # Remove one assignee from a card
+
+        Copy/Move Swimlane/List/Card API (position = 0-based index from top-left):
+    python3 api.py copycard BOARDID LISTID CARDID TOSWIMLANEID [TOBOARDID] [TOLISTID] [POSITION] # Copy a card (deep copy)
+    python3 api.py copyswimlane BOARDID SWIMLANEID [TOBOARDID] [POSITION] # Copy a swimlane (deep copy)
+    python3 api.py moveswimlane BOARDID SWIMLANEID [TOBOARDID] [POSITION] # Move a swimlane
+    python3 api.py copylist BOARDID LISTID TOSWIMLANEID [TOBOARDID] [POSITION] # Copy a list (deep copy)
+    python3 api.py movelist BOARDID LISTID [TOSWIMLANEID] [TOBOARDID] [POSITION] # Move a list
+
+        My Cards / Due Cards API (Issue #4815):
+    python3 api.py mycards [due] [FROM] [TO] # Current user's cards. 'due' = only cards with a due date; FROM/TO = ISO 8601 due-date range
+
+        Card Settings API (Issue #3062):
+    python3 api.py getcardsettings BOARDID # Get board-level card settings (allows* toggles)
+    python3 api.py setcardsetting BOARDID KEY VALUE # Set one board card setting, e.g. allowsDueDate true
+
  Admin API:
-    python3 api.py users                # All users
-    python3 api.py boards               # All Public Boards
    python3 api.py newuser USERNAME EMAIL PASSWORD
 """

@@ -723,9 +777,9 @@ if arguments == 2:
            print(f"Error: {e}")
        # ------- GET BOARD CARDS COUNT END -----------

-if arguments == 1:
+if arguments >= 1:

-    if sys.argv[1] == 'users':
+    if arguments == 1 and sys.argv[1] == 'users':

        # ------- LIST OF USERS START -----------
        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
@@ -736,7 +790,7 @@ if arguments == 1:
        print(data2)
        # ------- LIST OF USERS END -----------

-    if sys.argv[1] == 'user':
+    if arguments == 1 and sys.argv[1] == 'user':
        # ------- LIST OF ALL USERS START -----------
        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
        print(user)
@@ -746,7 +800,7 @@ if arguments == 1:
        print(data2)
        # ------- LIST OF ALL USERS END -----------

-    if sys.argv[1] == 'boards':
+    if arguments == 1 and sys.argv[1] == 'boards':

        # ------- LIST OF PUBLIC BOARDS START -----------
        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
@@ -761,7 +815,7 @@ if arguments == 1:

    if sys.argv[1] == 'uploadattachment':
        # ------- UPLOAD ATTACHMENT START -----------
-        if arguments < 5:
+        if arguments < 6:
            print("Usage: python3 api.py uploadattachment BOARDID SWIMLANEID LISTID CARDID FILEPATH [STORAGE_BACKEND]")
            print("Storage backends: fs, gridfs, s3")
            exit(1)
@@ -1026,3 +1080,411 @@ if arguments == 1:
        # ------- DELETE ATTACHMENT END -----------

 # ------- NEW ATTACHMENT API ENDPOINTS END -----------
+
+# ------- BOARD MEMBER / CARD FIELD API ENDPOINTS START -----------
+# These commands wrap REST endpoints that already exist in Wekan.
+# See CHANGELOG.md "Upcoming" section for related issues and design notes.
+
+    # Map a human readable ROLE to the board member permission boolean flags
+    # used by /api/boards/:boardId/members/:userId/add and .../members/:memberId
+    def board_role_flags(role):
+        flags = {
+            'isAdmin': 'false',
+            'isNoComments': 'false',
+            'isCommentOnly': 'false',
+            'isWorker': 'false',
+            'isNormalAssignedOnly': 'false',
+            'isCommentAssignedOnly': 'false',
+            'isReadOnly': 'false',
+            'isReadAssignedOnly': 'false',
+        }
+        role = (role or 'normal').lower()
+        rolemap = {
+            'admin': 'isAdmin',
+            'nocomments': 'isNoComments',
+            'comment': 'isCommentOnly',
+            'commentonly': 'isCommentOnly',
+            'worker': 'isWorker',
+            'normalassignedonly': 'isNormalAssignedOnly',
+            'commentassignedonly': 'isCommentAssignedOnly',
+            'readonly': 'isReadOnly',
+            'readassignedonly': 'isReadAssignedOnly',
+        }
+        if role in ('normal', 'member'):
+            return flags  # all false == Normal board member
+        if role in rolemap:
+            flags[rolemap[role]] = 'true'
+            return flags
+        print("Invalid ROLE. Valid: admin, normal, comment, readonly, worker, "
+              "normalassignedonly, commentassignedonly, readassignedonly, nocomments")
+        sys.exit(1)
+
+    if sys.argv[1] == 'addboardmember':
+        # ------- ADD BOARD MEMBER START -----------
+        if arguments < 3:
+            print("Usage: python3 api.py addboardmember BOARDID USERID ROLE")
+            exit(1)
+        boardid = sys.argv[2]
+        userid = sys.argv[3]
+        role = sys.argv[4] if arguments > 3 else 'normal'
+        add_member_url = wekanurl + apiboards + boardid + s + 'members' + s + userid + s + 'add'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        post_data = {'action': 'add'}
+        post_data.update(board_role_flags(role))
+        body = requests.post(add_member_url, data=post_data, headers=headers)
+        print("=== ADD BOARD MEMBER ===\n")
+        print(body.text)
+        # ------- ADD BOARD MEMBER END -----------
+
+    if sys.argv[1] == 'removeboardmember':
+        # ------- REMOVE BOARD MEMBER START -----------
+        if arguments < 3:
+            print("Usage: python3 api.py removeboardmember BOARDID USERID")
+            exit(1)
+        boardid = sys.argv[2]
+        userid = sys.argv[3]
+        remove_member_url = wekanurl + apiboards + boardid + s + 'members' + s + userid + s + 'remove'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        post_data = {'action': 'remove'}
+        body = requests.post(remove_member_url, data=post_data, headers=headers)
+        print("=== REMOVE BOARD MEMBER ===\n")
+        print(body.text)
+        # ------- REMOVE BOARD MEMBER END -----------
+
+    if sys.argv[1] == 'setboardmemberrole':
+        # ------- SET BOARD MEMBER ROLE START -----------
+        if arguments < 4:
+            print("Usage: python3 api.py setboardmemberrole BOARDID USERID ROLE")
+            exit(1)
+        boardid = sys.argv[2]
+        userid = sys.argv[3]
+        role = sys.argv[4]
+        set_role_url = wekanurl + apiboards + boardid + s + 'members' + s + userid
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        post_data = board_role_flags(role)
+        body = requests.post(set_role_url, data=post_data, headers=headers)
+        print("=== SET BOARD MEMBER ROLE ===\n")
+        print(body.text)
+        # ------- SET BOARD MEMBER ROLE END -----------
+
+    if sys.argv[1] in ('setcardmembers', 'setcardassignees'):
+        # ------- SET CARD MEMBERS / ASSIGNEES START -----------
+        if arguments < 4:
+            print("Usage: python3 api.py {} BOARDID LISTID CARDID IDS".format(sys.argv[1]))
+            print("IDS = comma-separated userIds, or '' to clear")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        cardid = sys.argv[4]
+        ids_raw = sys.argv[5] if arguments > 4 else ''
+        ids = [x for x in ids_raw.split(',') if x] if ids_raw else []
+        field = 'members' if sys.argv[1] == 'setcardmembers' else 'assignees'
+        edcard = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        # Empty array clears the field; send as JSON so the array type is preserved.
+        put_data = {field: ids if ids else []}
+        body = requests.put(edcard, json=put_data, headers=headers)
+        print("=== SET CARD {} ===\n".format(field.upper()))
+        print(body.text)
+        # ------- SET CARD MEMBERS / ASSIGNEES END -----------
+
+    if sys.argv[1] == 'setcarddate':
+        # ------- SET CARD DATE START -----------
+        if arguments < 5:
+            print("Usage: python3 api.py setcarddate BOARDID LISTID CARDID DATETYPE DATEVALUE")
+            print("DATETYPE: received, start, due, end")
+            print("DATEVALUE: ISO 8601, e.g. 2026-06-07T12:00:00.000Z")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        cardid = sys.argv[4]
+        datetype = sys.argv[5].lower()
+        datevalue = sys.argv[6] if arguments > 5 else ''
+        datemap = {
+            'received': 'receivedAt',
+            'start': 'startAt',
+            'due': 'dueAt',
+            'end': 'endAt',
+        }
+        if datetype not in datemap:
+            print("Invalid DATETYPE. Valid: received, start, due, end")
+            sys.exit(1)
+        edcard = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        put_data = {datemap[datetype]: datevalue}
+        body = requests.put(edcard, data=put_data, headers=headers)
+        print("=== SET CARD DATE {} ===\n".format(datetype.upper()))
+        print(body.text)
+        # ------- SET CARD DATE END -----------
+
+    if sys.argv[1] == 'setcardlabels':
+        # ------- SET CARD LABELS START -----------
+        if arguments < 4:
+            print("Usage: python3 api.py setcardlabels BOARDID LISTID CARDID LABELIDS")
+            print("LABELIDS = comma-separated labelIds, or '' to clear")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        cardid = sys.argv[4]
+        labelids_raw = sys.argv[5] if arguments > 4 else ''
+        labelids = [x for x in labelids_raw.split(',') if x] if labelids_raw else []
+        edcard = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        # NOTE: this REPLACES the card's labels. Bulk add/remove (merge) is not yet
+        # implemented server-side, see Issue #5819 in CHANGELOG.md "Upcoming".
+        put_data = {'labelIds': labelids if labelids else []}
+        body = requests.put(edcard, json=put_data, headers=headers)
+        print("=== SET CARD LABELS ===\n")
+        print(body.text)
+        # ------- SET CARD LABELS END -----------
+
+    if sys.argv[1] == 'movecard':
+        # ------- MOVE CARD START -----------
+        if arguments < 7:
+            print("Usage: python3 api.py movecard BOARDID LISTID CARDID NEWBOARDID NEWSWIMLANEID NEWLISTID")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        cardid = sys.argv[4]
+        newboardid = sys.argv[5]
+        newswimlaneid = sys.argv[6]
+        newlistid = sys.argv[7]
+        edcard = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        put_data = {
+            'newBoardId': newboardid,
+            'newSwimlaneId': newswimlaneid,
+            'newListId': newlistid,
+        }
+        body = requests.put(edcard, data=put_data, headers=headers)
+        print("=== MOVE CARD ===\n")
+        print(body.text)
+        # ------- MOVE CARD END -----------
+
+    if sys.argv[1] == 'bulkaddcards':
+        # ------- BULK ADD CARDS START -----------
+        if arguments < 5:
+            print("Usage: python3 api.py bulkaddcards BOARDID LISTID AUTHORID SWIMLANEID CARDSJSONFILE")
+            print("CARDSJSONFILE = JSON file with a list of titles, e.g. [\"Card A\", \"Card B\"],")
+            print("                or a list of card objects [{\"title\": \"Card A\", \"description\": \"...\"}, ...]")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        authorid = sys.argv[4]
+        swimlaneid = sys.argv[5]
+        cardsjsonfile = sys.argv[6] if arguments > 5 else None
+        if not cardsjsonfile:
+            print("CARDSJSONFILE is required")
+            exit(1)
+        try:
+            with open(cardsjsonfile, 'r') as f:
+                raw_cards = json.load(f)
+        except Exception as e:
+            print("Error reading CARDSJSONFILE: {}".format(e))
+            exit(1)
+        if not isinstance(raw_cards, list) or len(raw_cards) == 0:
+            print("CARDSJSONFILE must contain a non-empty JSON list")
+            exit(1)
+        cards = []
+        for item in raw_cards:
+            if isinstance(item, str):
+                cards.append({'title': item})
+            elif isinstance(item, dict):
+                cards.append(item)
+            else:
+                print("Each card must be a string (title) or an object")
+                exit(1)
+        bulk_url = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + 'bulk'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        post_data = {'authorId': authorid, 'swimlaneId': swimlaneid, 'cards': cards}
+        body = requests.post(bulk_url, json=post_data, headers=headers)
+        print("=== BULK ADD CARDS ===\n")
+        print(body.text)
+        # ------- BULK ADD CARDS END -----------
+
+    if sys.argv[1] == 'bulkdeletecards':
+        # ------- BULK DELETE CARDS START -----------
+        if arguments < 3:
+            print("Usage: python3 api.py bulkdeletecards BOARDID CARDIDS")
+            print("CARDIDS = comma-separated cardIds")
+            exit(1)
+        boardid = sys.argv[2]
+        cardids_raw = sys.argv[3]
+        cardids = [x for x in cardids_raw.split(',') if x]
+        bulk_url = wekanurl + apiboards + boardid + s + cs + s + 'bulk'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        # requests sends a body with DELETE via the json= parameter.
+        body = requests.delete(bulk_url, json={'cardIds': cardids}, headers=headers)
+        print("=== BULK DELETE CARDS ===\n")
+        print(body.text)
+        # ------- BULK DELETE CARDS END -----------
+
+    if sys.argv[1] == 'bulkcardlabels':
+        # ------- BULK CARD LABELS START -----------
+        if arguments < 5:
+            print("Usage: python3 api.py bulkcardlabels BOARDID CARDIDS ADDLABELIDS REMOVELABELIDS")
+            print("CARDIDS / ADDLABELIDS / REMOVELABELIDS = comma-separated, or '' for none")
+            exit(1)
+        boardid = sys.argv[2]
+        cardids = [x for x in sys.argv[3].split(',') if x]
+        add_labelids = [x for x in sys.argv[4].split(',') if x]
+        remove_labelids = [x for x in sys.argv[5].split(',') if x]
+        bulk_url = wekanurl + apiboards + boardid + s + cs + s + 'labels'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        post_data = {'cardIds': cardids, 'addLabelIds': add_labelids, 'removeLabelIds': remove_labelids}
+        body = requests.post(bulk_url, json=post_data, headers=headers)
+        print("=== BULK CARD LABELS ===\n")
+        print(body.text)
+        # ------- BULK CARD LABELS END -----------
+
+    if sys.argv[1] == 'linkcard':
+        # ------- CREATE LINKED CARD START -----------
+        if arguments < 6:
+            print("Usage: python3 api.py linkcard BOARDID LISTID SWIMLANEID AUTHORID LINKEDCARDID")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        swimlaneid = sys.argv[4]
+        authorid = sys.argv[5]
+        linkedcardid = sys.argv[6]
+        link_url = wekanurl + apiboards + boardid + s + l + s + listid + s + cs
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        post_data = {'authorId': authorid, 'swimlaneId': swimlaneid, 'linkedId': linkedcardid}
+        body = requests.post(link_url, data=post_data, headers=headers)
+        print("=== CREATE LINKED CARD ===\n")
+        print(body.text)
+        # ------- CREATE LINKED CARD END -----------
+
+    if sys.argv[1] in ('addcardmember', 'removecardmember', 'addcardassignee', 'removecardassignee'):
+        # ------- ADD/REMOVE CARD MEMBER / ASSIGNEE START -----------
+        if arguments < 5:
+            print("Usage: python3 api.py {} BOARDID LISTID CARDID USERID".format(sys.argv[1]))
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        cardid = sys.argv[4]
+        userid = sys.argv[5]
+        field = 'members' if 'member' in sys.argv[1] else 'assignees'
+        url = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid + s + field + s + userid
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        if sys.argv[1].startswith('add'):
+            body = requests.post(url, headers=headers)
+        else:
+            body = requests.delete(url, headers=headers)
+        print("=== {} ===\n".format(sys.argv[1].upper()))
+        print(body.text)
+        # ------- ADD/REMOVE CARD MEMBER / ASSIGNEE END -----------
+
+    if sys.argv[1] == 'copycard':
+        # ------- COPY CARD START -----------
+        if arguments < 4:
+            print("Usage: python3 api.py copycard BOARDID LISTID CARDID TOSWIMLANEID [TOBOARDID] [TOLISTID] [POSITION]")
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        cardid = sys.argv[4]
+        toswimlaneid = sys.argv[5] if arguments > 4 else None
+        if not toswimlaneid:
+            print("TOSWIMLANEID is required")
+            exit(1)
+        toboardid = sys.argv[6] if arguments > 5 else boardid
+        tolistid = sys.argv[7] if arguments > 6 else listid
+        url = wekanurl + apiboards + boardid + s + l + s + listid + s + cs + s + cardid + s + 'copy'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        post_data = {'toBoardId': toboardid, 'toSwimlaneId': toswimlaneid, 'toListId': tolistid}
+        if arguments > 7:
+            post_data['position'] = int(sys.argv[8])
+        body = requests.post(url, json=post_data, headers=headers)
+        print("=== COPY CARD ===\n")
+        print(body.text)
+        # ------- COPY CARD END -----------
+
+    if sys.argv[1] in ('copyswimlane', 'moveswimlane'):
+        # ------- COPY/MOVE SWIMLANE START -----------
+        if arguments < 3:
+            print("Usage: python3 api.py {} BOARDID SWIMLANEID [TOBOARDID] [POSITION]".format(sys.argv[1]))
+            exit(1)
+        boardid = sys.argv[2]
+        swimlaneid = sys.argv[3]
+        toboardid = sys.argv[4] if arguments > 3 else boardid
+        action = 'copy' if sys.argv[1] == 'copyswimlane' else 'move'
+        url = wekanurl + apiboards + boardid + s + sws + s + swimlaneid + s + action
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        post_data = {'toBoardId': toboardid}
+        if arguments > 4:
+            post_data['position'] = int(sys.argv[5])
+        body = requests.post(url, json=post_data, headers=headers)
+        print("=== {} ===\n".format(sys.argv[1].upper()))
+        print(body.text)
+        # ------- COPY/MOVE SWIMLANE END -----------
+
+    if sys.argv[1] in ('copylist', 'movelist'):
+        # ------- COPY/MOVE LIST START -----------
+        if arguments < 3:
+            print("Usage: python3 api.py {} BOARDID LISTID [TOSWIMLANEID] [TOBOARDID] [POSITION]".format(sys.argv[1]))
+            exit(1)
+        boardid = sys.argv[2]
+        listid = sys.argv[3]
+        toswimlaneid = sys.argv[4] if arguments > 3 else None
+        toboardid = sys.argv[5] if arguments > 4 else boardid
+        action = 'copy' if sys.argv[1] == 'copylist' else 'move'
+        url = wekanurl + apiboards + boardid + s + l + s + listid + s + action
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        post_data = {'toBoardId': toboardid}
+        if toswimlaneid:
+            post_data['toSwimlaneId'] = toswimlaneid
+        if arguments > 5:
+            post_data['position'] = int(sys.argv[6])
+        body = requests.post(url, json=post_data, headers=headers)
+        print("=== {} ===\n".format(sys.argv[1].upper()))
+        print(body.text)
+        # ------- COPY/MOVE LIST END -----------
+
+    if sys.argv[1] == 'mycards':
+        # ------- MY CARDS / DUE CARDS START -----------
+        params = {}
+        if arguments >= 2 and sys.argv[2].lower() == 'due':
+            params['due'] = 'true'
+        if arguments >= 3:
+            params['from'] = sys.argv[3]
+        if arguments >= 4:
+            params['to'] = sys.argv[4]
+        url = wekanurl + 'api/user/cards'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        body = requests.get(url, headers=headers, params=params)
+        print("=== MY CARDS ===\n")
+        data2 = body.text.replace('}', "}\n")
+        print(data2)
+        # ------- MY CARDS / DUE CARDS END -----------
+
+    if sys.argv[1] == 'getcardsettings':
+        # ------- GET CARD SETTINGS START -----------
+        if arguments < 2:
+            print("Usage: python3 api.py getcardsettings BOARDID")
+            exit(1)
+        boardid = sys.argv[2]
+        url = wekanurl + apiboards + boardid + s + 'cardSettings'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey)}
+        body = requests.get(url, headers=headers)
+        print("=== CARD SETTINGS ===\n")
+        data2 = body.text.replace(',', ",\n")
+        print(data2)
+        # ------- GET CARD SETTINGS END -----------
+
+    if sys.argv[1] == 'setcardsetting':
+        # ------- SET CARD SETTING START -----------
+        if arguments < 4:
+            print("Usage: python3 api.py setcardsetting BOARDID KEY VALUE")
+            print("e.g. python3 api.py setcardsetting BOARDID allowsDueDate true")
+            exit(1)
+        boardid = sys.argv[2]
+        key = sys.argv[3]
+        value = sys.argv[4]
+        url = wekanurl + apiboards + boardid + s + 'cardSettings'
+        headers = {'Accept': 'application/json', 'Authorization': 'Bearer {}'.format(apikey), 'Content-Type': 'application/json'}
+        body = requests.put(url, json={key: value}, headers=headers)
+        print("=== SET CARD SETTING ===\n")
+        print(body.text)
+        # ------- SET CARD SETTING END -----------
+
+# ------- BOARD MEMBER / CARD FIELD API ENDPOINTS END -----------
@@ -1,7 +1,41 @@
-// PWA
+// Fix dynamic-import chunk loading when Wekan runs under a sub-path (ROOT_URL includes a pathname,
+// e.g. https://example.com/wekan). Rspack uses __webpack_public_path__ to prefix chunk URLs; by
+// default it is set to /build-chunks/ (no context path). We update it here, at module evaluation
+// time, before any import() expression runs (those are deferred to Meteor.startup callbacks).
+/* global __webpack_public_path__:writable */
+try {
+  const _cfg = typeof window !== 'undefined' && window.__meteor_runtime_config__;
+  const _rootUrl = _cfg && _cfg.ROOT_URL;
+  if (_rootUrl) {
+    const _rootPath = new URL(_rootUrl).pathname.replace(/\/+$/, '');
+    if (_rootPath && _rootPath !== '/') {
+      __webpack_public_path__ = _rootPath + '/build-chunks/';
+    }
+  }
+} catch (_) {}
+
+// Fix bug in jam:offline 0.4.1: s?.message.includes() crashes when s.message is
+// undefined (e.g. during WebSocket reconnect errors that don't carry a .message).
+// Wrap _debug so the optional chain is complete: s?.message?.includes().
+(function patchJamOfflineDebug() {
+  const patched = Meteor._debug;
+  Meteor._debug = function (m, s) {
+    try {
+      return patched.call(this, m, s);
+    } catch (e) {
+      // jam:offline's override threw — fall back to the bare console log.
+      if (typeof console !== 'undefined') {
+        console.log(m, s);
+      }
+    }
+  };
+})();
+
+// PWA — use Meteor.absoluteUrl so the path is correct under sub-URL deployments
 if ('serviceWorker' in navigator) {
  window.addEventListener('load', function() {
-    navigator.serviceWorker.register('/pwa-service-worker.js');
+    const swPath = new URL('pwa-service-worker.js', Meteor.absoluteUrl()).pathname;
+    navigator.serviceWorker.register(swPath);
  });
 }

@@ -10,7 +44,8 @@ import '/client/config/blazeHelpers';

 // Import board converter for on-demand conversion
 import '/client/lib/boardConverter';
-import '/client/components/boardConversionProgress';
+import '/client/features/boardConversion';
+import { Utils } from '/client/lib/utils';

 // Import migration manager and progress UI - COMMENTED OUT
 // import '/client/lib/attachmentMigrationManager';
@@ -25,6 +60,22 @@ import '/client/components/boardConversionProgress';
 // Token already lives in localStorage; cookie adds same-origin send-on-request semantics
 Meteor.startup(() => {
  const COOKIE_NAME = 'meteor_login_token';
+  const USER_ID_COOKIE = 'meteor_user_id';
+  const TOKEN_EXPIRES_COOKIE = 'meteor_login_token_expires';
+
+  const getCookie = (name) => {
+    try {
+      const parts = document.cookie ? document.cookie.split(';') : [];
+      for (const part of parts) {
+        const [k, ...rest] = part.trim().split('=');
+        if (decodeURIComponent(k) === name) {
+          return decodeURIComponent(rest.join('='));
+        }
+      }
+    } catch (_) {}
+    return '';
+  };
+
  const cookieAttrs = () => {
    const attrs = ['Path=/', 'SameSite=Lax'];
    try {
@@ -52,6 +103,37 @@ Meteor.startup(() => {
    }
  };

+  const bootstrapTokenFromCookie = () => {
+    try {
+      const currentToken = Accounts && typeof Accounts._storedLoginToken === 'function'
+        ? Accounts._storedLoginToken()
+        : null;
+      if (currentToken) {
+        return;
+      }
+
+      const token = getCookie(COOKIE_NAME);
+      const userId = getCookie(USER_ID_COOKIE);
+      const tokenExpiresRaw = getCookie(TOKEN_EXPIRES_COOKIE);
+      const tokenExpires = tokenExpiresRaw ? new Date(tokenExpiresRaw) : null;
+
+      if (!token || !userId || !tokenExpires || Number.isNaN(tokenExpires.getTime())) {
+        return;
+      }
+
+      if (Accounts && typeof Accounts._storeLoginToken === 'function') {
+        Accounts._storeLoginToken(userId, token, tokenExpires);
+        if (Meteor.status && !Meteor.status().connected && typeof Meteor.reconnect === 'function') {
+          Meteor.reconnect();
+        }
+      }
+    } catch (_) {
+      // ignore
+    }
+  };
+
+  bootstrapTokenFromCookie();
+
  // Initial sync on startup
  syncCookie();

@@ -9,11 +9,11 @@ template(name="activities")
        +cardActivities

 template(name="boardActivities")
-  each activityData in currentBoard.activities
+  each activityData in boardActivitiesList
    +activity(activity=activityData card=card mode=mode)

 template(name="cardActivities")
-  each activityData in activities
+  each activityData in cardActivitiesList
    +activity(activity=activityData card=card mode=mode)

 template(name="activity")
@@ -1,12 +1,17 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import { ReactiveVar } from 'meteor/reactive-var';
+import { Template } from 'meteor/templating';
 import DOMPurify from 'dompurify';
 import { sanitizeHTML, sanitizeText } from '/imports/lib/secureDOMPurify';
 import { TAPi18n } from '/imports/i18n';
+import { Utils } from '/client/lib/utils';
+import { getSidebarInstance } from '/client/features/sidebar/service';

 const activitiesPerPage = 500;

 Template.activities.onCreated(function () {
  // Register with sidebar so it can call loadNextPage on us
+  const Sidebar = getSidebarInstance();
  if (Sidebar) {
    Sidebar.activitiesInstance = this;
  }
@@ -22,7 +27,7 @@ Template.activities.onCreated(function () {
  };

  // TODO is sidebar always available? E.g. on small screens/mobile devices
-  const sidebar = Sidebar;
+  const sidebar = getSidebarInstance();
  if (sidebar && sidebar.infiniteScrolling) {
    sidebar.infiniteScrolling.resetNextPeak();
  }
@@ -71,7 +76,9 @@ function _showActivities(data) {
      const currentCard = Utils.getCurrentCard();
      ret = currentCard.showActivities ?? false;
    } else if (mode === 'card') {
-      ret = data?.card?.showActivities ?? false;
+      // For card mode, get showActivities from data context or fallback to current card
+      const card = data?.card || Utils.getCurrentCard();
+      ret = card?.showActivities ?? false;
    } else {
      ret = Utils.getCurrentBoard().showActivities ?? false;
    }
@@ -80,8 +87,31 @@ function _showActivities(data) {
 }

 Template.activities.helpers({
+  showActivities() {
+    const data = Template.currentData();
+    return _showActivities(data);
+  },
+
  activities() {
-    return this.card.activities();
+    const activities = this.card?.activities?.();
+    return activities || [];
+  },
+});
+
+Template.boardActivities.helpers({
+  boardActivitiesList() {
+    const board = Utils.getCurrentBoard();
+    const activities = board?.activities?.();
+    return activities || [];
+  },
+});
+
+Template.cardActivities.helpers({
+  cardActivitiesList() {
+    const data = Template.currentData();
+    const card = data?.card;
+    const activities = card?.activities?.();
+    return activities || [];
  },
 });

@@ -228,14 +258,18 @@ Template.activity.helpers({

  attachmentLink() {
    const attachment = this.activity.attachment();
+    const attachmentUrl = attachment && typeof attachment.link === 'function'
+      ? attachment.link()
+      : '';
    // trying to display url before file is stored generates js errors
    return (
      (attachment &&
        attachment.path &&
+        attachmentUrl &&
        Blaze.toHTML(
          HTML.A(
            {
-              href: `${attachment.link()}?download=true`,
+              href: `${attachmentUrl}?download=true`,
              target: '_blank',
            },
            sanitizeText(attachment.name),
@@ -260,7 +294,8 @@ Template.activity.helpers({

 Template.commentReactions.events({
  'click .reaction'(event) {
-    if (ReactiveCache.getCurrentUser().isBoardMember()) {
+    const user = ReactiveCache.getCurrentUser();
+    if (user && user.isBoardMember()) {
      const codepoint = event.currentTarget.dataset['codepoint'];
      const commentId = Template.instance().data.commentId;
      const cardComment = ReactiveCache.getCardComment(commentId);
@@ -272,7 +307,8 @@ Template.commentReactions.events({

 Template.addReactionPopup.events({
  'click .add-comment-reaction'(event) {
-    if (ReactiveCache.getCurrentUser().isBoardMember()) {
+    const user = ReactiveCache.getCurrentUser();
+    if (user && user.isBoardMember()) {
      const codepoint = event.currentTarget.dataset['codepoint'];
      const commentId = Template.instance().data.commentId;
      const cardComment = ReactiveCache.getCardComment(commentId);
@@ -1,4 +1,9 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import CardComments from '/models/cardComments';
+import { UnsavedEdits } from '/client/lib/unsavedEdits';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { Utils } from '/client/lib/utils';
+import autosize from 'autosize';

 const commentFormIsOpen = new ReactiveVar(false);

@@ -65,7 +70,7 @@ Template.comment.events({
    evt.preventDefault();
    const textarea = tpl.find('.js-edit-comment textarea,input[type=text]');
    const commentText = textarea && textarea.value ? textarea.value.trim() : '';
-    const commentId = this._id;
+    const commentId = tpl.data._id;
    if (commentText) {
      CardComments.update(commentId, {
        $set: {
@@ -8,10 +8,10 @@ template(name="archivedBoards")
    each archivedBoards
      li.archived-lists-item
        div.board-header-btns
-          button.board-header-btn.js-delete-board
+          button.primary.board-header-btn.js-delete-board
            i.fa.fa-trash
            | {{_ 'delete-board'}}
-          button.board-header-btn.js-restore-board
+          button.primary.board-header-btn.js-restore-board
            i.fa.fa-undo
            | {{_ 'restore-board'}}
          = title
@@ -1,5 +1,7 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import Boards from '/models/boards';
+import { Utils } from '/client/lib/utils';

 Template.archivedBoards.onCreated(function () {
  this.subscribe('archivedBoards');
@@ -64,7 +64,7 @@ template(name="boardBody")

 template(name="calendarView")
  if isViewCalendar
-    .calendar-view.swimlane
+    .calendar-view.swimlane.dragscroll
      if currentCard
        +cardDetails(currentCard)
      +fullcalendar(calendarOptions)
@@ -1,117 +1,87 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import '../gantt/gantt.js';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import { TAPi18n } from '/imports/i18n';
 import dragscroll from '@wekanteam/dragscroll';
+import '/client/lib/dragscrollTouch';
 import { boardConverter } from '/client/lib/boardConverter';
 import { formatDateByUserPreference } from '/imports/lib/dateUtils';
 import Swimlanes from '/models/swimlanes';
 import Lists from '/models/lists';
+import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { Utils } from '/client/lib/utils';

-const subManager = new SubsManager();
+// SubsManager removed for Meteor 3 migration
 const { calculateIndex } = Utils;
 const swimlaneWhileSortingHeight = 150;

 // Global reference so child components (swimlanes, cards) can access boardBody instance
-BoardBody = null;
+let BoardBody = null;

 Template.board.onCreated(function () {
  this.isBoardReady = new ReactiveVar(false);
+  // Kept for the template/jade which still references it; conversion is a no-op.
  this.isConverting = new ReactiveVar(false);
-  this._swimlaneCreated = new Set(); // Track boards where we've created swimlanes
-  this._boardProcessed = false; // Track if board has been processed
-  this._lastProcessedBoardId = null; // Track last processed board ID
+  this._swimlaneCreated = new Set(); // boards where a default swimlane was ensured

-  this.ensureDefaultSwimlane = (boardId) => {
-    // Only create swimlane once per board
+  // Ensure a board has at least one swimlane. Guarded to run once per board and
+  // fire-and-forget so it never blocks rendering. The board is marked
+  // immediately to avoid duplicate concurrent calls, and the mark is rolled
+  // back on failure so a later attempt can retry.
+  this.ensureDefaultSwimlane = async (boardId) => {
    if (this._swimlaneCreated.has(boardId)) {
      return;
    }
-
+    this._swimlaneCreated.add(boardId);
    try {
      const board = ReactiveCache.getBoard(boardId);
-      if (!board) return;
-
-      const swimlanes = board.swimlanes();
-
-      if (swimlanes.length === 0) {
-        // Check if any swimlane exists in the database to avoid race conditions
-        const existingSwimlanes = ReactiveCache.getSwimlanes({ boardId });
-        if (existingSwimlanes.length === 0) {
-          const swimlaneId = Swimlanes.insert({
-            title: 'Default',
-            boardId: boardId,
-          });
-          if (process.env.DEBUG === 'true') {
-            console.log(
-              `Created default swimlane ${swimlaneId} for board ${boardId}`,
-            );
-          }
+      if (!board) {
+        this._swimlaneCreated.delete(boardId);
+        return;
+      }
+      if (board.swimlanes().length === 0) {
+        const swimlaneId = await Meteor.callAsync('ensureDefaultSwimlane', boardId);
+        if (process.env.DEBUG === 'true' && swimlaneId) {
+          console.log(
+            `Ensured default swimlane ${swimlaneId} for board ${boardId}`,
+          );
        }
-        this._swimlaneCreated.add(boardId);
-      } else {
-        this._swimlaneCreated.add(boardId);
      }
    } catch (error) {
+      this._swimlaneCreated.delete(boardId); // allow a later retry
      console.error('Error creating default swimlane:', error);
    }
  };

-  this.checkAndConvertBoard = async (boardId) => {
-    try {
-      const board = ReactiveCache.getBoard(boardId);
-      if (!board) {
-        this.isBoardReady.set(true);
-        return;
-      }
-
-      this.isBoardReady.set(true);
-    } catch (error) {
-      console.error('Error during board conversion check:', error);
-      this.isConverting.set(false);
-      this.isBoardReady.set(true); // Show board even if conversion check failed
-    }
-  };
-
-  // The pattern we use to manually handle data loading is described here:
-  // https://kadira.io/academy/meteor-routing-guide/content/subscriptions-and-data-management/using-subs-manager
-  // XXX The boardId should be readed from some sort the component "props",
-  // unfortunatly, Blaze doesn't have this notion.
+  // Single reactive computation that subscribes to the current board and tracks
+  // its ready state in one place. Previously a Tracker.autorun was created
+  // *inside* this autorun on every re-run without being stopped, leaking
+  // computations that raced on shared ready-state flags. When navigating
+  // between boards — e.g. opening a freshly created board — that race could
+  // leave swimlanes/lists unrendered until the board was re-selected. A single
+  // self-managed autorun (auto-stopped by Blaze on destroy) avoids both the
+  // leak and the race.
+  // Pattern: https://kadira.io/academy/meteor-routing-guide/content/subscriptions-and-data-management/using-subs-manager
  this.autorun(() => {
    const currentBoardId = Session.get('currentBoard');
-    if (!currentBoardId) return;
+    if (!currentBoardId) {
+      this.isBoardReady.set(false);
+      return;
+    }

-    const handle = subManager.subscribe('board', currentBoardId, false);
+    const handle = Meteor.subscribe('board', currentBoardId, false);
+    const ready = handle.ready();
+    this.isBoardReady.set(ready);

-    // Use a separate autorun for subscription ready state to avoid reactive loops
-    this.subscriptionReadyAutorun = Tracker.autorun(() => {
-      if (handle.ready()) {
-        if (
-          !this._boardProcessed ||
-          this._lastProcessedBoardId !== currentBoardId
-        ) {
-          this._boardProcessed = true;
-          this._lastProcessedBoardId = currentBoardId;
-
-          // Ensure default swimlane exists (only once per board)
-          this.ensureDefaultSwimlane(currentBoardId);
-          // Check if board needs conversion
-          this.checkAndConvertBoard(currentBoardId);
-        }
-      } else {
-        this.isBoardReady.set(false);
-      }
-    });
+    if (ready) {
+      // Run outside the computation so this autorun depends only on the board
+      // id and the subscription's ready state — not on the swimlane data that
+      // ensureDefaultSwimlane reads — which would otherwise cause extra re-runs.
+      Tracker.nonreactive(() => this.ensureDefaultSwimlane(currentBoardId));
+    }
  });
 });

-Template.board.onDestroyed(function () {
-  // Clean up the subscription ready autorun to prevent memory leaks
-  if (this.subscriptionReadyAutorun) {
-    this.subscriptionReadyAutorun.stop();
-  }
-});
-
 Template.board.helpers({
  onlyShowCurrentCard() {
    const isMiniScreen = Utils.isMiniScreen();
@@ -150,6 +120,7 @@ Template.board.helpers({

 Template.boardBody.onCreated(function () {
  Meteor.subscribe('tableVisibilityModeSettings');
+  Meteor.subscribe('inviteToBoardRolesSettings');
  this.showOverlay = new ReactiveVar(false);
  this.draggingActive = new ReactiveVar(false);
  this._isDragging = false;
@@ -614,6 +585,17 @@ Template.boardBody.onDestroyed(function () {
 });

 Template.boardBody.helpers({
+  openCards() {
+    const isMobile = Utils.getMobileMode();
+    if (!isMobile) {
+      const openCardIds = Session.get('openCards') || [];
+      return openCardIds
+        .map((id) => ReactiveCache.getCard(id))
+        .filter((card) => card);
+    }
+    return [];
+  },
+
  draggingActive() {
    return Template.instance().draggingActive.get();
  },
@@ -1091,11 +1073,33 @@ Template.calendarView.helpers({
        const createCardButton = modalElement.querySelector(
          '#create-card-button',
        );
-        createCardButton.addEventListener('click', function () {
+        createCardButton.addEventListener('click', async function () {
          const myTitle = modalElement.querySelector('#card-title-input').value;
          if (myTitle) {
-            const firstList = currentBoard.draggableLists()[0];
-            const firstSwimlane = currentBoard.swimlanes()[0];
+            let firstSwimlane = currentBoard.swimlanes()[0];
+            if (!firstSwimlane) {
+              const swimlaneId = await Swimlanes.insertAsync({
+                title: 'Default',
+                boardId: currentBoard._id,
+              });
+              firstSwimlane = ReactiveCache.getSwimlane(swimlaneId);
+            }
+
+            let firstList = currentBoard.draggableLists()[0];
+            if (!firstList && firstSwimlane) {
+              const defaultTitle = TAPi18n.__('default');
+              const listId = await Lists.insertAsync({
+                title: typeof defaultTitle === 'string' ? defaultTitle : 'Default',
+                boardId: currentBoard._id,
+                swimlaneId: firstSwimlane._id,
+              });
+              firstList = ReactiveCache.getList(listId);
+            }
+
+            if (!firstList || !firstSwimlane) {
+              return;
+            }
+
            Meteor.call(
              'createCardWithDueDate',
              currentBoard._id,
@@ -3370,18 +3370,19 @@ THEME - Clean Light

 .board-color-cleanlight .list,
 .board-color-cleandark .list {
-  background: none;
-  border-left: none;
+  background: none !important;
+  border-left: none !important;
 }

 .board-color-cleanlight .list .list-header,
 .board-color-cleandark .list .list-header {
-  border-bottom: none;
-  display: flex;
+  border-bottom: none !important;
+  display: flex !important;
  justify-content: space-between;
  align-items: center;
  font-size: 16px;
-  background: none;
+  background: none !important;
+  background-color: transparent !important;
 }

 .board-color-cleanlight .list .list-header div:has(.list-header-name),
@@ -4279,6 +4280,14 @@ THEME - Clean Light
  font-weight: 500;
 }

+.board-color-cleandark .pop-over-list li > a {
+  color: rgba(255, 255, 255, 1) !important;
+}
+
+.board-color-cleanlight .pop-over-list li > a {
+  color: rgba(10, 10, 20, 0.85) !important;
+}
+
 .board-color-cleanlight .pop-over-list li > a i,
 .board-color-cleandark .pop-over-list li > a i {
  margin-right: 6px !important;
@@ -1,151 +1,152 @@
 template(name="boardHeaderBar")
-  h1.header-board-menu
-    with currentBoard
-      if $eq title 'Templates'
-        | {{_ 'templates'}}
-      else
-        +viewer
-          = title
+  unless notDisplayThisBoard
+    h1.header-board-menu
+      with currentBoard
+        if $eq title 'Templates'
+          | {{_ 'templates'}}
+        else
+          +viewer
+            = title

-  .board-header-btns.left
-    unless isMiniScreen
+    .board-header-btns.left
+      unless isMiniScreen
+        if currentBoard
+          if currentUser
+            with currentBoard
+              if currentUser.isBoardAdmin
+                a.board-header-btn(class="{{#if currentUser.isBoardAdmin}}js-edit-board-title{{else}}is-disabled{{/if}}" title="{{_ 'edit'}}" value=title)
+                  i.fa.fa-pencil-square-o
+
+              a.board-header-btn(
+                class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
+                title="{{_ currentBoard.permission}}")
+                i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
+                span {{_ currentBoard.permission}}
+
+              a.board-header-btn.js-watch-board(
+                title="{{_ watchLevel }}")
+                if $eq watchLevel "watching"
+                  i.fa.fa-eye
+                if $eq watchLevel "tracking"
+                  i.fa.fa-bell
+                if $eq watchLevel "muted"
+                  i.fa.fa-bell-slash
+                span {{_ watchLevel}}
+              a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
+                title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
+                i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+                if showStarCounter
+                  span.board-star-counter {{currentBoard.stars}}
+              a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
+                i.fa.fa-sort
+                span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
+              if isSortActive
+                a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
+                  i.fa.fa-times-thin
+
+          else
+            a.board-header-btn.js-log-in(
+              title="{{_ 'log-in'}}")
+              i.fa.fa-sign-in
+              span {{_ 'log-in'}}
+
+    .board-header-btns.center
+
+    .board-header-btns.right
      if currentBoard
-        if currentUser
-          with currentBoard
-            if currentUser.isBoardAdmin
+        if isMiniScreen
+          if currentUser
+            with currentBoard
              a.board-header-btn(class="{{#if currentUser.isBoardAdmin}}js-edit-board-title{{else}}is-disabled{{/if}}" title="{{_ 'edit'}}" value=title)
                i.fa.fa-pencil-square-o

-            a.board-header-btn(
-              class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
-              title="{{_ currentBoard.permission}}")
-              i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-              span {{_ currentBoard.permission}}
+              a.board-header-btn(
+                class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
+                title="{{_ currentBoard.permission}}")
+                i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")

-            a.board-header-btn.js-watch-board(
-              title="{{_ watchLevel }}")
-              if $eq watchLevel "watching"
-                i.fa.fa-eye
-              if $eq watchLevel "tracking"
-                i.fa.fa-bell
-              if $eq watchLevel "muted"
-                i.fa.fa-bell-slash
-              span {{_ watchLevel}}
-            a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
-              title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
-              i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-              if showStarCounter
-                span.board-star-counter {{currentBoard.stars}}
-            a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
-              i.fa.fa-sort
-              span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
-            if isSortActive
-              a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
-                i.fa.fa-times-thin
+              a.board-header-btn.js-watch-board(
+                title="{{_ watchLevel }}")
+                if $eq watchLevel "watching"
+                  i.fa.fa-eye
+                if $eq watchLevel "tracking"
+                  i.fa.fa-bell
+                if $eq watchLevel "muted"
+                  i.fa.fa-bell-slash
+              a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
+                title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
+                i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
+              a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
+                i.fa.fa-sort
+                span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
+              if isSortActive
+                a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
+                  i.fa.fa-times-thin

-        else
-          a.board-header-btn.js-log-in(
-            title="{{_ 'log-in'}}")
-            i.fa.fa-sign-in
-            span {{_ 'log-in'}}
+          else
+            a.board-header-btn.js-log-in(
+              title="{{_ 'log-in'}}")
+              i.fa.fa-sign-in

-  .board-header-btns.center
+        if isSandstorm
+          if currentUser
+            a.board-header-btn.js-open-archived-board
+              i.fa.fa-archive

-  .board-header-btns.right
-    if currentBoard
-      if isMiniScreen
-        if currentUser
-          with currentBoard
-            a.board-header-btn(class="{{#if currentUser.isBoardAdmin}}js-edit-board-title{{else}}is-disabled{{/if}}" title="{{_ 'edit'}}" value=title)
-              i.fa.fa-pencil-square-o
+        //if showSort
+        //
+          a.board-header-btn.js-open-sort-view(title="{{_ 'sort-desc'}}")
+        //
+              i.fa(class="{{directionClass}}")
+        //
+              span {{_ 'sort'}}{{_ listSortShortDesc}}

-            a.board-header-btn(
-              class="{{#if currentUser.isBoardAdmin}}js-change-visibility{{else}}is-disabled{{/if}}"
-              title="{{_ currentBoard.permission}}")
-              i.fa(class="{{#if currentBoard.isPublic}}fa-globe{{else}}fa-lock{{/if}}")
-
-            a.board-header-btn.js-watch-board(
-              title="{{_ watchLevel }}")
-              if $eq watchLevel "watching"
-                i.fa.fa-eye
-              if $eq watchLevel "tracking"
-                i.fa.fa-bell
-              if $eq watchLevel "muted"
-                i.fa.fa-bell-slash
-            a.board-header-btn.js-star-board(class="{{#if isStarred}}is-active{{/if}}"
-              title="{{#if isStarred}}{{_ 'click-to-unstar'}}{{else}}{{_ 'click-to-star'}}{{/if}} {{_ 'starred-boards-description'}}")
-              i.fa(class="fa-star{{#unless isStarred}}-o{{/unless}}")
-            a.board-header-btn(title="{{_ 'sort-cards'}}" class="{{#if isSortActive }}emphasis{{else}} js-sort-cards {{/if}}")
-              i.fa.fa-sort
-              span {{#if isSortActive }}{{_ 'sort-is-on'}}{{else}}{{_ 'sort-cards'}}{{/if}}
-            if isSortActive
-              a.board-header-btn-close.js-sort-reset(title="{{_ 'remove-sort'}}")
-                i.fa.fa-times-thin
-
-        else
-          a.board-header-btn.js-log-in(
-            title="{{_ 'log-in'}}")
-            i.fa.fa-sign-in
-
-      if isSandstorm
-        if currentUser
-          a.board-header-btn.js-open-archived-board
-            i.fa.fa-archive
-
-      //if showSort
-      //
-        a.board-header-btn.js-open-sort-view(title="{{_ 'sort-desc'}}")
-      //
-          i.fa(class="{{directionClass}}")
-      //
-          span {{_ 'sort'}}{{_ listSortShortDesc}}
-
-      a.board-header-btn.js-open-filter-view(
-          title="{{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}"
-          class="{{#if Filter.isActive}}js-filter-active{{/if}}")
-        i.fa.fa-filter
-        span {{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}
-        if Filter.isActive
-          a.board-header-btn-close.js-filter-reset(title="{{_ 'filter-clear'}}")
-            i.fa.fa-times-thin
-
-      a.board-header-btn.js-open-search-view(title="{{_ 'search'}}")
-        i.fa.fa-search
-        span {{_ 'search'}}
-
-      unless currentBoard.isTemplatesBoard
-        a.board-header-btn.js-toggle-board-view
-          i.fa.fa-caret-down
-          if $eq boardView 'board-view-swimlanes'
-            i.fa.fa-th-large
-          if $eq boardView 'board-view-lists'
-            i.fa.fa-trello
-          if $eq boardView 'board-view-cal'
-            i.fa.fa-calendar
-          if $eq boardView 'board-view-gantt'
-            i.fa.fa-bar-chart
-          span
-            if $eq boardView 'board-view-swimlanes'
-              | {{_ 'swimlanes'}}
-            if $eq boardView 'board-view-lists'
-              | {{_ 'lists'}}
-            if $eq boardView 'board-view-cal'
-              | {{_ 'calendar'}}
-            if $eq boardView 'board-view-gantt'
-              | {{_ 'gantt'}}
-      if canModifyBoard
-        a.board-header-btn.js-multiselection-activate(
-            title="{{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
-            class="{{#if MultiSelection.isActive}}emphasis{{/if}}")
-          i.fa.fa-check-square-o
-          span {{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
-          if MultiSelection.isActive
-            a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
+        a.board-header-btn.js-open-filter-view(
+            title="{{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}"
+            class="{{#if Filter.isActive}}js-filter-active{{/if}}")
+          i.fa.fa-filter
+          span {{#if Filter.isActive}}{{_ 'filter-on-desc'}}{{else}}{{_ 'filter'}}{{/if}}
+          if Filter.isActive
+            a.board-header-btn-close.js-filter-reset(title="{{_ 'filter-clear'}}")
              i.fa.fa-times-thin

-      .separator
-      a.board-header-btn.js-toggle-sidebar(title="{{_ 'sidebar-open'}} {{_ 'or'}} {{_ 'sidebar-close'}}")
-        i.fa.fa-bars
+        a.board-header-btn.js-open-search-view(title="{{_ 'search'}}")
+          i.fa.fa-search
+          span {{_ 'search'}}
+
+        unless currentBoard.isTemplatesBoard
+          a.board-header-btn.js-toggle-board-view
+            i.fa.fa-caret-down
+            if $eq boardView 'board-view-swimlanes'
+              i.fa.fa-th-large
+            if $eq boardView 'board-view-lists'
+              i.fa.fa-trello
+            if $eq boardView 'board-view-cal'
+              i.fa.fa-calendar
+            if $eq boardView 'board-view-gantt'
+              i.fa.fa-bar-chart
+            span
+              if $eq boardView 'board-view-swimlanes'
+                | {{_ 'swimlanes'}}
+              if $eq boardView 'board-view-lists'
+                | {{_ 'lists'}}
+              if $eq boardView 'board-view-cal'
+                | {{_ 'calendar'}}
+              if $eq boardView 'board-view-gantt'
+                | {{_ 'gantt'}}
+        if canModifyBoard
+          a.board-header-btn.js-multiselection-activate(
+              title="{{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}"
+              class="{{#if MultiSelection.isActive}}emphasis{{/if}}")
+            i.fa.fa-check-square-o
+            span {{#if MultiSelection.isActive}}{{_ 'multi-selection-on'}}{{else}}{{_ 'multi-selection'}}{{/if}}
+            if MultiSelection.isActive
+              a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
+                i.fa.fa-times-thin
+
+        .separator
+        a.board-header-btn.js-toggle-sidebar(title="{{_ 'sidebar-open'}} {{_ 'or'}} {{_ 'sidebar-close'}}")
+          i.fa.fa-bars

 template(name="boardVisibilityList")
  ul.pop-over-list
@@ -2,6 +2,14 @@ import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import dragscroll from '@wekanteam/dragscroll';
+import getSlug from 'limax';
+import Boards from '/models/boards';
+import Swimlanes from '/models/swimlanes';
+import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
+import { Filter } from '/client/lib/filter';
+import { MultiSelection } from '/client/lib/multiSelection';
+import { getSidebarInstance } from '/client/features/sidebar/service';
+import { Utils } from '/client/lib/utils';

 /*
 const DOWNCLS = 'fa-sort-down';
@@ -11,6 +19,7 @@ const sortCardsBy = new ReactiveVar('');

 Template.boardChangeTitlePopup.events({
  async submit(event, templateInstance) {
+    event.preventDefault();
    const newTitle = templateInstance
      .$('.js-board-name')
      .val()
@@ -27,11 +36,25 @@ Template.boardChangeTitlePopup.events({
      }
      Popup.back();
    }
-    event.preventDefault();
  },
 });

+Template.boardHeaderBar.onCreated(function () {
+  Meteor.subscribe('tableVisibilityModeSettings');
+});
+
 Template.boardHeaderBar.helpers({
+  notDisplayThisBoard() {
+    const allowPrivateVisibilityOnly = TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly');
+    const currentBoard = Utils.getCurrentBoard();
+    return (
+      allowPrivateVisibilityOnly !== undefined &&
+      allowPrivateVisibilityOnly.booleanValue &&
+      currentBoard &&
+      currentBoard.permission === 'public'
+    );
+  },
+
  watchLevel() {
    const currentBoard = Utils.getCurrentBoard();
    return currentBoard && currentBoard.getWatchLevel(Meteor.userId());
@@ -94,30 +117,32 @@ Template.boardHeaderBar.events({
      console.log('Hamburger menu clicked');
    }
    // Use the same approach as keyboard shortcuts
-    if (typeof Sidebar !== 'undefined' && Sidebar && typeof Sidebar.toggle === 'function') {
+    const sidebar = getSidebarInstance();
+    if (sidebar && typeof sidebar.toggle === 'function') {
      if (process.env.DEBUG === 'true') {
        console.log('Using Sidebar.toggle()');
      }
-      Sidebar.toggle();
+      sidebar.toggle();
    } else {
      if (process.env.DEBUG === 'true') {
        console.warn('Sidebar not available, trying alternative approach');
      }
      // Try to trigger the sidebar through the global Blaze helper
      if (typeof Blaze !== 'undefined' && Blaze._globalHelpers && Blaze._globalHelpers.Sidebar) {
-        const sidebar = Blaze._globalHelpers.Sidebar();
-        if (sidebar && typeof sidebar.toggle === 'function') {
+        const blazeSidebar = Blaze._globalHelpers.Sidebar();
+        if (blazeSidebar && typeof blazeSidebar.toggle === 'function') {
          if (process.env.DEBUG === 'true') {
            console.log('Using Blaze helper Sidebar.toggle()');
          }
-          sidebar.toggle();
+          blazeSidebar.toggle();
        }
      }
    }
  },
  'click .js-open-filter-view'() {
-    if (Sidebar) {
-      Sidebar.setView('filter');
+    const sidebar = getSidebarInstance();
+    if (sidebar) {
+      sidebar.setView('filter');
    } else {
      console.warn('Sidebar not available for setView');
    }
@@ -137,8 +162,9 @@ Template.boardHeaderBar.events({
  */
  'click .js-filter-reset'(event) {
    event.stopPropagation();
-    if (Sidebar) {
-      Sidebar.setView();
+    const sidebar = getSidebarInstance();
+    if (sidebar) {
+      sidebar.setView();
    } else {
      console.warn('Sidebar not available for setView');
    }
@@ -148,8 +174,9 @@ Template.boardHeaderBar.events({
    Session.set('sortBy', '');
  },
  'click .js-open-search-view'() {
-    if (Sidebar) {
-      Sidebar.setView('search');
+    const sidebar = getSidebarInstance();
+    if (sidebar) {
+      sidebar.setView('search');
    } else {
      console.warn('Sidebar not available for setView');
    }
@@ -206,7 +233,7 @@ function createBoardHelpers() {
      return Template.instance().visibility.get();
    },
    notAllowPrivateVisibilityOnly() {
-      return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly').booleanValue;
+      return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
    },
    visibilityCheck() {
      return Template.currentData() === Template.instance().visibility.get();
@@ -214,55 +241,26 @@ function createBoardHelpers() {
  };
 }

-function createBoardSubmit(tpl, event) {
+async function createBoardSubmit(tpl, event) {
  event.preventDefault();
  const title = tpl.find('.js-new-board-title').value;
+  const slug = getSlug(title) || 'board';

  const addTemplateContainer = $('#add-template-container.is-checked').length > 0;
  if (addTemplateContainer) {
-    //const templateContainerId = Meteor.call('setCreateTemplateContainer');
-    //Utils.goBoardId(templateContainerId);
-    //alert('niinku template ' + Meteor.call('setCreateTemplateContainer'));
-
    tpl.boardId.set(
-      Boards.insert({
-          // title: TAPi18n.__('templates'),
-          title: title,
-          permission: 'private',
-          type: 'template-container',
-          migrationVersion: 1, // Latest version - no migration needed
-        }),
-     );
-
-    // Insert the card templates swimlane
-    Swimlanes.insert({
-        // title: TAPi18n.__('card-templates-swimlane'),
-        title: 'Card Templates',
-        boardId: tpl.boardId.get(),
-        sort: 1,
+      await Meteor.callAsync('createBoardWithInitialSwimlanes', {
+        title,
+        slug,
+        permission: 'private',
        type: 'template-container',
+        migrationVersion: 1,
+        swimlanes: [
+          { title: 'Card Templates', sort: 1, type: 'template-container' },
+          { title: 'List Templates', sort: 2, type: 'template-container' },
+          { title: 'Board Templates', sort: 3, type: 'template-container' },
+        ],
      }),
-
-    // Insert the list templates swimlane
-    Swimlanes.insert(
-      {
-        // title: TAPi18n.__('list-templates-swimlane'),
-        title: 'List Templates',
-        boardId: tpl.boardId.get(),
-        sort: 2,
-        type: 'template-container',
-      },
-    );
-
-    // Insert the board templates swimlane
-    Swimlanes.insert(
-      {
-        //title: TAPi18n.__('board-templates-swimlane'),
-        title: 'Board Templates',
-        boardId: tpl.boardId.get(),
-        sort: 3,
-        type: 'template-container',
-      },
    );

    // Assign to space if one was selected
@@ -274,24 +272,21 @@ function createBoardSubmit(tpl, event) {
      Session.set('createBoardInWorkspace', null); // Clear after use
    }

-    Utils.goBoardId(tpl.boardId.get());
+    FlowRouter.go('board', { id: tpl.boardId.get(), slug });

  } else {
    const visibility = tpl.visibility.get();

    tpl.boardId.set(
-      Boards.insert({
+      await Meteor.callAsync('createBoardWithInitialSwimlanes', {
        title,
+        slug,
        permission: visibility,
-        migrationVersion: 1, // Latest version - no migration needed
+        migrationVersion: 1,
+        swimlanes: [{ title: 'Default' }],
      }),
    );

-    Swimlanes.insert({
-      title: 'Default',
-      boardId: tpl.boardId.get(),
-    });
-
    // Assign to space if one was selected
    const spaceId = Session.get('createBoardInWorkspace');
    if (spaceId) {
@@ -301,22 +296,22 @@ function createBoardSubmit(tpl, event) {
      Session.set('createBoardInWorkspace', null); // Clear after use
    }

-    Utils.goBoardId(tpl.boardId.get());
+    FlowRouter.go('board', { id: tpl.boardId.get(), slug });
  }
 }

 function createBoardEvents() {
  return {
    'click .js-select-visibility'(event, tpl) {
-      tpl.visibility.set(Template.currentData());
+      tpl.visibility.set(this);
      tpl.visibilityMenuIsOpen.set(false);
    },
    'click .js-change-visibility'(event, tpl) {
      tpl.visibilityMenuIsOpen.set(!tpl.visibilityMenuIsOpen.get());
    },
    'click .js-import': Popup.open('boardImportBoard'),
-    'submit'(event, tpl) {
-      createBoardSubmit(tpl, event);
+    async 'submit'(event, tpl) {
+      await createBoardSubmit(tpl, event);
    },
    'click .js-import-board': Popup.open('chooseBoardSource'),
    'click .js-board-template': Popup.open('searchElement'),
@@ -367,7 +362,7 @@ Template.headerBarCreateBoardPopup.helpers(createBoardHelpers());

 Template.headerBarCreateBoardPopup.events({
  'click .js-select-visibility'(event, tpl) {
-    tpl.visibility.set(Template.currentData());
+    tpl.visibility.set(this);
    tpl.visibilityMenuIsOpen.set(false);
  },
  'click .js-change-visibility'(event, tpl) {
@@ -375,7 +370,7 @@ Template.headerBarCreateBoardPopup.events({
  },
  'click .js-import': Popup.open('boardImportBoard'),
  async submit(event, tpl) {
-    createBoardSubmit(tpl, event);
+    await createBoardSubmit(tpl, event);
    // Immediately star boards created with the headerbar popup.
    await ReactiveCache.getCurrentUser().toggleBoardStar(tpl.boardId.get());
  },
@@ -386,13 +381,19 @@ Template.headerBarCreateBoardPopup.events({
  },
 });

+Template.boardVisibilityList.helpers({
+  notAllowPrivateVisibilityOnly() {
+    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
+  },
+});
+
 Template.boardChangeVisibilityPopup.onCreated(function () {
  Meteor.subscribe('tableVisibilityModeSettings');
 });

 Template.boardChangeVisibilityPopup.helpers({
  notAllowPrivateVisibilityOnly(){
-    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly').booleanValue;
+    return !TableVisibilityModeSettings.findOne('tableVisibilityMode-allowPrivateOnly')?.booleanValue;
  },
  visibilityCheck() {
    const currentBoard = Utils.getCurrentBoard();
@@ -403,9 +404,11 @@ Template.boardChangeVisibilityPopup.helpers({
 Template.boardChangeVisibilityPopup.events({
  'click .js-select-visibility'() {
    const currentBoard = Utils.getCurrentBoard();
-    const visibility = String(this);
-    currentBoard.setVisibility(visibility);
-    Popup.back();
+    const visibility = this;
+    if (typeof visibility === 'string') {
+      currentBoard.setVisibility(visibility);
+      Popup.back();
+    }
  },
 });

@@ -423,16 +426,18 @@ Template.boardChangeWatchPopup.helpers({

 Template.boardChangeWatchPopup.events({
  'click .js-select-watch'() {
-    const level = String(this);
-    Meteor.call(
-      'watch',
-      'board',
-      Session.get('currentBoard'),
-      level,
-      (err, ret) => {
-        if (!err && ret) Popup.back();
-      },
-    );
+    const level = this;
+    if (typeof level === 'string') {
+      Meteor.call(
+        'watch',
+        'board',
+        Session.get('currentBoard'),
+        level,
+        (err, ret) => {
+          if (!err && ret) Popup.back();
+        },
+      );
+    }
  },
 });

@@ -1,4 +1,4 @@
-@import url("../../../css/reset.css") print, screen;
+@import url("../../../public/css/reset.css") print, screen;

 /* Board List Header with Zoom Controls */
 .board-list-header {
@@ -62,6 +62,17 @@
  border: 2px dashed #2196F3;
 }

+/* Highlight valid drop targets while a board is being dragged */
+.workspace-node.board-drag-hint > .workspace-node-content {
+  background: #e8f5e9;
+  border: 1px dashed #4CAF50;
+  border-radius: 4px;
+}
+.boards-left-menu .menu-item a.board-drag-hint {
+  background: #e8f5e9;
+  border: 1px dashed #4CAF50;
+}
+
 .workspaces-header {
  display: flex;
  align-items: center;
@@ -950,6 +961,22 @@ body.grey-icons-enabled .checkmark-no-grey {
    font-size: inherit !important; /* Inherit the 2x scaling */
  }

+  /* Stack the two-column All Boards layout on small screens. The fixed
+     "260px 1fr" grid had no mobile collapse, so on narrow non-iPhone browsers
+     (Fairphone Firefox ESR / Ubuntu Touch Morph, narrow desktop) it overflowed
+     and the left menu (Starred / Templates / Remaining / Workspaces / + Add
+     board) was clipped. Width-based, so it applies to every browser. */
+  .boards-layout {
+    grid-template-columns: 1fr !important;
+  }
+
+  .boards-left-menu {
+    border-right: none !important;
+    border-bottom: 1px solid #e0e0e0;
+    padding-right: 0 !important;
+    padding-bottom: 12px;
+  }
+
  .wrapper .fa, .wrapper .icon {
    font-size: 2em !important; /* 2x bigger icons */
  }
@@ -95,7 +95,7 @@ template(name="boardList")
                a.board-header-btn-close.js-multiselection-reset(title="{{_ 'filter-clear'}}")
                  span.emoji-icon
                    i.fa.fa-times
-        ul.board-list.clearfix.js-boards(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
+        ul.board-list.clearfix.js-boards.dragscroll(class="{{#if isMiniScreen}}mobile-view{{/if}} {{#if BoardMultiSelection.isActive}}is-multiselection-active{{/if}}")
          li.js-add-board
            if isSelectedMenu 'templates'
              a.board-list-item.label(title="{{_ 'add-template-container'}}")
@@ -130,7 +130,7 @@ template(name="boardList")
                    if BoardMultiSelection.isActive
                      .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
                        class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.board-handle(title="{{_ 'drag-board'}}")
+                    span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
                      span.emoji-icon
                        i.fa.fa-arrows

@@ -158,13 +158,13 @@ template(name="boardList")
                    if BoardMultiSelection.isActive
                      .materialCheckBox.multi-selection-checkbox.js-toggle-board-multi-selection(
                        class="{{#if BoardMultiSelection.isSelected _id}}is-checked{{/if}}")
-                    span.board-handle(title="{{_ 'drag-board'}}")
+                    span.board-handle.nodragscroll(title="{{boardWorkspaceDragHint}}")
                      span.emoji-icon
                        i.fa.fa-arrows

                    a.js-open-board(href="{{pathFor 'board' id=_id slug=slug}}")
                      span.details
-                        span.board-list-item-name(title="{{_ 'board-drag-drop-reorder-or-click-open'}}")
+                        span.board-list-item-name(title="{{boardOpenAndMoveHint}}")
                          +viewer
                            = title
                        unless currentSetting.hideBoardMemberList
@@ -2,8 +2,14 @@ import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import getSlug from 'limax';
+import dragscroll from '@wekanteam/dragscroll';
+import '/client/lib/dragscrollTouch';
+import TableVisibilityModeSettings from '/models/tableVisibilityModeSettings';
+import { BoardMultiSelection } from '/client/lib/boardMultiSelection';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { Utils } from '/client/lib/utils';

-const subManager = new SubsManager();
+// SubsManager removed for Meteor 3 migration

 const DEFAULT_WORKSPACE_ICON = '📁';

@@ -193,6 +199,13 @@ Template.boardList.onCreated(function () {
 });

 Template.boardList.onRendered(function () {
+  // Enable drag-to-scroll on the All Boards list (.board-list.dragscroll), the
+  // same way the board canvas/swimlanes do. This makes mouse drag-scrolling
+  // work on desktop; finger drag-scrolling is handled by dragscrollTouch.js.
+  // The .board-list element is stable across menu/workspace switches (only its
+  // li children are re-rendered), so a single reset() binding is enough.
+  dragscroll.reset();
+
  // jQuery sortable is disabled in favor of HTML5 drag-and-drop for space management
  // The old sortable code has been removed to prevent conflicts
  /* OLD SORTABLE CODE - DISABLED
@@ -350,12 +363,6 @@ Template.boardList.helpers({
    if (FlowRouter.getRouteName() === 'home') {
      membershipOrs.push({ 'members.userId': Meteor.userId() });

-      if (
-        allowPrivateVisibilityOnly !== undefined &&
-        allowPrivateVisibilityOnly.booleanValue
-      ) {
-        query.$and.push({ permission: 'private' });
-      }
      const currUser = ReactiveCache.getCurrentUser();

      let orgIdsUserBelongs = currUser?.orgIdsUserBelongs() || '';
@@ -535,6 +542,28 @@ Template.boardList.helpers({
  hasBoardsSelected() {
    return BoardMultiSelection.count() > 0;
  },
+  boardWorkspaceDragHint() {
+    const remaining = TAPi18n.__('allboards.remaining') || 'Remaining';
+    const workspaces = TAPi18n.__('allboards.workspaces') || 'Workspaces';
+    return (
+      TAPi18n.__('drag-board-to-workspace', { remaining, workspaces }) ||
+      `Drag board to assign to ${workspaces} (drop on workspace in left sidebar)`
+    );
+  },
+  boardOpenAndMoveHint() {
+    const remaining = TAPi18n.__('allboards.remaining') || 'Remaining';
+    const workspaces = TAPi18n.__('allboards.workspaces') || 'Workspaces';
+    return (
+      TAPi18n.__(
+        'board-open-and-move-between-remaining-and-workspaces',
+        {
+          remaining,
+          workspaces,
+        },
+      ) ||
+      `Click board icon to open board. Drag board between ${remaining} and ${workspaces}.`
+    );
+  },
 });

 Template.workspaceTree.helpers({
@@ -638,6 +667,20 @@ Template.boardList.events({
        evt.originalEvent.dataTransfer.setData('text/plain', boardId);
      } catch (e) {}
    }
+    // Highlight valid drop targets in the sidebar so users know where to drop
+    document.querySelectorAll('.workspace-node').forEach((el) => {
+      el.classList.add('board-drag-hint');
+    });
+    document.querySelectorAll('.js-select-menu').forEach((el) => {
+      if (el.getAttribute('data-type') === 'remaining') {
+        el.classList.add('board-drag-hint');
+      }
+    });
+  },
+  'dragend .js-board'() {
+    document.querySelectorAll('.workspace-node.board-drag-hint, .js-select-menu.board-drag-hint').forEach((el) => {
+      el.classList.remove('board-drag-hint');
+    });
  },
  'click .js-clone-board'(evt) {
    if (confirm(TAPi18n.__('duplicate-board-confirm'))) {
@@ -657,7 +700,7 @@ Template.boardList.events({
            console.error(err);
          } else {
            Session.set('fromBoard', null);
-            subManager.subscribe('board', res, false);
+            Meteor.subscribe('board', res, false);
            FlowRouter.go('board', {
              id: res,
              slug: title,
@@ -671,7 +714,9 @@ Template.boardList.events({
  'click .js-archive-board'(evt) {
    if (confirm(TAPi18n.__('archive-board-confirm'))) {
      const boardId = this._id;
-      Meteor.call('archiveBoard', boardId);
+      Meteor.call('archiveBoard', boardId, (err) => {
+        if (err) alert(err?.reason || err?.message || 'Failed to archive board');
+      });
      evt.preventDefault();
    }
  },
@@ -714,7 +759,9 @@ Template.boardList.events({
      confirm(TAPi18n.__('archive-board-confirm'))
    ) {
      selectedBoards.forEach((boardId) => {
-        Meteor.call('archiveBoard', boardId);
+        Meteor.call('archiveBoard', boardId, (err) => {
+          if (err) alert(err?.reason || err?.message || 'Failed to archive board');
+        });
      });
      BoardMultiSelection.reset();
    }
@@ -86,6 +86,10 @@ template(name="attachmentGallery")
              b
                = name
              span.file-size ({{fileSize size}})
+            if uploaderName
+              div.attachment-uploader {{uploaderName}}
+            if uploadedAt
+              div.attachment-uploaded-at {{uploadedAt}}
            .attachment-actions
              a.js-download(href="{{link}}?download=true", download="{{name}}", title="{{_ 'download'}}")
                i.fa.fa-arrow-down
@@ -121,23 +125,6 @@ template(name="attachmentActionsPopup")
            else
              | {{_ 'add-background-image'}}

-        if $neq versions.original.storage "fs"
-          a.js-move-storage-fs
-            i.fa.fa-arrow-right
-            | {{_ 'attachment-move-storage-fs'}}
-
-        if $neq versions.original.storage "gridfs"
-          if versions.original.storage
-            a.js-move-storage-gridfs
-              i.fa.fa-arrow-right
-              | {{_ 'attachment-move-storage-gridfs'}}
-
-        if $neq versions.original.storage "s3"
-          if versions.original.storage
-            a.js-move-storage-s3
-              i.fa.fa-arrow-right
-              | {{_ 'attachment-move-storage-s3'}}
-
 template(name="attachmentRenamePopup")
  input.js-edit-attachment-name(type='text' autofocus value="{{getNameWithoutExtension}}" dir="auto")
  .edit-controls.clearfix
@@ -1,12 +1,16 @@
 import { ReactiveCache } from '/imports/reactiveCache';
-import { ObjectID } from 'bson';
+import { ObjectId } from 'bson';
 import DOMPurify from 'dompurify';
 import { sanitizeHTML, sanitizeText } from '/imports/lib/secureDOMPurify';
 import uploadProgressManager from '../../lib/uploadProgressManager';
 import { attachmentMigrationManager } from '/client/lib/attachmentMigrationManager';
+import Attachments from '/models/attachments';
+import { Utils } from '/client/lib/utils';
+import { formatDateTime } from '/imports/lib/dateUtils';
+import { EscapeActions } from '/client/lib/escapeActions';

-const filesize = require('filesize');
-const prettyMilliseconds = require('pretty-ms');
+const { filesize } = require('filesize');
+import prettyMilliseconds from 'pretty-ms';

 // We store current card ID and the ID of currently opened attachment in a
 // global var. This is used so that we know what's the next attachment to open
@@ -19,7 +23,7 @@ let touchStartCoords = null;
 let touchEndCoords = null;

 // Stores link to the attachment for which attachment actions popup was opened
-attachmentActionsLink = null;
+let attachmentActionsLink = null;

 Template.attachmentGallery.events({
  'click .open-preview'(event) {
@@ -40,8 +44,12 @@ Template.attachmentGallery.events({
    attachmentActionsLink = event.currentTarget.getAttribute("data-attachment-link");
  },
  'click .js-rename': Popup.open('attachmentRename'),
-  'click .js-confirm-delete': Popup.afterConfirm('attachmentDelete', function() {
-      Attachments.remove(this._id);
+  'click .js-confirm-delete': Popup.afterConfirm('attachmentDelete', async function() {
+      const card = this.meta && this.meta.cardId ? ReactiveCache.getCard(this.meta.cardId) : null;
+      if (card && card.coverId === this._id) {
+        await card.unsetCover();
+      }
+      await Attachments.removeAsync(this._id);
      Popup.back();
  }),
 });
@@ -81,6 +89,10 @@ function attachmentCanBeOpened(attachment) {
  );
 }

+function getAttachmentUrl(attachment) {
+  return attachment && typeof attachment.link === 'function' ? attachment.link() : '';
+}
+
 function openAttachmentViewer(attachmentId) {
  const attachment = ReactiveCache.getAttachment(attachmentId);

@@ -97,18 +109,18 @@ function openAttachmentViewer(attachmentId) {
  */
  switch(true){
    case (attachment.isImage):
-      $("#image-viewer").attr("src", attachment.link());
+      $("#image-viewer").attr("src", getAttachmentUrl(attachment));
      $("#image-viewer").removeClass("hidden");
      break;
    case (attachment.isPDF):
-      $("#pdf-viewer").attr("data", attachment.link());
+      $("#pdf-viewer").attr("data", getAttachmentUrl(attachment));
      $("#pdf-viewer").removeClass("hidden");
      break;
    case (attachment.isVideo):
      // We have to create a new <source> DOM element and append it to the video
      // element, otherwise the video won't load
      let videoSource = document.createElement('source');
-      videoSource.setAttribute('src', attachment.link());
+      videoSource.setAttribute('src', getAttachmentUrl(attachment));
      $("#video-viewer").append(videoSource);

      $("#video-viewer").removeClass("hidden");
@@ -117,14 +129,14 @@ function openAttachmentViewer(attachmentId) {
      // We have to create a new <source> DOM element and append it to the audio
      // element, otherwise the audio won't load
      let audioSource = document.createElement('source');
-      audioSource.setAttribute('src', attachment.link());
+      audioSource.setAttribute('src', getAttachmentUrl(attachment));
      $("#audio-viewer").append(audioSource);

      $("#audio-viewer").removeClass("hidden");
      break;
    case (attachment.isText):
    case (attachment.isJSON):
-      $("#txt-viewer").attr("data", attachment.link());
+      $("#txt-viewer").attr("data", getAttachmentUrl(attachment));
      $("#txt-viewer").removeClass("hidden");
      break;
  }
@@ -196,8 +208,6 @@ function processTouch(){
  xDist = touchEndCoords.x - touchStartCoords.x;
  yDist = touchEndCoords.y - touchStartCoords.y;

-  console.log("xDist: " + xDist);
-
  // Left swipe
  if (Math.abs(xDist) > Math.abs(yDist) && xDist < 0) {
    openNextAttachment();
@@ -217,14 +227,12 @@ function processTouch(){

 Template.attachmentViewer.events({
  'touchstart #viewer-container'(event) {
-    console.log("touchstart")
    touchStartCoords = {
      x: event.changedTouches[0].screenX,
      y: event.changedTouches[0].screenY
    }
  },
  'touchend #viewer-container'(event) {
-    console.log("touchend")
    touchEndCoords = {
      x: event.changedTouches[0].screenX,
      y: event.changedTouches[0].screenY
@@ -263,6 +271,24 @@ Template.attachmentViewer.events({
 });

 Template.attachmentGallery.helpers({
+  attachments() {
+    const card = Template.currentData();
+    if (!card) return [];
+    const cardId = typeof card.getRealId === 'function' ? card.getRealId() : card._id;
+    if (!cardId) return [];
+    const filesCursor = Attachments.find(
+      { 'meta.cardId': cardId },
+      { sort: { uploadedAt: -1 } },
+    );
+    // Call fetch() on the underlying Mongo cursor to establish a reactive
+    // dependency directly inside this Blaze computation. Without this,
+    // .each() (which calls cursor.map()) would not register reactivity and
+    // newly-uploaded attachments would not appear until a page reload.
+    if (filesCursor && filesCursor.cursor) {
+      filesCursor.cursor.fetch();
+    }
+    return filesCursor.each();
+  },
  isBoardAdmin() {
    return ReactiveCache.getCurrentUser().isBoardAdmin();
  },
@@ -273,6 +299,26 @@ Template.attachmentGallery.helpers({
  sanitize(value) {
    return sanitizeHTML(value);
  },
+  uploaderName() {
+    const uploaderId = this.userId;
+    if (!uploaderId) return '';
+    const uploader = ReactiveCache.getUser(uploaderId);
+    if (!uploader) return '';
+    return uploader.profile && uploader.profile.fullname
+      ? uploader.profile.fullname
+      : uploader.username || '';
+  },
+  uploadedAt() {
+    if (this.uploadedAtOstrio) {
+      return formatDateTime(this.uploadedAtOstrio);
+    }
+    // Fall back to ObjectId timestamp (first 4 bytes = Unix seconds)
+    try {
+      const ts = parseInt(this._id.substring(0, 8), 16) * 1000;
+      if (!isNaN(ts)) return formatDateTime(new Date(ts));
+    } catch (_) {}
+    return '';
+  },
 });

 Template.cardAttachmentsPopup.onCreated(function() {
@@ -294,12 +340,13 @@ Template.cardAttachmentsPopup.helpers({
 });

 Template.cardAttachmentsPopup.events({
-  'change .js-attach-file'(event, templateInstance) {
+  async 'change .js-attach-file'(event, templateInstance) {
+    event.stopPropagation();
    const card = this;
    const files = event.currentTarget.files;
    if (files) {
      let uploads = [];
-      const uploaders = handleFileUpload(card, files);
+      const uploaders = await handleFileUpload(card, files);

      uploaders.forEach(uploader => {
        uploader.on('start', function() {
@@ -317,6 +364,10 @@ Template.cardAttachmentsPopup.events({
    }
  },
  'click .js-computer-upload'(event, templateInstance) {
+    // Prevent the click fired when the OS file-picker dialog closes from
+    // triggering EscapeActions and closing the popup before the upload starts.
+    // Same pattern as swimlanes.js after drag operations.
+    EscapeActions.preventNextClick();
    templateInstance.find('.js-attach-file').click();
    event.preventDefault();
  },
@@ -328,7 +379,7 @@ const COMPRESS_RATIO = Utils.IMAGE_COMPRESS_RATIO;
 let pastedResults = null;

 // Shared upload logic for drag-and-drop functionality
-export function handleFileUpload(card, files) {
+export async function handleFileUpload(card, files) {
  if (!files || files.length === 0) {
    return [];
  }
@@ -361,7 +412,7 @@ export function handleFileUpload(card, files) {
      continue;
    }

-    const fileId = new ObjectID().toString();
+    const fileId = new ObjectId().toString();
    let fileName = sanitizeText(file.name);

    // If sanitized filename is not same as original filename,
@@ -381,11 +432,16 @@ export function handleFileUpload(card, files) {
      fileName: fileName,
      meta: Utils.getCommonAttachmentMetaFrom(card),
      chunkSize: 'dynamic',
+      // Use HTTP transport instead of DDP so file chunks go over a dedicated
+      // fetch POST rather than flooding the WebSocket/DDP channel.  DDP
+      // upload causes repeated DDP reconnects in Safari, showing the
+      // "Loading, please wait" offline banner and stalling progress at ~95%.
+      transport: 'http',
    };
    config.meta.fileId = fileId;

    try {
-      const uploader = Attachments.insert(
+      const uploader = await Attachments.insertAsync(
        config,
        false,
      );
@@ -460,21 +516,22 @@ Template.previewClipboardImagePopup.onRendered(() => {
 });

 Template.previewClipboardImagePopup.events({
-  'click .js-upload-pasted-image'() {
+  async 'click .js-upload-pasted-image'() {
    const card = this;
    if (pastedResults && pastedResults.file) {
      const file = pastedResults.file;
      window.oPasted = pastedResults;
-      const fileId = new ObjectID().toString();
+      const fileId = new ObjectId().toString();
      const config = {
        file,
        fileId: fileId,
        meta: Utils.getCommonAttachmentMetaFrom(card),
        fileName: file.name || file.type.replace('image/', 'clipboard.'),
        chunkSize: 'dynamic',
+        transport: 'http',
      };
      config.meta.fileId = fileId;
-      const uploader = Attachments.insert(
+      const uploader = await Attachments.insertAsync(
        config,
        false,
      );
@@ -531,23 +588,11 @@ Template.attachmentActionsPopup.events({
    Utils.reload();
    event.preventDefault();
  },
-  'click .js-move-storage-fs'() {
-    Meteor.call('moveAttachmentToStorage', this._id, "fs");
-    Popup.back();
-  },
-  'click .js-move-storage-gridfs'() {
-    Meteor.call('moveAttachmentToStorage', this._id, "gridfs");
-    Popup.back();
-  },
-  'click .js-move-storage-s3'() {
-    Meteor.call('moveAttachmentToStorage', this._id, "s3");
-    Popup.back();
-  },
 });

 Template.attachmentRenamePopup.helpers({
  getNameWithoutExtension() {
-    const ret = this.name.replace(new RegExp("\." + this.extension + "$"), "");
+    const ret = this.name.replace(new RegExp("\\." + this.extension + "$"), "");
    return ret;
  },
 });
@@ -55,11 +55,10 @@ template(name="cardCustomField-number")
 template(name="cardCustomField-checkbox")
  .js-checklist-item.checklist-item(class="{{#if data.value }}is-checked{{/if}}")
    if canModifyCard
-      span.check-box-unicode
-        i.fa(class="{{#if data.value}}fa-check-square{{else}}fa-square-o{{/if}}")
+      .check-box-container
+        .check-box.materialCheckBox(class="{{#if data.value}}is-checked{{/if}}")
    else
-      span.check-box-unicode
-        i.fa(class="{{#if data.value}}fa-check-square{{else}}fa-square-o{{/if}}")
+      .materialCheckBox(class="{{#if data.value}}is-checked{{/if}}")

 template(name="cardCustomField-currency")
    if canModifyCard
@@ -29,6 +29,8 @@ import {
 } from '/imports/lib/dateUtils';
 import { CustomFieldStringTemplate } from '/client/lib/customFields'
 import { getCurrentCardFromContext } from '/client/lib/currentCard';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { getSidebarInstance } from '/client/features/sidebar/service';

 Template.cardCustomFieldsPopup.helpers({
  hasCustomField() {
@@ -49,7 +51,10 @@ Template.cardCustomFieldsPopup.events({
  },
  'click .js-settings'(event) {
    EscapeActions.executeUpTo('detailsPane');
-    Sidebar.setView('customFields');
+    const sidebar = getSidebarInstance();
+    if (sidebar) {
+      sidebar.setView('customFields');
+    }
    event.preventDefault();
  },
 });
@@ -101,9 +106,6 @@ Template['cardCustomField-checkbox'].onCreated(function () {
 });

 Template['cardCustomField-checkbox'].events({
-  'click .js-checklist-item .check-box-unicode'(event, tpl) {
-    tpl.card.setCustomField(tpl.customFieldId, !Template.currentData().value);
-  },
  'click .js-checklist-item .check-box-container'(event, tpl) {
    tpl.card.setCustomField(tpl.customFieldId, !Template.currentData().value);
  },
@@ -165,7 +167,7 @@ Template['cardCustomField-date'].helpers({
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
  showISODate() {
@@ -48,7 +48,7 @@ Template.editCardReceivedDatePopup.helpers(datePickerHelpers());

 Template.editCardReceivedDatePopup.events(datePickerEvents({
  storeDate(date) {
-    this.datePicker.card.setReceived(formatDateTime(date));
+    this.datePicker.card.setReceived(date);
  },
  deleteDate() {
    this.datePicker.card.unsetReceived();
@@ -72,7 +72,7 @@ Template.editCardStartDatePopup.helpers(datePickerHelpers());

 Template.editCardStartDatePopup.events(datePickerEvents({
  storeDate(date) {
-    this.datePicker.card.setStart(formatDateTime(date));
+    this.datePicker.card.setStart(date);
  },
  deleteDate() {
    this.datePicker.card.unsetStart();
@@ -96,7 +96,7 @@ Template.editCardDueDatePopup.helpers(datePickerHelpers());

 Template.editCardDueDatePopup.events(datePickerEvents({
  storeDate(date) {
-    this.datePicker.card.setDue(formatDateTime(date));
+    this.datePicker.card.setDue(date);
  },
  deleteDate() {
    this.datePicker.card.unsetDue();
@@ -120,7 +120,7 @@ Template.editCardEndDatePopup.helpers(datePickerHelpers());

 Template.editCardEndDatePopup.events(datePickerEvents({
  storeDate(date) {
-    this.datePicker.card.setEnd(formatDateTime(date));
+    this.datePicker.card.setEnd(date);
  },
  deleteDate() {
    this.datePicker.card.unsetEnd();
@@ -146,14 +146,12 @@ function cardDateHelpers(extraHelpers) {
    },
    showWeekOfYear() {
      const user = ReactiveCache.getCurrentUser();
-      if (!user) {
-        return false;
-      }
+      if (!user) return window.localStorage.getItem('showWeekOfYear') === 'true';
      return user.isShowWeekOfYear();
    },
    showDate() {
      const currentUser = ReactiveCache.getCurrentUser();
-      const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+      const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
      return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
    },
    showISODate() {
@@ -196,7 +194,7 @@ Template.cardReceivedDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${TAPi18n.__('card-received-on')} ${formattedDate}`;
  },
@@ -237,7 +235,7 @@ Template.cardStartDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${TAPi18n.__('card-start-on')} ${formattedDate}`;
  },
@@ -286,7 +284,7 @@ Template.cardDueDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${TAPi18n.__('card-due-on')} ${formattedDate}`;
  },
@@ -356,7 +354,7 @@ Template.cardCustomFieldDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${formattedDate}`;
  },
@@ -400,13 +398,13 @@ Template.minicardReceivedDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${TAPi18n.__('card-received-on')} ${formattedDate}`;
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
 }));
@@ -446,13 +444,13 @@ Template.minicardStartDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${TAPi18n.__('card-start-on')} ${formattedDate}`;
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
 }));
@@ -500,13 +498,13 @@ Template.minicardDueDate.helpers(cardDateHelpers({
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${TAPi18n.__('card-due-on')} ${formattedDate}`;
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
 }));
@@ -549,7 +547,7 @@ Template.minicardEndDate.helpers(cardDateHelpers({
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
 }));
@@ -570,13 +568,13 @@ Template.minicardCustomFieldDate.onCreated(function () {
 Template.minicardCustomFieldDate.helpers(cardDateHelpers({
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
  showTitle() {
    const tpl = Template.instance();
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    const formattedDate = formatDateByUserPreference(tpl.date.get(), dateFormat, true);
    return `${formattedDate}`;
  },
@@ -602,7 +600,7 @@ Template.voteEndDate.helpers(cardDateHelpers({
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
  showTitle() {
@@ -630,7 +628,7 @@ Template.pokerEndDate.helpers(cardDateHelpers({
  },
  showDate() {
    const currentUser = ReactiveCache.getCurrentUser();
-    const dateFormat = currentUser ? currentUser.getDateFormat() : 'YYYY-MM-DD';
+    const dateFormat = currentUser ? currentUser.getDateFormat() : (window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD');
    return formatDateByUserPreference(Template.instance().date.get(), dateFormat, true);
  },
  showTitle() {
@@ -890,3 +890,167 @@ body.mobile-mode .card-details .card-details-header .close-card-details-mobile-w
  transform: scale(1.01);
  transition: all 0.2s ease;
 }
+
+/* Sticker picker + card-detail stickers + due-complete toggle */
+.card-stickers-picker {
+  max-width: 320px;
+}
+.card-sticker-select {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 36px;
+  height: 36px;
+  margin: 2px;
+  border-radius: 3px;
+  font-size: 18px;
+  color: #4d4d4d;
+  cursor: pointer;
+  position: relative;
+}
+.card-sticker-select:hover {
+  background: #e0e0e0;
+}
+.card-sticker-select.active {
+  background: #d6ecd2;
+  color: #3cb500;
+}
+.card-sticker-select .card-sticker-check {
+  position: absolute;
+  bottom: 1px;
+  right: 2px;
+  font-size: 10px;
+  color: #3cb500;
+}
+.card-stickers .card-sticker {
+  display: inline-flex;
+  align-items: center;
+  margin: 0 8px 4px 0;
+  font-size: 18px;
+}
+.card-sticker .card-sticker-remove {
+  margin-left: 3px;
+  font-size: 11px;
+  color: #999;
+  cursor: pointer;
+}
+.card-sticker .card-sticker-remove:hover {
+  color: #eb4646;
+}
+.card-due-complete-toggle {
+  display: inline-flex;
+  align-items: center;
+  margin-left: 8px;
+  vertical-align: middle;
+}
+
+/* Trello-style "mark complete" toggle, left of the card title */
+.card-details-complete-toggle {
+  float: left;
+  display: flex;
+  align-items: center;
+  /* Title is 1.35em with 1.3 line-height (~28px box) and margin-top 7px; push
+     the 13px checkbox down so it lands at the vertical middle of the title. */
+  margin: 14px 10px 0 0;
+  cursor: pointer;
+}
+
+/* Card locations: multiple locations, each editable with a remove button */
+.card-details-item-location .card-locations {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  margin-bottom: 6px;
+}
+.card-details-item-location .card-location {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  background: #fff;
+  border: 1px solid #e3e3e3;
+  border-radius: 4px;
+  padding: 6px 8px;
+}
+.card-details-item-location .card-location-info {
+  flex: 1;
+}
+.card-details-item-location .js-edit-location {
+  cursor: pointer;
+}
+.card-details-item-location .card-location-name {
+  font-weight: bold;
+}
+.card-details-item-location .card-location-address {
+  color: #4d4d4d;
+}
+.card-details-item-location .card-location-remove {
+  margin-left: 8px;
+  color: #8c8c8c;
+  cursor: pointer;
+}
+.card-details-item-location .card-location-remove:hover {
+  color: #eb4646;
+}
+
+/* Sticker icon highlight styles (used instead of colour): taco pack => underline,
+   pete pack => round (ring around the icon). Icon keeps its normal colour. */
+.card-sticker i.sticker-underline {
+  border-bottom: 2px solid currentColor;
+  padding-bottom: 1px;
+  line-height: 1;
+}
+.card-sticker i.sticker-round {
+  border: 1px solid currentColor;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.6em;
+  height: 1.6em;
+  line-height: 1;
+  box-sizing: border-box;
+}
+
+/* "Open map links at" provider selector in the location popup */
+.js-card-location-form .map-provider-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  margin-bottom: 6px;
+}
+.js-card-location-form .map-provider-row .js-map-provider {
+  flex: 0 0 auto;
+  width: auto;
+}
+
+/* Opened card (card details popup) docks to the very top of the window and
+   overlays the global + board header bars instead of opening below them. The
+   base .pop-over is position:absolute with a small margin/top offset, which left
+   the card's top behind the fixed header bars; fix it to the viewport top with a
+   z-index above every header (headers top out around z-index 1000-2000). */
+.pop-over[data-popup="cardDetailsPopup"] {
+  position: fixed !important;
+  top: 0 !important;
+  margin-top: 0 !important;
+  z-index: 100000 !important;
+}
+
+/* Sticker highlight styles inside the sticker picker (mascot = underline,
+   computer = round), matching how they render on the card. */
+.card-sticker-select i.sticker-underline {
+  border-bottom: 2px solid currentColor;
+  padding-bottom: 1px;
+  line-height: 1;
+}
+.card-sticker-select i.sticker-round {
+  border: 1px solid currentColor;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.6em;
+  height: 1.6em;
+  line-height: 1;
+  box-sizing: border-box;
+}
@@ -11,31 +11,30 @@ template(name="cardDetails")
        +editCardTitleForm
      else
        unless isMiniScreen
-          unless isPopup
-            span.card-collapse-toggle.js-card-collapse-toggle(title="{{_ 'collapse-card'}}")
-              if cardCollapsed
-                i.fa.fa-caret-right
-              else
-                i.fa.fa-caret-down
-            a.close-card-details.js-close-card-details(title="{{_ 'close-card'}}")
-              i.fa.fa-times-thin
-            if cardMaximized
-              a.fa.fa-window-minimize.minimize-card-details.js-minimize-card-details(title="{{_ 'minimize-card'}}")
+          span.card-collapse-toggle.js-card-collapse-toggle(title="{{_ 'collapse-card'}}")
+            if cardCollapsed
+              i.fa.fa-caret-right
            else
-              a.fa.fa-window-maximize.maximize-card-details.js-maximize-card-details(title="{{_ 'maximize-card'}}")
-            a.card-details-menu.js-open-card-details-menu(title="{{_ 'cardDetailsActionsPopup-title'}}")
-              i.fa.fa-bars
-            a.card-copy-button.js-copy-link(
-              id="cardURL_copy"
-              title="{{_ 'copy-card-link-to-clipboard'}}"
-              href="{{ originRelativeUrl }}"
-            )
-              span.emoji-icon
-                i.fa.fa-link
-            if canModifyCard
-              span.card-drag-handle.js-card-drag-handle(title="Drag card")
-                i.fa.fa-arrows
-            span.copied-tooltip {{_ 'copied'}}
+              i.fa.fa-caret-down
+          a.close-card-details.js-close-card-details(title="{{_ 'close-card'}}")
+            i.fa.fa-times-thin
+          if cardMaximized
+            a.fa.fa-window-minimize.minimize-card-details.js-minimize-card-details(title="{{_ 'minimize-card'}}")
+          else
+            a.fa.fa-window-maximize.maximize-card-details.js-maximize-card-details(title="{{_ 'maximize-card'}}")
+          a.card-details-menu.js-open-card-details-menu(title="{{_ 'cardDetailsActionsPopup-title'}}")
+            i.fa.fa-bars
+          a.card-copy-button.js-copy-link(
+            id="cardURL_copy"
+            title="{{_ 'copy-card-link-to-clipboard'}}"
+            href="{{ originRelativeUrl }}"
+          )
+            span.emoji-icon
+              i.fa.fa-link
+          if canModifyCard
+            span.card-drag-handle.js-card-drag-handle(title="Drag card")
+              i.fa.fa-arrows
+          span.copied-tooltip {{_ 'copied'}}
        else
          a.close-card-details.js-close-card-details(title="{{_ 'close-card'}}")
            i.fa.fa-times-thin
@@ -62,12 +61,15 @@ template(name="cardDetails")
            span.emoji-icon
              i.fa.fa-link
          span.copied-tooltip {{_ 'copied'}}
+        if canModifyCard
+          a.card-details-complete-toggle.js-toggle-due-complete(title="{{#if getDueComplete}}{{_ 'card-mark-incomplete'}}{{else}}{{_ 'card-mark-complete'}}{{/if}}")
+            .materialCheckBox(class="{{#if getDueComplete}}is-checked{{/if}}")
        h2.card-details-title.js-card-title(
          class="{{#if canModifyCard}}js-open-inlined-form is-editable{{else}}js-card-title-drag-handle{{/if}}")
            +viewer
              if currentBoard.allowsCardNumber
                span.card-number
-                  | ##{getCardNumber}
+                  | ##{getCardNumber} &nbsp;
              = getTitle
            if isWatching
              i.card-details-watch
@@ -127,6 +129,47 @@ template(name="cardDetails")
                a.card-label.add-label.js-add-labels(title="{{_ 'card-labels-title'}}")
                  i.fa.fa-plus

+        .card-details-item.card-details-item-stickers
+          h3.card-details-item-title
+            i.fa.fa-sticky-note-o
+            | {{_ 'stickers'}}
+          .card-details-item-content.card-stickers
+            each stickers
+              span.card-sticker(title="{{#if name}}{{name}}{{else}}{{icon}}{{/if}}")
+                i.fa(class="fa-{{icon}} {{#if highlight}}sticker-{{highlight}}{{/if}}")
+                if canModifyCard
+                  a.card-sticker-remove.js-remove-sticker(data-index="{{@index}}" title="{{_ 'remove-sticker'}}")
+                    i.fa.fa-times
+            if canModifyCard
+              unless currentUser.isWorker
+                a.card-label.add-label.js-add-stickers(title="{{_ 'add-sticker'}}")
+                  i.fa.fa-plus
+
+        .card-details-item.card-details-item-location
+          h3.card-details-item-title
+            i.fa.fa-map-marker
+            | {{_ 'location'}}
+          .card-details-item-content.card-locations
+            each getLocations
+              .card-location
+                .card-location-info(class="{{#if canModifyCard}}js-edit-location{{/if}}" data-location-id="{{_id}}")
+                  if name
+                    .card-location-name= name
+                  if address
+                    .card-location-address= address
+                  if hasCoordinates
+                    a.card-location-map(href=mapUrl target="_blank" rel="noopener noreferrer")
+                      i.fa.fa-map-o
+                      = ' '
+                      | {{_ 'location-open-map'}}
+                if canModifyCard
+                  a.card-location-remove.js-remove-location(data-location-id="{{_id}}" title="{{_ 'delete'}}")
+                    i.fa.fa-times
+          if canModifyCard
+            unless currentUser.isWorker
+              a.card-label.add-label.js-add-location(title="{{_ 'add-location'}}")
+                i.fa.fa-plus
+
        if currentBoard.hasAnyAllowsDate
          hr

@@ -298,7 +341,7 @@ template(name="cardDetails")
              i.fa.fa-list
              | {{_ 'list'}}
            select.js-select-card-details-lists(disabled="{{#unless canModifyCard}}disabled{{/unless}}")
-              each currentBoard.lists
+              each currentSwimlaneListsSorted
                option(value="{{_id}}" selected="{{#if isCurrentListId _id}}selected{{/if}}") {{title}}

        //.card-details-items
@@ -625,19 +668,18 @@ template(name="cardDetails")
            +attachmentGallery
      hr

-      unless currentUser.isNoComments
+      if currentBoard.allowsComments
        .comment-title
          h3.card-details-item-title
            i.fa.fa-comment-o
            | {{_ 'comments'}}

-        if currentBoard.allowsComments
-          if currentUser.isBoardMember
-            unless currentUser.isNoComments
-              unless currentUser.isReadOnly
-                unless currentUser.isReadAssignedOnly
-                  +commentForm
-              +comments
+        if currentUser.isBoardMember
+          unless currentUser.isNoComments
+            unless currentUser.isReadOnly
+              unless currentUser.isReadAssignedOnly
+                +commentForm
+        +comments
      hr

    .card-details-right
@@ -692,154 +734,156 @@ template(name="editCardSortOrderForm")
    a.js-close-inlined-form

 template(name="cardDetailsActionsPopup")
-  ul.pop-over-list
-    li
-      a.js-toggle-watch-card
-        if isWatching
-          i.fa.fa-eye
-          |  {{_ 'unwatch'}}
-        else
-          i.fa.fa-eye
-          |  {{_ 'watch'}}
-  hr
-  if canModifyCard
-    unless currentUser.isWorker
-      ul.pop-over-list
-        //li: a.js-members {{_ 'card-edit-members'}}
-        //li: a.js-labels {{_ 'card-edit-labels'}}
-        //li: a.js-attachments {{_ 'card-edit-attachments'}}
-        li
-          a.js-start-voting
-            i.fa.fa-thumbs-up
-            | {{_ 'card-edit-voting'}}
-        li
-          a.js-start-planning-poker
-            i.fa.fa-thumbs-up
-            | {{_ 'card-edit-planning-poker'}}
-        if currentUser.isBoardAdmin
-          li
-            a.js-custom-fields
-              i.fa.fa-list
-              | {{_ 'card-edit-custom-fields'}}
-        //li: a.js-received-date {{_ 'editCardReceivedDatePopup-title'}}
-        //li: a.js-start-date {{_ 'editCardStartDatePopup-title'}}
-        //li: a.js-due-date {{_ 'editCardDueDatePopup-title'}}
-        //li: a.js-end-date {{_ 'editCardEndDatePopup-title'}}
-        li
-          a.js-spent-time
-            i.fa.fa-clock-o
-            | {{_ 'editCardSpentTimePopup-title'}}
-        li
-          a.js-set-card-color
-            i.fa.fa-paint-brush
-            | {{_ 'setCardColorPopup-title'}}
-        li
-          a.js-toggle-show-list-on-minicard
-            if showListOnMinicard
-              i.fa.fa-eye
-              | {{_ 'hide-list-on-minicard'}}
-            else
-              i.fa.fa-eye
-              | {{_ 'show-list-on-minicard'}}
-  if canModifyCard
+  if currentUser
+    ul.pop-over-list
+      li
+        a.js-toggle-watch-card
+          if isWatching
+            i.fa.fa-eye
+            |  {{_ 'unwatch'}}
+          else
+            i.fa.fa-eye
+            |  {{_ 'watch'}}
    hr
-  else
-    unless currentUser.isReadOnly
-      unless currentUser.isReadAssignedOnly
-        hr
+    if canModifyCard
+      unless currentUser.isWorker
+        ul.pop-over-list
+          //li: a.js-members {{_ 'card-edit-members'}}
+          //li: a.js-labels {{_ 'card-edit-labels'}}
+          //li: a.js-attachments {{_ 'card-edit-attachments'}}
+          li
+            a.js-start-voting
+              i.fa.fa-thumbs-up
+              | {{_ 'card-edit-voting'}}
+          li
+            a.js-start-planning-poker
+              i.fa.fa-thumbs-up
+              | {{_ 'card-edit-planning-poker'}}
+          if currentUser.isBoardAdmin
+            li
+              a.js-custom-fields
+                i.fa.fa-list
+                | {{_ 'card-edit-custom-fields'}}
+          //li: a.js-received-date {{_ 'editCardReceivedDatePopup-title'}}
+          //li: a.js-start-date {{_ 'editCardStartDatePopup-title'}}
+          //li: a.js-due-date {{_ 'editCardDueDatePopup-title'}}
+          //li: a.js-end-date {{_ 'editCardEndDatePopup-title'}}
+          li
+            a.js-spent-time
+              i.fa.fa-clock-o
+              | {{_ 'editCardSpentTimePopup-title'}}
+          li
+            a.js-set-card-color
+              i.fa.fa-paint-brush
+              | {{_ 'setCardColorPopup-title'}}
+          li
+            a.js-toggle-show-list-on-minicard
+              if showListOnMinicard
+                i.fa.fa-eye
+                | {{_ 'hide-list-on-minicard'}}
+              else
+                i.fa.fa-eye
+                | {{_ 'show-list-on-minicard'}}
+    if canModifyCard
+      hr
+    else
+      unless currentUser.isReadOnly
+        unless currentUser.isReadAssignedOnly
+          hr
  ul.pop-over-list
    li
      a.js-export-card
        i.fa.fa-upload
        | {{_ 'export-card'}}
-  unless canModifyCard
-    unless currentUser.isReadOnly
-      unless currentUser.isReadAssignedOnly
-        hr
-        ul.pop-over-list
-          li
-            a.js-move-card-to-top
-              i.fa.fa-arrow-up
-              | {{_ 'moveCardToTop-title'}}
-          li
-            a.js-move-card-to-bottom
-              i.fa.fa-arrow-down
-              | {{_ 'moveCardToBottom-title'}}
-        hr
-        ul.pop-over-list
-          if currentUser.isBoardAdmin
-            li
-              a.js-move-card
-                i.fa.fa-arrow-right
-                | {{_ 'moveCardPopup-title'}}
-          unless currentUser.isWorker
-            li
-              a.js-copy-card
-                i.fa.fa-clipboard
-                | {{_ 'copyCardPopup-title'}}
-        unless currentUser.isWorker
-          ul.pop-over-list
-            li
-              a.js-copy-checklist-cards
-                i.fa.fa-copy
-                | {{_ 'copyManyCardsPopup-title'}}
-          unless archived
-            hr
-            ul.pop-over-list
-              li
-                a.js-archive
-                  i.fa.fa-archive
-                  | {{_ 'archive-card'}}
+  if currentUser
+    unless canModifyCard
+      unless currentUser.isReadOnly
+        unless currentUser.isReadAssignedOnly
          hr
          ul.pop-over-list
            li
-              a.js-more
-                span.emoji-icon
-                i.fa.fa-link
-                | {{_ 'cardMorePopup-title'}}
-  if canModifyCard
-    hr
-    ul.pop-over-list
-      li
-        a.js-move-card-to-top
-          i.fa.fa-arrow-up
-          | {{_ 'moveCardToTop-title'}}
-      li
-        a.js-move-card-to-bottom
-          i.fa.fa-arrow-down
-          | {{_ 'moveCardToBottom-title'}}
-    hr
-    ul.pop-over-list
-      if currentUser.isBoardAdmin
-        li
-          a.js-move-card
-            i.fa.fa-arrow-right
-            | {{_ 'moveCardPopup-title'}}
-      unless currentUser.isWorker
-        li
-          a.js-copy-card
-            i.fa.fa-clipboard
-            | {{_ 'copyCardPopup-title'}}
-    unless currentUser.isWorker
-      ul.pop-over-list
-        li
-          a.js-copy-checklist-cards
-            i.fa.fa-copy
-            | {{_ 'copyManyCardsPopup-title'}}
-      unless archived
-        hr
-        ul.pop-over-list
-          li
-            a.js-archive
-              i.fa.fa-archive
-              | {{_ 'archive-card'}}
+              a.js-move-card-to-top
+                i.fa.fa-arrow-up
+                | {{_ 'moveCardToTop-title'}}
+            li
+              a.js-move-card-to-bottom
+                i.fa.fa-arrow-down
+                | {{_ 'moveCardToBottom-title'}}
+          hr
+          ul.pop-over-list
+            if currentUser.isBoardAdmin
+              li
+                a.js-move-card
+                  i.fa.fa-arrow-right
+                  | {{_ 'moveCardPopup-title'}}
+            unless currentUser.isWorker
+              li
+                a.js-copy-card
+                  i.fa.fa-clipboard
+                  | {{_ 'copyCardPopup-title'}}
+          unless currentUser.isWorker
+            ul.pop-over-list
+              li
+                a.js-copy-checklist-cards
+                  i.fa.fa-copy
+                  | {{_ 'copyManyCardsPopup-title'}}
+            unless archived
+              hr
+              ul.pop-over-list
+                li
+                  a.js-archive
+                    i.fa.fa-archive
+                    | {{_ 'archive-card'}}
+            hr
+            ul.pop-over-list
+              li
+                a.js-more
+                  span.emoji-icon
+                  i.fa.fa-link
+                  | {{_ 'cardMorePopup-title'}}
+    if canModifyCard
      hr
      ul.pop-over-list
        li
-          a.js-more
-            span.emoji-icon
-              i.fa.fa-link
-            | {{_ 'cardMorePopup-title'}}
+          a.js-move-card-to-top
+            i.fa.fa-arrow-up
+            | {{_ 'moveCardToTop-title'}}
+        li
+          a.js-move-card-to-bottom
+            i.fa.fa-arrow-down
+            | {{_ 'moveCardToBottom-title'}}
+      hr
+      ul.pop-over-list
+        if currentUser.isBoardAdmin
+          li
+            a.js-move-card
+              i.fa.fa-arrow-right
+              | {{_ 'moveCardPopup-title'}}
+        unless currentUser.isWorker
+          li
+            a.js-copy-card
+              i.fa.fa-clipboard
+              | {{_ 'copyCardPopup-title'}}
+      unless currentUser.isWorker
+        ul.pop-over-list
+          li
+            a.js-copy-checklist-cards
+              i.fa.fa-copy
+              | {{_ 'copyManyCardsPopup-title'}}
+        unless archived
+          hr
+          ul.pop-over-list
+            li
+              a.js-archive
+                i.fa.fa-archive
+                | {{_ 'archive-card'}}
+        hr
+        ul.pop-over-list
+          li
+            a.js-more
+              span.emoji-icon
+                i.fa.fa-link
+              | {{_ 'cardMorePopup-title'}}

 template(name="exportCardPopup")
  ul.pop-over-list
@@ -1196,3 +1240,39 @@ template(name="cardStartPlanningPokerPopup")
    if getPokerQuestion
      if currentUser.isBoardAdmin
        button.js-remove-poker.negate.wide.right {{_ 'delete'}}
+
+template(name="cardLocationsPopup")
+  form.js-card-location-form
+    label
+      | {{_ 'location-detect-from-map'}}
+      input.js-location-map-link(type="text" placeholder="https://..." autofocus)
+    button.primary.js-detect-location(type="button") {{_ 'location-detect'}}
+    if detectMessage
+      p.quiet.js-detect-message {{detectMessage}}
+    hr
+    label
+      | {{_ 'location-name'}}
+      input.js-location-name(type="text" value="{{location.name}}")
+    label
+      | {{_ 'location-address'}}
+      input.js-location-address(type="text" value="{{location.address}}")
+    label
+      | {{_ 'location-latitude'}}
+      input.js-location-latitude(type="number" step="any" value="{{location.latitude}}")
+    label
+      | {{_ 'location-longitude'}}
+      input.js-location-longitude(type="number" step="any" value="{{location.longitude}}")
+    button.primary.confirm.js-submit-location(type="submit") {{_ 'save'}}
+    if location._id
+      button.negate.wide.right.js-delete-location(type="button") {{_ 'delete'}}
+    hr
+    .map-provider-row
+      span.map-provider-label {{_ 'location-open-map-at'}}
+      select.js-map-provider
+        option(value="openstreetmap" selected="{{#if isMapProvider 'openstreetmap'}}selected{{/if}}") OpenStreetMap
+        option(value="google" selected="{{#if isMapProvider 'google'}}selected{{/if}}") Google Maps
+        option(value="bing" selected="{{#if isMapProvider 'bing'}}selected{{/if}}") Bing Maps
+        option(value="apple" selected="{{#if isMapProvider 'apple'}}selected{{/if}}") Apple Maps
+    button.primary.js-save-map-provider(type="button") {{_ 'save'}}
+    if mapSavedMessage
+      p.quiet.js-map-saved {{mapSavedMessage}}
@@ -37,6 +37,7 @@ import CardComments from '/models/cardComments';
 import { ALLOWED_COLORS } from '/config/const';
 import { uniqBy } from '/imports/lib/collectionHelpers';
 import { UserAvatar } from '../users/userAvatar';
+import { Filter } from '/client/lib/filter';
 import { BoardSwimlaneListCardDialog } from '/client/lib/dialogWithBoardSwimlaneListCard';
 import { handleFileUpload } from './attachments';
 import { InfiniteScrolling } from '/client/lib/infiniteScrolling';
@@ -45,8 +46,106 @@ import {
  getCurrentCardFromContext,
 } from '/client/lib/currentCard';
 import uploadProgressManager from '../../lib/uploadProgressManager';
+import { CSSEvents } from '/client/lib/cssEvents';
+import { UnsavedEdits } from '/client/lib/unsavedEdits';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { MultiSelection } from '/client/lib/multiSelection';
+import { Utils } from '/client/lib/utils';
+import { ReactiveVar } from 'meteor/reactive-var';
+import autosize from 'autosize';

-const subManager = new SubsManager();
+// Id of the location currently being edited in the cardLocationsPopup; null
+// when adding a new location.
+const editingLocationId = new ReactiveVar(null);
+
+// Parse coordinates (and, when present, a place name / address) out of a map
+// link from common providers: Google Maps, OpenStreetMap, Bing Maps, Apple Maps
+// and generic `?q=lat,lon` / `?ll=lat,lon` links. Returns whatever it can find
+// as { latitude, longitude, name, address }.
+function parseMapLink(url) {
+  const result = {};
+  if (!url) return result;
+  const s = String(url).trim();
+
+  let lat;
+  let lon;
+  const setCoords = (la, lo) => {
+    if (lat !== undefined) return;
+    const a = parseFloat(la);
+    const o = parseFloat(lo);
+    if (!isNaN(a) && !isNaN(o) && Math.abs(a) <= 90 && Math.abs(o) <= 180) {
+      lat = a;
+      lon = o;
+    }
+  };
+
+  const N = '(-?\\d+(?:\\.\\d+)?)';
+  let m;
+  // Google Maps place marker in the data part: !3d<lat>!4d<lon> (most precise).
+  if ((m = s.match(new RegExp(`!3d${N}!4d${N}`)))) setCoords(m[1], m[2]);
+  // Google Maps view/place: @<lat>,<lon>
+  if ((m = s.match(new RegExp(`@${N},${N}`)))) setCoords(m[1], m[2]);
+  // OpenStreetMap marker: ?mlat=..&mlon=..
+  if ((m = s.match(new RegExp(`[?&#]mlat=${N}`)))) {
+    const mlon = s.match(new RegExp(`[?&#]mlon=${N}`));
+    if (mlon) setCoords(m[1], mlon[1]);
+  }
+  // OpenStreetMap map hash: #map=z/lat/lon
+  if ((m = s.match(new RegExp(`[#&]map=\\d+(?:\\.\\d+)?/${N}/${N}`)))) setCoords(m[1], m[2]);
+  // Bing Maps: cp=lat~lon
+  if ((m = s.match(new RegExp(`[?&]cp=${N}~${N}`)))) setCoords(m[1], m[2]);
+  // Apple Maps and generic ll=lat,lon
+  if ((m = s.match(new RegExp(`[?&]ll=${N},${N}`)))) setCoords(m[1], m[2]);
+  // Generic q=lat,lon (Google/Apple query form)
+  if ((m = s.match(new RegExp(`[?&]q=${N},${N}`)))) setCoords(m[1], m[2]);
+  // Generic center=lat,lon
+  if ((m = s.match(new RegExp(`[?&]center=${N},${N}`)))) setCoords(m[1], m[2]);
+
+  if (lat !== undefined) {
+    result.latitude = lat;
+    result.longitude = lon;
+  }
+
+  const decode = (raw) => {
+    try {
+      return decodeURIComponent(raw.replace(/\+/g, ' ')).trim();
+    } catch (e) {
+      return raw.replace(/\+/g, ' ').trim();
+    }
+  };
+  const isCoordText = (t) => /^-?\d+(\.\d+)?\s*,\s*-?\d+(\.\d+)?$/.test(t);
+
+  // Place name from Google Maps /place/<Name>/
+  if ((m = s.match(/\/place\/([^/@?]+)/))) {
+    const name = decode(m[1]);
+    if (name && !isCoordText(name)) result.name = name;
+  }
+  // Address from a textual q=/query=/destination= parameter.
+  if ((m = s.match(/[?&](?:q|query|destination)=([^&]+)/))) {
+    const q = decode(m[1]);
+    if (q && !isCoordText(q)) result.address = q;
+  }
+
+  return result;
+}
+
+// Build an "open in map" link for the given provider and coordinates. Mirrors
+// the providers offered in the location popup's "Open map links at" selector.
+function mapLinkFor(provider, lat, lon) {
+  switch (provider) {
+    case 'google':
+      return `https://www.google.com/maps/search/?api=1&query=${lat},${lon}`;
+    case 'bing':
+      return `https://www.bing.com/maps?cp=${lat}~${lon}&lvl=16`;
+    case 'apple':
+      return `https://maps.apple.com/?ll=${lat},${lon}`;
+    case 'openstreetmap':
+    default:
+      return `https://www.openstreetmap.org/?mlat=${lat}&mlon=${lon}#map=16/${lat}/${lon}`;
+  }
+}
+
+// SubsManager removed for Meteor 3 migration
 const { calculateIndexData } = Utils;

 function getCardId() {
@@ -114,9 +213,24 @@ Template.cardDetails.onCreated(function () {
  };

  Meteor.subscribe('unsaved-edits');
+
+  // Surface legacy CollectionFS attachments for the current board so they show
+  // up in the card's attachment gallery and can be read in place (without
+  // migrating them to Meteor-Files first).
+  this.autorun(() => {
+    const board = Utils.getCurrentBoard();
+    if (board && board._id) {
+      Meteor.subscribe('legacyBoardAttachments', board._id);
+    }
+  });
 });

 Template.cardDetails.onRendered(function () {
+  // A reactive re-render (e.g. a card moving between the inline swimlane render
+  // and the draggable openCards popup) can create and then remove this instance
+  // within the same flush. If our DOM range is already gone, calling this.$()
+  // below throws "Can't select in removed DomRange", so bail out early.
+  if (this.view && this.view.isDestroyed) return;
  this.calculateNextPeak();
  if (Meteor.settings.public.CARD_OPENED_WEBHOOK_ENABLED) {
    // Send Webhook but not create Activities records ---
@@ -200,22 +314,22 @@ Template.cardDetails.onRendered(function () {
      EscapeActions.executeUpTo('popup-close');
    },
    stop(evt, ui) {
-      let prevChecklist = ui.item.prev('.js-subtasks').get(0);
-      if (prevChecklist) {
-        prevChecklist = Blaze.getData(prevChecklist).subtask;
+      let prevSubtask = ui.item.prev('.js-subtasks').get(0);
+      if (prevSubtask) {
+        prevSubtask = Blaze.getData(prevSubtask).subtask;
      }
-      let nextChecklist = ui.item.next('.js-subtasks').get(0);
-      if (nextChecklist) {
-        nextChecklist = Blaze.getData(nextChecklist).subtask;
+      let nextSubtask = ui.item.next('.js-subtasks').get(0);
+      if (nextSubtask) {
+        nextSubtask = Blaze.getData(nextSubtask).subtask;
      }
-      const sortIndex = calculateIndexData(prevChecklist, nextChecklist, 1);
+      const sortIndex = calculateIndexData(prevSubtask, nextSubtask, 1);

      $subtasksDom.sortable('cancel');
      const subtask = Blaze.getData(ui.item.get(0)).subtask;

-      Subtasks.update(subtask._id, {
+      Cards.updateAsync(subtask._id, {
        $set: {
-          subtaskSort: sortIndex.base,
+          sort: sortIndex.base,
        },
      });
    },
@@ -256,17 +370,38 @@ Template.cardDetails.helpers({
    return card.findWatcher(Meteor.userId());
  },

+  // Returns the card's locations (multiple supported), each enriched with the
+  // coordinate flag and OpenStreetMap link used by the template.
+  getLocations() {
+    const card = Template.currentData();
+    if (!card || !card.getLocations) return [];
+    const user = ReactiveCache.getCurrentUser();
+    const provider = user ? user.getMapProvider() : 'openstreetmap';
+    return card.getLocations().map(loc => {
+      const hasCoordinates =
+        typeof loc.latitude === 'number' && typeof loc.longitude === 'number';
+      const mapUrl = hasCoordinates
+        ? mapLinkFor(provider, loc.latitude, loc.longitude)
+        : '';
+      return { ...loc, hasCoordinates, mapUrl };
+    });
+  },
+
  customFieldsGrid() {
    return ReactiveCache.getCurrentUser().hasCustomFieldsGrid();
  },

  cardMaximized() {
-    return !Utils.getPopupCardId() && ReactiveCache.getCurrentUser().hasCardMaximized();
+    const currentUser = ReactiveCache.getCurrentUser();
+    const maximized = currentUser
+      ? currentUser.hasCardMaximized()
+      : window.localStorage.getItem('cardMaximized') === 'true';
+    return !Utils.getPopupCardId() && maximized;
  },

  showActivities() {
-    const user = ReactiveCache.getCurrentUser();
-    return user && user.hasShowActivities();
+    const card = Template.currentData();
+    return card && card.showActivities;
  },

  cardCollapsed() {
@@ -329,8 +464,29 @@ Template.cardDetails.helpers({
    return user && user.isVerticalScrollbars();
  },

+  currentSwimlaneListsSorted() {
+    const card = Template.currentData();
+    if (!card || !card.boardId) return [];
+    const board = ReactiveCache.getBoard(card.boardId);
+    if (!board) return [];
+    const swimlaneId = card.swimlaneId;
+    const selector = { boardId: card.boardId, archived: false };
+    if (swimlaneId) {
+      const defaultSwimlane = board.getDefaultSwimline && board.getDefaultSwimline();
+      if (defaultSwimlane && defaultSwimlane._id === swimlaneId) {
+        selector.swimlaneId = { $in: [swimlaneId, null, ''] };
+      } else {
+        selector.swimlaneId = swimlaneId;
+      }
+    }
+    return ReactiveCache.getLists(selector, { sort: { sort: 1 } });
+  },
+
  isCurrentListId(listId) {
-    const data = Template.currentData();
+    let data = Template.currentData();
+    if (!data || typeof data.listId === 'undefined') {
+      data = Template.parentData(1);
+    }
    if (!data || typeof data.listId === 'undefined') return false;
    return data.listId == listId;
  },
@@ -468,7 +624,11 @@ Template.cardDetails.events({
  },
  'change .js-date-format-selector'(event) {
    const dateFormat = event.target.value;
-    Meteor.call('changeDateFormat', dateFormat);
+    if (Meteor.userId()) {
+      Meteor.call('changeDateFormat', dateFormat);
+    } else {
+      window.localStorage.setItem('dateFormat', dateFormat);
+    }
  },
  'click .js-open-card-details-menu': Popup.open('cardDetailsActions'),
  // Mobile: switch to desktop popup view (maximize)
@@ -549,9 +709,8 @@ Template.cardDetails.events({
    }
  },
  async 'change .js-select-card-details-lists'(event, tpl) {
+    const listId = event.target.value;
    let card = Template.currentData();
-    const listSelect = tpl.$('.js-select-card-details-lists')[0];
-    const listId = listSelect.options[listSelect.selectedIndex].value;

    const minOrder = await card.getMinSort(listId, card.swimlaneId);
    await card.move(card.boardId, card.swimlaneId, listId, minOrder - 1);
@@ -565,9 +724,57 @@ Template.cardDetails.events({
  'click .js-assignee': Popup.open('cardAssignee'),
  'click .js-add-assignees': Popup.open('cardAssignees'),
  'click .js-add-labels': Popup.open('cardLabels'),
+  'click .js-add-stickers': Popup.open('cardStickers'),
+  'click .js-remove-sticker'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    if (!Utils.canModifyCard()) return;
+    const index = parseInt(event.currentTarget.dataset.index, 10);
+    const card = Template.currentData();
+    if (card && !Number.isNaN(index)) {
+      card.removeStickerAt(index);
+    }
+  },
+  'click .js-add-location'(event) {
+    event.preventDefault();
+    if (!Utils.canModifyCard()) return;
+    const card = Template.currentData();
+    editingLocationId.set(null);
+    Popup.open('cardLocations')(event, {
+      dataContextIfCurrentDataIsUndefined: card,
+    });
+  },
+  'click .js-edit-location'(event) {
+    // Let the "Open in map" link work without also opening the edit popup.
+    if ($(event.target).closest('a.card-location-map').length) return;
+    event.preventDefault();
+    if (!Utils.canModifyCard()) return;
+    const card = Template.currentData();
+    editingLocationId.set(event.currentTarget.dataset.locationId || null);
+    Popup.open('cardLocations')(event, {
+      dataContextIfCurrentDataIsUndefined: card,
+    });
+  },
+  'click .js-remove-location'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    if (!Utils.canModifyCard()) return;
+    const locationId = event.currentTarget.dataset.locationId;
+    const card = Template.currentData();
+    if (card && locationId) {
+      card.removeLocation(locationId);
+    }
+  },
  'click .js-received-date': Popup.open('editCardReceivedDate'),
  'click .js-start-date': Popup.open('editCardStartDate'),
  'click .js-due-date': Popup.open('editCardDueDate'),
+  'click .js-toggle-due-complete'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    if (!Utils.canModifyCard()) return;
+    const card = Template.currentData();
+    card.setDueComplete(!card.getDueComplete());
+  },
  'click .js-end-date': Popup.open('editCardEndDate'),
  'click .js-show-positive-votes': Popup.open('positiveVoteMembers'),
  'click .js-show-negative-votes': Popup.open('negativeVoteMembers'),
@@ -595,15 +802,27 @@ Template.cardDetails.events({
    const card = Template.currentData();
    await card.toggleHideCheckedChecklistItems();
  },
+  async 'change #toggleShowActivitiesCard'() {
+    const card = Template.currentData();
+    await card.toggleShowActivities();
+  },
  'click #toggleCustomFieldsGridButton'() {
    Meteor.call('toggleCustomFieldsGrid');
  },
  'click .js-maximize-card-details'() {
-    Meteor.call('toggleCardMaximized');
+    if (Meteor.userId()) {
+      Meteor.call('toggleCardMaximized');
+    } else {
+      window.localStorage.setItem('cardMaximized', 'true');
+    }
    autosize($('.card-details'));
  },
  'click .js-minimize-card-details'() {
-    Meteor.call('toggleCardMaximized');
+    if (Meteor.userId()) {
+      Meteor.call('toggleCardMaximized');
+    } else {
+      window.localStorage.setItem('cardMaximized', 'false');
+    }
    autosize($('.card-details'));
  },
  'click .js-vote'(e) {
@@ -760,7 +979,10 @@ Template.cardDetails.helpers({
  },
  isDateFormat(format) {
    const currentUser = ReactiveCache.getCurrentUser();
-    if (!currentUser) return format === 'YYYY-MM-DD';
+    if (!currentUser) {
+      const stored = window.localStorage.getItem('dateFormat') || 'YYYY-MM-DD';
+      return format === stored;
+    }
    return currentUser.getDateFormat() === format;
  },
  // Upload progress helpers
@@ -788,13 +1010,14 @@ Template.cardDetailsPopup.helpers({
 // Ordered list of Excel export field keys and their i18n label keys.
 // Must match ALL_FIELDS in models/server/ExporterExcelCard.js.
 const EXCEL_EXPORT_FIELDS = [
+  { field: 'labels',      label: 'labels' },
  { field: 'people',      label: 'export-card-field-people' },
  { field: 'board-info',  label: 'export-card-field-board-info' },
  { field: 'dates',       label: 'export-card-field-dates' },
  { field: 'description', label: 'description' },
-  { field: 'checklists',  label: 'checklist' },
+  { field: 'checklists',  label: 'checklists' },
  { field: 'subtasks',    label: 'export-card-subtasks' },
-  { field: 'comments',    label: 'comment' },
+  { field: 'comments',    label: 'comments' },
  { field: 'attachments', label: 'export-card-attachments' },
 ];

@@ -849,7 +1072,7 @@ Template.exportCardPopup.helpers({
    return FlowRouter.path(
      '/api/boards/:boardId/lists/:listId/cards/:cardId/exportExcel',
      params,
-      { authToken: Accounts._storedLoginToken(), fields: selectedFields.join(',') },
+      { authToken: Accounts._storedLoginToken(), fields: selectedFields.join(','), lang: TAPi18n.getLanguage() },
    );
  },
  exportFilenameCardExcel() {
@@ -1083,19 +1306,129 @@ Template.cardMembersPopup.helpers({
  },
 });

+// Popup that adds or edits a single card location (name, address, latitude,
+// longitude). Cards can hold multiple locations, like members.
+Template.cardLocationsPopup.onCreated(function () {
+  const data = Template.currentData();
+  this.cardId = data && data._id;
+  this.detectMsg = new ReactiveVar('');
+  this.mapSavedMsg = new ReactiveVar('');
+});
+
+Template.cardLocationsPopup.helpers({
+  location() {
+    const tpl = Template.instance();
+    const card = ReactiveCache.getCard(tpl.cardId);
+    const id = editingLocationId.get();
+    if (card && id) {
+      const found = card.getLocations().find(loc => loc._id === id);
+      if (found) return found;
+    }
+    return {};
+  },
+  detectMessage() {
+    return Template.instance().detectMsg.get();
+  },
+  isMapProvider(provider) {
+    const user = ReactiveCache.getCurrentUser();
+    const current = user ? user.getMapProvider() : 'openstreetmap';
+    return current === provider;
+  },
+  mapSavedMessage() {
+    return Template.instance().mapSavedMsg.get();
+  },
+});
+
+Template.cardLocationsPopup.events({
+  'click .js-detect-location'(event) {
+    event.preventDefault();
+    const tpl = Template.instance();
+    const linkInput = tpl.find('.js-location-map-link');
+    const parsed = parseMapLink(linkInput ? linkInput.value : '');
+    let filled = false;
+    if (typeof parsed.latitude === 'number') {
+      tpl.find('.js-location-latitude').value = parsed.latitude;
+      tpl.find('.js-location-longitude').value = parsed.longitude;
+      filled = true;
+    }
+    if (parsed.name) {
+      tpl.find('.js-location-name').value = parsed.name;
+      filled = true;
+    }
+    if (parsed.address) {
+      tpl.find('.js-location-address').value = parsed.address;
+      filled = true;
+    }
+    tpl.detectMsg.set(
+      TAPi18n.__(filled ? 'location-detect-done' : 'location-detect-none'),
+    );
+  },
+  'submit .js-card-location-form'(event) {
+    event.preventDefault();
+    const tpl = Template.instance();
+    const card = ReactiveCache.getCard(tpl.cardId);
+    if (!card) {
+      Popup.back();
+      return;
+    }
+    const name = tpl.find('.js-location-name').value.trim();
+    const address = tpl.find('.js-location-address').value.trim();
+    const latRaw = tpl.find('.js-location-latitude').value.trim();
+    const lonRaw = tpl.find('.js-location-longitude').value.trim();
+    const latitude = latRaw === '' ? undefined : parseFloat(latRaw);
+    const longitude = lonRaw === '' ? undefined : parseFloat(lonRaw);
+    const data = { name, address, latitude, longitude };
+    const id = editingLocationId.get();
+    if (id) {
+      card.updateLocation(id, data);
+    } else {
+      card.addLocation(data);
+    }
+    Popup.back();
+  },
+  'click .js-delete-location'(event) {
+    event.preventDefault();
+    const tpl = Template.instance();
+    const card = ReactiveCache.getCard(tpl.cardId);
+    const id = editingLocationId.get();
+    if (card && id) {
+      card.removeLocation(id);
+    }
+    Popup.back();
+  },
+  'click .js-save-map-provider'(event) {
+    event.preventDefault();
+    const tpl = Template.instance();
+    const select = tpl.find('.js-map-provider');
+    const provider = select ? select.value : 'openstreetmap';
+    Meteor.call('setMapProvider', provider, err => {
+      tpl.mapSavedMsg.set(
+        TAPi18n.__(err ? 'server-error' : 'map-provider-saved'),
+      );
+    });
+  },
+});
+
 const filterMembers = (filterTerm) => {
  let currBoard = Utils.getCurrentBoard();
  let members = currBoard.activeMembers();

  if (filterTerm) {
+    const searchTerm = filterTerm.toLowerCase();
    members = members
      .map(member => ({
        member,
        user: ReactiveCache.getUser(member.userId)
      }))
-      .filter(({ user }) =>
-        (user.profile.fullname !== undefined && user.profile.fullname.toLowerCase().indexOf(filterTerm.toLowerCase()) !== -1)
-        || user.profile.fullname === undefined && user.profile.username !== undefined && user.profile.username.toLowerCase().indexOf(filterTerm.toLowerCase()) !== -1)
+      .filter(({ user }) => {
+        // Check if user data is available
+        if (!user || !user.profile) {
+          return false;
+        }
+        const fullname = (user.profile.fullname || '').toLowerCase();
+        const username = (user.username || '').toLowerCase();
+        return fullname.indexOf(searchTerm) !== -1 || username.indexOf(searchTerm) !== -1;
+      })
      .map(({ member }) => member);
  }
  return members;
@@ -1426,7 +1759,8 @@ Template.setCardColorPopup.helpers({

 Template.setCardColorPopup.events({
  'click .js-palette-color'(event, tpl) {
-    tpl.currentColor.set(Template.currentData().color);
+    const paletteData = Blaze.getData(event.currentTarget);
+    tpl.currentColor.set(paletteData?.color);
  },
  async 'click .js-submit'(event, tpl) {
    event.preventDefault();
@@ -1445,7 +1779,9 @@ Template.setCardColorPopup.events({
 });

 Template.setSelectionColorPopup.onCreated(function () {
-  this.currentColor = new ReactiveVar(null);
+  const selectedCards = ReactiveCache.getCards(MultiSelection.getMongoSelector());
+  const uniqueColors = [...new Set(selectedCards.map(card => card.color || null))];
+  this.currentColor = new ReactiveVar(uniqueColors.length === 1 ? uniqueColors[0] : null);
 });

 Template.setSelectionColorPopup.helpers({
@@ -1466,22 +1802,32 @@ Template.setSelectionColorPopup.events({
    const color = colorClass ? colorClass.replace('card-details-', '') : null;
    tpl.currentColor.set(color);
  },
-  async 'click .js-submit'(event, tpl) {
+  async 'submit form.edit-label'(event, tpl) {
    event.preventDefault();
    const color = tpl.currentColor.get();
-    // Use MultiSelection to get selected cards and set color on each
-    for (const card of ReactiveCache.getCards(MultiSelection.getMongoSelector())) {
-      await card.setColor(color);
+    try {
+      for (const card of ReactiveCache.getCards(MultiSelection.getMongoSelector())) {
+        await card.setColor(color);
+      }
+      Popup.back();
+    } catch (error) {
+      alert(error?.reason || error?.message || 'Failed to save selection color');
    }
-    Popup.back();
+  },
+  async 'click .js-submit'(event, tpl) {
+    event.preventDefault();
+    await tpl.$('form.edit-label').trigger('submit');
  },
  async 'click .js-remove-color'(event, tpl) {
    event.preventDefault();
-    // Use MultiSelection to get selected cards and remove color from each
-    for (const card of ReactiveCache.getCards(MultiSelection.getMongoSelector())) {
-      await card.setColor(null);
+    try {
+      for (const card of ReactiveCache.getCards(MultiSelection.getMongoSelector())) {
+        await card.setColor(null);
+      }
+      Popup.back();
+    } catch (error) {
+      alert(error?.reason || error?.message || 'Failed to unset selection color');
    }
-    Popup.back();
  },
 });

@@ -1592,7 +1938,7 @@ Template.cardMorePopup.events({
    if (selection === 'none') {
      tpl.parentBoard.set(null);
    } else {
-      subManager.subscribe('board', $(event.currentTarget).val(), false);
+      Meteor.subscribe('board', $(event.currentTarget).val(), false);
      tpl.parentBoard.set(selection);
      list.prop('disabled', false);
    }
@@ -1822,8 +2168,8 @@ EscapeActions.register(
      Session.set('cardDetailsIsMouseDown', false);

    } else {
-      // Prevent close card when the user is selecting text and moves the mouse cursor outside the card detail area
-      Utils.goBoardId(Session.get('currentBoard'));
+      // Trigger the close button so all close logic (openCards, routing, mini-screen) runs consistently
+      $('.js-close-card-details').first().trigger('click');
    }
  },
  () => {
@@ -0,0 +1,7 @@
+template(name="cardStickersPopup")
+  .card-stickers-picker.clearfix
+    each stickerIcons
+      a.card-sticker-select.js-select-sticker(class="{{#if isSelected}}active{{/if}}" title="{{stickerTitle}}")
+        i.fa(class="fa-{{icon}} {{#if highlight}}sticker-{{highlight}}{{/if}}")
+        if isSelected
+          i.fa.fa-check.card-sticker-check
@@ -0,0 +1,39 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+import { STICKER_PICKER } from '/models/metadata/stickers';
+
+// Picker popup that lets a user add/remove stickers on a card. Each entry is
+// { icon, highlight?, name? }: the plain Font Awesome icons plus the mascot
+// (underlined) and computer (ringed) highlighted stickers. Opened from the card
+// details stickers section with the card as the data context.
+
+Template.cardStickersPopup.onCreated(function () {
+  const data = Template.currentData();
+  this.cardId = data && data._id;
+});
+
+function pickerCard(tpl) {
+  return ReactiveCache.getCard(tpl.cardId);
+}
+
+Template.cardStickersPopup.helpers({
+  stickerIcons() {
+    return STICKER_PICKER;
+  },
+  isSelected() {
+    const card = pickerCard(Template.instance());
+    return !!(card && card.hasSticker(this.icon, this.highlight));
+  },
+  stickerTitle() {
+    return this.name || this.icon;
+  },
+});
+
+Template.cardStickersPopup.events({
+  'click .js-select-sticker'(event) {
+    event.preventDefault();
+    const card = pickerCard(Template.instance());
+    if (card) {
+      card.toggleSticker(this.icon, this.highlight, this.name);
+    }
+  },
+});
@@ -34,7 +34,7 @@ template(name="checklists")
 template(name="checklistDetail")
  .js-checklist.checklist.nodragscroll
    +inlinedForm(classNames="js-edit-checklist-title" checklist = checklist)
-      +editChecklistItemForm(checklist = checklist)
+      +editChecklistForm(checklist = checklist)
    else
      .checklist-title
        span
@@ -85,6 +85,19 @@ template(name="addChecklistItemForm")
          label.toggle-label(for="toggleNewlineBecomesNewChecklistItemOriginOrder")
          | {{_ 'originOrder'}}

+template(name="editChecklistForm")
+  a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
+  span.copied-tooltip {{_ 'copied'}}
+  textarea.js-edit-checklist-item(rows='1' autofocus dir="auto")
+    if $eq type 'item'
+      = item.title
+    else
+      = checklist.title
+  .edit-controls.clearfix
+    button.primary.confirm.js-submit-edit-checklist-item-form(type="submit") {{_ 'save'}}
+    a.fa.fa-times-thin.js-close-inlined-form(title="{{_ 'close-edit-checklist-item'}}")
+    span(title=createdAt) {{ displayDate createdAt }}
+
 template(name="editChecklistItemForm")
  a.fa.fa-copy(title="{{_ 'copy-text-to-clipboard'}}")
  span.copied-tooltip {{_ 'copied'}}
@@ -171,6 +184,15 @@ template(name="checklistActionsPopup")
          else
            input.toggle-switch(type="checkbox" id="toggleHideAllChecklistItems_{{checklist._id}}")
          label.toggle-label(for="toggleHideAllChecklistItems_{{checklist._id}}")
+      a.js-show-checklist-at-minicard
+        i.fa.fa-th-list
+        | {{_ "show-on-minicard"}} ...
+        .material-toggle-switch(title="{{_ 'show-on-minicard'}}")
+          if checklist.showChecklistAtMinicard
+            input.toggle-switch(type="checkbox" id="toggleShowChecklistAtMinicard_{{checklist._id}}" checked="checked")
+          else
+            input.toggle-switch(type="checkbox" id="toggleShowChecklistAtMinicard_{{checklist._id}}")
+          label.toggle-label(for="toggleShowChecklistAtMinicard_{{checklist._id}}")

 template(name="copyChecklistPopup")
  +copyAndMoveChecklist
@@ -2,9 +2,14 @@ import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import Cards from '/models/cards';
 import Boards from '/models/boards';
+import ChecklistItems from '/models/checklistItems';
+import Checklists from '/models/checklists';
 import { BoardSwimlaneListCardDialog } from '/client/lib/dialogWithBoardSwimlaneListCard';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { Utils } from '/client/lib/utils';
+import autosize from 'autosize';

-const subManager = new SubsManager();
+// SubsManager removed for Meteor 3 migration
 const { calculateIndexData } = Utils;

 function initSorting(items) {
@@ -130,8 +135,11 @@ Template.checklists.events({
    event.preventDefault();
    const textarea = tpl.find('textarea.js-edit-checklist-item');
    const title = textarea.value.trim();
-    const checklist = Template.currentData().checklist;
-    checklist.setTitle(title);
+    const formData = Blaze.getData(event.currentTarget) || Blaze.getData(event.target);
+    const checklist = formData?.checklist;
+    if (checklist) {
+      checklist.setTitle(title);
+    }
  },
  'submit .js-add-checklist-item'(event, tpl) {
    event.preventDefault();
@@ -218,7 +226,7 @@ Template.checklists.events({
    event.preventDefault();
    Template.currentData().card.toggleHideFinishedChecklist();
  },
-  keydown(event) {
+  'keydown textarea.js-add-checklist-item'(event) {
    //If user press enter key inside a form, submit it
    //Unless the user is also holding down the 'shift' key
    if (event.keyCode === 13 && !event.shiftKey) {
@@ -266,6 +274,11 @@ Template.checklistActionsPopup.events({
    Template.currentData().checklist.toggleHideAllChecklistItems();
    Popup.back();
  },
+  'click .js-show-checklist-at-minicard'(event) {
+    event.preventDefault();
+    Template.currentData().checklist.toggleShowChecklistAtMinicard();
+    Popup.back();
+  },
 });

 Template.editChecklistItemForm.onRendered(function () {
@@ -1,8 +1,11 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import { LABEL_COLORS } from '/models/metadata/colors';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { Utils } from '/client/lib/utils';

 let labelColors;
 Meteor.startup(() => {
-  labelColors = Boards.simpleSchema()._schema['labels.$.color'].allowedValues;
+  labelColors = LABEL_COLORS;
 });

 const getFallbackLabelColor = () => {
@@ -3,7 +3,7 @@
  position: relative;
  display: flex;
  align-items: center;
-  margin-bottom: 1.2vh;
+  margin-bottom: 8px;
 }
 .minicard-wrapper.placeholder {
  background: #ccc;
@@ -16,8 +16,8 @@
 }
 .minicard-wrapper.ui-sortable-helper .and-n-other {
  width: 100%;
-  height: 2.5vh;
-  padding: 0.5vh;
+  height: 25px;
+  padding: 5px;
  background-color: #f2f2f2;
  text-align: center;
  border-radius: 0.4vw;
@@ -28,15 +28,27 @@
 .minicard-wrapper .multi-selection-checkbox + .minicard {
  margin-left: 1vw;
 }
+/* Enlarge the clickable area of the small selection checkbox so it can be
+   reliably clicked at the left side of the minicard. The visible 13px box (and
+   its rotated is-checked checkmark) keep their size; an invisible overlay only
+   extends the hit target. */
+.minicard-wrapper .multi-selection-checkbox::before {
+  content: "";
+  position: absolute;
+  top: -8px;
+  left: -8px;
+  right: -8px;
+  bottom: -8px;
+}
@media only screen {
  .minicard {
-    padding: 0.8vh 1vw 0.3vh;
+    padding: 8px 1vw 3px;
    position: relative;
    flex: 1;
    flex-wrap: wrap;
    background-color: #fff;
-    min-height: 2.5vh;
-    box-shadow: 0 0.2vh 0.3vh rgba(0,0,0,0.15);
+    min-height: 25px;
+    box-shadow: 0 2px 3px rgba(0,0,0,0.15);
    border-radius: 0.3vw;
    color: #4d4d4d;
    overflow: hidden;
@@ -77,7 +89,7 @@
  border-bottom-right-radius: 0;
  border-top-right-radius: 0;
  z-index: 25;
-  box-shadow: -0.3vw 0.2vh 0.3vh rgba(0,0,0,0.2);
+  box-shadow: -0.3vw 2px 3px rgba(0,0,0,0.2);
 }
 .minicard:hover:not(.minicard-composer),
 .is-selected .minicard,
@@ -91,9 +103,9 @@
  background-position: center;
  background-repeat: no-repeat;
  background-size: contain;
-  height: 20vh;
+  height: 150px;
  user-select: none;
-  margin: 0.8vh -1vw 0.8vh -1vw;
+  margin: 8px -1vw 8px -1vw;
  border-radius: top 0.3vw;
 }
 .minicard .minicard-labels {
@@ -105,7 +117,7 @@
  height: clamp(12px, 1.5vw, 16px);
  border-radius: 0.3vw;
  margin-right: 0.4vw;
-  margin-bottom: 0.4vh;
+  margin-bottom: 4px;
 }
 .minicard .minicard-labels-no-text {
  display: flex;
@@ -137,7 +149,7 @@
  height: clamp(20px, 2.5vw, 28px);
  position: absolute;
  right: 0vw;
-  top: 4vh;
+  top: 28px;
  display: none;
  z-index: 1;
 }
@@ -313,7 +325,7 @@

 .minicard .badges {
  float: left;
-  margin-top: 1vh;
+  margin-top: 8px;
  color: #808080;
 }
 .minicard .badges:empty {
@@ -322,7 +334,7 @@
 .minicard .badges .badge {
  float: left;
  margin-right: 1.5vw;
-  margin-bottom: 0.4vh;
+  margin-bottom: 4px;
  font-size: 0.9em;
 }
 .minicard .badges .badge.is-finished {
@@ -356,7 +368,7 @@
 .minicard .minicard-creator {
  float: right;
  margin-left: 0.7vw;
-  margin-bottom: 0.5vh;
+  margin-bottom: 4px;
 }
 .minicard .minicard-members .member,
 .minicard .minicard-assignees .member,
@@ -365,7 +377,7 @@
  border-radius: 50%;
  height: clamp(24px, 3.5vw, 32px);
  width: clamp(24px, 3.5vw, 32px);
-  margin-bottom: 0.5vh;
+  margin-bottom: 4px;
 }
 .minicard .minicard-members .assignee,
 .minicard .minicard-assignees .assignee,
@@ -378,7 +390,7 @@
 .minicard .minicard-members + .badges,
 .minicard .minicard-assignees + .badges,
 .minicard .minicard-creator + .badges {
-  margin-top: 0.7vh;
+  margin-top: 6px;
 }
 .minicard .minicard-assignees {
  border-bottom: 1px solid #f00;
@@ -391,11 +403,11 @@
  display: none;
 }
 .minicard .minicard-description {
-  padding: 0.8vh 0 0 1vw;
+  padding: 8px 0 0 1vw;
  color: #000;
  background-color: #eee;
  width: 100%;
-  margin-bottom: 0.3vh;
+  margin-bottom: 3px;
  margin-left: -0.5vw;
  border-radius: 0.4vw;
  overflow: hidden;
@@ -405,7 +417,7 @@
  -webkit-box-orient: vertical;
 }
 .minicard.minicard-composer {
-  margin-bottom: 1.3vh;
+  margin-bottom: 12px;
 }
 .minicard.minicard-composer textarea.minicard-composer-textarea,
 .minicard.minicard-composer textarea.minicard-composer-textarea:focus {
@@ -416,9 +428,9 @@
  height: auto;
  margin: 0;
  padding: 0;
-  max-height: 22vh;
-  min-height: 5vh;
-  margin-bottom: 2.5vh;
+  max-height: 200px;
+  min-height: 50px;
+  margin-bottom: 20px;
  overflow-y: auto;
 }
 .parent-prefix {
@@ -736,7 +748,7 @@
 .minicard-list-name {
  font-size: 0.75em;
  color: #8c8c8c;
-  margin-top: 0.2vh;
+  margin-top: 2px;
  display: flex;
  align-items: center;
  gap: 0.3vw;
@@ -745,9 +757,11 @@
 /* Checklist display on minicard */
 .minicard-checklist {
  width: 100%;
-  margin-top: 0.5vh;
-  margin-bottom: 0.5vh;
-  padding: 0.3vh 0.5vw;
+  box-sizing: border-box;
+  clear: both;
+  margin-top: 2px;
+  margin-bottom: 5px;
+  padding: 3px 0.5vw;
  background-color: rgba(255, 255, 255, 0.8);
  border-radius: 0.3vw;
  border: 1px solid #e0e0e0;
@@ -757,7 +771,7 @@
  display: flex;
  justify-content: space-between;
  align-items: center;
-  margin-bottom: 0.3vh;
+  margin-bottom: 3px;
 }

 .minicard-checklist .checklist-title {
@@ -765,6 +779,7 @@
  font-weight: bold;
  color: #4d4d4d;
  flex: 1;
+  margin: 0;
 }

 .minicard-checklist .checklist-menu {
@@ -783,13 +798,13 @@
 .minicard-checklist .checklist-item {
  font-size: 0.75em;
  color: #666;
-  margin-bottom: 0.2vh;
+  margin-bottom: 2px;
  display: flex;
  align-items: flex-start;
  gap: 0.3vw;
  line-height: 1.2;
  cursor: pointer;
-  padding: 0.2vh 0;
+  padding: 2px 0;
  border-radius: 0.2vw;
  transition: background-color 0.2s;
 }
@@ -806,7 +821,7 @@
 .minicard-checklist .checklist-item .check-box-unicode {
  flex-shrink: 0;
  font-size: 0.8em;
-  margin-top: 0.1vh;
+  margin-top: 1px;
  transition: transform 0.2s;
 }

@@ -819,3 +834,35 @@
  word-wrap: break-word;
  overflow-wrap: break-word;
 }
+
+/* Trello-style "mark complete" toggle, left of the minicard title */
+.minicard-title .minicard-complete-toggle {
+  display: inline-flex;
+  align-items: center;
+  vertical-align: middle;
+  /* Nudge down so the checkmark sits at the vertical middle of the title text
+     (the checked materialCheckBox is shifted up 4px by its own positioning). */
+  position: relative;
+  top: 4px;
+  margin-right: 6px;
+  cursor: pointer;
+}
+
+/* Sticker icon highlight styles (used instead of colour): taco pack => underline,
+   pete pack => round (ring around the icon). Icon keeps its normal colour. */
+.minicard-sticker i.sticker-underline {
+  border-bottom: 2px solid currentColor;
+  padding-bottom: 1px;
+  line-height: 1;
+}
+.minicard-sticker i.sticker-round {
+  border: 1px solid currentColor;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.6em;
+  height: 1.6em;
+  line-height: 1;
+  box-sizing: border-box;
+}
@@ -11,17 +11,21 @@ template(name="minicard")
      a.minicard-details-menu-with-handle.js-open-minicard-details-menu(title="{{_ 'cardDetailsActionsPopup-title'}}")
        i.fa.fa-bars
    .dates
-      if getReceived
-        .date
-          +minicardReceivedDate
-      if getStart
-        .date
-          +minicardStartDate
-      if getDue
-        .date
-          +minicardDueDate
-      if getEnd
-         +minicardEndDate
+      if showReceived
+        if getReceived
+          .date
+            +minicardReceivedDate
+      if showStart
+        if getStart
+          .date
+            +minicardStartDate
+      if showDue
+        if getDue
+          .date(class="{{#if getDueComplete}}due-complete{{/if}}")
+            +minicardDueDate
+      if showEnd
+        if getEnd
+           +minicardEndDate
      if getSpentTime
        .date
          +cardSpentTime
@@ -50,6 +54,9 @@ template(name="minicard")
                span {{_ 'upload-completed'}}

    .minicard-title
+      if canModifyCard
+        a.minicard-complete-toggle.js-toggle-card-complete(title="{{#if getDueComplete}}{{_ 'card-mark-incomplete'}}{{else}}{{_ 'card-mark-complete'}}{{/if}}")
+          .materialCheckBox(class="{{#if getDueComplete}}is-checked{{/if}}")
      if $eq 'prefix-with-full-path' currentBoard.presentParentTask
        .parent-prefix
          | {{ parentString ' > ' }}
@@ -68,19 +75,20 @@ template(name="minicard")
        span.linked-icon.linked-archived
          i.fa.fa-archive
      +viewer
-        if currentBoard.allowsCardNumber
+        if showCardNumber
          span.card-number
-            | ##{getCardNumber}
+            | ##{getCardNumber} &nbsp;
        = getTitle
-    if labels
-      .minicard-labels(class="{{#if hiddenMinicardLabelText}}minicard-labels-no-text{{/if}}")
-        each labels
-          unless hiddenMinicardLabelText
-            span.js-card-label.card-label(class="card-label-{{color}}" title=name)
-              +viewer
-                = name
-          if hiddenMinicardLabelText
-            .minicard-label(class="card-label-{{color}}" title="{{name}}")
+    if showLabels
+      if labels
+        .minicard-labels(class="{{#if hiddenMinicardLabelText}}minicard-labels-no-text{{/if}}")
+          each labels
+            unless hiddenMinicardLabelText
+              span.js-card-label.card-label(class="card-label-{{color}}" title=name)
+                +viewer
+                  = name
+            if hiddenMinicardLabelText
+              .minicard-label(class="card-label-{{color}}" title="{{name}}")

    .minicard-custom-fields
      each customFieldsWD
@@ -143,14 +151,21 @@ template(name="minicard")
      .minicard-creator
        +userAvatar(userId=this.userId noRemove=true)

+    if shouldShowChecklistAtMinicard
+      each shouldShowChecklistAtMinicard
+        +minicardChecklist(checklist=. card=..)
    .badges
-      if canModifyCard
-        if comments.length
-          .badge(title="{{_ 'card-comments-title' comments.length }}")
-            span.badge-icon.badge-comment.badge-text
-              i.fa.fa-comment-o
-              = ' '
-              = comments.length
+      if stickers.length
+        .badge.badge-state-image-only.minicard-stickers
+          each stickers
+            span.badge-icon.minicard-sticker(title="{{#if name}}{{name}}{{else}}{{icon}}{{/if}}")
+              i.fa(class="fa-{{icon}} {{#if highlight}}sticker-{{highlight}}{{/if}}")
+      if comments.length
+        .badge(title="{{_ 'card-comments-title' comments.length }}")
+          span.badge-icon.badge-comment.badge-text
+            i.fa.fa-comment-o
+            = ' '
+            = comments.length
            //span.badge-comment.badge-text
            //|
              {{_ 'comment'}}
@@ -179,21 +194,19 @@ template(name="minicard")
            span.badge-icon
              i.fa.fa-paperclip
            span.badge-text= attachments.length
-      if allSubtasks.count
-        .badge
-          span.badge-icon
-            i.fa.fa-globe
-          span.badge-text.check-list-text {{subtasksFinishedCount}}/{{allSubtasksCount}}
-          //{{subtasksFinishedCount}}/{{subtasksCount}} does not work because when a subtaks is archived, the count goes down
+      if showSubtasks
+        if allSubtasks.count
+          .badge
+            span.badge-icon
+              i.fa.fa-globe
+            span.badge-text.check-list-text {{subtasksFinishedCount}}/{{allSubtasksCount}}
+            //{{subtasksFinishedCount}}/{{subtasksCount}} does not work because when a subtaks is archived, the count goes down
      if currentBoard.allowsCardSortingByNumber
        if currentBoard.allowsCardSortingByNumberOnMinicard
          .badge
            span.badge-icon
              i.fa.fa-sort-numeric-asc
            span.badge-text.check-list-sort {{ sort }}
-    if shouldShowChecklistAtMinicard
-      each shouldShowChecklistAtMinicard
-        +minicardChecklist(checklist=. card=..)
    if currentBoard.allowsDescriptionTextOnMinicard
      if getDescription
        .minicard-description
@@ -218,10 +231,26 @@ template(name="editCardSortOrderPopup")
 template(name="minicardChecklist")
  .minicard-checklist
    .checklist-header
-      .checklist-title= checklist.title
+      if canModifyCard
+        +inlinedForm(classNames="js-edit-checklist-title" checklist=checklist)
+          +editChecklistForm(checklist=checklist)
+        else
+          h4.checklist-title.js-open-inlined-form.is-editable= checklist.title
+      else
+        h4.checklist-title= checklist.title
      if canModifyCard
        a.checklist-menu.js-open-checklist-menu(title="{{_ 'checklistActionsPopup-title'}}")
          i.fa.fa-bars
-    each visibleItems
-      +checklistItemDetail(item = . checklist = checklist card = card)
+    .checklist-items.js-checklist-items
+      each visibleItems
+        +inlinedForm(classNames="js-edit-checklist-item" item=. checklist=checklist)
+          +editChecklistItemForm(type='item' item=. checklist=checklist)
+        else
+          +checklistItemDetail(item=. checklist=checklist card=card)
+    if canModifyCard
+      +inlinedForm(autoclose=false classNames="js-add-checklist-item" checklist=checklist)
+        +addChecklistItemForm(checklist=checklist showNewlineBecomesNewChecklistItem=false)
+      else
+        a.add-checklist-item.js-open-inlined-form(title="{{_ 'add-checklist-item'}}")
+          i.fa.fa-plus

@@ -3,6 +3,19 @@ import { TAPi18n } from '/imports/i18n';
 import { CustomFieldStringTemplate } from '/client/lib/customFields';
 import { handleFileUpload } from './attachments';
 import uploadProgressManager from '../../lib/uploadProgressManager';
+import { Utils } from '/client/lib/utils';
+import ChecklistItems from '/models/checklistItems';
+
+function getMinicardFlag(board, onMinicardField, legacyField, defaultValue) {
+  if (!board) return false;
+  if (board[onMinicardField] !== null && board[onMinicardField] !== undefined) {
+    return board[onMinicardField];
+  }
+  if (legacyField && board[legacyField] !== null && board[legacyField] !== undefined) {
+    return board[legacyField];
+  }
+  return defaultValue;
+}

 // Template.cards.events({
 //   'click .member': Popup.open('cardMember')
@@ -49,31 +62,41 @@ Template.minicard.helpers({
  },

  showMembers() {
-    // cache "board" to reduce the mini-mongodb access
    const board = this.board();
-    let ret = false;
-    if (board) {
-      ret =
-        board.allowsMembers === null ||
-        board.allowsMembers === undefined ||
-        board.allowsMembers
-      ;
-    }
-    return ret;
+    return getMinicardFlag(board, 'allowsMembersOnMinicard', 'allowsMembers', true);
  },

  showAssignee() {
-    // cache "board" to reduce the mini-mongodb access
    const board = this.board();
-    let ret = false;
-    if (board) {
-      ret =
-        board.allowsAssignee === null ||
-        board.allowsAssignee === undefined ||
-        board.allowsAssignee
-      ;
-    }
-    return ret;
+    return getMinicardFlag(board, 'allowsAssigneeOnMinicard', 'allowsAssignee', true);
+  },
+  showReceived() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsReceivedDateOnMinicard', 'allowsReceivedDate', true);
+  },
+  showStart() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsStartDateOnMinicard', 'allowsStartDate', true);
+  },
+  showDue() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsDueDateOnMinicard', 'allowsDueDate', true);
+  },
+  showEnd() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsEndDateOnMinicard', 'allowsEndDate', true);
+  },
+  showLabels() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsLabelsOnMinicard', 'allowsLabels', true);
+  },
+  showCardNumber() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsCardNumberOnMinicard', 'allowsCardNumber', false);
+  },
+  showSubtasks() {
+    const board = this.board();
+    return getMinicardFlag(board, 'allowsSubtasksOnMinicard', 'allowsSubtasks', true);
  },

  hiddenMinicardLabelText() {
@@ -90,10 +113,11 @@ Template.minicard.helpers({
    if (!this.coverId) return null;
    const attachment = ReactiveCache.getAttachment(this.coverId);
    if (!attachment) return null;
-    const coverId = this.coverId;
+    const coverLink = typeof attachment.link === 'function' ? attachment.link() : '';
+    if (!coverLink) return null;
    return {
      link() {
-        return `/cdn/storage/attachments/${coverId}`;
+        return coverLink;
      },
    };
  },
@@ -154,6 +178,16 @@ Template.minicard.events({
    else if (this.isLinkedBoard())
      Utils.goBoardId(this.linkedId);
  },
+  'click .js-toggle-card-complete'(event) {
+    // Trello-style "mark complete" toggle (left of the title). Don't let the
+    // click open the card.
+    event.preventDefault();
+    event.stopPropagation();
+    if (!Utils.canModifyCard()) {
+      return;
+    }
+    this.setDueComplete(!this.getDueComplete());
+  },
  'click .js-toggle-minicard-label-text'() {
    if (window.localStorage.getItem('hiddenMinicardLabelText')) {
      window.localStorage.removeItem('hiddenMinicardLabelText'); //true
@@ -251,6 +285,13 @@ Template.minicardChecklist.helpers({
 });

 Template.minicardChecklist.events({
+  'click .js-convert-checklist-item-to-card'(event) {
+    event.stopPropagation();
+    const formData = Blaze.getData(event.currentTarget);
+    if (!formData) return;
+    const context = { currentData: () => formData };
+    Popup.open('convertChecklistItemToCard').call(context, event);
+  },
  'click .js-open-checklist-menu'(event) {
    const data = Template.currentData();
    const checklist = data.checklist || data;
@@ -258,6 +299,66 @@ Template.minicardChecklist.events({
    const context = { currentData: () => ({ checklist, card }) };
    Popup.open('checklistActions').call(context, event);
  },
+  'click .js-checklist-item .check-box-container'(event) {
+    event.stopPropagation();
+    event.preventDefault();
+    const data = Blaze.getData(event.target) || Blaze.getData(event.currentTarget);
+    const item = data && data.item;
+    if (item && item._id) {
+      item.toggleItem();
+    }
+  },
+  'click .js-submit-edit-checklist-item-form'(event) {
+    event.preventDefault();
+    event.stopPropagation();
+    const $btn = $(event.currentTarget);
+    const $form = $btn.closest('form');
+    const textarea = $form.find('textarea.js-edit-checklist-item')[0];
+    if (!textarea) return;
+    const title = textarea.value.trim();
+    if (!title) return;
+    const formData = Blaze.getData($form[0]);
+    if (formData && formData.item && formData.item._id) {
+      formData.item.setTitle(title);
+    } else if (formData && formData.checklist && formData.checklist._id) {
+      formData.checklist.setTitle(title);
+    }
+    $form.find('.js-close-inlined-form').trigger('click');
+  },
+  'submit .js-add-checklist-item'(event, tpl) {
+    event.preventDefault();
+    const textarea = tpl.find('textarea.js-add-checklist-item');
+    if (!textarea) return;
+    const title = textarea.value.trim();
+    const data = Template.currentData() || {};
+    const checklist = data.checklist;
+    if (!checklist || !title) return;
+    const items = checklist.items();
+    const lastItem = items[items.length - 1] || null;
+    const sortIndex = Utils.calculateIndexData(lastItem, null).base;
+    ChecklistItems.insert({
+      title,
+      checklistId: checklist._id,
+      cardId: checklist.cardId,
+      sort: sortIndex,
+    });
+    textarea.value = '';
+    textarea.focus();
+  },
+  'click .js-delete-checklist-item': Popup.afterConfirm('checklistItemDelete', function () {
+    Popup.back();
+    const item = this && this.item ? this.item : this;
+    if (item && item._id) {
+      ChecklistItems.remove(item._id);
+    }
+  }),
+  'keydown textarea.js-add-checklist-item'(event) {
+    if (event.keyCode === 13 && !event.shiftKey) {
+      event.preventDefault();
+      const $form = $(event.currentTarget).closest('form');
+      $form.find('button[type=submit]').click();
+    }
+  },
 });

 Template.editCardSortOrderPopup.events({
@@ -0,0 +1,3 @@
+.minicard-title .minicard-complete-toggle {
+  display: none;
+}
@@ -1,7 +1,52 @@
+import { ReactiveCache } from '/imports/reactiveCache';
+
 Template.resultCard.helpers({
  userId() {
    return Meteor.userId();
  },
+  getBoard() {
+    const card = Template.currentData();
+    try {
+      if (card && card.boardId) {
+        const board = ReactiveCache.getBoard(card.boardId);
+        return board || null;
+      }
+    } catch (err) {
+      // Silently handle errors
+    }
+    return null;
+  },
+  getSwimlane() {
+    const card = Template.currentData();
+    try {
+      if (card && card.swimlaneId) {
+        const swimlane = ReactiveCache.getSwimlane(card.swimlaneId);
+        return swimlane || null;
+      }
+    } catch (err) {
+      // Silently handle errors
+    }
+    return null;
+  },
+  getList() {
+    const card = Template.currentData();
+    try {
+      if (card && card.listId) {
+        const list = ReactiveCache.getList(card.listId);
+        return list || null;
+      }
+    } catch (err) {
+      // Silently handle errors
+    }
+    return null;
+  },
+  originRelativeUrl() {
+    const card = Template.currentData();
+    if (card && card.boardId && card._id) {
+      return `/board/${card.boardId}?cardId=${card._id}`;
+    }
+    return '#';
+  },
 });

 Template.resultCard.events({
@@ -15,7 +15,7 @@ textarea.js-edit-subtask-item {
  color: #8c8c8c;
  text-decoration: underline;
  word-wrap: break-word;
-  float: right;
+  flex-shrink: 0;
  padding-top: 6px;
 }
 .delete-text:hover,
@@ -24,8 +24,13 @@ textarea.js-edit-subtask-item {
 .js-delete-subtask-item:hover {
  color: inherit;
 }
+.subtask-title {
+  display: flex;
+  align-items: center;
+  width: 100%;
+}
 .subtask-title .checkbox {
-  float: left;
+  flex-shrink: 0;
  width: 30px;
  height: 30px;
  font-size: 18px;
@@ -34,10 +39,12 @@ textarea.js-edit-subtask-item {
 .subtask-title .title {
  font-size: 18px;
  line-height: 25px;
+  flex: 1;
+  order: 1;
 }
 .subtask-title .subtasks-stat {
  margin: 0 0.5em;
-  float: right;
+  flex-shrink: 0;
  padding-top: 6px;
 }
 .subtask-title .subtasks-stat.is-finished {
@@ -46,6 +53,9 @@ textarea.js-edit-subtask-item {
 .subtask-title .js-delete-subtask {
  margin: 0 0.5em;
 }
+.subtask-title .js-view-subtask {
+  margin: 0 0.5em;
+}
 .js-confirm-subtask-delete {
  background-color: #f7f7f7;
  position: absolute;
@@ -129,6 +139,9 @@ textarea.js-edit-subtask-item {
 .subtasks-item:hover {
  background-color: #ebebeb;
 }
+.subtasks-item .check-box-container {
+  padding-right: 10px;
+}
 .subtasks-item .check-box {
  margin: 0.1em 0 0 0;
 }
@@ -175,6 +188,7 @@ body.grey-icons-enabled .subtasks-item .check-box-unicode {
  display: inline-block;
 }
 .subtask-details-menu {
-  float: right;
+  flex-shrink: 0;
  padding: 6px 10px 6px 10px;
+  order: 2;
 }
@@ -74,14 +74,13 @@ template(name="subtasksItems")
 template(name='subtaskItemDetail')
  .js-subtasks-item.subtasks-item
    if canModifyCard
-      span.check-box-unicode
-        i.fa(class="{{#if item.isFinished}}fa-check-square{{else}}fa-square-o{{/if}}")
+      .check-box-container
+        .check-box.materialCheckBox(class="{{#if item.isFinished}}is-checked{{/if}}")
      .item-title.js-open-inlined-form.is-editable(class="{{#if item.isFinished }}is-checked{{/if}}")
        +viewer
          = item.title
    else
-      span.check-box-unicode
-        i.fa(class="{{#if item.isFinished}}fa-check-square{{else}}fa-square-o{{/if}}")
+      .materialCheckBox(class="{{#if item.isFinished}}is-checked{{/if}}")
      .item-title(class="{{#if item.isFinished }}is-checked{{/if}}")
        +viewer
          = item.title
@@ -1,8 +1,17 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import Cards from '/models/cards';
+import { Filter } from '/client/lib/filter';

 Template.subtasks.events({
-  'click .js-open-subtask-details-menu': Popup.open('subtaskActions'),
+  'click .js-open-subtask-details-menu'(event) {
+    // Close any existing popup first to avoid accumulating content
+    if (Popup.isOpen()) {
+      Popup.close();
+    }
+    // Now open the popup for this specific subtask
+    Popup.open('subtaskActions').call(this, event);
+  },
  async 'submit .js-add-subtask'(event, tpl) {
    event.preventDefault();
    const textarea = tpl.find('textarea.js-add-subtask-item');
@@ -11,8 +20,16 @@ Template.subtasks.events({
    const card = ReactiveCache.getCard(cardId);
    const sortIndex = -1;
    const crtBoard = ReactiveCache.getBoard(card.boardId);
-    const targetBoard = crtBoard.getDefaultSubtasksBoard();
-    const listId = targetBoard.getDefaultSubtasksListId();
+    const targetBoard = await crtBoard.getDefaultSubtasksBoardAsync();
+    if (!targetBoard) {
+      return;
+    }
+
+    const targetList = await targetBoard.getDefaultSubtasksListAsync();
+    if (!targetList) {
+      return;
+    }
+    const listId = targetList._id;

    //Get the full swimlane data for the parent task.
    const parentSwimlane = ReactiveCache.getSwimlane({
@@ -20,10 +37,12 @@ Template.subtasks.events({
      _id: card.swimlaneId,
    });
    //find the swimlane of the same name in the target board.
-    const targetSwimlane = ReactiveCache.getSwimlane({
-      boardId: targetBoard._id,
-      title: parentSwimlane.title,
-    });
+    const targetSwimlane = parentSwimlane
+      ? ReactiveCache.getSwimlane({
+          boardId: targetBoard._id,
+          title: parentSwimlane.title,
+        })
+      : undefined;
    //If no swimlane with a matching title exists in the target board, fall back to the default swimlane.
    const swimlaneId =
      targetSwimlane === undefined
@@ -33,7 +52,7 @@ Template.subtasks.events({
    const nextCardNumber = await targetBoard.getNextCardNumber();

    if (title) {
-      const _id = Cards.insert({
+      const _id = await Cards.insertAsync({
        title,
        parentId: cardId,
        members: [],
@@ -44,7 +63,7 @@ Template.subtasks.events({
        sort: sortIndex,
        swimlaneId,
        type: 'cardType-card',
-        cardNumber: nextCardNumber
+        cardNumber: nextCardNumber,
      });

      // In case the filter is active we need to add the newly inserted card in
@@ -100,7 +119,7 @@ Template.subtasks.helpers({
 });

 Template.subtaskItemDetail.events({
-  async 'click .js-subtasks-item .check-box-unicode'() {
+  async 'click .js-subtasks-item .check-box-container'() {
    const item = Template.currentData().item;
    if (item && item._id) {
      await item.toggleItem();
@@ -1,4 +1,5 @@
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import Cards from '/models/cards';

 // Add click handler to ganttView for card titles
 Template.ganttView.events({
@@ -14,6 +15,7 @@ Template.ganttView.events({
  },
 });
 import { Template } from 'meteor/templating';
+import { Utils } from '/client/lib/utils';

 // Blaze template helpers for ganttView
 function getISOWeekInfo(d) {
@@ -49,3 +49,119 @@ a.show-mapping {
  font-size: 90%;
  font-weight: bold;
 }
+
+/* Trello API import: file rows, workspace tree, job progress and errors */
+/* The shared page spinners are centered with a large top margin (e.g. bounce
+   uses margin:100px auto), which leaves a big empty gap above the spinner in
+   this compact panel. Make spinners here small and inline instead. */
+.trello-api-import .sk-spinner {
+  margin: 0 8px 0 0;
+  display: inline-block;
+  vertical-align: middle;
+  width: auto;
+}
+.trello-api-import .import-file-row label {
+  display: block;
+  font-weight: bold;
+}
+.trello-api-import .import-file-row input,
+.trello-api-import .import-file-row select {
+  width: 100%;
+}
+.trello-workspaces {
+  max-height: 40vh;
+  overflow-y: auto;
+  border: 1px solid #ddd;
+  padding: 8px;
+  margin: 8px 0;
+}
+.trello-workspace {
+  margin-bottom: 8px;
+}
+.trello-workspace .trello-boards {
+  margin-left: 22px;
+}
+.trello-workspace-title,
+.trello-board {
+  align-items: center;
+  padding: 3px 0;
+  cursor: pointer;
+  text-decoration: none;
+  color: inherit;
+}
+.trello-workspace-title .materialCheckBox,
+.trello-board .materialCheckBox {
+  flex: 0 0 auto;
+  margin-right: 12px;
+}
+.trello-select-controls button {
+  margin-right: 6px;
+}
+.trello-job-controls button {
+  margin-right: 6px;
+}
+/* Import progress meter, styled like Admin Panel / Attachments / Move Attachments */
+.trello-progress-label {
+  margin: 8px 0 6px;
+}
+.trello-progress-bar {
+  background: #e9ecef;
+  border-radius: 8px;
+  height: 12px;
+  overflow: hidden;
+  margin-bottom: 4px;
+}
+.trello-progress-fill {
+  background: linear-gradient(90deg, #28a745, #20c997);
+  height: 100%;
+  border-radius: 8px;
+  transition: width 0.3s ease;
+  position: relative;
+}
+.trello-progress-fill.is-running::after {
+  content: '';
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: linear-gradient(90deg, transparent, rgba(255, 255, 255, 0.4), transparent);
+  animation: trelloProgressShimmer 2s infinite;
+}
+@keyframes trelloProgressShimmer {
+  0% { transform: translateX(-100%); }
+  100% { transform: translateX(100%); }
+}
+.trello-progress-percent {
+  text-align: right;
+  font-size: 12px;
+  color: #666;
+  font-weight: 600;
+  margin-bottom: 8px;
+}
+.trello-import-result.is-ok {
+  color: #3cb500;
+}
+.trello-import-result.is-error {
+  color: #eb4646;
+}
+.js-trello-errors-text {
+  width: 100%;
+  font-family: monospace;
+  white-space: pre;
+}
+
+/* Trello API credential Save/Delete buttons */
+.trello-api-creds-buttons button {
+  margin-right: 6px;
+}
+.trello-creds-saved {
+  color: #3cb500;
+}
+
+/* Simplified per-field hint text under the Trello file upload labels */
+.import-file-row .import-file-hint {
+  display: block;
+  font-size: 0.85em;
+  margin: 2px 0 4px;
+}
@@ -8,6 +8,8 @@ template(name="import")
  .wrapper
    if error.get
      .warning {{_ error.get}}
+    if zipImporting
+      .warning {{_ 'import-trello-zip-progress'}}
    +Template.dynamic(template=currentTemplate)

 template(name="importTextarea")
@@ -15,7 +17,115 @@ template(name="importTextarea")
    p: label(for='import-textarea') {{_ instruction}} {{_ 'import-board-instruction-about-errors'}}
    textarea.js-import-json(id='import-textarea' placeholder="{{_ importPlaceHolder}}" autofocus)
      | {{jsonText}}
+    if isTrelloImport
+      p.import-file-row
+        label(for='import-json-file') {{_ 'import-trello-json-file'}}
+        span.quiet.import-file-hint {{_ 'import-trello-json-file-hint'}}
+        input.js-import-json-file(id='import-json-file' type="file" accept=".json,application/json")
+      p.import-file-row
+        label(for='import-zip-file') {{_ 'import-trello-zip-file'}}
+        span.quiet.import-file-hint {{_ 'import-trello-zip-file-hint'}}
+        input.js-import-zip-file(id='import-zip-file' type="file" accept=".zip,application/zip")
+      p.import-file-row
+        label(for='import-workspace-name') {{_ 'import-trello-workspace'}}
+        input.js-import-workspace-name(id='import-workspace-name' type="text" placeholder="{{_ 'import-trello-workspace-placeholder'}}")
    input.primary.wide(type="submit" value="{{_ 'import'}}")
+  if isTrelloImport
+    hr
+    +importTrelloApi
+
+template(name="importTrelloApi")
+  .trello-api-import
+    h2 {{_ 'trello-api-import'}}
+    p.quiet {{_ 'trello-api-import-desc'}}
+    p.import-file-row
+      label(for='trello-api-key') {{_ 'trello-api-key'}}
+      input.js-trello-key(id='trello-api-key' type="text" autocomplete="off")
+    p.import-file-row
+      label(for='trello-api-token') {{_ 'trello-api-token'}}
+      input.js-trello-token(id='trello-api-token' type="password" autocomplete="off")
+    p.trello-api-creds-buttons
+      button.primary.js-trello-save-creds(type="button") {{_ 'save'}}
+      button.negate.js-trello-delete-creds(type="button") {{_ 'delete'}}
+    if credsSaved
+      p.quiet.trello-creds-saved
+        i.fa.fa-check
+        span  {{_ 'trello-api-credentials-saved'}}
+    p
+      button.primary.js-trello-list-workspaces(type="button") {{_ 'trello-list-workspaces'}}
+    if error.get
+      .warning {{_ error.get}}
+    if loading.get
+      +spinner
+    if hasWorkspaces
+      p.import-file-row
+        label(for='trello-parent-workspace') {{_ 'import-trello-parent-workspace'}}
+        select.js-trello-parent-workspace(id='trello-parent-workspace')
+          option(value="") {{_ 'trello-parent-workspace-top'}}
+          each flatWorkspaceNodes
+            option(value=id)= label
+      p.trello-select-controls
+        button.primary.js-trello-select-all(type="button") {{_ 'select-all'}}
+        button.primary.js-trello-unselect-all(type="button") {{_ 'unselect-all'}}
+      .trello-workspaces
+        each workspaceList
+          .trello-workspace
+            a.flex.trello-workspace-title.js-toggle-workspace
+              .materialCheckBox(class="{{#if workspaceSelected}}is-checked{{/if}}")
+              b  {{name}}
+            .trello-boards
+              each boards
+                a.flex.trello-board.js-toggle-board(data-board-id="{{id}}")
+                  .materialCheckBox(class="{{#if boardSelected}}is-checked{{/if}}")
+                  span  {{name}}
+                  if closed
+                    span.quiet  ({{_ 'archived'}})
+      if canStartImport
+        p
+          button.primary.wide.js-trello-import-selected(type="button") {{_ 'trello-import-selected'}}
+    if currentJob
+      hr
+      .trello-import-job
+        h3 {{_ 'trello-import-progress'}}
+        with currentJob
+          p.trello-progress-label
+            b {{_ 'status'}}:
+            span  {{_ status}} ({{jobProgressText}})
+          .trello-progress-bar
+            .trello-progress-fill(class="{{#if $eq status 'running'}}is-running{{/if}}" style="width: {{jobProgressPercent}}%")
+          .trello-progress-percent {{jobProgressPercent}}%
+          if lastError
+            .warning {{lastError}}
+        p.trello-job-controls
+          if jobIsRunning
+            button.primary.js-trello-cancel(type="button") {{_ 'trello-cancel'}}
+            button.negate.js-trello-cancel-delete(type="button") {{_ 'trello-cancel-delete'}}
+          if jobCanResume
+            button.primary.js-trello-resume(type="button") {{_ 'trello-resume'}}
+            button.negate.js-trello-cancel-delete(type="button") {{_ 'trello-cancel-delete'}}
+          if jobIsFinished
+            button.negate.js-trello-cancel-delete(type="button") {{_ 'trello-delete-imported'}}
+            button.primary.js-trello-clear(type="button") {{_ 'trello-clear-job'}}
+
+        if jobResults.length
+          .trello-import-results
+            each jobResults
+              p.trello-import-result(class="{{#if success}}is-ok{{else}}is-error{{/if}}")
+                if success
+                  i.fa.fa-check
+                  span  {{title}} — {{attachmentsImported}} {{_ 'attachments'}}
+                else
+                  i.fa.fa-warning
+                  span  {{trelloBoardId}}: {{this.error}}
+
+        if jobHasErrors
+          .trello-import-errors
+            p
+              b {{_ 'trello-import-errors'}}
+              button.primary.js-trello-copy-errors(type="button") {{_ 'copy-to-clipboard'}}
+              if copied.get
+                span.quiet  {{_ 'copied'}}
+            textarea.js-trello-errors-text(readonly rows="8" wrap="off")= jobErrorText

 template(name="importMapMembers")
  h2 {{_ 'import-map-members'}}
@@ -4,6 +4,10 @@ import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import { wekanGetMembersToMap } from './wekanMembersMapper';
 import { csvGetMembersToMap } from './csvMembersMapper';
 import getSlug from 'limax';
+import { UserSearchIndex } from '/models/users';
+import { Utils } from '/client/lib/utils';
+import { TAPi18n } from '/imports/i18n';
+import TrelloImportJobs from '/models/trelloImportJobs';

 const Papa = require('papaparse');

@@ -42,6 +46,92 @@ function _prepareAdditionalData(dataObject) {
  return membersToMap;
 }

+// All Trello file/text imports are run on the server over HTTP instead of the
+// DDP `importBoard` method. This matters for correctness, not just size: Meteor
+// automatically re-sends an unacknowledged method call on every reconnect, so if
+// an import is heavy (or the connection hiccups) the WebSocket can enter an
+// endless drop/retry loop (the "Invalid frame header" flicker). An HTTP request
+// is never auto-retried, and a .zip's attachment bytes never touch the realtime
+// connection at all. The body is either a .zip File (application/zip) or a JSON
+// string { board, membersMapping } (application/json).
+async function postTrelloImport(body, contentType) {
+  const token =
+    (window.localStorage && window.localStorage.getItem('Meteor.loginToken')) || '';
+  const resp = await fetch('/import-trello', {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: {
+      'Content-Type': contentType,
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
+    body,
+  });
+  let result = {};
+  try {
+    result = await resp.json();
+  } catch (e) {
+    result = {};
+  }
+  if (!resp.ok || result.error) {
+    throw new Error(result.error || 'import-trello-failed');
+  }
+  return result;
+}
+
+// A safe URL slug for an imported board. Trello exports name the board `name`,
+// WeKan exports use `title`; getSlug (limax) throws on undefined, so guard it.
+function boardSlug(data) {
+  const raw = (data && (data.title || data.name)) || '';
+  return (raw && getSlug(raw)) || 'imported-board';
+}
+
+// Navigate to a freshly server-imported board. The HTTP import (unlike a DDP
+// method) does not push the new board's documents to this client, so we first
+// subscribe to the board and wait until its lists/swimlanes/cards are loaded
+// into Minimongo — otherwise the board opens with an empty Swimlanes view until
+// the page is reloaded. The subscription is left running so the data stays
+// available when the board is reopened from All Boards in the same session. A
+// timeout is the safety net in case the subscription never signals ready.
+function goToImportedBoard(boardId, slug) {
+  let navigated = false;
+  const go = () => {
+    if (navigated) return;
+    navigated = true;
+    FlowRouter.go('board', { id: boardId, slug });
+  };
+  Meteor.subscribe('board', boardId, false, { onReady: go });
+  Meteor.setTimeout(go, 5000);
+}
+
+// Find a workspace node by name anywhere in the user's personal workspace tree.
+function findWorkspaceByName(nodes, name) {
+  for (const node of nodes || []) {
+    if (node.name === name) return node;
+    if (node.children) {
+      const found = findWorkspaceByName(node.children, name);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
+// Assign an imported board to a personal workspace named `wsName`, creating the
+// workspace (under an optional parent) only if one with that name doesn't exist.
+function assignBoardToNamedWorkspace(boardId, wsName, parentId = null) {
+  const user = ReactiveCache.getCurrentUser();
+  const tree = (user && user.profile && user.profile.boardWorkspacesTree) || [];
+  const existing = findWorkspaceByName(tree, wsName);
+  if (existing) {
+    Meteor.call('assignBoardToWorkspace', boardId, existing.id);
+    return;
+  }
+  Meteor.call('createWorkspace', { parentId, name: wsName }, (err, node) => {
+    if (!err && node) {
+      Meteor.call('assignBoardToWorkspace', boardId, node.id);
+    }
+  });
+}
+
 Template.import.onCreated(function () {
  this.error = new ReactiveVar('');
  this.steps = ['importTextarea', 'importMapMembers'];
@@ -49,6 +139,8 @@ Template.import.onCreated(function () {
  this.importedData = new ReactiveVar();
  this.membersToMap = new ReactiveVar([]);
  this.importSource = Session.get('importSource');
+  // True while a Trello .zip package is being uploaded/imported server-side.
+  this.zipImporting = new ReactiveVar(false);

  this.nextStep = () => {
    const nextStepIndex = this._currentStepIndex.get() + 1;
@@ -63,10 +155,10 @@ Template.import.onCreated(function () {
    this.error.set(error);
  };

-  this.importData = (evt, dataSource) => {
+  this.importData = async (evt, dataSource) => {
    evt.preventDefault();
-    const input = this.find('.js-import-json').value;
    if (dataSource === 'csv') {
+      const input = this.find('.js-import-json').value;
      const csv = input.indexOf('\t') > 0 ? input.replace(/(\t)/g, ',') : input;
      const ret = Papa.parse(csv);
      if (ret && ret.data && ret.data.length) this.importedData.set(ret.data);
@@ -74,52 +166,136 @@ Template.import.onCreated(function () {
      const membersToMap = _prepareAdditionalData(ret.data);
      this.membersToMap.set(membersToMap);
      this.nextStep();
-    } else {
-      try {
-        const dataObject = JSON.parse(input);
-        this.setError('');
-        this.importedData.set(dataObject);
-        const membersToMap = _prepareAdditionalData(dataObject);
-        // store members data and mapping in Session
-        // (we go deep and 2-way, so storing in data context is not a viable option)
-        this.membersToMap.set(membersToMap);
-        this.nextStep();
-      } catch (e) {
-        this.setError('error-json-malformed');
+      return;
+    }
+    // Trello: a .zip package (one or more board .json files plus per-board
+    // attachment subdirectories from the Trello Attachments Downloader) imports
+    // all of its boards at once, through a separate field from the single .json.
+    if (dataSource === 'trello') {
+      const zipEl = this.find('.js-import-zip-file');
+      if (zipEl && zipEl.files && zipEl.files[0]) {
+        await this.importTrelloZip(zipEl.files[0]);
+        return;
      }
    }
+    try {
+      // A single board: JSON may come from an uploaded .json file (large Trello
+      // exports are awkward to paste) or from the textarea.
+      let input = this.find('.js-import-json').value;
+      const jsonFileEl = this.find('.js-import-json-file');
+      if (jsonFileEl && jsonFileEl.files && jsonFileEl.files[0]) {
+        input = await jsonFileEl.files[0].text();
+      }
+      const dataObject = JSON.parse(input);
+      this.setError('');
+
+      // Trello: remember the target personal-workspace name for finishImport.
+      this.workspaceName = '';
+      if (dataSource === 'trello') {
+        const wsEl = this.find('.js-import-workspace-name');
+        this.workspaceName = wsEl && wsEl.value ? wsEl.value.trim() : '';
+      }
+
+      this.importedData.set(dataObject);
+      const membersToMap = _prepareAdditionalData(dataObject);
+      // store members data and mapping in Session
+      // (we go deep and 2-way, so storing in data context is not a viable option)
+      this.membersToMap.set(membersToMap);
+      this.nextStep();
+    } catch (e) {
+      this.setError('error-json-malformed');
+    }
  };

-  this.finishImport = () => {
-    const additionalData = {};
+  // Upload a Trello .zip package to the server, which extracts it (with
+  // zip-bomb / path-traversal guards), imports every board and streams each
+  // attachment to the Default storage, then go to All Boards.
+  this.importTrelloZip = async (zipFile) => {
+    this.setError('');
+    const wsEl = this.find('.js-import-workspace-name');
+    const workspaceName = wsEl && wsEl.value ? wsEl.value.trim() : '';
+
+    this.zipImporting.set(true);
+    let result;
+    try {
+      result = await postTrelloImport(zipFile, 'application/zip');
+    } catch (e) {
+      this.zipImporting.set(false);
+      this.setError((e && e.message) || 'import-trello-failed');
+      return;
+    }
+    this.zipImporting.set(false);
+
+    (result.boardIds || []).forEach(boardId => {
+      if (workspaceName) {
+        assignBoardToNamedWorkspace(boardId, workspaceName);
+      }
+    });
+    Session.set('fromBoard', null);
+    // Go to All Boards, where the newly imported boards appear.
+    FlowRouter.go('home');
+  };
+
+  this.finishImport = async () => {
    const membersMapping = this.membersToMap.get();
+    const mappingById = {};
    if (membersMapping) {
-      const mappingById = {};
      membersMapping.forEach(member => {
        if (member.wekanId) {
          mappingById[member.id] = member.wekanId;
        }
      });
-      additionalData.membersMapping = mappingById;
    }
+    const importedData = this.importedData.get();
+
+    // Trello: import over HTTP (see postTrelloImport) so the realtime DDP
+    // connection is never used for the board payload and can't enter the
+    // drop/retry "Invalid frame header" flicker loop. Do NOT mutate the still-
+    // mounted map-members template (e.g. clearing membersToMap) before
+    // navigating away — that forces an empty re-render mid-teardown and can
+    // throw "Can't select in removed DomRange". We navigate away, which
+    // destroys the import templates.
+    if (this.importSource === 'trello') {
+      let result;
+      try {
+        result = await postTrelloImport(
+          JSON.stringify({ board: importedData, membersMapping: mappingById }),
+          'application/json',
+        );
+      } catch (e) {
+        this.setError((e && e.message) || 'import-trello-failed');
+        return;
+      }
+      const boardId = (result.boardIds || [])[0];
+      if (!boardId) {
+        this.setError('import-trello-failed');
+        return;
+      }
+      Session.set('fromBoard', null);
+      if (this.workspaceName) {
+        assignBoardToNamedWorkspace(boardId, this.workspaceName);
+      }
+      goToImportedBoard(boardId, boardSlug(importedData));
+      return;
+    }
+
+    // wekan / csv: unchanged DDP import.
    this.membersToMap.set([]);
    Meteor.call(
      'importBoard',
-      this.importedData.get(),
-      additionalData,
+      importedData,
+      { membersMapping: mappingById },
      this.importSource,
      Session.get('fromBoard'),
      (err, res) => {
        if (err) {
          this.setError(err.error);
        } else {
-          let title = getSlug(this.importedData.get().title) || 'imported-board';
          Session.set('fromBoard', null);
          FlowRouter.go('board', {
            id: res,
-            slug: title,
+            slug: boardSlug(importedData),
          });
-          //Utils.goBoardId(res);
        }
      },
    );
@@ -133,6 +309,9 @@ Template.import.helpers({
  currentTemplate() {
    return Template.instance().steps[Template.instance()._currentStepIndex.get()];
  },
+  zipImporting() {
+    return Template.instance().zipImporting.get();
+  },
 });

 Template.importTextarea.helpers({
@@ -147,6 +326,9 @@ Template.importTextarea.helpers({
      return 'import-json-placeholder';
    }
  },
+  isTrelloImport() {
+    return Session.get('importSource') === 'trello';
+  },
 });

 Template.importTextarea.events({
@@ -318,7 +500,11 @@ Template.importMapMembersAddPopup.onCreated(function () {
 });

 Template.importMapMembersAddPopup.onRendered(function () {
-  this.find('.js-search-member-input').focus();
+  // Guard against the DOM range being gone (e.g. the popup was closed during a
+  // re-render) — calling find/$ then throws "Can't select in removed DomRange".
+  if (this.view && this.view.isDestroyed) return;
+  const input = this.find('.js-search-member-input');
+  if (input) input.focus();
 });

 Template.importMapMembersAddPopup.onDestroyed(function () {
@@ -378,3 +564,310 @@ Template.importMapMembersAddPopup.helpers({
    return importMemberPopupState.noResults;
  },
 });
+
+// ---------------------------------------------------------------------------
+// Live Trello API import: key/token -> list workspaces & boards -> import
+// selected boards (with attachments) server-side, placing each under a
+// personal workspace named after its Trello workspace.
+// ---------------------------------------------------------------------------
+
+function flattenWorkspaceTree(nodes, depth = 0, acc = []) {
+  (nodes || []).forEach(node => {
+    acc.push({ id: node.id, label: `${'— '.repeat(depth)}${node.name}` });
+    if (node.children && node.children.length) {
+      flattenWorkspaceTree(node.children, depth + 1, acc);
+    }
+  });
+  return acc;
+}
+
+// Build the copy-paste-friendly error text for a job: the error log plus a
+// summary line per failed board.
+function jobErrorText(job) {
+  if (!job) return '';
+  const lines = [];
+  (job.errorLog || []).forEach(line => lines.push(line));
+  return lines.join('\n');
+}
+
+Template.importTrelloApi.onCreated(function () {
+  this.error = new ReactiveVar('');
+  this.loading = new ReactiveVar(false);
+  this.workspaces = new ReactiveVar([]);
+  this.copied = new ReactiveVar(false);
+  // Board selection state: map of trelloBoardId -> true. Tracked here (rather
+  // than via DOM checkboxes) because the UI uses animated .materialCheckBox
+  // elements, not native inputs.
+  this.selectedBoards = new ReactiveVar({});
+  // The import itself runs server-side as a persisted job; watch it reactively
+  // so progress survives navigating away and back.
+  this.subscribe('trelloImportJobs');
+});
+
+// Collect every board id across all listed workspaces.
+function allBoardIds(workspaces) {
+  const ids = {};
+  (workspaces || []).forEach(ws => {
+    (ws.boards || []).forEach(b => {
+      ids[b.id] = true;
+    });
+  });
+  return ids;
+}
+
+Template.importTrelloApi.helpers({
+  error() {
+    return Template.instance().error;
+  },
+  loading() {
+    return Template.instance().loading;
+  },
+  copied() {
+    return Template.instance().copied;
+  },
+  hasWorkspaces() {
+    return Template.instance().workspaces.get().length > 0;
+  },
+  workspaceList() {
+    return Template.instance().workspaces.get();
+  },
+  boardSelected() {
+    return !!Template.instance().selectedBoards.get()[this.id];
+  },
+  workspaceSelected() {
+    const sel = Template.instance().selectedBoards.get();
+    const boards = this.boards || [];
+    return boards.length > 0 && boards.every(b => sel[b.id]);
+  },
+  flatWorkspaceNodes() {
+    const user = ReactiveCache.getCurrentUser();
+    const tree = (user && user.profile && user.profile.boardWorkspacesTree) || [];
+    return flattenWorkspaceTree(tree);
+  },
+  credsSaved() {
+    const user = ReactiveCache.getCurrentUser();
+    return !!(user && user.profile && user.profile.trelloApiSaved);
+  },
+
+  // --- current background job ---
+  currentJob() {
+    return TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+  },
+  jobIsRunning() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    return job && job.status === 'running';
+  },
+  jobCanResume() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    return job && (job.status === 'paused' || job.status === 'error');
+  },
+  jobIsFinished() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    return job && (job.status === 'done' || job.status === 'cancelled');
+  },
+  canStartImport() {
+    // Don't start a second import while one is active (running/paused/error),
+    // which would create a hidden concurrent job.
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    return !job || job.status === 'done' || job.status === 'cancelled';
+  },
+  jobProgressText() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    if (!job) return '';
+    return `${job.currentIndex} / ${job.total}`;
+  },
+  jobProgressPercent() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    if (!job || !job.total) return 0;
+    return Math.round((job.currentIndex / job.total) * 100);
+  },
+  jobResults() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    return (job && job.results) || [];
+  },
+  jobHasErrors() {
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    return !!(job && job.errorLog && job.errorLog.length);
+  },
+  jobErrorText() {
+    return jobErrorText(TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } }));
+  },
+});
+
+Template.importTrelloApi.events({
+  'click .js-trello-save-creds'(evt, tpl) {
+    evt.preventDefault();
+    const key = tpl.find('.js-trello-key').value.trim();
+    const token = tpl.find('.js-trello-token').value.trim();
+    if (!key || !token) {
+      tpl.error.set('trello-api-credentials-required');
+      return;
+    }
+    tpl.error.set('');
+    Meteor.call('saveTrelloCredentials', key, token, err => {
+      if (err) {
+        tpl.error.set(err.reason || err.error || 'trello-api-error');
+        return;
+      }
+      // Don't keep the token sitting in the browser; it now lives server-side.
+      tpl.find('.js-trello-key').value = '';
+      tpl.find('.js-trello-token').value = '';
+    });
+  },
+  'click .js-trello-delete-creds'(evt, tpl) {
+    evt.preventDefault();
+    tpl.error.set('');
+    Meteor.call('deleteTrelloCredentials', err => {
+      if (err) tpl.error.set(err.reason || err.error || 'trello-api-error');
+    });
+    tpl.find('.js-trello-key').value = '';
+    tpl.find('.js-trello-token').value = '';
+  },
+  'click .js-trello-list-workspaces'(evt, tpl) {
+    evt.preventDefault();
+    // key/token may be empty when saved credentials exist; the server falls
+    // back to the saved ones and returns an error if neither is available.
+    const key = tpl.find('.js-trello-key').value.trim();
+    const token = tpl.find('.js-trello-token').value.trim();
+    tpl.error.set('');
+    tpl.loading.set(true);
+    Meteor.call('trelloListWorkspaces', key, token, (err, res) => {
+      tpl.loading.set(false);
+      if (err) {
+        tpl.error.set(err.reason || err.error || 'trello-api-error');
+        tpl.workspaces.set([]);
+        tpl.selectedBoards.set({});
+      } else {
+        const workspaces = res || [];
+        tpl.workspaces.set(workspaces);
+        // Preselect all boards by default.
+        tpl.selectedBoards.set(allBoardIds(workspaces));
+      }
+    });
+  },
+  // Toggle a single board's animated checkbox.
+  'click .js-toggle-board'(evt, tpl) {
+    evt.preventDefault();
+    const id = this.id;
+    const sel = { ...tpl.selectedBoards.get() };
+    if (sel[id]) {
+      delete sel[id];
+    } else {
+      sel[id] = true;
+    }
+    tpl.selectedBoards.set(sel);
+  },
+  // Toggle all boards in a workspace: if all are selected, clear them; else
+  // select them all.
+  'click .js-toggle-workspace'(evt, tpl) {
+    evt.preventDefault();
+    const boards = this.boards || [];
+    const sel = { ...tpl.selectedBoards.get() };
+    const allSelected = boards.length > 0 && boards.every(b => sel[b.id]);
+    boards.forEach(b => {
+      if (allSelected) {
+        delete sel[b.id];
+      } else {
+        sel[b.id] = true;
+      }
+    });
+    tpl.selectedBoards.set(sel);
+  },
+  'click .js-trello-select-all'(evt, tpl) {
+    evt.preventDefault();
+    tpl.selectedBoards.set(allBoardIds(tpl.workspaces.get()));
+  },
+  'click .js-trello-unselect-all'(evt, tpl) {
+    evt.preventDefault();
+    tpl.selectedBoards.set({});
+  },
+  'click .js-trello-import-selected'(evt, tpl) {
+    evt.preventDefault();
+    const key = tpl.find('.js-trello-key').value.trim();
+    const token = tpl.find('.js-trello-token').value.trim();
+    const sel = tpl.selectedBoards.get();
+    const boardIds = Object.keys(sel).filter(id => sel[id]);
+    if (!boardIds.length) {
+      tpl.error.set('trello-select-boards');
+      return;
+    }
+    const parentEl = tpl.find('.js-trello-parent-workspace');
+    const parentId = parentEl && parentEl.value ? parentEl.value : null;
+
+    tpl.error.set('');
+    // Start the server-side job; progress shows up via the subscription. The
+    // user is free to navigate away and come back.
+    Meteor.call('trelloStartImport', key, token, boardIds, parentId, err => {
+      if (err) {
+        tpl.error.set(err.reason || err.error || 'trello-api-error');
+      }
+    });
+  },
+  'click .js-trello-resume'(evt, tpl) {
+    evt.preventDefault();
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    if (!job) return;
+    const key = tpl.find('.js-trello-key').value.trim();
+    const token = tpl.find('.js-trello-token').value.trim();
+    if (!key || !token) {
+      tpl.error.set('trello-api-credentials-required');
+      return;
+    }
+    tpl.error.set('');
+    Meteor.call('trelloResumeImport', job._id, key, token, err => {
+      if (err) tpl.error.set(err.reason || err.error || 'trello-api-error');
+    });
+  },
+  'click .js-trello-cancel'(evt, tpl) {
+    evt.preventDefault();
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    if (!job) return;
+    Meteor.call('trelloCancelImport', job._id, false);
+  },
+  'click .js-trello-cancel-delete'(evt, tpl) {
+    evt.preventDefault();
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    if (!job) return;
+    // eslint-disable-next-line no-alert
+    if (!window.confirm(TAPi18n.__('trello-cancel-delete-confirm'))) return;
+    Meteor.call('trelloCancelImport', job._id, true);
+  },
+  'click .js-trello-clear'(evt, tpl) {
+    evt.preventDefault();
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    if (!job) return;
+    Meteor.call('trelloClearImportJob', job._id, false);
+  },
+  'click .js-trello-copy-errors'(evt, tpl) {
+    evt.preventDefault();
+    const job = TrelloImportJobs.findOne({}, { sort: { createdAt: -1 } });
+    const text = jobErrorText(job);
+    if (!text) return;
+    const done = () => {
+      tpl.copied.set(true);
+      setTimeout(() => tpl.copied.set(false), 2000);
+    };
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+      navigator.clipboard.writeText(text).then(done, () => {
+        // Fall back to selecting the textarea so the user can copy manually.
+        const ta = tpl.find('.js-trello-errors-text');
+        if (ta) {
+          ta.focus();
+          ta.select();
+        }
+      });
+    } else {
+      const ta = tpl.find('.js-trello-errors-text');
+      if (ta) {
+        ta.focus();
+        ta.select();
+        try {
+          document.execCommand('copy');
+          done();
+        } catch (e) {
+          // user can copy manually from the selected textarea
+        }
+      }
+    }
+  },
+});
@@ -4,15 +4,24 @@ export function wekanGetMembersToMap(data) {
  // we will work on the list itself (an ordered array of objects) when a
  // mapping is done, we add a 'wekan' field to the object representing the
  // imported member
-  const membersToMap = data.members;
-  const users = data.users;
+  const membersToMap = data.members || [];
+  const users = data.users || [];
  // auto-map based on username
+  const mappable = [];
  membersToMap.forEach(importedMember => {
    importedMember.id = importedMember.userId;
    delete importedMember.userId;
    const user = users.filter(user => {
      return user._id === importedMember.id;
    })[0];
+    // The exported `users` array only contains users that still exist in the
+    // source instance, so a member whose account was deleted (or any other
+    // dangling user reference, e.g. from an older export) has no matching
+    // user. Skip it instead of dereferencing `undefined`, which would throw
+    // and make the whole import fail as "error-json-malformed".
+    if (!user) {
+      return;
+    }
    if (user.profile && user.profile.fullname) {
      importedMember.fullName = user.profile.fullname;
    }
@@ -21,6 +30,7 @@ export function wekanGetMembersToMap(data) {
    if (wekanUser) {
      importedMember.wekanId = wekanUser._id;
    }
+    mappable.push(importedMember);
  });
-  return membersToMap;
+  return mappable;
 }
@@ -1,4 +1,12 @@
-const { ReactiveVar } = require('meteor/reactive-var');
+import { ReactiveVar } from 'meteor/reactive-var';
+
+// Creation-time stack tracking which basicTabs is currently being rendered.
+// Blaze creates parent views before children, so when tabContent.onCreated fires,
+// its parent basicTabs instance is on top of this stack.
+// This is necessary because Blaze content blocks render with parentView pointing
+// back to the calling context (e.g. membersWidget), not the basicTabs template —
+// so walking the view tree cannot find the basicTabs instance.
+const _creatingStack = [];

 Template.basicTabs.onCreated(function () {
  const activeTab = this.data.activeTab
@@ -10,6 +18,13 @@ Template.basicTabs.onCreated(function () {
    const current = this._activeTab.get();
    return current && current.slug === slug;
  };
+
+  _creatingStack.push(this);
+});
+
+Template.basicTabs.onRendered(function () {
+  const idx = _creatingStack.lastIndexOf(this);
+  if (idx !== -1) _creatingStack.splice(idx, 1);
 });

 Template.basicTabs.helpers({
@@ -26,25 +41,16 @@ Template.basicTabs.events({
  },
 });

-function findBasicTabsInstance() {
-  let view = Blaze.currentView;
-  while (view) {
-    if (view.name === 'Template.basicTabs' && view.templateInstance) {
-      const inst = view.templateInstance();
-      if (inst && inst.isActiveSlug) {
-        return inst;
-      }
-    }
-    view = view.parentView;
-  }
-  return null;
-}
+Template.tabContent.onCreated(function () {
+  // Capture the parent basicTabs instance at creation time via the stack.
+  // isActiveSlug reads a ReactiveVar on the basicTabs instance, so the
+  // isActiveTab helper below will re-run reactively when the tab changes.
+  this._basicTabsInst = _creatingStack[_creatingStack.length - 1] || null;
+});

 Template.tabContent.helpers({
  isActiveTab(slug) {
-    const inst = findBasicTabsInstance();
-    if (inst && inst.isActiveSlug(slug)) {
-      return 'active';
-    }
+    const inst = Template.instance()._basicTabsInst;
+    if (inst && inst.isActiveSlug(slug)) return 'active';
  },
 });
@@ -152,12 +152,12 @@ body.list-resizing-active * {
 /* Ensure consistent header height for all lists */
 .list-header {
  /* Maintain consistent height and padding for all lists */
-  min-height: 2.5vh !important;
+  min-height: 30px !important;
  height: auto !important;
-  padding: 2.5vh 1.5vw 0.5vh !important;
+  padding: 28px 1.5vw 6px !important;
  /* Make sure the background covers the full height */
  background-color: #e4e4e4 !important;
-  border-bottom: 0.8vh solid #e4e4e4 !important;
+  border-bottom: 8px solid #e4e4e4 !important;
  /* Use original display for consistent button positioning */
  display: block !important;
  position: relative !important;
@@ -401,24 +401,24 @@ form.inlined-form .list-composer {
 .list.list-composer .list-name-input,
 .list .list-composer .list-name-input {
  background: #fff;
-  margin: -0.4vh 0 1vh;
+  margin: -4px 0 8px;
 }
 .list-header-add {
  flex: 0 0 auto;
-  padding: 1.5vh 1.5vw;
+  padding: 14px 1.5vw;
  position: relative;
-  min-height: 2.5vh;
+  min-height: 30px;
 }
 .list-header {
  flex: 0 0 auto;
-  padding: 2.5vh 1.5vw 0.5vh;
+  padding: 28px 1.5vw 6px;
  position: relative;
-  min-height: 2.5vh;
+  min-height: 30px;
  background-color: #e4e4e4;
-  border-bottom: 0.8vh solid #e4e4e4;
+  border-bottom: 8px solid #e4e4e4;
 }
 .list-header.list-header-card-count {
-  min-height: 4.5vh;
+  min-height: 45px;
  height: auto;
 }
 .list-header.ui-sortable-handle {
@@ -433,7 +433,7 @@ form.inlined-form .list-composer {
  line-height: 1.2;
  margin: 0;
  font-weight: bold;
-  min-height: 1.2vh;
+  min-height: 14px;
  min-width: 4vw;
  overflow-wrap: break-word;
  word-wrap: break-word;
@@ -1196,7 +1196,7 @@ form.inlined-form .list-composer {

 /* Allow long list titles to expand on desktop (non-mobile, non-collapsed) */
 .list:not(.mobile-view):not(.list-collapsed) .list-header {
-  padding-top: calc(2.5vh - 6px) !important;
+  padding-top: 22px !important;
  overflow: visible !important;
 }

@@ -1226,52 +1226,52 @@ form.inlined-form .list-composer {
  margin-top: unset !important;
 }
 .list-header-white {
-  border-bottom: 6px solid #fff;
+  border-bottom: 6px solid #fff !important;
 }
 .list-header-green {
-  border-bottom: 6px solid #3cb500;
+  border-bottom: 6px solid #3cb500 !important;
 }
 .list-header-yellow {
-  border-bottom: 6px solid #fad900;
+  border-bottom: 6px solid #fad900 !important;
 }
 .list-header-orange {
-  border-bottom: 6px solid #ff9f19;
+  border-bottom: 6px solid #ff9f19 !important;
 }
 .list-header-red {
-  border-bottom: 6px solid #eb4646;
+  border-bottom: 6px solid #eb4646 !important;
 }
 .list-header-purple {
-  border-bottom: 6px solid #a632db;
+  border-bottom: 6px solid #a632db !important;
 }
 .list-header-blue {
-  border-bottom: 6px solid #0079bf;
+  border-bottom: 6px solid #0079bf !important;
 }
 .list-header-pink {
-  border-bottom: 6px solid #ff78cb;
+  border-bottom: 6px solid #ff78cb !important;
 }
 .list-header-sky {
-  border-bottom: 6px solid #00c2e0;
+  border-bottom: 6px solid #00c2e0 !important;
 }
 .list-header-black {
-  border-bottom: 6px solid #4d4d4d;
+  border-bottom: 6px solid #4d4d4d !important;
 }
 .list-header-lime {
-  border-bottom: 6px solid #51e898;
+  border-bottom: 6px solid #51e898 !important;
 }
 .list-header-silver {
-  border-bottom: 6px solid #e4e4e4;
+  border-bottom: 6px solid #e4e4e4 !important;
 }
 .list-header-peachpuff {
-  border-bottom: 6px solid #ffdab9;
+  border-bottom: 6px solid #ffdab9 !important;
 }
 .list-header-crimson {
-  border-bottom: 6px solid #dc143c;
+  border-bottom: 6px solid #dc143c !important;
 }
 .list-header-plum {
-  border-bottom: 6px solid #dda0dd;
+  border-bottom: 6px solid #dda0dd !important;
 }
 .list-header-darkgreen {
-  border-bottom: 6px solid #006400;
+  border-bottom: 6px solid #006400 !important;
 }

 /* Final collapsed desktop overrides:
@@ -1379,31 +1379,31 @@ form.inlined-form .list-composer {
  opacity: 1 !important;
 }
 .list-header-slateblue {
-  border-bottom: 6px solid #6a5acd;
+  border-bottom: 6px solid #6a5acd !important;
 }
 .list-header-magenta {
-  border-bottom: 6px solid #f0f;
+  border-bottom: 6px solid #f0f !important;
 }
 .list-header-gold {
-  border-bottom: 6px solid #ffd700;
+  border-bottom: 6px solid #ffd700 !important;
 }
 .list-header-navy {
-  border-bottom: 6px solid #000080;
+  border-bottom: 6px solid #000080 !important;
 }
 .list-header-gray {
-  border-bottom: 6px solid #808080;
+  border-bottom: 6px solid #808080 !important;
 }
 .list-header-saddlebrown {
-  border-bottom: 6px solid #8b4513;
+  border-bottom: 6px solid #8b4513 !important;
 }
 .list-header-paleturquoise {
-  border-bottom: 6px solid #afeeee;
+  border-bottom: 6px solid #afeeee !important;
 }
 .list-header-mistyrose {
-  border-bottom: 6px solid #ffe4e1;
+  border-bottom: 6px solid #ffe4e1 !important;
 }
 .list-header-indigo {
-  border-bottom: 6px solid #4b0082;
+  border-bottom: 6px solid #4b0082 !important;
 }

 .list.list-collapsed .collapsed-list-drag-area {
@@ -1,5 +1,8 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
+import { EscapeActions } from '/client/lib/escapeActions';
+import { MultiSelection } from '/client/lib/multiSelection';
+import { Utils } from '/client/lib/utils';
 require('/client/lib/jquery-ui.js')

 const { calculateIndex } = Utils;
@@ -35,6 +38,15 @@ Template.list.onRendered(function () {
  const itemsSelector = '.js-minicard:not(.placeholder, .js-card-composer)';
  const $cards = this.$('.js-minicards');

+  // Destroy any existing sortable before re-initializing. Without this, a
+  // re-render of the list (e.g. when a Card Details panel opens) binds a SECOND
+  // sortable to the same .js-minicards element, so dragging a card from its
+  // handle fires the `stop` handler twice and the card appears to duplicate.
+  // Mirrors the guard in swimlanes.js initSortable().
+  if ($cards.data('uiSortable') || $cards.data('sortable')) {
+    $cards.sortable('destroy');
+  }
+
  $cards.sortable({
    connectWith: '.js-minicards:not(.js-list-full)',
    tolerance: 'pointer',
@@ -75,7 +87,8 @@ Template.list.onRendered(function () {
      const nextCardDom = ui.item.next('.js-minicard').get(0);
      const nCards = MultiSelection.isActive() ? MultiSelection.count() : 1;
      const sortIndex = calculateIndex(prevCardDom, nextCardDom, nCards);
-      const listId = Blaze.getData(ui.item.parents('.list').get(0))._id;
+      const listData = Blaze.getData(ui.item.parents('.list').get(0));
+      const listId = listData._id;
      const currentBoard = Utils.getCurrentBoard();
      const defaultSwimlaneId = currentBoard.getDefaultSwimline()._id;
      let targetSwimlaneId = null;
@@ -84,9 +97,12 @@ Template.list.onRendered(function () {
      if (
        Utils.boardView() === 'board-view-swimlanes' ||
        currentBoard.isTemplatesBoard()
-      )
+      ) {
        targetSwimlaneId = Blaze.getData(ui.item.parents('.swimlane').get(0))
          ._id;
+      } else if (listData.swimlaneId) {
+        targetSwimlaneId = listData.swimlaneId;
+      }

      // Normally the jquery-ui sortable library moves the dragged DOM element
      // to its new position, which disrupts Blaze reactive updates mechanism
@@ -338,9 +354,19 @@ Template.list.onCreated(function () {
      return 550;
    };

+    // Read the horizontal page coordinate from either a jQuery mouse event
+    // or a native touch event (touchstart/move expose `touches`, touchend
+    // exposes `changedTouches`).
+    const getEventPageX = (e) => {
+      const oe = e.originalEvent || e;
+      if (oe.touches && oe.touches.length) return oe.touches[0].pageX;
+      if (oe.changedTouches && oe.changedTouches.length) return oe.changedTouches[0].pageX;
+      return e.pageX;
+    };
+
    const startResize = (e) => {
      isResizing = true;
-      startX = e.pageX || e.originalEvent.touches[0].pageX;
+      startX = getEventPageX(e);
      startWidth = $list.outerWidth();

      // Add visual feedback
@@ -359,7 +385,7 @@ Template.list.onCreated(function () {
        return;
      }

-      const currentX = e.pageX || e.originalEvent.touches[0].pageX;
+      const currentX = getEventPageX(e);
      const deltaX = currentX - startX;
      const newWidth = Math.max(minWidth, startWidth + deltaX);

@@ -383,7 +409,7 @@ Template.list.onCreated(function () {
      isResizing = false;

      // Calculate final width
-      const currentX = e.pageX || e.originalEvent.touches[0].pageX;
+      const currentX = getEventPageX(e);
      const deltaX = currentX - startX;
      const finalWidth = Math.max(minWidth, startWidth + deltaX);
      const listConstraint = getListConstraint();
@@ -461,10 +487,15 @@ Template.list.onCreated(function () {
    $(document).on('mousemove', doResize);
    $(document).on('mouseup', stopResize);

-    // Touch events for mobile
-    $resizeHandle.on('touchstart', startResize, { passive: false });
-    $(document).on('touchmove', doResize, { passive: false });
-    $(document).on('touchend', stopResize, { passive: false });
+    // Touch events for mobile.
+    // NOTE: jQuery's .on() does not accept an addEventListener-style options
+    // object — passing { passive: false } made jQuery bind the object itself
+    // as the handler, throwing "handler.apply is not a function" on every
+    // touch. Use the native API so { passive: false } actually applies and
+    // preventDefault() works during the resize.
+    $resizeHandle[0].addEventListener('touchstart', startResize, { passive: false });
+    document.addEventListener('touchmove', doResize, { passive: false });
+    document.addEventListener('touchend', stopResize, { passive: false });

    // Prevent dragscroll interference
    $resizeHandle.on('mousedown', (e) => {
@@ -485,8 +516,8 @@ Template.list.onCreated(function () {
    tpl.view.onViewDestroyed(() => {
      $(document).off('mousemove', doResize);
      $(document).off('mouseup', stopResize);
-      $(document).off('touchmove', doResize);
-      $(document).off('touchend', stopResize);
+      document.removeEventListener('touchmove', doResize);
+      document.removeEventListener('touchend', stopResize);
    });
  };
 });
@@ -1,39 +1,38 @@
 template(name="listBody")
-  unless collapsed
-    .list-body(class="{{#unless isVerticalScrollbars}}no-scrollbars{{/unless}}")
-      .minicards.clearfix.js-minicards(class="{{#if reachedWipLimit}}js-list-full{{/if}}")
-        +inlinedForm(autoclose=false position="top")
-          +addCardForm(listId=_id position="top")
-        ul.sidebar-list
-          each customFieldsSum
-            li
+  .list-body(class="{{#unless isVerticalScrollbars}}no-scrollbars{{/unless}}")
+    .minicards.clearfix.js-minicards(class="{{#if reachedWipLimit}}js-list-full{{/if}}")
+      +inlinedForm(autoclose=false position="top")
+        +addCardForm(listId=_id position="top")
+      ul.sidebar-list
+        each customFieldsSum
+          li
+            +viewer
+              = name
+            if $eq customFieldsSum.type "number"
              +viewer
-                = name
-              if $eq customFieldsSum.type "number"
-                +viewer
-                  = value
-              if $eq customFieldsSum.type "currency"
-                +viewer
-                  = formattedCurrencyCustomFieldValue(value)
-        each (cardsWithLimit (idOrNull ../../_id))
-          a.minicard-wrapper.js-minicard(href=originRelativeUrl
-            class="{{#if cardIsSelected}}is-selected{{/if}}"
-            class="{{#if MultiSelection.isSelected _id}}is-checked{{/if}}")
-            if MultiSelection.isActive
-              .materialCheckBox.multi-selection-checkbox.js-toggle-multi-selection(
-                class="{{#if MultiSelection.isSelected _id}}is-checked{{/if}}")
-            +minicard(this)
-        if (showSpinner (idOrNull ../../_id))
-          +spinnerList
-        if canSeeAddCard
-          +inlinedForm(autoclose=false position="bottom")
-            +addCardForm(listId=_id position="bottom")
-          else
-            a.open-minicard-composer.js-card-composer.js-open-inlined-form(title="{{_ 'add-card-to-bottom-of-list'}}")
-              i.fa.fa-plus
-              | {{_ 'add-card'}}
+                = value
+            if $eq customFieldsSum.type "currency"
+              +viewer
+                = formattedCurrencyCustomFieldValue(value)
+      each (cardsWithLimit (idOrNull ../../_id))
+        a.minicard-wrapper.js-minicard(href=originRelativeUrl
+          class="{{#if cardIsSelected}}is-selected{{/if}}"
+          class="{{#if MultiSelection.isSelected _id}}is-checked{{/if}}")
+          if MultiSelection.isActive
+            .materialCheckBox.multi-selection-checkbox.js-toggle-multi-selection(
+              class="{{#if MultiSelection.isSelected _id}}is-checked{{/if}}")
+          +minicard(this)
+      if (showSpinner (idOrNull ../../_id))
+        +spinnerList
+      if canSeeAddCard
        +inlinedForm(autoclose=false position="bottom")
          +addCardForm(listId=_id position="bottom")
+        else
+          a.open-minicard-composer.js-card-composer.js-open-inlined-form(title="{{_ 'add-card-to-bottom-of-list'}}")
+            i.fa.fa-plus
+            | {{_ 'add-card'}}
+      +inlinedForm(autoclose=false position="bottom")
+        +addCardForm(listId=_id position="bottom")

 template(name="spinnerList")
  .sk-spinner.sk-spinner-list(
@@ -3,8 +3,15 @@ import { TAPi18n } from '/imports/i18n';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
 import { getSpinnerName, getSpinnerTemplate } from '/client/lib/spinner';
 import getSlug from 'limax';
+import Boards from '/models/boards';
+import Cards from '/models/cards';
+import Swimlanes from '/models/swimlanes';
+import { Filter } from '/client/lib/filter';
+import { MultiSelection } from '/client/lib/multiSelection';
+import { Utils } from '/client/lib/utils';
+import autosize from 'autosize';

-const subManager = new SubsManager();
+// SubsManager removed for Meteor 3 migration
 const InfiniteScrollIter = 10;

 Template.listBody.onCreated(function () {
@@ -59,7 +66,10 @@ Template.listBody.onCreated(function () {
  };

  this.idOrNull = (swimlaneId) => {
-    const data = Template.currentData();
+    const data = this.data;
+    if (!data) {
+      return undefined;
+    }
    if (
      Utils.boardView() === 'board-view-swimlanes' ||
      data.board().isTemplatesBoard()
@@ -88,12 +98,20 @@ Template.listBody.onCreated(function () {
    const labelIds = formComponent.labels.get();
    const customFields = formComponent.customFields.get();

-    const data = Template.currentData();
+    const data = this.data;
+    if (!data) {
+      return;
+    }
    const board = data.board();
    let linkedId = '';
    let swimlaneId = '';
    let cardType = 'cardType-card';
    if (title) {
+      // Clear the textarea immediately so the next card starts empty,
+      // before any async operations that would leave the old text visible.
+      textarea.val('').focus();
+      autosize.update(textarea);
+
      if (board.isTemplatesBoard()) {
        const swimlaneEl = this.$('.js-minicards').closest('.swimlane').get(0);
        swimlaneId = swimlaneEl && Blaze.getData(swimlaneEl)?._id; // Always swimlanes view
@@ -102,13 +120,15 @@ Template.listBody.onCreated(function () {
        if (swimlane.isCardTemplatesSwimlane()) cardType = 'template-card';
        // If this is the board templates swimlane, insert a board template and a linked card
        else if (swimlane.isBoardTemplatesSwimlane()) {
-          linkedId = Boards.insert({
+          linkedId = await Boards.insertAsync({
            title,
+            slug: getSlug(title) || 'board',
            permission: 'private',
            type: 'template-board',
          });
-          Swimlanes.insert({
-            title: TAPi18n.__('default'),
+          const defaultTitle = TAPi18n.__('default');
+          await Swimlanes.insertAsync({
+            title: typeof defaultTitle === 'string' ? defaultTitle : 'Default',
            boardId: linkedId,
          });
          cardType = 'cardType-linkedBoard';
@@ -121,8 +141,9 @@ Template.listBody.onCreated(function () {
        Utils.boardView() === 'board-view-lists' ||
        Utils.boardView() === 'board-view-cal' ||
        !Utils.boardView()
-      )
-      swimlaneId = board.getDefaultSwimline()._id;
+      ) {
+        swimlaneId = data.swimlaneId || board.getDefaultSwimline()._id;
+      }

      const nextCardNumber = await board.getNextCardNumber();

@@ -156,9 +177,7 @@ Template.listBody.onCreated(function () {
      // See https://github.com/wekan/wekan/issues/80
      Filter.addException(_id);

-      // We keep the form opened, empty it, and scroll to it.
-      textarea.val('').focus();
-      autosize.update(textarea);
+      // We keep the form opened and scroll to it.
      if (position === 'bottom') {
        this.scrollToBottom();
      }
@@ -173,6 +192,26 @@ Template.listBody.onCreated(function () {
    }
    const clickedTitle = $target.closest('.minicard-title').length > 0;
    const clickedLinkedReference = $target.closest('.js-linked-link').length > 0;
+    const clickedChecklist = $target.closest('.minicard-checklist').length > 0;
+
+    // When multi-selection is active (or Shift is held), a click anywhere on the
+    // minicard toggles its selection. This must be checked before the title and
+    // checklist handlers below, otherwise clicking a card's title (which covers
+    // most of the minicard) would open the card details instead of (de)selecting
+    // it, making it impossible to check some cards in multi-selection mode.
+    if (MultiSelection.isActive() || evt.shiftKey) {
+      evt.stopImmediatePropagation();
+      evt.preventDefault();
+      const methodName = evt.shiftKey ? 'toggleRange' : 'toggle';
+      MultiSelection[methodName](card._id);
+      return;
+    }
+
+    if (clickedChecklist) {
+      evt.preventDefault();
+      evt.stopPropagation();
+      return;
+    }

    // Title clicks should open the regular board card details view.
    if (clickedTitle && !clickedLinkedReference) {
@@ -188,16 +227,7 @@ Template.listBody.onCreated(function () {
      return;
    }

-    if (MultiSelection.isActive() || evt.shiftKey) {
-      evt.stopImmediatePropagation();
-      evt.preventDefault();
-      const methodName = evt.shiftKey ? 'toggleRange' : 'toggle';
-      MultiSelection[methodName](card._id);
-
-      // If the card is already selected, we want to de-select it.
-      // XXX We should probably modify the minicard href attribute instead of
-      // overwriting the event in case the card is already selected.
-    } else if (Utils.isMiniScreen()) {
+    if (Utils.isMiniScreen()) {
      evt.preventDefault();
      Session.set('popupCardId', card._id);
      this.cardDetailsPopup(evt);
@@ -218,9 +248,18 @@ Template.listBody.onCreated(function () {
  };

  this.toggleMultiSelection = (evt) => {
-    evt.stopPropagation();
+    evt.stopImmediatePropagation();
    evt.preventDefault();
-    MultiSelection.toggle(Template.currentData()._id);
+    // Resolve the card from the clicked checkbox element. Using
+    // Blaze.getData(evt.currentTarget) is reliable for the per-card data
+    // context, whereas Template.currentData() can resolve to the enclosing
+    // list context and toggle the wrong id (so the checkbox appears to do
+    // nothing). Falls back to Template.currentData() just in case.
+    const card =
+      Blaze.getData(evt.currentTarget) || Template.currentData();
+    if (card && card._id) {
+      MultiSelection.toggle(card._id);
+    }
  };

  this.cardDetailsPopup = (event) => {
@@ -290,7 +329,15 @@ Template.listBody.helpers({
      listId: Template.currentData()._id,
      archived: false,
    };
-    if (swimlaneId) selector.swimlaneId = swimlaneId;
+    if (swimlaneId) {
+      // Fallback: also show cards with no swimlaneId (null/empty) so that
+      // pre-migration / orphaned cards are always visible without a DB migration.
+      selector.$or = [
+        { swimlaneId },
+        { swimlaneId: null },  // null covers null AND missing field
+        { swimlaneId: '' },    // empty string from shared-lists era
+      ];
+    }
    const ret = ReactiveCache.getCards(Filter.mongoSelector(selector), {
      // sort: ['sort'],
      sort: sortBy,
@@ -550,11 +597,12 @@ Template.linkCardPopup.onCreated(function () {

  this.boardId = Session.get('currentBoard');
  // In order to get current board info
-  subManager.subscribe('board', this.boardId, false);
+  Meteor.subscribe('board', this.boardId, false);
  this.board = ReactiveCache.getBoard(this.boardId);
  // List where to insert card
  this.list = $(Popup._getTopStack().openerElement).closest('.js-list');
-  this.listId = Blaze.getData(this.list[0])._id;
+  const listData = Blaze.getData(this.list[0]);
+  this.listId = listData._id;
  // Swimlane where to insert card
  const swimlane = $(Popup._getTopStack().openerElement).closest(
    '.js-swimlane',
@@ -563,7 +611,7 @@ Template.linkCardPopup.onCreated(function () {
  if (Utils.boardView() === 'board-view-swimlanes')
    this.swimlaneId = Blaze.getData(swimlane[0])._id;
  else if (Utils.boardView() === 'board-view-lists' || !Utils.boardView)
-    this.swimlaneId = ReactiveCache.getSwimlane({ boardId: this.boardId })._id;
+    this.swimlaneId = listData.swimlaneId || ReactiveCache.getSwimlane({ boardId: this.boardId })._id;

  this.getSortIndex = () => {
    const position = Template.currentData().position;
@@ -680,7 +728,7 @@ Template.linkCardPopup.helpers({
 Template.linkCardPopup.events({
  'change .js-select-boards'(evt, tpl) {
    const val = $(evt.currentTarget).val();
-    subManager.subscribe('board', val, false);
+    Meteor.subscribe('board', val, false);
    // Clear selections to allow linking only board or re-choose swimlane/list
    tpl.selectedSwimlaneId.set('');
    tpl.selectedListId.set('');
@@ -768,7 +816,7 @@ Template.searchElementPopup.onCreated(function () {
  if (this.isTemplateSearch) {
    const boardId = (ReactiveCache.getCurrentUser().profile || {}).templatesBoardId;
    if (boardId) {
-      subManager.subscribe('board', boardId, false);
+      Meteor.subscribe('board', boardId, false);
      this.board = ReactiveCache.getBoard(boardId);
    }
  } else {
@@ -780,21 +828,22 @@ Template.searchElementPopup.onCreated(function () {
  }
  this.boardId = this.board._id;
  // Subscribe to this board
-  subManager.subscribe('board', this.boardId, false);
+  Meteor.subscribe('board', this.boardId, false);
  this.selectedBoardId = new ReactiveVar(this.boardId);
  this.list = $(Popup._getTopStack().openerElement).closest('.js-list');

-  if (!this.isBoardTemplateSearch) {
-    this.swimlaneId = '';
-    // Swimlane where to insert card
-    const swimlane = $(Popup._getTopStack().openerElement).parents(
-      '.js-swimlane',
-    );
-    if (Utils.boardView() === 'board-view-swimlanes')
-      this.swimlaneId = Blaze.getData(swimlane[0])._id;
-    else this.swimlaneId = ReactiveCache.getSwimlane({ boardId: this.boardId })._id;
-    // List where to insert card
-    this.listId = Blaze.getData(this.list[0])._id;
+    if (!this.isBoardTemplateSearch) {
+      this.swimlaneId = '';
+      // Swimlane where to insert card
+      const swimlane = $(Popup._getTopStack().openerElement).parents(
+        '.js-swimlane',
+      );
+      const listData = Blaze.getData(this.list[0]);
+      if (Utils.boardView() === 'board-view-swimlanes')
+        this.swimlaneId = Blaze.getData(swimlane[0])._id;
+      else this.swimlaneId = listData.swimlaneId || ReactiveCache.getSwimlane({ boardId: this.boardId })._id;
+      // List where to insert card
+      this.listId = listData._id;
  }
  this.term = new ReactiveVar('');

@@ -843,7 +892,7 @@ Template.searchElementPopup.helpers({
    } else if (tpl.isBoardTemplateSearch) {
      const boards = board.searchBoards(tpl.term.get());
      boards.forEach(board => {
-        subManager.subscribe('board', board.linkedId, false);
+        Meteor.subscribe('board', board.linkedId, false);
      });
      return boards;
    } else {
@@ -854,7 +903,7 @@ Template.searchElementPopup.helpers({

 Template.searchElementPopup.events({
  'change .js-select-boards'(evt, tpl) {
-    subManager.subscribe('board', $(evt.currentTarget).val(), false);
+    Meteor.subscribe('board', $(evt.currentTarget).val(), false);
    tpl.selectedBoardId.set($(evt.currentTarget).val());
  },
  'submit .js-search-term-form'(evt, tpl) {
@@ -909,7 +958,7 @@ Template.searchElementPopup.events({
        },
        (err, data) => {
          _id = data;
-          subManager.subscribe('board', _id, false);
+          Meteor.subscribe('board', _id, false);
          FlowRouter.go('board', {
            id: _id,
            slug: getSlug(element.title),
@@ -3,10 +3,14 @@ import Lists from '../../../models/lists';
 import { TAPi18n } from '/imports/i18n';
 import dragscroll from '@wekanteam/dragscroll';
 import { BoardSwimlaneListDialog } from '/client/lib/dialogWithBoardSwimlaneList';
+import Cards from '/models/cards';
+import { LIST_COLORS } from '/models/metadata/colors';
+import { MultiSelection } from '/client/lib/multiSelection';
+import { Utils } from '/client/lib/utils';

 let listsColors;
 Meteor.startup(() => {
-  listsColors = Lists.simpleSchema()._schema.color.allowedValues;
+  listsColors = LIST_COLORS;
 });

 Template.listHeader.helpers({
@@ -439,14 +443,39 @@ Template.setListColorPopup.helpers({

 Template.setListColorPopup.events({
  'click .js-palette-color'(event, tpl) {
-    tpl.currentColor.set(Template.currentData().color);
+    const paletteData = Blaze.getData(event.currentTarget);
+    tpl.currentColor.set(paletteData?.color);
+  },
+  async 'submit form'(event, tpl) {
+    event.preventDefault();
+    console.log('[ListColor] submit form, color:', tpl.currentColor.get(), 'listId:', tpl.currentList?._id, 'setColor type:', typeof tpl.currentList?.setColor);
+    try {
+      const result = await tpl.currentList.setColor(tpl.currentColor.get());
+      console.log('[ListColor] submit form setColor result:', result);
+    } catch (err) {
+      console.error('[ListColor] submit form setColor error:', err);
+    }
+    Popup.close();
  },
  async 'click .js-submit'(event, tpl) {
-    await tpl.currentList.setColor(tpl.currentColor.get());
+    event.preventDefault();
+    console.log('[ListColor] click submit, color:', tpl.currentColor.get(), 'listId:', tpl.currentList?._id, 'setColor type:', typeof tpl.currentList?.setColor);
+    try {
+      const result = await tpl.currentList.setColor(tpl.currentColor.get());
+      console.log('[ListColor] click submit setColor result:', result);
+    } catch (err) {
+      console.error('[ListColor] click submit setColor error:', err);
+    }
    Popup.close();
  },
  async 'click .js-remove-color'(event, tpl) {
-    await tpl.currentList.setColor(null);
+    event.preventDefault();
+    console.log('[ListColor] remove color, listId:', tpl.currentList?._id);
+    try {
+      await tpl.currentList.setColor(null);
+    } catch (err) {
+      console.error('[ListColor] remove color error:', err);
+    }
    Popup.close();
  },
 });
@@ -1,5 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
+import AccessibilitySettings from '/models/accessibilitySettings';

 // Shared helpers for both accessibility templates
 const accessibilityHelpers = {
@@ -1,3 +1,5 @@
+import Boards from '/models/boards';
+
 Template.bookmarks.helpers({
  hasStarredBoards() {
    const user = ReactiveCache.getCurrentUser();
@@ -1,5 +1,6 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
+import { Utils } from '/client/lib/utils';

 // const subManager = new SubsManager();

@@ -1,6 +1,9 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { findWhere } from '/imports/lib/collectionHelpers';
 import { TAPi18n } from '/imports/i18n';
+import Attachments from '/models/attachments';
+import { Utils } from '/client/lib/utils';
+import autosize from 'autosize';
 var converter = require('@wekanteam/html-to-markdown');

 const specialHandles = [
@@ -207,11 +210,11 @@ Template.editor.onRendered(function () {
                  const currentCard = Utils.getCurrentCard();
                  const MAX_IMAGE_PIXEL = Utils.MAX_IMAGE_PIXEL;
                  const COMPRESS_RATIO = Utils.IMAGE_COMPRESS_RATIO;
-                  const processUpload = function(file) {
-                    const uploader = Attachments.insert(
+                  const processUpload = async function(file) {
+                    const uploader = await Attachments.insertAsync(
                      {
                        file,
-                        meta: Utils.getCommonAttachmentMetaFrom(card),
+                        meta: Utils.getCommonAttachmentMetaFrom(currentCard),
                        chunkSize: 'dynamic',
                      },
                      false,
@@ -84,6 +84,21 @@
  margin-right: auto;
  margin-left: auto;
 }
+.js-new-search {
+  cursor: pointer;
+  transition: background-color 0.2s;
+}
+.board-color-belize.js-new-search {
+  background-color: #216694 !important;
+  color: #fff !important;
+  border: none !important;
+}
+.board-color-belize.js-new-search:hover {
+  background-color: #1a4d6a !important;
+}
+.board-color-belize.js-new-search:active {
+  background-color: #0d334d !important;
+}
 .global-search-operator {
  font-family: Courier;
 }
@@ -11,68 +11,47 @@ template(name="globalSearchModalTitle")
      | {{_ 'globalSearch-title'}}

 template(name="resultsPaged")
-  if resultsHeading.get
-    h1
-      = resultsHeading.get
-      a(title="{{_ 'link-to-search' }}" href="{{ getSearchHref }}")
-        | 🔗
-  each card in results.get
+  if resultsHeading
+    h1= resultsHeading
+  each card in results
    +resultCard(card)
  table.global-search-footer
    tr
      td.global-search-previous-page
-        if hasPreviousPage.get
+        if hasPreviousPage
          button.js-previous-page
            | {{_ 'previous-page' }}
      td.global-search-next-page(align="right")
-        if hasNextPage.get
+        if hasNextPage
          button.js-next-page
            | {{_ 'next-page' }}

 template(name="globalSearch")
  if currentUser
-    .wrapper
-      form.global-search-page.js-search-query-form
+    .wrapper(class=boardColorClass)
+      form.global-search-page.js-search-query-form(onsubmit="return false;")
        input.global-search-query-input(
-          style="{# if hasResults.get #}display: inline-block;{#/if#}"
+          style="display: inline-block;"
          id="global-search-input"
          type="text"
          name="searchQuery"
          placeholder="{{_ 'search-example'}}"
-          value="{{ query.get }}"
+          value="{{ queryValue }}"
          autofocus dir="auto"
        )
-        a.js-new-search
+        button.js-new-search.board-color-belize(type="button" style="background: #216694 !important; background-color: #216694 !important; color: #fff !important; border: none !important;")
          | 🧹
-      if debug.get.show
-        h1 Debug
-        if debug.get.showSelector
-          h2 Selector
-            button.js-copy-debug-selector
-              = 'Copy'
-          pre(
-            id="debug-selector"
-          )
-            = sessionData.selector
-        if debug.get.showProjection
-          h2 Projection
-            button.js-copy-debug-projection
-              = 'Copy'
-          pre(
-            id="debug-projection"
-          )
-            = sessionData.projection
-      if searching.get
+      if searching
        +spinner
-      else if hasResults.get
+      else if hasResults
        .global-search-results-list-wrapper
-          if hasQueryErrors.get
+          if hasQueryErrors
            ul
              each msg in errorMessages
                li.global-search-error-messages
                  = msg
-          +resultsPaged(this)
-      else if serverError.get
+          +resultsPaged getSearchData
+      else if serverError
        .global-search-page
          .global-search-help
            h1 {{_ 'server-error' }}
@@ -83,22 +62,22 @@ template(name="globalSearch")
          .global-search-help
            h2 {{_ 'boards' }}
            .lists-wrapper
-              each title in myBoardNames.get
+              each title in myBoardNames
                span.card-label.list-title.js-board-title
                  = title
            h2 {{_ 'lists' }}
            .lists-wrapper
-              each title in myLists.get
+              each title in myLists
                span.card-label.list-title.js-list-title
                  = title
            h2 {{_ 'label-colors' }}
            .palette-colors: each label in labelColors
              span.card-label.palette-color.js-label-color(class="card-label-{{label.color}}")
                = label.name
-            if myLabelNames.get.length
+            if myLabelNames
              h2 {{_ 'label-names' }}
              .lists-wrapper
-                each name in myLabelNames.get
+                each name in myLabelNames
                  span.card-label.list-title.js-label-name
                    = name
          .global-search-instructions
@@ -1,7 +1,8 @@
 import { TAPi18n } from '/imports/i18n';
 import { CardSearchPaged } from '../../lib/cardSearch';
-import Boards from '../../../models/boards';
+import { LABEL_COLORS } from '/models/metadata/colors';
 import { Query, QueryErrors } from '../../../config/query-classes';
+import { ReactiveCache } from '/imports/reactiveCache';

 // const subManager = new SubsManager();

@@ -98,36 +99,45 @@ Template.globalSearch.helpers({
    return Meteor.userId();
  },

-  // Return ReactiveVars so jade can use .get pattern
+  // Return ReactiveVar values so Blaze can use them
  searching() {
-    return Template.instance().search.searching;
+    const val = Template.instance().search.searching.get();
+    return val;
  },
  hasResults() {
-    return Template.instance().search.hasResults;
+    const val = Template.instance().search.hasResults.get();
+    return val;
  },
  hasQueryErrors() {
-    return Template.instance().search.hasQueryErrors;
+    const val = Template.instance().search.hasQueryErrors.get();
+    return val;
  },
  serverError() {
-    return Template.instance().search.serverError;
+    const val = Template.instance().search.serverError.get();
+    return val;
  },
  query() {
    return Template.instance().search.query;
  },
  debug() {
-    return Template.instance().search.debug;
+    const val = Template.instance().search.debug.get();
+    return val;
  },
  resultsHeading() {
-    return Template.instance().search.resultsHeading;
+    const rv = Template.instance().search.resultsHeading;
+    return rv ? rv.get() : '';
  },
  results() {
-    return Template.instance().search.results;
+    const rv = Template.instance().search.results;
+    return rv ? rv.get() : [];
  },
  hasNextPage() {
-    return Template.instance().search.hasNextPage;
+    const rv = Template.instance().search.hasNextPage;
+    return rv ? rv.get() : false;
  },
  hasPreviousPage() {
-    return Template.instance().search.hasPreviousPage;
+    const rv = Template.instance().search.hasPreviousPage;
+    return rv ? rv.get() : false;
  },
  sessionData() {
    return Template.instance().search.sessionData;
@@ -137,124 +147,170 @@ Template.globalSearch.helpers({
  },

  myLists() {
-    return Template.instance().myLists;
+    const rv = Template.instance().myLists;
+    return rv ? rv.get() : [];
  },
  myLabelNames() {
-    return Template.instance().myLabelNames;
+    const rv = Template.instance().myLabelNames;
+    return rv ? rv.get() : [];
  },
  myBoardNames() {
-    return Template.instance().myBoardNames;
+    const rv = Template.instance().myBoardNames;
+    return rv ? rv.get() : [];
  },

  errorMessages() {
    return errorMessages(Template.instance());
  },

-  searchInstructions() {
-    const tags = {
-      operator_board: TAPi18n.__('operator-board'),
-      operator_list: TAPi18n.__('operator-list'),
-      operator_swimlane: TAPi18n.__('operator-swimlane'),
-      operator_comment: TAPi18n.__('operator-comment'),
-      operator_label: TAPi18n.__('operator-label'),
-      operator_label_abbrev: TAPi18n.__('operator-label-abbrev'),
-      operator_user: TAPi18n.__('operator-user'),
-      operator_user_abbrev: TAPi18n.__('operator-user-abbrev'),
-      operator_member: TAPi18n.__('operator-member'),
-      operator_member_abbrev: TAPi18n.__('operator-member-abbrev'),
-      operator_assignee: TAPi18n.__('operator-assignee'),
-      operator_assignee_abbrev: TAPi18n.__('operator-assignee-abbrev'),
-      operator_creator: TAPi18n.__('operator-creator'),
-      operator_due: TAPi18n.__('operator-due'),
-      operator_created: TAPi18n.__('operator-created'),
-      operator_modified: TAPi18n.__('operator-modified'),
-      operator_status: TAPi18n.__('operator-status'),
-      operator_has: TAPi18n.__('operator-has'),
-      operator_sort: TAPi18n.__('operator-sort'),
-      operator_limit: TAPi18n.__('operator-limit'),
-      operator_debug: TAPi18n.__('operator-debug'),
-      operator_org: TAPi18n.__('operator-org'),
-      operator_team: TAPi18n.__('operator-team'),
-      predicate_overdue: TAPi18n.__('predicate-overdue'),
-      predicate_archived: TAPi18n.__('predicate-archived'),
-      predicate_all: TAPi18n.__('predicate-all'),
-      predicate_ended: TAPi18n.__('predicate-ended'),
-      predicate_week: TAPi18n.__('predicate-week'),
-      predicate_month: TAPi18n.__('predicate-month'),
-      predicate_quarter: TAPi18n.__('predicate-quarter'),
-      predicate_year: TAPi18n.__('predicate-year'),
-      predicate_attachment: TAPi18n.__('predicate-attachment'),
-      predicate_description: TAPi18n.__('predicate-description'),
-      predicate_checklist: TAPi18n.__('predicate-checklist'),
-      predicate_public: TAPi18n.__('predicate-public'),
-      predicate_private: TAPi18n.__('predicate-private'),
-      predicate_due: TAPi18n.__('predicate-due'),
-      predicate_created: TAPi18n.__('predicate-created'),
-      predicate_modified: TAPi18n.__('predicate-modified'),
-      predicate_start: TAPi18n.__('predicate-start'),
-      predicate_end: TAPi18n.__('predicate-end'),
-      predicate_assignee: TAPi18n.__('predicate-assignee'),
-      predicate_member: TAPi18n.__('predicate-member'),
-      predicate_selector: TAPi18n.__('predicate-selector'),
-      predicate_projection: TAPi18n.__('predicate-projection'),
-    };
+  getSearchData() {
+    return Template.instance().search;
+  },

-    let text = '';
-    [
-      ['# ', 'globalSearch-instructions-heading'],
-      ['\n', 'globalSearch-instructions-description'],
-      ['\n\n', 'globalSearch-instructions-operators'],
-      ['\n- ', 'globalSearch-instructions-operator-board'],
-      ['\n- ', 'globalSearch-instructions-operator-list'],
-      ['\n- ', 'globalSearch-instructions-operator-swimlane'],
-      ['\n- ', 'globalSearch-instructions-operator-comment'],
-      ['\n- ', 'globalSearch-instructions-operator-label'],
-      ['\n- ', 'globalSearch-instructions-operator-hash'],
-      ['\n- ', 'globalSearch-instructions-operator-user'],
-      ['\n- ', 'globalSearch-instructions-operator-at'],
-      ['\n- ', 'globalSearch-instructions-operator-member'],
-      ['\n- ', 'globalSearch-instructions-operator-assignee'],
-      ['\n- ', 'globalSearch-instructions-operator-creator'],
-      ['\n- ', 'globalSearch-instructions-operator-org'],
-      ['\n- ', 'globalSearch-instructions-operator-team'],
-      ['\n- ', 'globalSearch-instructions-operator-due'],
-      ['\n- ', 'globalSearch-instructions-operator-created'],
-      ['\n- ', 'globalSearch-instructions-operator-modified'],
-      ['\n- ', 'globalSearch-instructions-operator-status'],
-      ['\n    - ', 'globalSearch-instructions-status-archived'],
-      ['\n    - ', 'globalSearch-instructions-status-public'],
-      ['\n    - ', 'globalSearch-instructions-status-private'],
-      ['\n    - ', 'globalSearch-instructions-status-all'],
-      ['\n    - ', 'globalSearch-instructions-status-ended'],
-      ['\n- ', 'globalSearch-instructions-operator-has'],
-      ['\n- ', 'globalSearch-instructions-operator-sort'],
-      ['\n- ', 'globalSearch-instructions-operator-limit'],
-      ['\n## ', 'heading-notes'],
-      ['\n- ', 'globalSearch-instructions-notes-1'],
-      ['\n- ', 'globalSearch-instructions-notes-2'],
-      ['\n- ', 'globalSearch-instructions-notes-3'],
-      ['\n- ', 'globalSearch-instructions-notes-3-2'],
-      ['\n- ', 'globalSearch-instructions-notes-4'],
-      ['\n- ', 'globalSearch-instructions-notes-5'],
-    ].forEach(([prefix, instruction]) => {
-      text += `${prefix}${TAPi18n.__(instruction, tags)}`
-      // Replace *<text>* with `<text>` so markdown shows correctly
-      .replace(/\*\</, '`<')
-      .replace(/\>\*/, '\>\`')
-    });
-    return text;
+  boardColorClass() {
+    const boardId = Session.get('currentBoard');
+    const board = boardId ? ReactiveCache.getBoard(boardId) : null;
+    return board ? board.colorClass() : 'board-color-belize';
+  },
+
+  searchInstructions() {
+    try {
+      const tags = {
+        operator_board: TAPi18n.__('operator-board'),
+        operator_list: TAPi18n.__('operator-list'),
+        operator_swimlane: TAPi18n.__('operator-swimlane'),
+        operator_comment: TAPi18n.__('operator-comment'),
+        operator_label: TAPi18n.__('operator-label'),
+        operator_label_abbrev: TAPi18n.__('operator-label-abbrev'),
+        operator_user: TAPi18n.__('operator-user'),
+        operator_user_abbrev: TAPi18n.__('operator-user-abbrev'),
+        operator_member: TAPi18n.__('operator-member'),
+        operator_member_abbrev: TAPi18n.__('operator-member-abbrev'),
+        operator_assignee: TAPi18n.__('operator-assignee'),
+        operator_assignee_abbrev: TAPi18n.__('operator-assignee-abbrev'),
+        operator_creator: TAPi18n.__('operator-creator'),
+        operator_due: TAPi18n.__('operator-due'),
+        operator_created: TAPi18n.__('operator-created'),
+        operator_modified: TAPi18n.__('operator-modified'),
+        operator_status: TAPi18n.__('operator-status'),
+        operator_has: TAPi18n.__('operator-has'),
+        operator_sort: TAPi18n.__('operator-sort'),
+        operator_limit: TAPi18n.__('operator-limit'),
+        operator_debug: TAPi18n.__('operator-debug'),
+        operator_org: TAPi18n.__('operator-org'),
+        operator_team: TAPi18n.__('operator-team'),
+        predicate_overdue: TAPi18n.__('predicate-overdue'),
+        predicate_archived: TAPi18n.__('predicate-archived'),
+        predicate_all: TAPi18n.__('predicate-all'),
+        predicate_ended: TAPi18n.__('predicate-ended'),
+        predicate_week: TAPi18n.__('predicate-week'),
+        predicate_month: TAPi18n.__('predicate-month'),
+        predicate_quarter: TAPi18n.__('predicate-quarter'),
+        predicate_year: TAPi18n.__('predicate-year'),
+        predicate_attachment: TAPi18n.__('predicate-attachment'),
+        predicate_description: TAPi18n.__('predicate-description'),
+        predicate_checklist: TAPi18n.__('predicate-checklist'),
+        predicate_public: TAPi18n.__('predicate-public'),
+        predicate_private: TAPi18n.__('predicate-private'),
+        predicate_due: TAPi18n.__('predicate-due'),
+        predicate_created: TAPi18n.__('predicate-created'),
+        predicate_modified: TAPi18n.__('predicate-modified'),
+        predicate_start: TAPi18n.__('predicate-start'),
+        predicate_end: TAPi18n.__('predicate-end'),
+        predicate_assignee: TAPi18n.__('predicate-assignee'),
+        predicate_member: TAPi18n.__('predicate-member'),
+        predicate_selector: TAPi18n.__('predicate-selector'),
+        predicate_projection: TAPi18n.__('predicate-projection'),
+      };
+
+      let text = '';
+      [
+        ['# ', 'globalSearch-instructions-heading'],
+        ['\n', 'globalSearch-instructions-description'],
+        ['\n\n', 'globalSearch-instructions-operators'],
+        ['\n- ', 'globalSearch-instructions-operator-board'],
+        ['\n- ', 'globalSearch-instructions-operator-list'],
+        ['\n- ', 'globalSearch-instructions-operator-swimlane'],
+        ['\n- ', 'globalSearch-instructions-operator-comment'],
+        ['\n- ', 'globalSearch-instructions-operator-label'],
+        ['\n- ', 'globalSearch-instructions-operator-hash'],
+        ['\n- ', 'globalSearch-instructions-operator-user'],
+        ['\n- ', 'globalSearch-instructions-operator-at'],
+        ['\n- ', 'globalSearch-instructions-operator-member'],
+        ['\n- ', 'globalSearch-instructions-operator-assignee'],
+        ['\n- ', 'globalSearch-instructions-operator-creator'],
+        ['\n- ', 'globalSearch-instructions-operator-org'],
+        ['\n- ', 'globalSearch-instructions-operator-team'],
+        ['\n- ', 'globalSearch-instructions-operator-due'],
+        ['\n- ', 'globalSearch-instructions-operator-created'],
+        ['\n- ', 'globalSearch-instructions-operator-modified'],
+        ['\n- ', 'globalSearch-instructions-operator-status'],
+        ['\n    - ', 'globalSearch-instructions-status-archived'],
+        ['\n    - ', 'globalSearch-instructions-status-public'],
+        ['\n    - ', 'globalSearch-instructions-status-private'],
+        ['\n    - ', 'globalSearch-instructions-status-all'],
+        ['\n    - ', 'globalSearch-instructions-status-ended'],
+        ['\n- ', 'globalSearch-instructions-operator-has'],
+        ['\n- ', 'globalSearch-instructions-operator-sort'],
+        ['\n- ', 'globalSearch-instructions-operator-limit'],
+        ['\n## ', 'heading-notes'],
+        ['\n- ', 'globalSearch-instructions-notes-1'],
+        ['\n- ', 'globalSearch-instructions-notes-2'],
+        ['\n- ', 'globalSearch-instructions-notes-3'],
+        ['\n- ', 'globalSearch-instructions-notes-3-2'],
+        ['\n- ', 'globalSearch-instructions-notes-4'],
+        ['\n- ', 'globalSearch-instructions-notes-5'],
+      ].forEach(([prefix, instruction]) => {
+        text += `${prefix}${TAPi18n.__(instruction, tags)}`
+          // Replace *<text>* with `<text>` so markdown shows correctly
+          .replace(/\*\</, '`<')
+          .replace(/\>\*/, '\>\`');
+      });
+      return text;
+    } catch (e) {
+      console.error('Error building searchInstructions:', e);
+      return '';
+    }
  },

  labelColors() {
-    return Boards.simpleSchema()._schema['labels.$.color'].allowedValues.map(
-      color => {
-        return { color, name: TAPi18n.__(`color-${color}`) };
-      },
-    );
+    try {
+      if (!LABEL_COLORS) return [];
+      return LABEL_COLORS.map(
+        color => {
+          return { color, name: TAPi18n.__(`color-${color}`) };
+        },
+      );
+    } catch (e) {
+      console.error('Error building labelColors:', e);
+      return [];
+    }
  },
 });

 Template.globalSearch.events({
+  'click input.global-search-query-input'(evt) {
+    evt.preventDefault();
+    evt.stopPropagation();
+  },
+  'focus input.global-search-query-input'(evt) {
+    evt.preventDefault();
+    evt.stopPropagation();
+  },
+  'keyup input.global-search-query-input'(evt, tpl) {
+    evt.preventDefault();
+    evt.stopPropagation();
+    // Store the query value
+    tpl.search.query.set(evt.target.value);
+  },
+  'keydown input.global-search-query-input'(evt, tpl) {
+    // Allow normal key behavior but capture Enter key
+    if (evt.key === 'Enter') {
+      evt.preventDefault();
+      evt.stopPropagation();
+      searchAllBoards(tpl, evt.target.value);
+    }
+  },
  'submit .js-search-query-form'(evt, tpl) {
    evt.preventDefault();
    searchAllBoards(tpl, evt.target.searchQuery.value);
@@ -269,30 +325,6 @@ Template.globalSearch.events({
    );
    document.getElementById('global-search-input').focus();
  },
-  'click .js-copy-debug-selector'(evt) {
-    /* Get the text field */
-    const selector = document.getElementById("debug-selector");
-
-    try {
-      navigator.clipboard.writeText(selector.textContent);
-      alert("Selector copied to clipboard");
-    } catch(err) {
-      alert("Error copying text: " + err);
-    }
-
-  },
-  'click .js-copy-debug-projection'(evt) {
-    /* Get the text field */
-    const projection = document.getElementById("debug-projection");
-
-    try {
-      navigator.clipboard.writeText(projection.textContent);
-      alert("Projection copied to clipboard");
-    } catch(err) {
-      alert("Error copying text: " + err);
-    }
-
-  },
  'click .js-board-title'(evt, tpl) {
    evt.preventDefault();
    const input = document.getElementById('global-search-input');
@@ -340,47 +372,46 @@ Template.globalSearch.events({
  },
 });

-// resultsPaged template helpers - this template is used by globalSearch, brokenCards, and brokenCardsReport.
-// It receives the parent's data context (which includes reactive vars) via +resultsPaged(this).
-// The jade accesses resultsHeading.get, results.get, getSearchHref, hasPreviousPage.get, hasNextPage.get
-// directly on the data context, so we don't need helpers for those when the parent passes
-// the right data context. However, we need to ensure the helpers exist for the template.
+// resultsPaged template helpers - receives search data context from parent template.
 Template.resultsPaged.helpers({
  resultsHeading() {
    const data = Template.currentData();
-    if (data && data.resultsHeading) return data.resultsHeading;
-    // fallback: check parent template
-    const parentTpl = Template.instance().view.parentView.templateInstance && Template.instance().view.parentView.templateInstance();
-    if (parentTpl && parentTpl.search) return parentTpl.search.resultsHeading;
-    return new ReactiveVar('');
+    if (data && data.resultsHeading) {
+      const rv = data.resultsHeading;
+      return rv && typeof rv.get === 'function' ? rv.get() : rv;
+    }
+    return '';
  },
  results() {
    const data = Template.currentData();
-    if (data && data.results) return data.results;
-    const parentTpl = Template.instance().view.parentView.templateInstance && Template.instance().view.parentView.templateInstance();
-    if (parentTpl && parentTpl.search) return parentTpl.search.results;
-    return new ReactiveVar([]);
+    if (data && data.results) {
+      const rv = data.results;
+      return rv && typeof rv.get === 'function' ? rv.get() : rv;
+    }
+    return [];
  },
  getSearchHref() {
    const data = Template.currentData();
-    if (data && data.getSearchHref) return data.getSearchHref();
-    const parentTpl = Template.instance().view.parentView.templateInstance && Template.instance().view.parentView.templateInstance();
-    if (parentTpl && parentTpl.search) return parentTpl.search.getSearchHref();
+    if (data && typeof data.getSearchHref === 'function') {
+      return data.getSearchHref();
+    }
    return '';
  },
  hasPreviousPage() {
    const data = Template.currentData();
-    if (data && data.hasPreviousPage) return data.hasPreviousPage;
-    const parentTpl = Template.instance().view.parentView.templateInstance && Template.instance().view.parentView.templateInstance();
-    if (parentTpl && parentTpl.search) return parentTpl.search.hasPreviousPage;
-    return new ReactiveVar(false);
+    if (data && data.hasPreviousPage) {
+      const rv = data.hasPreviousPage;
+      return rv && typeof rv.get === 'function' ? rv.get() : rv;
+    }
+    return false;
  },
  hasNextPage() {
    const data = Template.currentData();
-    if (data && data.hasNextPage) return data.hasNextPage;
-    const parentTpl = Template.instance().view.parentView.templateInstance && Template.instance().view.parentView.templateInstance();
-    if (parentTpl && parentTpl.search) return parentTpl.search.hasNextPage;
-    return new ReactiveVar(false);
+    if (data && data.hasNextPage) {
+      const rv = data.hasNextPage;
+      return rv && typeof rv.get === 'function' ? rv.get() : rv;
+    }
+    return false;
  },
 });

@@ -104,6 +104,26 @@
  height: 24px;
  float: left;
 }
+
+/* On non-board pages (All Boards / home, public, my cards, …) the second bar
+   holds only a title (e.g. "My Boards"). The fixed 40px bar height plus the
+   floated h1 with a 1.7em line-height clipped the bottom of the text on iOS
+   Safari. Vertically center the title in a bar that can grow so it is never
+   cut off. Scoped to non-board-view so the board header (floated buttons) is
+   untouched. */
+body:not(.board-view) #header #header-main-bar {
+  display: flex;
+  align-items: center;
+  height: auto;
+  min-height: 40px;
+  padding-top: 0;
+  padding-bottom: 0;
+}
+body:not(.board-view) #header #header-main-bar h1 {
+  float: none;
+  line-height: 1.3;
+}
+
 #header-quick-access {
  color: #fff;
  transition: background-color 0.4s;
@@ -157,6 +177,10 @@
 #header-quick-access i.fa:hover {
  color: #ccc;
 }
+/* Drag-handle toggle icons 30% smaller than the other quick-access icons. */
+#header-quick-access .js-toggle-desktop-drag-handles .fa {
+  font-size: 0.7em;
+}
 #header-quick-access #header-user-bar,
 #header-quick-access #header-new-board-icon,
 #header-quick-access ul li {
@@ -177,24 +201,25 @@
 }
 #header-quick-access ul.header-quick-access-list {
  transition: opacity 0.2s;
-  overflow: hidden;
  white-space: nowrap;
  padding: 10px;
-  margin: -10px;
+  margin: 10px;
  flex: 1; /* Take up available space */
  min-width: 0; /* Allow shrinking below content size */
  display: flex; /* Use flexbox for better control */
  align-items: center;
+  overflow-x: auto;
+  scrollbar-color: white #2573a7;
 }

 /* Hide scrollbar completely */
 #header-quick-access ul.header-quick-access-list::-webkit-scrollbar {
-  display: none;
+  display: flex;
 }

 #header-quick-access ul.header-quick-access-list {
-  -ms-overflow-style: none; /* IE and Edge */
-  scrollbar-width: none; /* Firefox */
+  -ms-overflow-style: thin; /* IE and Edge */
+  scrollbar-width: thin; /* Firefox */
 }
 #header-quick-access ul.header-quick-access-list li {
  display: inline-block; /* Keep inline-block for proper spacing */
@@ -1154,9 +1179,76 @@
    display: none;
  }
  #header-quick-access #header-user-bar {
-    right: 0px;
+    right: auto;
    padding: 10px;
-    margin: -8px 0 -10px -10px;
+    margin: 0 0.5rem;
+  }
+
+  /* ---- Small-screen quick-access bar (ALL browsers, width-based) ----
+     These rules use width-based selectors (not the .iphone-device class) so
+     they apply to every browser at small width — Fairphone/Android, narrow
+     desktop and iPhone alike. Keep every item visible: let the bar wrap and
+     grow instead of pinning its height and clipping the overflow. */
+  #header-quick-access {
+    height: auto !important;
+    min-height: 28px !important;
+    overflow: visible !important;
+    flex-wrap: wrap !important;
+    align-items: center !important;
+    row-gap: 4px !important;
+  }
+  /* The All Boards page scales this bar up to 2em-3em for every browser, which
+     is too big. Tame it to a moderate size so ~7 items fit in two wrapped rows.
+     (.iphone-device variants also cover the board view on detected iPhones.) */
+  body:not(.board-view) #header-quick-access,
+  .wrapper ~ #header-quick-access,
+  .iphone-device #header-quick-access,
+  .iphone-device .wrapper ~ #header-quick-access,
+  .iphone-device body:not(.board-view) #header-quick-access {
+    font-size: 1.2em !important;
+  }
+  body:not(.board-view) #header-quick-access .fa,
+  body:not(.board-view) #header-quick-access .icon,
+  .wrapper ~ #header-quick-access .fa,
+  .wrapper ~ #header-quick-access .icon,
+  .iphone-device #header-quick-access .fa,
+  .iphone-device #header-quick-access .icon,
+  .iphone-device .wrapper ~ #header-quick-access .fa,
+  .iphone-device .wrapper ~ #header-quick-access .icon,
+  .iphone-device body:not(.board-view) #header-quick-access .fa,
+  .iphone-device body:not(.board-view) #header-quick-access .icon {
+    font-size: 1.5em !important;
+  }
+  /* Zoom (100%), drag-handle toggle and mobile/desktop toggle 30% smaller than
+     the other quick-access controls at small width — for all browsers. */
+  body:not(.board-view) #header-quick-access .js-toggle-desktop-drag-handles .fa,
+  body:not(.board-view) #header-quick-access .mobile-mode-toggle .fa,
+  .wrapper ~ #header-quick-access .js-toggle-desktop-drag-handles .fa,
+  .wrapper ~ #header-quick-access .mobile-mode-toggle .fa,
+  .iphone-device #header-quick-access .js-toggle-desktop-drag-handles .fa,
+  .iphone-device #header-quick-access .mobile-mode-toggle .fa,
+  .iphone-device .wrapper ~ #header-quick-access .js-toggle-desktop-drag-handles .fa,
+  .iphone-device .wrapper ~ #header-quick-access .mobile-mode-toggle .fa,
+  .iphone-device body:not(.board-view) #header-quick-access .js-toggle-desktop-drag-handles .fa,
+  .iphone-device body:not(.board-view) #header-quick-access .mobile-mode-toggle .fa {
+    font-size: 1.05em !important; /* ~30% smaller than the 1.5em icons */
+  }
+  body:not(.board-view) #header-quick-access .zoom-controls,
+  body:not(.board-view) #header-quick-access .zoom-controls .zoom-level,
+  body:not(.board-view) #header-quick-access .zoom-controls .zoom-input,
+  .wrapper ~ #header-quick-access .zoom-controls,
+  .wrapper ~ #header-quick-access .zoom-controls .zoom-level,
+  .wrapper ~ #header-quick-access .zoom-controls .zoom-input,
+  .iphone-device #header-quick-access .zoom-controls,
+  .iphone-device #header-quick-access .zoom-controls .zoom-level,
+  .iphone-device #header-quick-access .zoom-controls .zoom-input,
+  .iphone-device .wrapper ~ #header-quick-access .zoom-controls,
+  .iphone-device .wrapper ~ #header-quick-access .zoom-controls .zoom-level,
+  .iphone-device .wrapper ~ #header-quick-access .zoom-controls .zoom-input,
+  .iphone-device body:not(.board-view) #header-quick-access .zoom-controls,
+  .iphone-device body:not(.board-view) #header-quick-access .zoom-controls .zoom-level,
+  .iphone-device body:not(.board-view) #header-quick-access .zoom-controls .zoom-input {
+    font-size: 0.7em !important; /* ~30% smaller than surrounding text */
  }
 }
@media print {
@@ -68,12 +68,8 @@ template(name="header")
                +viewer
                  = title
          else
-            li.current.empty(title="{{_ 'quick-access-description'}}")
+            li.current(title="{{_ 'quick-access-description'}}")
            | {{_ 'quick-access-description'}}
-        #header-new-board-icon
-      // Next line is used only for spacing at header,
-      // there is no visible clickable icon.
-      #header-new-board-icon
      //
        Hide duplicate create board button,
      //
@@ -126,5 +122,9 @@ template(name="offlineWarning")
    p
      i.fa.fa-warning
      | {{_ 'app-is-offline'}}
-
-      a.app-try-reconnect {{_ 'app-try-reconnect'}}
+      if appOfflineMessage
+        br
+        span= appOfflineMessage
+      if canReconnectNow
+        br
+        a.app-try-reconnect {{_ 'app-try-reconnect'}}
@@ -1,5 +1,9 @@
+import { Meteor } from 'meteor/meteor';
+import { Session } from 'meteor/session';
 import { ReactiveCache } from '/imports/reactiveCache';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import Announcements from '/models/announcements';
+import { Utils } from '/client/lib/utils';

 Meteor.subscribe('user-admin');
 Meteor.subscribe('boards');
@@ -43,7 +47,27 @@ Template.header.helpers({
  },

  appIsOffline() {
-    return !Meteor.status().connected;
+    const status = Meteor.status();
+    return ['waiting', 'failed', 'offline'].includes(status.status);
+  },
+
+  appOfflineMessage() {
+    const status = Meteor.status();
+
+    if (status.status === 'failed' && status.reason) {
+      return status.reason;
+    }
+
+    if (status.status === 'offline') {
+      return 'Connection is paused.';
+    }
+
+    return null;
+  },
+
+  canReconnectNow() {
+    const status = Meteor.status();
+    return ['waiting', 'failed', 'offline'].includes(status.status);
  },

  hasAnnouncement() {
@@ -132,7 +156,7 @@ Template.header.events({
    Session.set('currentCard', null);
  },
  'click .js-toggle-desktop-drag-handles'() {
-    currentUser = Meteor.user();
+    const currentUser = Meteor.user();
    if (currentUser) {
      Meteor.call('toggleDesktopDragHandles');
    } else if (window.localStorage.getItem('showDesktopDragHandles')) {
@@ -593,12 +593,20 @@ a:not(.disabled).is-active i.fa {
  }

  #header-quick-access {
-    /* Keep quick-access items in one row */
    display: flex;
    flex-direction: row;
    align-items: center;
    gap: 8px;
    width: 100%;
+    /* On narrow screens (e.g. iPhone 12 mini, 375px) the icon buttons cannot
+       shrink below their min-width, so a single nowrap row overflows and the
+       base rule's overflow:hidden clips the right-side items (mobile/desktop
+       toggle, notifications, member/user menu). Allow wrapping to a second row
+       and let the bar grow so nothing is ever hidden. */
+    flex-wrap: wrap;
+    overflow: visible;
+    height: auto;
+    min-height: 28px;
  }

  /* Hide elements that should move to the hamburger menu on mobile */
@@ -607,20 +615,18 @@ a:not(.disabled).is-active i.fa {
    display: none !important;
  }

-  /* Show only the home icon (hide the trailing text) on mobile */
+  /* Show the home link with its full "All Boards" text on mobile. The label is
+     a bare text node (not a span), so the old max-width:28px + overflow:hidden
+     clip revealed only "A"; removing it shows the whole label. The bar wraps,
+     so the extra width is fine. */
  #header-quick-access .home-icon a {
    display: inline-flex;
    align-items: center;
-    max-width: 28px; /* enough to display the icon */
-    overflow: hidden;
+    max-width: none;
+    overflow: visible;
    white-space: nowrap;
  }

-  /* Hide text in home icon on mobile, show only icon */
-  #header-quick-access .home-icon a span:not(.fa) {
-    display: none !important;
-  }
-
  /* Ensure proper spacing for mobile header elements */
  #header-quick-access .zoom-controls {
    margin-left: auto;
@@ -673,22 +679,18 @@ a:not(.disabled).is-active i.fa {
    -webkit-overflow-scrolling: touch;
  }

-  /* Admin panel mobile optimization */
+  /* Admin panel mobile optimization.
+     Keep the side-by-side (row) layout from settingBody.css even on narrow
+     screens — do NOT switch to a stacked column layout, which left the menu
+     only 32vw wide with empty space beside it and pushed the content off
+     screen. The side menu keeps a fixed basis and the main body fills the
+     rest, so both stay visible. */
  .setting-content .content-body {
-    flex-direction: column;
-    gap: 16px;
+    gap: 8px;
    padding: 8px;
  }

-  .setting-content .content-body .side-menu {
-    width: 100%;
-    order: 2;
-  }
-
  .setting-content .content-body .main-body {
-    order: 1;
-    min-height: 60vh;
-    overflow-x: auto;
    -webkit-overflow-scrolling: touch;
  }
 }
@@ -1,6 +1,8 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
 import { FlowRouter } from 'meteor/ostrio:flow-router-extra';
+import Users from '/models/users';
+import { EscapeActions } from '/client/lib/escapeActions';

 let alreadyCheck = 1;
 let isCheckDone = false;
@@ -1,4 +1,5 @@
 import { CardSearchPaged } from '../../lib/cardSearch';
+import { Utils } from '/client/lib/utils';

 Template.myCardsHeaderBar.helpers({
  myCardsSort() {
@@ -3,7 +3,7 @@
  border-radius: 0.4vw;
  border: 1px solid #dbdbdb;
  border-bottom-color: #c2c2c2;
-  box-shadow: 0 0.2vh 0.8vh rgba(0,0,0,0.3);
+  box-shadow: 0 0.2vh 0.8vh rgba(0, 0, 0, 0.3);
  position: absolute;
  /* Wider default to fit full color palette */
  width: min(380px, 55vw);
@@ -15,10 +15,10 @@
 }
 .pop-over p,
 .pop-over textarea,
-.pop-over input[type="text"],
-.pop-over input[type="email"],
-.pop-over input[type="password"],
-.pop-over input[type="file"] {
+.pop-over input[type='text'],
+.pop-over input[type='email'],
+.pop-over input[type='password'],
+.pop-over input[type='file'] {
  width: 100%;
 }
 .pop-over select {
@@ -78,9 +78,32 @@
  overflow-x: hidden;
 }

-/* Allow dynamic max-height to override default constraint */
-.pop-over[style*="max-height"] .content-wrapper {
-  max-height: inherit;
+/* Bounded height: flex column + clip so inline max-height cannot spill past the shell.
+   Class pop-over--bounded matches popup.tpl.jade when max-height is set (more reliable
+   than attribute substring matching on the style attribute alone). */
+.pop-over.pop-over--bounded,
+.pop-over[style*='max-height'] {
+  overflow: hidden;
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+  box-sizing: border-box;
+}
+
+.pop-over.pop-over--bounded .header,
+.pop-over[style*='max-height'] .header {
+  flex: 0 0 auto;
+}
+
+.pop-over.pop-over--bounded .content-wrapper,
+.pop-over[style*='max-height'] .content-wrapper {
+  /* 0% basis: use remaining space under header, scroll inside (not past white bg) */
+  flex: 1 1 0%;
+  min-height: 0;
+  max-height: none;
+  overflow-y: auto;
+  overflow-x: hidden;
+  background: inherit;
 }
 .pop-over .content-container {
  width: 100%;
@@ -89,17 +112,18 @@
 }

 /* Allow dynamic max-height to override default constraint for content-container */
-.pop-over[style*="max-height"] .content-container {
-  max-height: inherit;
+.pop-over.pop-over--bounded .content-container,
+.pop-over[style*='max-height'] .content-container {
+  max-height: none;
 }

 /* Fix overflow in the Member Settings (member menu) popup:
   the popup itself gets a max-height inline style, but the header consumes space.
   Make the header overlay the scrollable area so the list can't spill out. */
-.pop-over[data-popup="memberMenuPopup"] {
+.pop-over[data-popup='memberMenuPopup'] {
  overflow: hidden;
 }
-.pop-over[data-popup="memberMenuPopup"] > .header {
+.pop-over[data-popup='memberMenuPopup'] > .header {
  position: absolute;
  top: 0;
  left: 0;
@@ -107,30 +131,30 @@
  margin-bottom: 0;
  z-index: 1;
 }
-.pop-over[data-popup="memberMenuPopup"] > .content-wrapper {
+.pop-over[data-popup='memberMenuPopup'] > .content-wrapper {
  padding-top: calc(4.5vh + 1vh);
  box-sizing: border-box;
 }

 /* Admin edit popups: use full height */
-.pop-over[data-popup="editUserPopup"],
-.pop-over[data-popup="editOrgPopup"],
-.pop-over[data-popup="editTeamPopup"] {
+.pop-over[data-popup='editUserPopup'],
+.pop-over[data-popup='editOrgPopup'],
+.pop-over[data-popup='editTeamPopup'] {
  height: calc(100vh - 20px) !important;
  max-height: calc(100vh - 20px) !important;
 }

-.pop-over[data-popup="editUserPopup"] .content-wrapper,
-.pop-over[data-popup="editOrgPopup"] .content-wrapper,
-.pop-over[data-popup="editTeamPopup"] .content-wrapper {
+.pop-over[data-popup='editUserPopup'] .content-wrapper,
+.pop-over[data-popup='editOrgPopup'] .content-wrapper,
+.pop-over[data-popup='editTeamPopup'] .content-wrapper {
  max-height: calc(100vh - 80px) !important; /* Subtract header height */
  height: calc(100vh - 80px) !important;
  overflow-y: auto !important;
 }

-.pop-over[data-popup="editUserPopup"] .content-container,
-.pop-over[data-popup="editOrgPopup"] .content-container,
-.pop-over[data-popup="editTeamPopup"] .content-container {
+.pop-over[data-popup='editUserPopup'] .content-container,
+.pop-over[data-popup='editOrgPopup'] .content-container,
+.pop-over[data-popup='editTeamPopup'] .content-container {
  max-height: calc(100vh - 80px) !important; /* Subtract header height */
  height: calc(100vh - 80px) !important;
 }
@@ -142,7 +166,7 @@
 }

 /* Specific styling for language popup list */
-.pop-over[data-popup="changeLanguagePopup"] .pop-over-list {
+.pop-over[data-popup='changeLanguagePopup'] .pop-over-list {
  max-height: none;
  overflow: visible;
  height: auto;
@@ -150,7 +174,7 @@
 }

 /* Ensure content div in language popup contains all items */
-.pop-over[data-popup="changeLanguagePopup"] .content {
+.pop-over[data-popup='changeLanguagePopup'] .content {
  height: auto;
  /* Remove forced min-height to avoid top gap */
  display: flex;
@@ -158,7 +182,7 @@
 }

 /* Ensure hidden stack pages truly take no space */
-.pop-over[data-popup="changeLanguagePopup"] .content.no-height {
+.pop-over[data-popup='changeLanguagePopup'] .content.no-height {
  min-height: 0 !important;
  height: 0 !important;
  padding: 0 !important;
@@ -167,7 +191,7 @@
 }

 /* Make language popup extend to bottom of browser window */
-.pop-over[data-popup="changeLanguagePopup"] {
+.pop-over[data-popup='changeLanguagePopup'] {
  position: fixed !important;
  bottom: 0 !important;
  top: auto !important;
@@ -184,12 +208,12 @@
 }

 /* Allow dynamic height for Change Language popup */
-.pop-over[data-popup="changeLanguagePopup"] .header {
+.pop-over[data-popup='changeLanguagePopup'] .header {
  flex-shrink: 0 !important;
  height: auto !important;
 }

-.pop-over[data-popup="changeLanguagePopup"] .content-wrapper {
+.pop-over[data-popup='changeLanguagePopup'] .content-wrapper {
  flex: 1 !important;
  overflow-y: auto !important;
  overflow-x: hidden !important;
@@ -199,7 +223,7 @@
  width: 100% !important;
 }

-.pop-over[data-popup="changeLanguagePopup"] .content-container {
+.pop-over[data-popup='changeLanguagePopup'] .content-container {
  height: auto !important;
  max-height: none !important;
  flex: 1 !important;
@@ -208,7 +232,7 @@
  width: 100% !important;
 }

-.pop-over[data-popup="changeLanguagePopup"] .content {
+.pop-over[data-popup='changeLanguagePopup'] .content {
  height: auto !important;
  max-height: none !important;
  padding-bottom: 50px !important;
@@ -216,59 +240,59 @@
 }

 /* Date popup sizing for native HTML inputs */
-.pop-over[data-popup="editCardReceivedDatePopup"],
-.pop-over[data-popup="editCardStartDatePopup"],
-.pop-over[data-popup="editCardDueDatePopup"],
-.pop-over[data-popup="editCardEndDatePopup"],
-.pop-over[data-popup*="Date"] {
+.pop-over[data-popup='editCardReceivedDatePopup'],
+.pop-over[data-popup='editCardStartDatePopup'],
+.pop-over[data-popup='editCardDueDatePopup'],
+.pop-over[data-popup='editCardEndDatePopup'],
+.pop-over[data-popup*='Date'] {
  width: min(400px, 90vw) !important; /* Smaller width for native inputs */
  min-width: 350px !important;
  max-height: 80vh !important;
 }

-.pop-over[data-popup="editCardReceivedDatePopup"] .content-wrapper,
-.pop-over[data-popup="editCardStartDatePopup"] .content-wrapper,
-.pop-over[data-popup="editCardDueDatePopup"] .content-wrapper,
-.pop-over[data-popup="editCardEndDatePopup"] .content-wrapper,
-.pop-over[data-popup*="Date"] .content-wrapper {
+.pop-over[data-popup='editCardReceivedDatePopup'] .content-wrapper,
+.pop-over[data-popup='editCardStartDatePopup'] .content-wrapper,
+.pop-over[data-popup='editCardDueDatePopup'] .content-wrapper,
+.pop-over[data-popup='editCardEndDatePopup'] .content-wrapper,
+.pop-over[data-popup*='Date'] .content-wrapper {
  max-height: 60vh !important;
  overflow-y: auto !important;
 }

-.pop-over[data-popup="editCardReceivedDatePopup"] .content-container,
-.pop-over[data-popup="editCardStartDatePopup"] .content-container,
-.pop-over[data-popup="editCardDueDatePopup"] .content-container,
-.pop-over[data-popup="editCardEndDatePopup"] .content-container,
-.pop-over[data-popup*="Date"] .content-container {
+.pop-over[data-popup='editCardReceivedDatePopup'] .content-container,
+.pop-over[data-popup='editCardStartDatePopup'] .content-container,
+.pop-over[data-popup='editCardDueDatePopup'] .content-container,
+.pop-over[data-popup='editCardEndDatePopup'] .content-container,
+.pop-over[data-popup*='Date'] .content-container {
  max-height: 60vh !important;
 }

 /* Native HTML input styling */
-.pop-over[data-popup*="Date"] .datepicker-container {
+.pop-over[data-popup*='Date'] .datepicker-container {
  width: 100% !important;
  padding: 15px !important;
 }

-.pop-over[data-popup*="Date"] .datepicker-container .fields {
+.pop-over[data-popup*='Date'] .datepicker-container .fields {
  display: flex !important;
  gap: 15px !important;
  margin-bottom: 15px !important;
 }

-.pop-over[data-popup*="Date"] .datepicker-container .fields .left,
-.pop-over[data-popup*="Date"] .datepicker-container .fields .right {
+.pop-over[data-popup*='Date'] .datepicker-container .fields .left,
+.pop-over[data-popup*='Date'] .datepicker-container .fields .right {
  flex: 1 !important;
  width: auto !important;
 }

-.pop-over[data-popup*="Date"] .datepicker-container label {
+.pop-over[data-popup*='Date'] .datepicker-container label {
  display: block !important;
  margin-bottom: 5px !important;
  font-weight: bold !important;
 }

-.pop-over[data-popup*="Date"] .datepicker-container input[type="date"],
-.pop-over[data-popup*="Date"] .datepicker-container input[type="time"] {
+.pop-over[data-popup*='Date'] .datepicker-container input[type='date'],
+.pop-over[data-popup*='Date'] .datepicker-container input[type='time'] {
  width: 100% !important;
  padding: 8px !important;
  border: 1px solid #ccc !important;
@@ -277,71 +301,109 @@
  box-sizing: border-box !important;
 }

-.pop-over[data-popup*="Date"] .datepicker-container input[type="date"]:focus,
-.pop-over[data-popup*="Date"] .datepicker-container input[type="time"]:focus {
+.pop-over[data-popup*='Date'] .datepicker-container input[type='date']:focus,
+.pop-over[data-popup*='Date'] .datepicker-container input[type='time']:focus {
  outline: none !important;
  border-color: #007cba !important;
  box-shadow: 0 0 0 2px rgba(0, 124, 186, 0.2) !important;
 }

 /* Ensure date popup buttons stay within popup boundaries */
-.pop-over[data-popup="editCardReceivedDatePopup"] .content,
-.pop-over[data-popup="editCardStartDatePopup"] .content,
-.pop-over[data-popup="editCardDueDatePopup"] .content,
-.pop-over[data-popup="editCardEndDatePopup"] .content,
-.pop-over[data-popup*="Date"] .content {
+.pop-over[data-popup='editCardReceivedDatePopup'] .content,
+.pop-over[data-popup='editCardStartDatePopup'] .content,
+.pop-over[data-popup='editCardDueDatePopup'] .content,
+.pop-over[data-popup='editCardEndDatePopup'] .content,
+.pop-over[data-popup*='Date'] .content {
  max-height: 60vh !important; /* Leave space for buttons */
  overflow-y: auto !important;
  padding-bottom: 100px !important; /* More space for buttons */
  margin-bottom: 0 !important;
 }

-.pop-over[data-popup="editCardReceivedDatePopup"] .datepicker-container,
-.pop-over[data-popup="editCardStartDatePopup"] .datepicker-container,
-.pop-over[data-popup="editCardDueDatePopup"] .datepicker-container,
-.pop-over[data-popup="editCardEndDatePopup"] .datepicker-container,
-.pop-over[data-popup*="Date"] .datepicker-container {
+/* Workspace Settings popup: ensure modal doesn't overflow viewport */
+.pop-over[data-popup='workspaceActionsPopup'] {
+  max-height: 80vh !important;
+  width: min(420px, 85vw) !important;
+}
+
+.pop-over[data-popup='workspaceActionsPopup'] .content-wrapper {
+  max-height: calc(80vh - 70px) !important; /* Subtract header height */
+  overflow-y: auto !important;
+}
+
+.pop-over[data-popup='workspaceActionsPopup'] .content-container {
+  max-height: calc(80vh - 70px) !important;
+}
+
+.pop-over[data-popup='workspaceActionsPopup'] .content {
+  max-height: none !important; /* Allow content to scroll within container */
+  overflow: visible !important; /* Overflow handled by parent */
+}
+
+/* Card Details Actions popup: ensure menu doesn't overflow viewport */
+.pop-over[data-popup="cardDetailsActionsPopup"] {
+  max-height: 80vh !important;
+  width: min(380px, 85vw) !important;
+}
+
+.pop-over[data-popup="cardDetailsActionsPopup"] .content-wrapper {
+  max-height: calc(80vh - 70px) !important; /* Subtract header height */
+  overflow-y: auto !important;
+}
+
+.pop-over[data-popup="cardDetailsActionsPopup"] .content-container {
+  max-height: calc(80vh - 70px) !important;
+}
+
+.pop-over[data-popup="cardDetailsActionsPopup"] .content {
+  max-height: none !important; /* Allow content to scroll within container */
+  overflow: visible !important; /* Overflow handled by parent */
+}
+
+.pop-over[data-popup='editCardReceivedDatePopup'] .datepicker-container,
+.pop-over[data-popup='editCardStartDatePopup'] .datepicker-container,
+.pop-over[data-popup='editCardDueDatePopup'] .datepicker-container,
+.pop-over[data-popup='editCardEndDatePopup'] .datepicker-container,
+.pop-over[data-popup*='Date'] .datepicker-container {
  max-height: 50vh !important; /* Limit calendar height */
  overflow-y: auto !important;
  margin-bottom: 20px !important; /* Space before buttons */
 }

 /* Ensure buttons are properly positioned */
-.pop-over[data-popup="editCardReceivedDatePopup"] .edit-date,
-.pop-over[data-popup="editCardStartDatePopup"] .edit-date,
-.pop-over[data-popup="editCardDueDatePopup"] .edit-date,
-.pop-over[data-popup="editCardEndDatePopup"] .edit-date,
-.pop-over[data-popup*="Date"] .edit-date {
+.pop-over[data-popup='editCardReceivedDatePopup'] .edit-date,
+.pop-over[data-popup='editCardStartDatePopup'] .edit-date,
+.pop-over[data-popup='editCardDueDatePopup'] .edit-date,
+.pop-over[data-popup='editCardEndDatePopup'] .edit-date,
+.pop-over[data-popup*='Date'] .edit-date {
  display: flex !important;
  flex-direction: column !important;
  height: 100% !important;
 }

-.pop-over[data-popup="editCardReceivedDatePopup"] .edit-date .fields,
-.pop-over[data-popup="editCardStartDatePopup"] .edit-date .fields,
-.pop-over[data-popup="editCardDueDatePopup"] .edit-date .fields,
-.pop-over[data-popup="editCardEndDatePopup"] .edit-date .fields,
-.pop-over[data-popup*="Date"] .edit-date .fields {
+.pop-over[data-popup='editCardReceivedDatePopup'] .edit-date .fields,
+.pop-over[data-popup='editCardStartDatePopup'] .edit-date .fields,
+.pop-over[data-popup='editCardDueDatePopup'] .edit-date .fields,
+.pop-over[data-popup='editCardEndDatePopup'] .edit-date .fields,
+.pop-over[data-popup*='Date'] .edit-date .fields {
  flex-shrink: 0 !important;
  margin-bottom: 15px !important;
 }

-.pop-over[data-popup="editCardReceivedDatePopup"] .edit-date .js-datepicker,
-.pop-over[data-popup="editCardStartDatePopup"] .edit-date .js-datepicker,
-.pop-over[data-popup="editCardDueDatePopup"] .edit-date .js-datepicker,
-.pop-over[data-popup="editCardEndDatePopup"] .edit-date .js-datepicker,
-.pop-over[data-popup*="Date"] .edit-date .js-datepicker {
+.pop-over[data-popup='editCardReceivedDatePopup'] .edit-date .js-datepicker,
+.pop-over[data-popup='editCardStartDatePopup'] .edit-date .js-datepicker,
+.pop-over[data-popup='editCardDueDatePopup'] .edit-date .js-datepicker,
+.pop-over[data-popup='editCardEndDatePopup'] .edit-date .js-datepicker,
+.pop-over[data-popup*='Date'] .edit-date .js-datepicker {
  flex: 1 !important;
  overflow-y: auto !important;
 }

-
-
-.pop-over[data-popup="editCardReceivedDatePopup"] .edit-date button,
-.pop-over[data-popup="editCardStartDatePopup"] .edit-date button,
-.pop-over[data-popup="editCardDueDatePopup"] .edit-date button,
-.pop-over[data-popup="editCardEndDatePopup"] .edit-date button,
-.pop-over[data-popup*="Date"] .edit-date button {
+.pop-over[data-popup='editCardReceivedDatePopup'] .edit-date button,
+.pop-over[data-popup='editCardStartDatePopup'] .edit-date button,
+.pop-over[data-popup='editCardDueDatePopup'] .edit-date button,
+.pop-over[data-popup='editCardEndDatePopup'] .edit-date button,
+.pop-over[data-popup*='Date'] .edit-date button {
  flex-shrink: 0 !important;
  margin-top: 15px !important;
  position: relative !important;
@@ -350,7 +412,7 @@
 .pop-over .content-container .content {
  /* Match wider popover, leave padding */
  width: 100%;
-  padding: 0 1.3vw 1.3vh;
+  padding: 1.3vh 1.3vw 1.3vh;
  box-sizing: border-box;
  /* Ensure content is not shifted left */
  margin-left: 0 !important;
@@ -387,8 +449,6 @@
  margin-bottom: 2px;
 }

-
-
 /* Fix popup depth containers - don't block transforms which are needed for popup navigation */
 .pop-over .popup-container-depth-1,
 .pop-over .popup-container-depth-2,
@@ -477,15 +537,15 @@
  text-decoration: none;
  overflow: hidden;
  line-height: 33px;
-  display:flex;
-/*  flex-wrap:wrap;*/
-  gap:5px;
+  display: flex;
+  /*  flex-wrap:wrap;*/
+  gap: 5px;
  align-items: center;
  color: #000 !important;
 }
-.pop-over-list li > a > .member{
+.pop-over-list li > a > .member {
  align-self: flex-start;
-  flex:0 0 auto;
+  flex: 0 0 auto;
 }
 .pop-over-list li > a .item-name {
  display: block;
@@ -657,10 +717,10 @@ body.grey-icons-enabled .pop-over-list .pop-over-list.checkable .fa-check {
  }
  .pop-over .content-container .content p,
  .pop-over .content-container .content textarea,
-  .pop-over .content-container .content input[type="text"],
-  .pop-over .content-container .content input[type="email"],
-  .pop-over .content-container .content input[type="password"],
-  .pop-over .content-container .content input[type="file"] {
+  .pop-over .content-container .content input[type='text'],
+  .pop-over .content-container .content input[type='email'],
+  .pop-over .content-container .content input[type='password'],
+  .pop-over .content-container .content input[type='file'] {
    width: 100%;
    box-sizing: border-box;
  }
@@ -707,3 +767,60 @@ body.mobile-mode .pop-over .content-wrapper {
  overflow-y: auto !important;
  overflow-x: hidden !important;
 }
+
+/* ============================================
+   FIX: Popup overflow (Issues #6200, #6221, #6223)
+   Prevents menus from overflowing outside viewport
+   ============================================ */
+
+/* Specific fix for list actions menu */
+.pop-over[data-popup="listActionsPopup"] {
+  max-height: 85vh !important;
+}
+
+.pop-over[data-popup="listActionsPopup"] .content-wrapper {
+  max-height: calc(85vh - 50px) !important;
+  overflow-y: auto !important;
+}
+
+/* Prevent any popup from overflowing viewport */
+.pop-over {
+  max-height: 90vh !important;
+  display: flex !important;
+  flex-direction: column !important;
+}
+
+.pop-over .content-wrapper {
+  flex: 1 1 auto !important;
+  overflow-y: auto !important;
+  min-height: 0 !important;
+}
+
+.pop-over .content-container {
+  flex: 1 1 auto !important;
+  display: flex !important;
+  flex-direction: column !important;
+  min-height: 0 !important;
+}
+
+.pop-over .content {
+  flex: 1 1 auto !important;
+  overflow-y: auto !important;
+  min-height: 0 !important;
+}
+
+/* Keep header fixed while content scrolls */
+.pop-over .header {
+  flex-shrink: 0 !important;
+}
+
+/* Mobile-specific adjustments */
+@media screen and (max-width: 800px) {
+  .pop-over[data-popup="listActionsPopup"] {
+    max-height: 100vh !important;
+  }
+
+  .pop-over[data-popup="listActionsPopup"] .content-wrapper {
+    max-height: calc(100vh - 48px) !important;
+  }
+}
@@ -1,3 +1,5 @@
+import { CSSEvents } from '/client/lib/cssEvents';
+
 Popup.template.events({
  'click .js-back-view'() {
    Popup.back();
@@ -26,8 +28,11 @@ Popup.template.events({
 // When a popup content is removed (ie, when the user press the "back" button),
 // we need to wait for the container translation to end before removing the
 // actual DOM element. For that purpose we use the undocumented `_uihooks` API.
-Popup.template.onRendered(() => {
+Popup.template.onRendered(function () {
  const container = this.find('.content-container');
+  if (!container) {
+    return;
+  }
  container._uihooks = {
    removeElement(node) {
      $(node).addClass('no-height');
@@ -2,6 +2,7 @@
  class="{{#unless title}}miniprofile{{/unless}}"
  class=currentBoard.colorClass
  class="{{#unless title}}no-title{{/unless}}"
+  class="{{#if offset.maxHeight}}pop-over--bounded{{/if}}"
  data-popup="{{popupName}}"
  style="left:{{offset.left}}px; top:{{offset.top}}px;{{#if offset.maxHeight}} max-height:{{offset.maxHeight}}px;{{/if}}")
  .header
@@ -1,13 +1,14 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { formatDateByUserPreference } from '/imports/lib/dateUtils';
+import Users from '/models/users';

 Template.notification.events({
-  'click .read-status .materialCheckBox'() {
+  async 'click .read-status .materialCheckBox'() {
    const update = {};
-    const newReadValue = this.read ? null : Date.now();
+    const newReadValue = this.read ? null : new Date();
    update[`profile.notifications.${this.index}.read`] = newReadValue;

-    Users.update(Meteor.userId(), { $set: update }, (error, result) => {
+    await Users.updateAsync(Meteor.userId(), { $set: update }).catch((error) => {
      if (error) {
        console.error('Error updating notification:', error);
      }
@@ -1,5 +1,7 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import { TAPi18n } from '/imports/i18n';
 import { toggleNotificationsDrawer } from './notifications.js';
+import Users from '/models/users';

 Template.notificationsDrawer.onCreated(function() {
  Meteor.subscribe('notificationActivities');
@@ -34,7 +36,7 @@ Template.notificationsDrawer.events({
    event.stopPropagation();
    Session.set('showNotificationMenu', !Session.get('showNotificationMenu'));
  },
-  'click .notification-menu .menu-item'(event) {
+  async 'click .notification-menu .menu-item'(event) {
    const target = event.currentTarget;

    if (target.classList.contains('mark-all-read')) {
@@ -42,8 +44,10 @@ Template.notificationsDrawer.events({
      for (const index in notifications) {
        if (notifications.hasOwnProperty(index) && !notifications[index].read) {
          const update = {};
-          update[`profile.notifications.${index}.read`] = Date.now();
-          Users.update(Meteor.userId(), { $set: update });
+          update[`profile.notifications.${index}.read`] = new Date();
+          await Users.updateAsync(Meteor.userId(), { $set: update }).catch((error) => {
+            console.error('Error marking notification as read:', error);
+          });
        }
      }
      Session.set('showNotificationMenu', false);
@@ -53,7 +57,9 @@ Template.notificationsDrawer.events({
        if (notifications.hasOwnProperty(index) && notifications[index].read) {
          const update = {};
          update[`profile.notifications.${index}.read`] = null;
-          Users.update(Meteor.userId(), { $set: update });
+          await Users.updateAsync(Meteor.userId(), { $set: update }).catch((error) => {
+            console.error('Error marking notification as unread:', error);
+          });
        }
      }
      Session.set('showNotificationMenu', false);
@@ -1,5 +1,9 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
+import Actions from '/models/actions';
+import Rules from '/models/rules';
+import Triggers from '/models/triggers';
+import { Utils } from '/client/lib/utils';

 Template.boardActions.onCreated(function () {
  this.subscribe('boards');
@@ -1,6 +1,12 @@
+import Actions from '/models/actions';
+import { CARD_COLORS } from '/models/metadata/colors';
+import Rules from '/models/rules';
+import Triggers from '/models/triggers';
+import { Utils } from '/client/lib/utils';
+
 let cardColors;
 Meteor.startup(() => {
-  cardColors = Cards.simpleSchema()._schema.color.allowedValues;
+  cardColors = CARD_COLORS;
 });

 // Module-level shared state so the color popup can read/write the
@@ -1,3 +1,8 @@
+import Actions from '/models/actions';
+import Rules from '/models/rules';
+import Triggers from '/models/triggers';
+import { Utils } from '/client/lib/utils';
+
 Template.checklistActions.onCreated(function () {
  this.subscribe('allRules');
 });
@@ -1,3 +1,8 @@
+import Actions from '/models/actions';
+import Rules from '/models/rules';
+import Triggers from '/models/triggers';
+import { Utils } from '/client/lib/utils';
+
 Template.mailActions.events({
  'click .js-mail-action'(event, tpl) {
    const emailTo = tpl.find('#email-to').value;
@@ -1,4 +1,7 @@
 import { ReactiveCache } from '/imports/reactiveCache';
+import Actions from '/models/actions';
+import Rules from '/models/rules';
+import Triggers from '/models/triggers';

 Template.rulesMain.onCreated(function () {
  this.rulesCurrentTab = new ReactiveVar('rulesList');
@@ -1,3 +1,5 @@
+import { Utils } from '/client/lib/utils';
+
 Template.boardTriggers.onCreated(function () {
  this.provaVar = new ReactiveVar('');
  this.currentPopupTriggerId = 'def';
@@ -1,4 +1,5 @@
 import { TAPi18n } from '/imports/i18n';
+import { Utils } from '/client/lib/utils';

 Template.cardTriggers.onCreated(function () {
  this.subscribe('allRules');
@@ -1,3 +1,5 @@
+import { Utils } from '/client/lib/utils';
+
 Template.checklistTriggers.onCreated(function () {
  this.subscribe('allRules');
 });
@@ -0,0 +1,70 @@
+/* Search + pagination controls for the admin report tabs (files, rules,
+   boards, cards). Styled to match the admin People panel (peopleBody.css). */
+
+.admin-report-search {
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+  gap: 10px;
+  height: 34px;
+  margin-bottom: 12px;
+}
+
+.admin-report-search input {
+  flex: 1;
+  max-width: 320px;
+  padding: 0 8px;
+  height: 34px;
+}
+
+.admin-report-search button {
+  min-width: 90px;
+  height: 34px;
+  background: #01628c;
+  color: #fff;
+  border: none;
+  border-radius: 0.4vw;
+  cursor: pointer;
+  padding: 0 12px;
+}
+
+.admin-report-search button:hover {
+  background: #005377;
+}
+
+.admin-report-search button:active {
+  background: #004766;
+}
+
+.admin-report-pagination {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-bottom: 12px;
+}
+
+.admin-report-pagination button {
+  min-width: 32px;
+  height: 30px;
+  border: 1px solid #bbb;
+  background: #fff;
+  border-radius: 0.4vw;
+  cursor: pointer;
+}
+
+.admin-report-pagination button.active {
+  background: #01628c;
+  border-color: #01628c;
+  color: #fff;
+}
+
+.admin-report-pagination button.disabled {
+  opacity: 0.5;
+  pointer-events: none;
+}
+
+.admin-report-page-info {
+  min-width: 72px;
+  text-align: center;
+  color: #333;
+}
@@ -8,27 +8,27 @@ template(name="adminReports")
          ul
            li
              a.js-report-broken(data-id="report-broken")
-                span.emoji-icon 🔗
+                i.fa.fa-chain-broken
                | {{_ 'broken-cards'}}

            li
              a.js-report-files(data-id="report-files")
-                span.emoji-icon 📎
+                i.fa.fa-paperclip
                | {{_ 'filesReportTitle'}}

            li
              a.js-report-rules(data-id="report-rules")
-                span.emoji-icon ✨
+                i.fa.fa-magic
                | {{_ 'rulesReportTitle'}}

            li
              a.js-report-boards(data-id="report-boards")
-                span.emoji-icon ✨
+                i.fa.fa-columns
                | {{_ 'boardsReportTitle'}}

            li
              a.js-report-cards(data-id="report-cards")
-                span.emoji-icon ✨
+                i.fa.fa-id-card-o
                | {{_ 'cardsReportTitle'}}

        .main-body
@@ -37,13 +37,13 @@ template(name="adminReports")
          else if showBrokenCardsReport.get
            +brokenCardsReport
          else if showFilesReport.get
-            +filesReport
+            +filesReport(currentPage=filesCurrentPage totalPages=filesTotalPages hasPrevPage=hasFilesPrevPage hasNextPage=hasFilesNextPage)
          else if showRulesReport.get
-            +rulesReport
+            +rulesReport(currentPage=rulesCurrentPage totalPages=rulesTotalPages hasPrevPage=hasRulesPrevPage hasNextPage=hasRulesNextPage)
          else if showBoardsReport.get
-            +boardsReport
+            +boardsReport(currentPage=boardsCurrentPage totalPages=boardsTotalPages hasPrevPage=hasBoardsPrevPage hasNextPage=hasBoardsNextPage)
          else if showCardsReport.get
-            +cardsReport
+            +cardsReport(currentPage=cardsCurrentPage totalPages=cardsTotalPages hasPrevPage=hasCardsPrevPage hasNextPage=hasCardsNextPage)


 template(name="brokenCardsReport")
@@ -56,6 +56,17 @@ template(name="brokenCardsReport")

 template(name="rulesReport")
  h1 {{_ 'rulesReportTitle'}}
+  .admin-report-search
+    input.js-rules-search-input(type="text" placeholder="{{_ 'search'}}")
+    button.js-rules-search-button
+      i.fa.fa-search
+      | {{_ 'search'}}
+  .admin-report-pagination
+    button.js-rules-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+      | &lt;
+    span.admin-report-page-info {{currentPage}} / {{totalPages}}
+    button.js-rules-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+      | &gt;
  if resultsCount
    table
      thead
@@ -77,6 +88,17 @@ template(name="rulesReport")

 template(name="filesReport")
  h1 {{_ 'filesReportTitle'}}
+  .admin-report-search
+    input.js-files-search-input(type="text" placeholder="{{_ 'search'}}")
+    button.js-files-search-button
+      i.fa.fa-search
+      | {{_ 'search'}}
+  .admin-report-pagination
+    button.js-files-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+      | &lt;
+    span.admin-report-page-info {{currentPage}} / {{totalPages}}
+    button.js-files-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+      | &gt;
  if resultsCount
    table
      thead
@@ -102,6 +124,17 @@ template(name="filesReport")

 template(name="cardsReport")
  h1 {{_ 'cardsReportTitle'}}
+  .admin-report-search
+    input.js-cards-search-input(type="text" placeholder="{{_ 'search'}}")
+    button.js-cards-search-button
+      i.fa.fa-search
+      | {{_ 'search'}}
+  .admin-report-pagination
+    button.js-cards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+      | &lt;
+    span.admin-report-page-info {{currentPage}} / {{totalPages}}
+    button.js-cards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+      | &gt;
  if resultsCount
    table.table
      thead
@@ -127,6 +160,17 @@ template(name="cardsReport")

 template(name="boardsReport")
  h1 {{_ 'boardsReportTitle'}}
+  .admin-report-search
+    input.js-boards-search-input(type="text" placeholder="{{_ 'search'}}")
+    button.js-boards-search-button
+      i.fa.fa-search
+      | {{_ 'search'}}
+  .admin-report-pagination
+    button.js-boards-prev-page(class="{{#if hasPrevPage}}{{else}}disabled{{/if}}")
+      | &lt;
+    span.admin-report-page-info {{currentPage}} / {{totalPages}}
+    button.js-boards-next-page(class="{{#if hasNextPage}}{{else}}disabled{{/if}}")
+      | &gt;
  if resultsCount
    table.table
      thead
@@ -1,11 +1,12 @@
 import { ReactiveCache } from '/imports/reactiveCache';
 import { TAPi18n } from '/imports/i18n';
-import { AttachmentStorage } from '/models/attachments';
+import Attachments, { AttachmentStorage } from '/models/attachments';
 import { CardSearchPaged } from '/client/lib/cardSearch';
 import SessionData from '/models/usersessiondata';
-import { QueryParams } from '/config/query-classes';
-import { OPERATOR_LIMIT } from '/config/search-const';
-const filesize = require('filesize');
+import Boards from '/models/boards';
+import Cards from '/models/cards';
+import Rules from '/models/rules';
+const { filesize } = require('filesize');

 // --- Shared helper functions (formerly AdminReport base class methods) ---

@@ -32,8 +33,12 @@ function abbreviate(text) {
  return text;
 }

-function collectionResults(collection) {
-  return collection.find();
+// The report publications already send only the current page (server-side
+// search + limit/skip, sorted). Display exactly what was published, applying
+// the same sort so minimongo order matches the server page. Re-applying
+// skip/limit here would paginate an already-paginated set.
+function collectionResults(collection, sort) {
+  return collection.find({}, sort ? { sort } : {});
 }

 function collectionResultsCount(collection) {
@@ -42,6 +47,22 @@ function collectionResultsCount(collection) {

 // --- adminReports template ---

+// Rows per page for the paginated reports (files, rules, boards, cards).
+// Kept in sync with the admin People panel so all admin lists page alike.
+const REPORTS_PER_PAGE = 25;
+
+// Static description of each paginated report: which page/count reactive vars
+// it uses, which publication feeds it and which count method backs it. Lets a
+// single loadReport() drive all of them the same way.
+function reportConfig(tmpl) {
+  return {
+    'report-files': { page: tmpl.filesPage, count: tmpl.filesCount, search: tmpl.filesSearch, pub: 'attachmentsList', countMethod: 'getAttachmentsReportCount' },
+    'report-rules': { page: tmpl.rulesPage, count: tmpl.rulesCount, search: tmpl.rulesSearch, pub: 'rulesReport', countMethod: 'getRulesReportCount' },
+    'report-boards': { page: tmpl.boardsPage, count: tmpl.boardsCount, search: tmpl.boardsSearch, pub: 'boardsReport', countMethod: 'getBoardsReportCount' },
+    'report-cards': { page: tmpl.cardsPage, count: tmpl.cardsCount, search: tmpl.cardsSearch, pub: 'cardsReport', countMethod: 'getCardsReportCount' },
+  };
+}
+
 Template.adminReports.onCreated(function () {
  this.subscription = null;
  this.showFilesReport = new ReactiveVar(false);
@@ -53,6 +74,60 @@ Template.adminReports.onCreated(function () {
  this.sessionId = SessionData.getSessionId();
  this.error = new ReactiveVar('');
  this.loading = new ReactiveVar(false);
+
+  // Pagination state, one current-page + total-count pair per report.
+  this.activeReport = new ReactiveVar('');
+  this.filesPage = new ReactiveVar(1);
+  this.rulesPage = new ReactiveVar(1);
+  this.boardsPage = new ReactiveVar(1);
+  this.cardsPage = new ReactiveVar(1);
+  this.filesCount = new ReactiveVar(0);
+  this.rulesCount = new ReactiveVar(0);
+  this.boardsCount = new ReactiveVar(0);
+  this.cardsCount = new ReactiveVar(0);
+  // Current search term per report (empty string = no filter).
+  this.filesSearch = new ReactiveVar('');
+  this.rulesSearch = new ReactiveVar('');
+  this.boardsSearch = new ReactiveVar('');
+  this.cardsSearch = new ReactiveVar('');
+
+  // (Re)subscribe the given report for its current page and refresh its total
+  // count. Server-side search + limit/skip means only the matching page ever
+  // reaches minimongo.
+  this.loadReport = (reportId) => {
+    const cfg = reportConfig(this)[reportId];
+    if (!cfg) {
+      return;
+    }
+    // Note: we deliberately do not toggle the global `loading` spinner here.
+    // The spinner is shown once on tab switch (switchMenu); paging/searching
+    // re-subscribes silently so the search box keeps focus and the report
+    // stays mounted, just like the admin People panel.
+    if (this.subscription) {
+      this.subscription.stop();
+    }
+    const searchTerm = cfg.search.get();
+    const limit = REPORTS_PER_PAGE;
+    const skip = (cfg.page.get() - 1) * REPORTS_PER_PAGE;
+    this.subscription = Meteor.subscribe(cfg.pub, searchTerm, limit, skip, () => {
+      this.loading.set(false);
+    });
+    Meteor.call(cfg.countMethod, searchTerm, (error, count) => {
+      if (error) {
+        console.error(`Failed to load ${cfg.countMethod}:`, error);
+        return;
+      }
+      const total = count || 0;
+      const totalPages = Math.max(1, Math.ceil(total / REPORTS_PER_PAGE));
+      // If rows were removed while on a now-out-of-range page, clamp and reload.
+      if (cfg.page.get() > totalPages) {
+        cfg.page.set(totalPages);
+        this.loadReport(reportId);
+        return;
+      }
+      cfg.count.set(total);
+    });
+  };
 });

 Template.adminReports.helpers({
@@ -77,6 +152,39 @@ Template.adminReports.helpers({
  loading() {
    return Template.instance().loading;
  },
+
+  // --- Pagination helpers, passed down into each report sub-template ---
+  filesCurrentPage() { return Template.instance().filesPage.get(); },
+  filesTotalPages() { return Math.max(1, Math.ceil((Template.instance().filesCount.get() || 0) / REPORTS_PER_PAGE)); },
+  hasFilesPrevPage() { return Template.instance().filesPage.get() > 1; },
+  hasFilesNextPage() {
+    const tpl = Template.instance();
+    return tpl.filesPage.get() < Math.max(1, Math.ceil((tpl.filesCount.get() || 0) / REPORTS_PER_PAGE));
+  },
+
+  rulesCurrentPage() { return Template.instance().rulesPage.get(); },
+  rulesTotalPages() { return Math.max(1, Math.ceil((Template.instance().rulesCount.get() || 0) / REPORTS_PER_PAGE)); },
+  hasRulesPrevPage() { return Template.instance().rulesPage.get() > 1; },
+  hasRulesNextPage() {
+    const tpl = Template.instance();
+    return tpl.rulesPage.get() < Math.max(1, Math.ceil((tpl.rulesCount.get() || 0) / REPORTS_PER_PAGE));
+  },
+
+  boardsCurrentPage() { return Template.instance().boardsPage.get(); },
+  boardsTotalPages() { return Math.max(1, Math.ceil((Template.instance().boardsCount.get() || 0) / REPORTS_PER_PAGE)); },
+  hasBoardsPrevPage() { return Template.instance().boardsPage.get() > 1; },
+  hasBoardsNextPage() {
+    const tpl = Template.instance();
+    return tpl.boardsPage.get() < Math.max(1, Math.ceil((tpl.boardsCount.get() || 0) / REPORTS_PER_PAGE));
+  },
+
+  cardsCurrentPage() { return Template.instance().cardsPage.get(); },
+  cardsTotalPages() { return Math.max(1, Math.ceil((Template.instance().cardsCount.get() || 0) / REPORTS_PER_PAGE)); },
+  hasCardsPrevPage() { return Template.instance().cardsPage.get() > 1; },
+  hasCardsNextPage() {
+    const tpl = Template.instance();
+    return tpl.cardsPage.get() < Math.max(1, Math.ceil((tpl.cardsCount.get() || 0) / REPORTS_PER_PAGE));
+  },
 });

 Template.adminReports.events({
@@ -95,8 +203,60 @@ Template.adminReports.events({
  'click a.js-report-boards'(event) {
    switchMenu(event, Template.instance());
  },
+
+  // --- Pagination controls (buttons live inside the report sub-templates,
+  // their clicks bubble up to this parent template) ---
+  'click .js-files-prev-page'(event, tmpl) { goPrevPage(event, tmpl, 'report-files'); },
+  'click .js-files-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-files'); },
+  'click .js-rules-prev-page'(event, tmpl) { goPrevPage(event, tmpl, 'report-rules'); },
+  'click .js-rules-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-rules'); },
+  'click .js-boards-prev-page'(event, tmpl) { goPrevPage(event, tmpl, 'report-boards'); },
+  'click .js-boards-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-boards'); },
+  'click .js-cards-prev-page'(event, tmpl) { goPrevPage(event, tmpl, 'report-cards'); },
+  'click .js-cards-next-page'(event, tmpl) { goNextPage(event, tmpl, 'report-cards'); },
+
+  // --- Search (one input + button per report, mirrors the People panel) ---
+  'click .js-files-search-button'(event, tmpl) { runSearch(tmpl, 'report-files', '.js-files-search-input'); },
+  'keydown .js-files-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-files', '.js-files-search-input'); },
+  'click .js-rules-search-button'(event, tmpl) { runSearch(tmpl, 'report-rules', '.js-rules-search-input'); },
+  'keydown .js-rules-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-rules', '.js-rules-search-input'); },
+  'click .js-boards-search-button'(event, tmpl) { runSearch(tmpl, 'report-boards', '.js-boards-search-input'); },
+  'keydown .js-boards-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-boards', '.js-boards-search-input'); },
+  'click .js-cards-search-button'(event, tmpl) { runSearch(tmpl, 'report-cards', '.js-cards-search-input'); },
+  'keydown .js-cards-search-input'(event, tmpl) { if (event.keyCode === 13 && !event.shiftKey) runSearch(tmpl, 'report-cards', '.js-cards-search-input'); },
 });

+function goPrevPage(event, tmpl, reportId) {
+  event.preventDefault();
+  const cfg = reportConfig(tmpl)[reportId];
+  const current = cfg.page.get();
+  if (current > 1) {
+    cfg.page.set(current - 1);
+    tmpl.loadReport(reportId);
+  }
+}
+
+function goNextPage(event, tmpl, reportId) {
+  event.preventDefault();
+  const cfg = reportConfig(tmpl)[reportId];
+  const total = cfg.count.get() || 0;
+  const totalPages = Math.max(1, Math.ceil(total / REPORTS_PER_PAGE));
+  const current = cfg.page.get();
+  if (current < totalPages) {
+    cfg.page.set(current + 1);
+    tmpl.loadReport(reportId);
+  }
+}
+
+// Read the report's search box, store the term, reset to page 1 and reload.
+function runSearch(tmpl, reportId, inputSelector) {
+  const cfg = reportConfig(tmpl)[reportId];
+  const value = (tmpl.$(inputSelector).val() || '').trim();
+  cfg.search.set(value);
+  cfg.page.set(1);
+  tmpl.loadReport(reportId);
+}
+
 function switchMenu(event, tmpl) {
  const target = $(event.target);
  if (!target.hasClass('active')) {
@@ -114,6 +274,7 @@ function switchMenu(event, tmpl) {
    $('.side-menu li.active').removeClass('active');
    target.parent().addClass('active');
    const targetID = target.data('id');
+    tmpl.activeReport.set(targetID);

    if ('report-broken' === targetID) {
      tmpl.showBrokenCardsReport.set(true);
@@ -126,32 +287,24 @@ function switchMenu(event, tmpl) {
      );
    } else if ('report-files' === targetID) {
      tmpl.showFilesReport.set(true);
-      tmpl.subscription = Meteor.subscribe('attachmentsList', () => {
-        tmpl.loading.set(false);
-      });
+      tmpl.filesPage.set(1);
+      tmpl.filesSearch.set('');
+      tmpl.loadReport('report-files');
    } else if ('report-rules' === targetID) {
-      tmpl.subscription = Meteor.subscribe('rulesReport', () => {
-        tmpl.showRulesReport.set(true);
-        tmpl.loading.set(false);
-      });
+      tmpl.showRulesReport.set(true);
+      tmpl.rulesPage.set(1);
+      tmpl.rulesSearch.set('');
+      tmpl.loadReport('report-rules');
    } else if ('report-boards' === targetID) {
-      tmpl.subscription = Meteor.subscribe('boardsReport', () => {
-        tmpl.showBoardsReport.set(true);
-        tmpl.loading.set(false);
-      });
+      tmpl.showBoardsReport.set(true);
+      tmpl.boardsPage.set(1);
+      tmpl.boardsSearch.set('');
+      tmpl.loadReport('report-boards');
    } else if ('report-cards' === targetID) {
-      const qp = new QueryParams();
-      qp.addPredicate(OPERATOR_LIMIT, 300);
-      tmpl.subscription = Meteor.subscribe(
-        'globalSearch',
-        tmpl.sessionId,
-        qp.getParams(),
-        qp.text,
-        () => {
-          tmpl.showCardsReport.set(true);
-          tmpl.loading.set(false);
-        },
-      );
+      tmpl.showCardsReport.set(true);
+      tmpl.cardsPage.set(1);
+      tmpl.cardsSearch.set('');
+      tmpl.loadReport('report-cards');
    }
  }
 }
@@ -160,7 +313,7 @@ function switchMenu(event, tmpl) {

 Template.filesReport.helpers({
  results() {
-    return collectionResults(Attachments);
+    return collectionResults(Attachments, { name: 1 });
  },
  resultsCount() {
    return collectionResultsCount(Attachments);
@@ -176,19 +329,17 @@ Template.rulesReport.helpers({
  results() {
    const rules = [];

-    ReactiveCache.getRules().forEach(rule => {
+    ReactiveCache.getRules({}, { sort: { boardId: 1 } }).forEach(rule => {
      rules.push({
        _id: rule._id,
        title: rule.title,
        boardId: rule.boardId,
-        boardTitle: rule.board().title,
+        boardTitle: rule.board()?.title,
        action: rule.action(),
        trigger: rule.trigger(),
      });
    });

-    // eslint-disable-next-line no-console
-    console.log('rows:', rules);
    return rules;
  },
  resultsCount() {
@@ -200,7 +351,7 @@ Template.rulesReport.helpers({

 Template.boardsReport.helpers({
  results() {
-    return collectionResults(Boards);
+    return collectionResults(Boards, { sort: 1 });
  },
  resultsCount() {
    return collectionResultsCount(Boards);
@@ -244,7 +395,7 @@ Template.boardsReport.helpers({

 Template.cardsReport.helpers({
  results() {
-    return collectionResults(Cards);
+    return collectionResults(Cards, { boardId: 1, sort: 1 });
  },
  resultsCount() {
    return collectionResultsCount(Cards);
@@ -2,7 +2,241 @@
  display: flex;
  gap: 10px;
 }
+
+.attachments-content .move-compact-section,
+.setting-content .content-body .main-body .form-group .compact-block {
+  margin: 16px 0;
+  padding: 12px;
+  border: 1px solid #d0d7de;
+  border-radius: 6px;
+  background: #fff8e1;
+  max-width: 650px;
+  box-sizing: border-box;
+}
+
+.attachments-content .move-compact-section p,
+.setting-content .content-body .main-body .form-group .compact-block p {
+  max-width: 100%;
+  white-space: normal;
+  word-wrap: break-word;
+}
+
+.attachments-content .move-compact-section h4,
+.setting-content .content-body .main-body h4 {
+  margin: 0 0 6px;
+  font-size: 1em;
+  font-weight: 600;
+}
+
+.attachments-content .compact-result-list,
+.setting-content .content-body .main-body .compact-result-list {
+  margin: 6px 0 0;
+  padding-left: 20px;
+  font-size: 0.85em;
+  font-family: monospace;
+}
+
+.attachments-content .move-progress-section {
+  margin: 12px 0 16px;
+  padding: 12px;
+  border: 1px solid #d0d7de;
+  border-radius: 6px;
+  background: #f6f8fa;
+}
+
+.attachments-content .move-progress-header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 10px;
+}
+
+.attachments-content .move-progress-info {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+
+.attachments-content .move-progress-counter {
+  font-weight: 600;
+  font-size: 0.9em;
+}
+
+.attachments-content .move-progress-filename {
+  font-size: 0.85em;
+  color: #57606a;
+  word-break: break-all;
+}
+
+.attachments-content .move-progress-bar-track {
+  background: #dde1e4;
+  border-radius: 4px;
+  height: 8px;
+  overflow: hidden;
+  margin: 6px 0;
+}
+
+.attachments-content .move-progress-bar-fill {
+  background: #1976d2;
+  height: 100%;
+  border-radius: 4px;
+  transition: width 0.4s ease;
+  min-width: 2px;
+}
+
+.attachments-content .move-progress-bar-indeterminate {
+  height: 100%;
+  border-radius: 4px;
+  background: linear-gradient(90deg, transparent 0%, #1976d2 40%, #42a5f5 60%, transparent 100%);
+  background-size: 200% 100%;
+  animation: move-progress-slide 1.4s ease-in-out infinite;
+}
+
+@keyframes move-progress-slide {
+  0%   { background-position: 200% 0; }
+  100% { background-position: -200% 0; }
+}
+
+.attachments-content .move-progress-controls {
+  display: flex;
+  gap: 8px;
+  margin-top: 10px;
+}
+
+.attachments-content .move-storage-form {
+  display: flex;
+  align-items: flex-end;
+  gap: 12px;
+  flex-wrap: wrap;
+  margin-bottom: 16px;
+}
+
+.attachments-content .move-storage-selects {
+  display: flex;
+  align-items: flex-end;
+  gap: 12px;
+  flex-wrap: wrap;
+}
+
+.attachments-content .move-storage-form .form-group {
+  margin: 0;
+}
+
+.attachments-content .move-storage-form .form-group label {
+  display: block;
+  margin-bottom: 4px;
+  font-weight: 600;
+}
+
+.attachments-content .move-attachment-buttons button,
+.attachments-content .board-attachments td button {
+  background-color: #1976d2;
+  border: 1px solid #1565c0;
+  color: #fff;
+}
+
+.attachments-content .move-attachment-buttons button:hover,
+.attachments-content .board-attachments td button:hover {
+  background-color: #1565c0;
+  color: #fff;
+}
+
 .attachments-content hr {
  height: 0px;
  border: 1px solid #000;
 }
+
+
+.setting-content .content-body .main-body .storage-rw-row {
+  display: flex;
+  align-items: center;
+  gap: 24px;
+  margin-bottom: 12px;
+  padding: 6px 0;
+}
+
+.setting-content .content-body .main-body .storage-rw-item {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+}
+
+.setting-content .content-body .main-body .storage-rw-row input[type="checkbox"] {
+  position: static;
+  left: auto;
+  visibility: visible;
+  display: inline-block;
+  width: 16px;
+  height: 16px;
+  margin: 0;
+  flex-shrink: 0;
+  cursor: pointer;
+}
+
+.setting-content .content-body .main-body .storage-rw-row input[type="checkbox"]:disabled {
+  cursor: default;
+  opacity: 0.6;
+}
+
+.setting-content .content-body .main-body .storage-rw-row label {
+  margin: 0;
+  font-weight: 600;
+  cursor: pointer;
+}
+
+.setting-content .content-body .main-body .storage-rw-row input[type="checkbox"]:disabled + label {
+  cursor: default;
+  opacity: 0.6;
+}
+
+.setting-content .content-body .main-body .gridfs-stats-table {
+  border-collapse: collapse;
+  margin-top: 12px;
+  width: auto !important;
+  min-width: 0 !important;
+}
+
+.setting-content .content-body .main-body .gridfs-stats-table th,
+.setting-content .content-body .main-body .gridfs-stats-table td {
+  border: 1px solid #d0d7de;
+  padding: 6px 8px;
+  text-align: left;
+  white-space: nowrap;
+  min-width: 0 !important;
+}
+
+/* Cloud storage (S3 / Azure / GCS): example value shown below each input. */
+.attachments-content .cloud-input-example {
+  display: block;
+  color: #888;
+  font-size: 0.82em;
+  font-family: monospace;
+  word-break: break-all;
+  line-height: 1.35;
+}
+
+/* Cloud storage: where-to-find-this-value path shown below the example. */
+.attachments-content .cloud-input-path {
+  display: block;
+  color: #6a737d;
+  font-size: 0.82em;
+  line-height: 1.4;
+  margin-top: 2px;
+}
+
+/* Cloud storage: translated label shown under the (English) label. */
+.attachments-content .cloud-input-label-tr {
+  display: block;
+  color: #57606a;
+  font-size: 0.9em;
+  margin-bottom: 4px;
+}
+
+/* Cloud storage: description text (English literal and translated). */
+.attachments-content .cloud-input-desc {
+  display: block;
+  color: #6a737d;
+  font-size: 0.82em;
+  line-height: 1.4;
+  margin-top: 2px;
+}