From 80558976c54615a1c82fe257b6f0317bd1a986cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Sun, 11 Oct 2026 19:54:09 +0100
Subject: [PATCH 01/16] feat: daily D1 backups to R2 with a scheduled Workflow

- BackupWorkflow (splitpro-backup, 03:00 UTC): starts a D1 REST export, polls
  until the signed URL is ready, streams the SQL dump into the splitpro-backups
  R2 bucket, then prunes dumps older than BACKUP_RETENTION_DAYS (default 90)
- failures are logged to Workers Logs and retried per step
- wrangler.example.jsonc / README: bucket, workflow, vars, restore steps
---
 README.md                      |  12 ++++
 src/server/workflows/backup.ts | 126 +++++++++++++++++++++++++++++++++
 worker/index.ts                |   1 +
 wrangler.example.jsonc         |  15 +++-
 4 files changed, 153 insertions(+), 1 deletion(-)
 create mode 100644 src/server/workflows/backup.ts

diff --git a/README.md b/README.md
index 53df55798..0c812e3af 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,18 @@ setting belongs only in `previews.vars`, not production `vars`.
 - `drizzle-kit` and `wrangler d1 migrations` own the schema. `migrations/0001_balance_view_and_triggers.sql`
   is hand-written (the `BalanceView` view and a trigger). Back it up before regenerating migrations.
 
+## Backups
+
+- **Time Travel:** D1 keeps point-in-time history for 30 days on the Workers Paid plan.
+  Restore with `npx wrangler d1 time-travel restore splitpro --timestamp=<unix>`.
+- **Daily dump to R2:** the `splitpro-backup` Workflow (03:00 UTC) exports the database through the
+  D1 REST API into the `splitpro-backups` bucket (`d1/splitpro-<date>-<time>.sql`) and prunes dumps
+  older than `BACKUP_RETENTION_DAYS` (default 90). It needs the `D1_EXPORT_TOKEN` secret, an API token
+  with **D1 Write** on your account (the export endpoint rejects D1 Read), and the `CF_ACCOUNT_ID` and
+  `D1_DATABASE_ID` vars. Restore a dump into a database with
+  `npx wrangler d1 execute <db> --remote --file <dump>.sql`.
+- Trigger one by hand: `npx wrangler workflows trigger splitpro-backup`.
+
 ## Tests
 
 ```sh
diff --git a/src/server/workflows/backup.ts b/src/server/workflows/backup.ts
new file mode 100644
index 000000000..d2047f261
--- /dev/null
+++ b/src/server/workflows/backup.ts
@@ -0,0 +1,126 @@
+/**
+ * Backup Workflow: exports the D1 database to R2 as a SQL dump once a day.
+ *
+ * D1 Time Travel already allows point-in-time restores for 30 days (Workers Paid). These dumps
+ * are for longer retention and for restoring into a fresh database. Restore with
+ * `wrangler d1 execute <db> --remote --file <dump>.sql`.
+ *
+ * Uses the D1 REST export API (consistent snapshot, includes views and triggers), so it needs
+ * the `D1_EXPORT_TOKEN` secret (a scoped API token) plus the CF_ACCOUNT_ID and D1_DATABASE_ID vars.
+ */
+import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
+
+import { bindings } from '~/server/db';
+import { logError } from '~/server/observability/errorLog';
+
+interface BackupBindings {
+  BACKUPS: R2Bucket;
+  CF_ACCOUNT_ID: string;
+  D1_DATABASE_ID: string;
+  D1_EXPORT_TOKEN: string;
+  BACKUP_RETENTION_DAYS?: string;
+}
+
+interface ExportResponse {
+  success?: boolean;
+  errors?: { message: string }[];
+  result?: {
+    status?: string;
+    at_bookmark?: string;
+    signed_url?: string;
+    filename?: string;
+    error?: string;
+  };
+}
+
+const PREFIX = 'd1/';
+const DEFAULT_RETENTION_DAYS = 90;
+
+const steps = {
+  start: { retries: { limit: 5, delay: '15 seconds', backoff: 'exponential' } },
+  // The export is prepared asynchronously; poll until the signed URL is ready.
+  poll: { retries: { limit: 20, delay: '15 seconds', backoff: 'constant' } },
+  store: { retries: { limit: 5, delay: '30 seconds', backoff: 'exponential' } },
+} as const;
+
+export class BackupWorkflow extends WorkflowEntrypoint {
+  async run(event: WorkflowEvent<unknown>, step: WorkflowStep) {
+    const env = bindings as unknown as BackupBindings;
+    const when = new Date(event.schedule?.scheduledTime ?? event.timestamp.getTime());
+    const exportUrl = `https://api.cloudflare.com/client/v4/accounts/${env.CF_ACCOUNT_ID}/d1/database/${env.D1_DATABASE_ID}/export`;
+
+    const call = async (body: Record<string, unknown>) => {
+      const response = await fetch(exportUrl, {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${env.D1_EXPORT_TOKEN}`,
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify(body),
+      });
+      const json = (await response.json()) as ExportResponse;
+      if (!response.ok || json.success === false) {
+        throw new Error(
+          `D1 export API ${response.status}: ${json.errors?.map((e) => e.message).join('; ') ?? 'unknown error'}`,
+        );
+      }
+      return json.result ?? {};
+    };
+
+    try {
+      const bookmark = await step.do('start export', steps.start, async () => {
+        const result = await call({ output_format: 'polling' });
+        if (!result.at_bookmark) {
+          throw new Error('Export did not return a bookmark');
+        }
+        return result.at_bookmark;
+      });
+
+      const key = await step.do('download and store in R2', steps.poll, async () => {
+        const result = await call({ output_format: 'polling', current_bookmark: bookmark });
+        if (result.status === 'error') {
+          throw new Error(`Export failed: ${result.error ?? 'unknown'}`);
+        }
+        if (!result.signed_url) {
+          throw new Error('Export not ready yet');
+        }
+        const dump = await fetch(result.signed_url);
+        if (!dump.ok || !dump.body) {
+          throw new Error(`Could not download the export (${dump.status})`);
+        }
+        const day = when.toISOString().slice(0, 10);
+        const time = when.toISOString().slice(11, 16).replace(':', '');
+        const objectKey = `${PREFIX}splitpro-${day}-${time}.sql`;
+        await env.BACKUPS.put(objectKey, dump.body, {
+          customMetadata: { bookmark, createdAt: when.toISOString() },
+        });
+        return objectKey;
+      });
+
+      const pruned = await step.do('prune old backups', steps.store, async () => {
+        const days = Number(env.BACKUP_RETENTION_DAYS ?? DEFAULT_RETENTION_DAYS);
+        const cutoff = when.getTime() - days * 86_400_000;
+        const stale: string[] = [];
+        let cursor: string | undefined;
+        do {
+          const page = await env.BACKUPS.list({ prefix: PREFIX, cursor });
+          for (const object of page.objects) {
+            if (object.uploaded.getTime() < cutoff) {
+              stale.push(object.key);
+            }
+          }
+          cursor = page.truncated ? page.cursor : undefined;
+        } while (cursor);
+        if (stale.length > 0) {
+          await env.BACKUPS.delete(stale);
+        }
+        return stale.length;
+      });
+
+      return { key, pruned };
+    } catch (error) {
+      logError('workflow', error, { step: 'backup', instanceId: event.instanceId });
+      throw error;
+    }
+  }
+}
diff --git a/worker/index.ts b/worker/index.ts
index 90e3fca08..62332daa0 100644
--- a/worker/index.ts
+++ b/worker/index.ts
@@ -11,6 +11,7 @@ import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { logError } from '../src/server/observability/errorLog';
 import { PREVIEW_ACCESS_EMAIL_HEADER, PREVIEW_ACCESS_NAME_HEADER } from '../src/server/preview-access';
 
+export { BackupWorkflow } from '../src/server/workflows/backup';
 export { SchedulerWorkflow } from '../src/server/workflows/scheduler';
 
 addEventListener('unhandledrejection', (event: Event) => {
diff --git a/wrangler.example.jsonc b/wrangler.example.jsonc
index cb2dd0e89..88f32018b 100644
--- a/wrangler.example.jsonc
+++ b/wrangler.example.jsonc
@@ -27,7 +27,10 @@
       "migrations_dir": "migrations",
     },
   ],
-  "r2_buckets": [{ "binding": "UPLOADS", "bucket_name": "splitpro-uploads" }],
+  "r2_buckets": [
+    { "binding": "UPLOADS", "bucket_name": "splitpro-uploads" },
+    { "binding": "BACKUPS", "bucket_name": "splitpro-backups" },
+  ],
   "send_email": [{ "name": "EMAIL" }],
   "workflows": [
     {
@@ -38,6 +41,13 @@
       // and (on CLEAR_CACHE_CRON_RULE) clean up cached bank data and currency rates.
       "schedules": ["* * * * *"],
     },
+    {
+      // Daily D1 export to R2 (03:00 UTC). Needs the D1_EXPORT_TOKEN secret.
+      "name": "splitpro-backup",
+      "binding": "BACKUP",
+      "class_name": "BackupWorkflow",
+      "schedules": ["0 3 * * *"],
+    },
   ],
   "vars": {
     "NEXTAUTH_URL": "https://split.example.com",
@@ -51,6 +61,9 @@
     "CACHE_RETENTION_INTERVAL": "2 days",
     "CURRENCY_RATE_PROVIDER": "frankfurter",
     "UPLOAD_MAX_FILE_SIZE_MB": "10",
+    "CF_ACCOUNT_ID": "YOUR_ACCOUNT_ID",
+    "D1_DATABASE_ID": "00000000-0000-0000-0000-000000000000",
+    "BACKUP_RETENTION_DAYS": "90",
   },
   "previews": {
     "vars": {

From d973f1a182241eb8e18b3424901bf47847a3dccf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Sun, 11 Oct 2026 20:39:03 +0100
Subject: [PATCH 02/16] Back up D1 and uploaded files to R2

---
 README.md                                     |  23 +++-
 src/server/db/index.ts                        |   6 +
 src/server/workflows/backup.ts                | 129 ++++++++++++------
 src/server/workflows/backupProtocol.ts        |  43 ++++++
 src/server/workflows/backupStorage.ts         |  51 +++++++
 .../backupProtocol.integration.test.ts        |  42 ++++++
 .../integration/r2Backup.integration.test.ts  |  63 +++++++++
 test/wrangler.test.jsonc                      |   5 +-
 wrangler.example.jsonc                        |   2 +-
 9 files changed, 314 insertions(+), 50 deletions(-)
 create mode 100644 src/server/workflows/backupProtocol.ts
 create mode 100644 src/server/workflows/backupStorage.ts
 create mode 100644 src/tests/integration/backupProtocol.integration.test.ts
 create mode 100644 src/tests/integration/r2Backup.integration.test.ts

diff --git a/README.md b/README.md
index 0c812e3af..47cf417ef 100644
--- a/README.md
+++ b/README.md
@@ -89,12 +89,23 @@ setting belongs only in `previews.vars`, not production `vars`.
 
 - **Time Travel:** D1 keeps point-in-time history for 30 days on the Workers Paid plan.
   Restore with `npx wrangler d1 time-travel restore splitpro --timestamp=<unix>`.
-- **Daily dump to R2:** the `splitpro-backup` Workflow (03:00 UTC) exports the database through the
-  D1 REST API into the `splitpro-backups` bucket (`d1/splitpro-<date>-<time>.sql`) and prunes dumps
-  older than `BACKUP_RETENTION_DAYS` (default 90). It needs the `D1_EXPORT_TOKEN` secret, an API token
-  with **D1 Write** on your account (the export endpoint rejects D1 Read), and the `CF_ACCOUNT_ID` and
-  `D1_DATABASE_ID` vars. Restore a dump into a database with
-  `npx wrangler d1 execute <db> --remote --file <dump>.sql`.
+- **Daily backup to R2:** the `splitpro-backup` Workflow (03:00 UTC) exports D1 through the REST API
+  to `d1/splitpro-<date>-<time>.sql`, then writes a JSON manifest beside it. It also paginates the
+  `UPLOADS` bucket and copies new or changed objects to `uploads/<original-key>` in the private
+  `splitpro-backups` bucket, preserving HTTP and custom metadata. Existing upload copies are retained
+  even if their source object is later deleted, so R2 upload backups are not pruned automatically.
+  SQL dumps and manifests older than `BACKUP_RETENTION_DAYS` (default 90) are pruned. The D1 export
+  endpoint may block database requests while an export is running. It needs the `D1_EXPORT_TOKEN`
+  secret (an API token with **D1 Write**; the endpoint rejects D1 Read), and the `CF_ACCOUNT_ID` and
+  `D1_DATABASE_ID` vars.
+- **Restore:** load a SQL dump into a database with
+  `npx wrangler d1 execute <db> --remote --file <dump>.sql`, then copy objects under the backup
+  bucket's `uploads/` prefix back to `UPLOADS`, removing that prefix from each key. The application
+  code, migrations, and non-secret Worker configuration are in Git. Recreate Worker secrets from a
+  secure password manager; they cannot be recovered from a database or R2 dump.
+- Both buckets are in the same Cloudflare account. This protects against application-level deletion
+  from `UPLOADS`, but not account compromise or account-wide deletion; keep an additional copy in a
+  separate account or provider for that threat model.
 - Trigger one by hand: `npx wrangler workflows trigger splitpro-backup`.
 
 ## Tests
diff --git a/src/server/db/index.ts b/src/server/db/index.ts
index 5454b7f1f..c6b025f47 100644
--- a/src/server/db/index.ts
+++ b/src/server/db/index.ts
@@ -9,8 +9,14 @@ export type DB = DrizzleD1Database<typeof schema>;
 export interface AppBindings {
   DB: D1Database;
   UPLOADS: R2Bucket;
+  BACKUPS: R2Bucket;
   EMAIL?: SendEmail;
   SCHEDULER?: Workflow;
+  BACKUP?: Workflow;
+  CF_ACCOUNT_ID: string;
+  D1_DATABASE_ID: string;
+  D1_EXPORT_TOKEN: string;
+  BACKUP_RETENTION_DAYS?: string;
   [key: string]: unknown;
 }
 
diff --git a/src/server/workflows/backup.ts b/src/server/workflows/backup.ts
index d2047f261..b836a2e60 100644
--- a/src/server/workflows/backup.ts
+++ b/src/server/workflows/backup.ts
@@ -1,5 +1,5 @@
 /**
- * Backup Workflow: exports the D1 database to R2 as a SQL dump once a day.
+ * Backup Workflow: exports D1 and mirrors uploaded files to a private R2 bucket once a day.
  *
  * D1 Time Travel already allows point-in-time restores for 30 days (Workers Paid). These dumps
  * are for longer retention and for restoring into a fresh database. Restore with
@@ -10,43 +10,39 @@
  */
 import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
 
-import { bindings } from '~/server/db';
+import { type AppBindings } from '~/server/db';
 import { logError } from '~/server/observability/errorLog';
+import { copyUploadPage, type UploadObjectSummary } from './backupStorage';
+import { getD1ExportFile, isD1ExportResponse } from './backupProtocol';
 
-interface BackupBindings {
-  BACKUPS: R2Bucket;
-  CF_ACCOUNT_ID: string;
-  D1_DATABASE_ID: string;
-  D1_EXPORT_TOKEN: string;
-  BACKUP_RETENTION_DAYS?: string;
-}
-
-interface ExportResponse {
-  success?: boolean;
-  errors?: { message: string }[];
-  result?: {
-    status?: string;
-    at_bookmark?: string;
-    signed_url?: string;
-    filename?: string;
-    error?: string;
-  };
-}
-
-const PREFIX = 'd1/';
+const D1_PREFIX = 'd1/';
+const UPLOADS_PREFIX = 'uploads/';
 const DEFAULT_RETENTION_DAYS = 90;
+const UPLOADS_PAGE_SIZE = 100;
 
 const steps = {
   start: { retries: { limit: 5, delay: '15 seconds', backoff: 'exponential' } },
   // The export is prepared asynchronously; poll until the signed URL is ready.
   poll: { retries: { limit: 20, delay: '15 seconds', backoff: 'constant' } },
+  list: { retries: { limit: 5, delay: '15 seconds', backoff: 'exponential' } },
+  copy: {
+    retries: { limit: 5, delay: '30 seconds', backoff: 'exponential' },
+    timeout: '25 minutes',
+  },
   store: { retries: { limit: 5, delay: '30 seconds', backoff: 'exponential' } },
 } as const;
 
-export class BackupWorkflow extends WorkflowEntrypoint {
+export class BackupWorkflow extends WorkflowEntrypoint<AppBindings> {
   async run(event: WorkflowEvent<unknown>, step: WorkflowStep) {
-    const env = bindings as unknown as BackupBindings;
+    const env = this.env;
     const when = new Date(event.schedule?.scheduledTime ?? event.timestamp.getTime());
+    const retentionDays = Number(env.BACKUP_RETENTION_DAYS ?? DEFAULT_RETENTION_DAYS);
+    if (!Number.isInteger(retentionDays) || retentionDays < 1) {
+      throw new Error('BACKUP_RETENTION_DAYS must be a positive integer');
+    }
+
+    const day = when.toISOString().slice(0, 10);
+    const time = when.toISOString().slice(11, 16).replace(':', '');
     const exportUrl = `https://api.cloudflare.com/client/v4/accounts/${env.CF_ACCOUNT_ID}/d1/database/${env.D1_DATABASE_ID}/export`;
 
     const call = async (body: Record<string, unknown>) => {
@@ -58,7 +54,10 @@ export class BackupWorkflow extends WorkflowEntrypoint {
         },
         body: JSON.stringify(body),
       });
-      const json = (await response.json()) as ExportResponse;
+      const json: unknown = await response.json();
+      if (!isD1ExportResponse(json)) {
+        throw new Error(`D1 export API ${response.status}: invalid response`);
+      }
       if (!response.ok || json.success === false) {
         throw new Error(
           `D1 export API ${response.status}: ${json.errors?.map((e) => e.message).join('; ') ?? 'unknown error'}`,
@@ -76,48 +75,94 @@ export class BackupWorkflow extends WorkflowEntrypoint {
         return result.at_bookmark;
       });
 
-      const key = await step.do('download and store in R2', steps.poll, async () => {
+      const databaseKey = await step.do('download and store D1 export', steps.poll, async () => {
         const result = await call({ output_format: 'polling', current_bookmark: bookmark });
         if (result.status === 'error') {
           throw new Error(`Export failed: ${result.error ?? 'unknown'}`);
         }
-        if (!result.signed_url) {
+        const file = getD1ExportFile(result);
+        if (!file?.signed_url) {
           throw new Error('Export not ready yet');
         }
-        const dump = await fetch(result.signed_url);
+        const dump = await fetch(file.signed_url);
         if (!dump.ok || !dump.body) {
           throw new Error(`Could not download the export (${dump.status})`);
         }
-        const day = when.toISOString().slice(0, 10);
-        const time = when.toISOString().slice(11, 16).replace(':', '');
-        const objectKey = `${PREFIX}splitpro-${day}-${time}.sql`;
+        const objectKey = `${D1_PREFIX}splitpro-${day}-${time}.sql`;
         await env.BACKUPS.put(objectKey, dump.body, {
           customMetadata: { bookmark, createdAt: when.toISOString() },
         });
         return objectKey;
       });
 
-      const pruned = await step.do('prune old backups', steps.store, async () => {
-        const days = Number(env.BACKUP_RETENTION_DAYS ?? DEFAULT_RETENTION_DAYS);
-        const cutoff = when.getTime() - days * 86_400_000;
+      let cursor: string | undefined = undefined;
+      let pageNumber = 0;
+      let uploadsScanned = 0;
+      let uploadsCopied = 0;
+      do {
+        const page = await step.do(`list upload objects ${pageNumber}`, steps.list, async () => {
+          const listed = await env.UPLOADS.list({
+            prefix: '',
+            limit: UPLOADS_PAGE_SIZE,
+            ...(cursor ? { cursor } : {}),
+          });
+          if (listed.truncated && !listed.cursor) {
+            throw new Error('R2 upload listing was truncated without a cursor');
+          }
+          const objects: UploadObjectSummary[] = listed.objects.map(({ key, etag, size }) => ({
+            key,
+            etag,
+            size,
+          }));
+          return {
+            objects,
+            cursor: listed.truncated ? listed.cursor! : null,
+          };
+        });
+
+        const copied = await step.do(`copy upload objects ${pageNumber}`, steps.copy, async () =>
+          copyUploadPage(env.UPLOADS, env.BACKUPS, page.objects),
+        );
+        uploadsScanned += page.objects.length;
+        uploadsCopied += copied;
+        cursor = page.cursor ?? undefined;
+        pageNumber += 1;
+      } while (cursor);
+
+      const manifestKey = await step.do('write backup manifest', steps.store, async () => {
+        const key = `${D1_PREFIX}splitpro-${day}-${time}.json`;
+        const manifest = {
+          version: 1,
+          createdAt: when.toISOString(),
+          database: { key: databaseKey, bookmark },
+          uploads: { prefix: UPLOADS_PREFIX, scanned: uploadsScanned, copied: uploadsCopied },
+        };
+        await env.BACKUPS.put(key, JSON.stringify(manifest, null, 2), {
+          httpMetadata: { contentType: 'application/json' },
+        });
+        return key;
+      });
+
+      const pruned = await step.do('prune old D1 backup artifacts', steps.store, async () => {
+        const cutoff = when.getTime() - retentionDays * 86_400_000;
         const stale: string[] = [];
-        let cursor: string | undefined;
+        let pruneCursor: string | undefined;
         do {
-          const page = await env.BACKUPS.list({ prefix: PREFIX, cursor });
+          const page = await env.BACKUPS.list({ prefix: D1_PREFIX, cursor: pruneCursor });
           for (const object of page.objects) {
             if (object.uploaded.getTime() < cutoff) {
               stale.push(object.key);
             }
           }
-          cursor = page.truncated ? page.cursor : undefined;
-        } while (cursor);
-        if (stale.length > 0) {
-          await env.BACKUPS.delete(stale);
+          pruneCursor = page.truncated ? page.cursor : undefined;
+        } while (pruneCursor);
+        for (let index = 0; index < stale.length; index += 1000) {
+          await env.BACKUPS.delete(stale.slice(index, index + 1000));
         }
         return stale.length;
       });
 
-      return { key, pruned };
+      return { databaseKey, manifestKey, uploadsScanned, uploadsCopied, pruned };
     } catch (error) {
       logError('workflow', error, { step: 'backup', instanceId: event.instanceId });
       throw error;
diff --git a/src/server/workflows/backupProtocol.ts b/src/server/workflows/backupProtocol.ts
new file mode 100644
index 000000000..1aeac1081
--- /dev/null
+++ b/src/server/workflows/backupProtocol.ts
@@ -0,0 +1,43 @@
+export interface D1ExportFile {
+  filename?: string;
+  signed_url?: string;
+}
+
+export interface D1ExportResult {
+  status?: 'complete' | 'error';
+  at_bookmark?: string;
+  error?: string;
+  result?: D1ExportFile;
+}
+
+export interface D1ExportResponse {
+  success?: boolean;
+  errors?: { message: string }[];
+  result?: D1ExportResult | null;
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  null !== value && 'object' === typeof value;
+
+const isOptionalString = (value: unknown) => undefined === value || 'string' === typeof value;
+
+const isD1ExportFile = (value: unknown): value is D1ExportFile =>
+  isRecord(value) && isOptionalString(value.filename) && isOptionalString(value.signed_url);
+
+const isD1ExportResult = (value: unknown): value is D1ExportResult =>
+  isRecord(value) &&
+  (undefined === value.status || 'complete' === value.status || 'error' === value.status) &&
+  isOptionalString(value.at_bookmark) &&
+  isOptionalString(value.error) &&
+  (undefined === value.result || isD1ExportFile(value.result));
+
+export const isD1ExportResponse = (value: unknown): value is D1ExportResponse =>
+  isRecord(value) &&
+  (undefined === value.success || 'boolean' === typeof value.success) &&
+  (undefined === value.errors ||
+    (Array.isArray(value.errors) &&
+      value.errors.every((error) => isRecord(error) && 'string' === typeof error.message))) &&
+  (undefined === value.result || null === value.result || isD1ExportResult(value.result));
+
+/** The API nests the completed file metadata inside result.result. */
+export const getD1ExportFile = (result: D1ExportResult) => result.result;
diff --git a/src/server/workflows/backupStorage.ts b/src/server/workflows/backupStorage.ts
new file mode 100644
index 000000000..e0258baac
--- /dev/null
+++ b/src/server/workflows/backupStorage.ts
@@ -0,0 +1,51 @@
+const UPLOADS_PREFIX = 'uploads/';
+const COPY_CONCURRENCY = 5;
+
+export interface UploadObjectSummary {
+  key: string;
+  etag: string;
+  size: number;
+}
+
+const copyUploadObject = async (
+  uploads: R2Bucket,
+  backups: R2Bucket,
+  object: UploadObjectSummary,
+) => {
+  const backupKey = `${UPLOADS_PREFIX}${object.key}`;
+  const existing = await backups.head(backupKey);
+  if (existing?.etag === object.etag && existing.size === object.size) {
+    return false;
+  }
+
+  const source = await uploads.get(object.key);
+  if (!source?.body) {
+    throw new Error(`Upload disappeared while backing up: ${object.key}`);
+  }
+
+  const copied = await backups.put(backupKey, source.body, {
+    ...(source.httpMetadata ? { httpMetadata: source.httpMetadata } : {}),
+    ...(source.customMetadata ? { customMetadata: source.customMetadata } : {}),
+  });
+  if (!copied || copied.etag !== source.etag || copied.size !== source.size) {
+    throw new Error(`Could not verify uploaded backup object: ${object.key}`);
+  }
+  return true;
+};
+
+/** Idempotently mirrors one page of uploads while bounding concurrent object streams. */
+export const copyUploadPage = async (
+  uploads: R2Bucket,
+  backups: R2Bucket,
+  objects: UploadObjectSummary[],
+) => {
+  let copied = 0;
+  for (let index = 0; index < objects.length; index += COPY_CONCURRENCY) {
+    const page = objects.slice(index, index + COPY_CONCURRENCY);
+    const results = await Promise.all(
+      page.map((object) => copyUploadObject(uploads, backups, object)),
+    );
+    copied += results.filter(Boolean).length;
+  }
+  return copied;
+};
diff --git a/src/tests/integration/backupProtocol.integration.test.ts b/src/tests/integration/backupProtocol.integration.test.ts
new file mode 100644
index 000000000..d35b2b54d
--- /dev/null
+++ b/src/tests/integration/backupProtocol.integration.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+
+import { getD1ExportFile, isD1ExportResponse } from '~/server/workflows/backupProtocol';
+
+describe('D1 export response', () => {
+  it('reads the signed download URL from the nested completed result', () => {
+    const file = getD1ExportFile({
+      status: 'complete',
+      result: {
+        filename: 'splitpro.sql',
+        signed_url: 'https://example.com/splitpro.sql',
+      },
+    });
+
+    expect(file).toEqual({
+      filename: 'splitpro.sql',
+      signed_url: 'https://example.com/splitpro.sql',
+    });
+  });
+
+  it('returns no file while the export is still running', () => {
+    expect(getD1ExportFile({ at_bookmark: 'bookmark' })).toBeUndefined();
+  });
+
+  it('accepts the complete API response shape and rejects malformed nested file data', () => {
+    expect(
+      isD1ExportResponse({
+        success: true,
+        result: {
+          status: 'complete',
+          result: { filename: 'splitpro.sql', signed_url: 'https://example.com/splitpro.sql' },
+        },
+      }),
+    ).toBe(true);
+    expect(
+      isD1ExportResponse({
+        success: true,
+        result: { status: 'complete', result: { signed_url: 42 } },
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/src/tests/integration/r2Backup.integration.test.ts b/src/tests/integration/r2Backup.integration.test.ts
new file mode 100644
index 000000000..b1c25ad02
--- /dev/null
+++ b/src/tests/integration/r2Backup.integration.test.ts
@@ -0,0 +1,63 @@
+import { env } from 'cloudflare:workers';
+import { describe, expect, it } from 'vitest';
+
+import { copyUploadPage } from '~/server/workflows/backupStorage';
+
+const buckets = env as unknown as { UPLOADS: R2Bucket; BACKUPS: R2Bucket };
+
+describe('R2 upload backup', () => {
+  it('copies upload contents and metadata, skips unchanged objects, and refreshes changed objects', async () => {
+    const key = `backup-test/${crypto.randomUUID()}`;
+    const backupKey = `uploads/${key}`;
+
+    try {
+      await buckets.UPLOADS.put(key, 'first version', {
+        httpMetadata: { contentType: 'text/plain' },
+        customMetadata: { uploadedBy: 'test-user' },
+      });
+      const firstSource = await buckets.UPLOADS.head(key);
+      expect(firstSource).not.toBeNull();
+      if (!firstSource) {
+        throw new Error('Test upload was not stored');
+      }
+
+      expect(
+        await copyUploadPage(buckets.UPLOADS, buckets.BACKUPS, [
+          { key, etag: firstSource.etag, size: firstSource.size },
+        ]),
+      ).toBe(1);
+
+      const firstBackup = await buckets.BACKUPS.get(backupKey);
+      expect(firstBackup?.body).toBeDefined();
+      expect(await firstBackup?.text()).toBe('first version');
+      expect(firstBackup?.httpMetadata?.contentType).toBe('text/plain');
+      expect(firstBackup?.customMetadata).toEqual({ uploadedBy: 'test-user' });
+
+      expect(
+        await copyUploadPage(buckets.UPLOADS, buckets.BACKUPS, [
+          { key, etag: firstSource.etag, size: firstSource.size },
+        ]),
+      ).toBe(0);
+
+      await buckets.UPLOADS.put(key, 'updated version', {
+        httpMetadata: { contentType: 'application/json' },
+      });
+      const updatedSource = await buckets.UPLOADS.head(key);
+      if (!updatedSource) {
+        throw new Error('Updated test upload was not stored');
+      }
+
+      expect(
+        await copyUploadPage(buckets.UPLOADS, buckets.BACKUPS, [
+          { key, etag: updatedSource.etag, size: updatedSource.size },
+        ]),
+      ).toBe(1);
+
+      const updatedBackup = await buckets.BACKUPS.get(backupKey);
+      expect(await updatedBackup?.text()).toBe('updated version');
+      expect(updatedBackup?.httpMetadata?.contentType).toBe('application/json');
+    } finally {
+      await Promise.all([buckets.UPLOADS.delete(key), buckets.BACKUPS.delete(backupKey)]);
+    }
+  });
+});
diff --git a/test/wrangler.test.jsonc b/test/wrangler.test.jsonc
index 4cc58e1a3..765e6e24d 100644
--- a/test/wrangler.test.jsonc
+++ b/test/wrangler.test.jsonc
@@ -11,7 +11,10 @@
       "migrations_dir": "../migrations",
     },
   ],
-  "r2_buckets": [{ "binding": "UPLOADS", "bucket_name": "splitpro-test-uploads" }],
+  "r2_buckets": [
+    { "binding": "UPLOADS", "bucket_name": "splitpro-test-uploads" },
+    { "binding": "BACKUPS", "bucket_name": "splitpro-test-backups" },
+  ],
   "vars": {
     "SKIP_ENV_VALIDATION": "1",
     "NEXTAUTH_URL": "http://localhost:8787",
diff --git a/wrangler.example.jsonc b/wrangler.example.jsonc
index 88f32018b..85d4f4d08 100644
--- a/wrangler.example.jsonc
+++ b/wrangler.example.jsonc
@@ -42,7 +42,7 @@
       "schedules": ["* * * * *"],
     },
     {
-      // Daily D1 export to R2 (03:00 UTC). Needs the D1_EXPORT_TOKEN secret.
+      // Daily D1 and R2 uploads backup to the BACKUPS bucket (03:00 UTC).
       "name": "splitpro-backup",
       "binding": "BACKUP",
       "class_name": "BackupWorkflow",

From 74d2db73c9c528527dbdb0b9b3efb6b52a8a119a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:07:16 +0100
Subject: [PATCH 03/16] fix: refresh balance queries after expense mutations

---
 .../AddExpense/AddBankTransactions.tsx         |  6 +++++-
 src/components/AddExpense/AddExpensePage.tsx   |  7 ++++++-
 src/components/Expense/DeleteExpense.tsx       |  5 ++++-
 src/components/Expense/ExpenseDetails.tsx      | 18 ++++++++++++++----
 src/components/Friend/GroupSettleup.tsx        | 18 ++++++++++++++----
 src/components/Friend/Settleup.tsx             | 10 +++++-----
 src/hooks/useInvalidateExpenseQueries.ts       | 15 +++++++++++++++
 7 files changed, 63 insertions(+), 16 deletions(-)
 create mode 100644 src/hooks/useInvalidateExpenseQueries.ts

diff --git a/src/components/AddExpense/AddBankTransactions.tsx b/src/components/AddExpense/AddBankTransactions.tsx
index b5d1aa268..5ecfd67f6 100644
--- a/src/components/AddExpense/AddBankTransactions.tsx
+++ b/src/components/AddExpense/AddBankTransactions.tsx
@@ -1,4 +1,5 @@
 import React, { useCallback } from 'react';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { calculateParticipantSplit, useAddExpenseStore } from '~/store/addStore';
 import type { TransactionAddInputModel } from '~/types';
 import { BankingTransactionList } from './BankTransactions/BankingTransactionList';
@@ -35,6 +36,7 @@ const AddBankTransactions: React.FC<{
   } = useAddExpenseStore((s) => s.actions);
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const router = useRouter();
 
@@ -99,7 +101,8 @@ const AddBankTransactions: React.FC<{
       }) as CreateExpense[];
 
     await addExpenseMutation.mutateAsync(expenses, {
-      onSuccess: () => {
+      onSuccess: async () => {
+        await invalidateExpenseQueries();
         setMultipleTransactions([]);
         setIsTransactionLoading(false);
         router.back();
@@ -114,6 +117,7 @@ const AddBankTransactions: React.FC<{
     router,
     resetState,
     addExpenseMutation,
+    invalidateExpenseQueries,
     group,
     paidBy,
     splitType,
diff --git a/src/components/AddExpense/AddExpensePage.tsx b/src/components/AddExpense/AddExpensePage.tsx
index 77ce43b43..00e9afba8 100644
--- a/src/components/AddExpense/AddExpensePage.tsx
+++ b/src/components/AddExpense/AddExpensePage.tsx
@@ -5,6 +5,7 @@ import { useRouter } from 'next/router';
 import React, { useCallback } from 'react';
 
 import { type CurrencyCode } from '~/lib/currency';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { useAddExpenseStore } from '~/store/addStore';
 import { api } from '~/utils/api';
 
@@ -72,6 +73,7 @@ export const AddOrEditExpensePage: React.FC<{
   } = useAddExpenseStore((s) => s.actions);
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
   const updateProfile = api.user.updateUserDetail.useMutation();
   const { update } = useSession();
 
@@ -137,8 +139,10 @@ export const AddOrEditExpensePage: React.FC<{
           },
         ],
         {
-          onSuccess: (d) => {
+          onSuccess: async (d) => {
             if (d) {
+              await invalidateExpenseQueries();
+
               if (multipleTransactions.length > 0) {
                 const allTransactions = [...multipleTransactions];
                 const transactionToAdd = allTransactions.pop();
@@ -198,6 +202,7 @@ export const AddOrEditExpensePage: React.FC<{
     expenseId,
     router,
     addExpenseMutation,
+    invalidateExpenseQueries,
     group,
     paidBy,
     splitType,
diff --git a/src/components/Expense/DeleteExpense.tsx b/src/components/Expense/DeleteExpense.tsx
index ea25baabd..4763719c2 100644
--- a/src/components/Expense/DeleteExpense.tsx
+++ b/src/components/Expense/DeleteExpense.tsx
@@ -6,6 +6,7 @@ import { useTranslation } from 'next-i18next';
 import { toast } from 'sonner';
 
 import { extractTemplateExpenseId } from '~/lib/cron';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { api } from '~/utils/api';
 
 import { Button } from '../ui/button';
@@ -26,6 +27,7 @@ export const DeleteExpense: React.FC<DeleteExpenseProps> = ({ expenseId, recurre
   const router = useRouter();
 
   const deleteExpenseMutation = api.expense.deleteExpense.useMutation();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const isTemplate = useMemo(
     () => (recurrence ? extractTemplateExpenseId(recurrence.job.command) === expenseId : false),
@@ -36,6 +38,7 @@ export const DeleteExpense: React.FC<DeleteExpenseProps> = ({ expenseId, recurre
   const onDeleteExpense = useCallback(async () => {
     try {
       await deleteExpenseMutation.mutateAsync({ expenseId });
+      await invalidateExpenseQueries();
     } catch (error) {
       if (error instanceof Error) {
         toast.error(`Error: ${error.message}`);
@@ -46,7 +49,7 @@ export const DeleteExpense: React.FC<DeleteExpenseProps> = ({ expenseId, recurre
       return;
     }
     router.back();
-  }, [expenseId, deleteExpenseMutation, router]);
+  }, [expenseId, deleteExpenseMutation, invalidateExpenseQueries, router]);
 
   const description = useMemo(() => {
     if (!isPartOfRecurrence) {
diff --git a/src/components/Expense/ExpenseDetails.tsx b/src/components/Expense/ExpenseDetails.tsx
index 47766863f..f9bed4c43 100644
--- a/src/components/Expense/ExpenseDetails.tsx
+++ b/src/components/Expense/ExpenseDetails.tsx
@@ -9,6 +9,7 @@ import React, { type ComponentProps, useCallback, useMemo, useState } from 'reac
 import { toast } from 'sonner';
 
 import { useIntlCronParser } from '~/hooks/useIntlCronParser';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { useTranslationWithUtils } from '~/hooks/useTranslationWithUtils';
 import { cronFromBackend } from '~/lib/cron';
 import { DEFAULT_CATEGORY } from '~/lib/category';
@@ -272,7 +273,7 @@ export const EditSettlement: React.FC<{ expense: ExpenseDetailsOutput }> = ({ ex
   );
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
-  const apiUtils = api.useUtils();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const onCurrencyInputValueChange = useCallback(
     ({ strValue, bigIntValue }: { strValue?: string; bigIntValue?: bigint }) => {
@@ -314,8 +315,8 @@ export const EditSettlement: React.FC<{ expense: ExpenseDetailsOutput }> = ({ ex
         expenseDate,
       },
       {
-        onSuccess: () => {
-          apiUtils.invalidate().catch(console.error);
+        onSuccess: async () => {
+          await invalidateExpenseQueries();
         },
         onError: (error) => {
           console.error('Error while saving expense:', error);
@@ -323,7 +324,16 @@ export const EditSettlement: React.FC<{ expense: ExpenseDetailsOutput }> = ({ ex
         },
       },
     );
-  }, [amount, sender, receiver, expense, addExpenseMutation, expenseDate, apiUtils, t]);
+  }, [
+    amount,
+    sender,
+    receiver,
+    expense,
+    addExpenseMutation,
+    expenseDate,
+    invalidateExpenseQueries,
+    t,
+  ]);
 
   if (!sender || !receiver) {
     return null;
diff --git a/src/components/Friend/GroupSettleup.tsx b/src/components/Friend/GroupSettleup.tsx
index 186547a4f..e231e0bd2 100644
--- a/src/components/Friend/GroupSettleup.tsx
+++ b/src/components/Friend/GroupSettleup.tsx
@@ -2,6 +2,7 @@ import { SplitType, type User } from '~/server/db/types';
 import { ArrowRightIcon } from 'lucide-react';
 import React, { type ReactNode, useState } from 'react';
 import { toast } from 'sonner';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { useTranslationWithUtils } from '~/hooks/useTranslationWithUtils';
 import { DEFAULT_CATEGORY } from '~/lib/category';
 import { api } from '~/utils/api';
@@ -38,7 +39,7 @@ export const GroupSettleUp: React.FC<{
   );
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
-  const utils = api.useUtils();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const sender = 0 > _amount ? user : friend;
   const receiver = 0 > _amount ? friend : user;
@@ -69,8 +70,8 @@ export const GroupSettleUp: React.FC<{
         category: DEFAULT_CATEGORY,
       },
       {
-        onSuccess: () => {
-          utils.group.invalidate().catch(console.error);
+        onSuccess: async () => {
+          await invalidateExpenseQueries();
         },
         onError: (error) => {
           console.error('Error while saving expense:', error);
@@ -78,7 +79,16 @@ export const GroupSettleUp: React.FC<{
         },
       },
     );
-  }, [sender, receiver, amount, utils, addExpenseMutation, currency, groupId, t]);
+  }, [
+    sender,
+    receiver,
+    amount,
+    invalidateExpenseQueries,
+    addExpenseMutation,
+    currency,
+    groupId,
+    t,
+  ]);
 
   return (
     <AppDrawer
diff --git a/src/components/Friend/Settleup.tsx b/src/components/Friend/Settleup.tsx
index e7704b26c..d783c8ec1 100644
--- a/src/components/Friend/Settleup.tsx
+++ b/src/components/Friend/Settleup.tsx
@@ -3,6 +3,7 @@ import { ArrowRightIcon } from 'lucide-react';
 import React, { useState } from 'react';
 import { toast } from 'sonner';
 
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { DEFAULT_CATEGORY } from '~/lib/category';
 import { api } from '~/utils/api';
 import { BigMath } from '~/utils/numbers';
@@ -25,6 +26,7 @@ export const SettleUp: React.FC<
   const { t, displayName, getCurrencyHelpersCached } = useTranslationWithUtils();
   const { data } = useSession();
   const currentUser = data?.user;
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   if (!currentUser) {
     return null;
@@ -59,7 +61,6 @@ export const SettleUp: React.FC<
   }
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
-  const utils = api.useUtils();
 
   const saveExpense = React.useCallback(() => {
     if (!balanceToSettle || !amount || !currentUser) {
@@ -87,9 +88,8 @@ export const SettleUp: React.FC<
         groupId: balanceToSettle.groupId,
       },
       {
-        onSuccess: () => {
-          utils.user.invalidate().catch(console.error);
-          utils.expense.invalidate().catch(console.error);
+        onSuccess: async () => {
+          await invalidateExpenseQueries();
         },
         onError: (error) => {
           console.error('Error while saving expense:', error);
@@ -104,7 +104,7 @@ export const SettleUp: React.FC<
     isCurrentUserPaying,
     friend,
     addExpenseMutation,
-    utils,
+    invalidateExpenseQueries,
     t,
   ]);
 
diff --git a/src/hooks/useInvalidateExpenseQueries.ts b/src/hooks/useInvalidateExpenseQueries.ts
new file mode 100644
index 000000000..4af761a76
--- /dev/null
+++ b/src/hooks/useInvalidateExpenseQueries.ts
@@ -0,0 +1,15 @@
+import { useCallback } from 'react';
+
+import { api } from '~/utils/api';
+
+export const useInvalidateExpenseQueries = () => {
+  const utils = api.useUtils();
+
+  return useCallback(async () => {
+    await Promise.all([
+      utils.expense.invalidate(),
+      utils.user.invalidate(),
+      utils.group.invalidate(),
+    ]);
+  }, [utils]);
+};

From caf6d5aa570d3bf4030633ef370d3ff5a2439844 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:22:42 +0100
Subject: [PATCH 04/16] ci: deploy and comment on worker previews

---
 .github/workflows/worker-preview.yml | 73 ++++++++++++++++++++++++++++
 wrangler.example.jsonc               |  4 +-
 2 files changed, 75 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/worker-preview.yml

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
new file mode 100644
index 000000000..b6d9645d5
--- /dev/null
+++ b/.github/workflows/worker-preview.yml
@@ -0,0 +1,73 @@
+name: Worker Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  preview:
+    if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - run: cp wrangler.example.jsonc wrangler.jsonc
+      - run: SKIP_ENV_VALIDATION=1 pnpm build
+      - name: Apply preview database migrations
+        run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.jsonc
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
+      - name: Deploy Worker Preview
+        id: preview
+        run: |
+          output="$(pnpm exec wrangler preview --name "pr-${{ github.event.pull_request.number }}" --json)"
+          printf '%s\n' "$output"
+          url="$(printf '%s' "$output" | jq -er '.preview.urls[0]')"
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
+      - name: Add or update preview comment
+        uses: actions/github-script@v7
+        env:
+          PREVIEW_URL: ${{ steps.preview.outputs.url }}
+        with:
+          script: |
+            const marker = '<!-- worker-preview -->';
+            const body = `${marker}\n🚀 Worker preview: ${process.env.PREVIEW_URL}`;
+            const { owner, repo } = context.repo;
+            const issue_number = context.issue.number;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
+            const existing = comments.find((comment) => comment.body?.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            }
+
+  cleanup:
+    if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - run: cp wrangler.example.jsonc wrangler.jsonc
+      - run: pnpm exec wrangler preview delete --name "pr-${{ github.event.pull_request.number }}" --skip-confirmation
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
diff --git a/wrangler.example.jsonc b/wrangler.example.jsonc
index 85d4f4d08..ba056f634 100644
--- a/wrangler.example.jsonc
+++ b/wrangler.example.jsonc
@@ -73,7 +73,7 @@
       "DISABLE_EMAIL_SIGNUP": "true",
       "INVITE_ONLY": "true",
       "PREVIEW_ACCESS_AUTH": "true",
-      "PREVIEW_ACCESS_AUD": "replace-with-your-access-audience-tag",
+      "PREVIEW_ACCESS_AUD": "29e464ab20d4ba84467f961fdb4051899b486e982836b746a20357503ec86228",
       "CLEAR_CACHE_CRON_RULE": "0 2 * * 0",
       "CACHE_RETENTION_INTERVAL": "2 days",
       "CURRENCY_RATE_PROVIDER": "frankfurter",
@@ -83,7 +83,7 @@
       {
         "binding": "DB",
         "database_name": "splitpro-preview",
-        "database_id": "00000000-0000-0000-0000-000000000000",
+        "database_id": "7668fa6d-b120-4025-9bc6-2dae30c83657",
         "migrations_dir": "migrations",
       },
     ],

From 6039fafb74af39afaf1cccb25bb587c7ef904185 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:26:13 +0100
Subject: [PATCH 05/16] fix(ci): use preview deployment token secret

---
 .github/workflows/worker-preview.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index b6d9645d5..f81d19c65 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Apply preview database migrations
         run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.jsonc
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
       - name: Deploy Worker Preview
         id: preview
@@ -35,7 +35,7 @@ jobs:
           url="$(printf '%s' "$output" | jq -er '.preview.urls[0]')"
           echo "url=$url" >> "$GITHUB_OUTPUT"
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
       - name: Add or update preview comment
         uses: actions/github-script@v7
@@ -69,5 +69,5 @@ jobs:
       - run: cp wrangler.example.jsonc wrangler.jsonc
       - run: pnpm exec wrangler preview delete --name "pr-${{ github.event.pull_request.number }}" --skip-confirmation
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5

From 1639386cef5f29b6bcdadc4367a77f6ea2fe142c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:26:34 +0100
Subject: [PATCH 06/16] fix(ci): prefer scoped preview token

---
 .github/workflows/worker-preview.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index f81d19c65..737431109 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Apply preview database migrations
         run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.jsonc
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CF_PREVIEW_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
       - name: Deploy Worker Preview
         id: preview
@@ -35,7 +35,7 @@ jobs:
           url="$(printf '%s' "$output" | jq -er '.preview.urls[0]')"
           echo "url=$url" >> "$GITHUB_OUTPUT"
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CF_PREVIEW_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
       - name: Add or update preview comment
         uses: actions/github-script@v7
@@ -69,5 +69,5 @@ jobs:
       - run: cp wrangler.example.jsonc wrangler.jsonc
       - run: pnpm exec wrangler preview delete --name "pr-${{ github.event.pull_request.number }}" --skip-confirmation
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN || secrets.CF_PREVIEW_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5

From 09d4d3fda8ebb25b30551d00efef5bfb0bb4fe2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:27:29 +0100
Subject: [PATCH 07/16] fix(ci): use scoped preview token directly

---
 .github/workflows/worker-preview.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index 737431109..656ae8c02 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Apply preview database migrations
         run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.jsonc
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
       - name: Deploy Worker Preview
         id: preview
@@ -35,7 +35,7 @@ jobs:
           url="$(printf '%s' "$output" | jq -er '.preview.urls[0]')"
           echo "url=$url" >> "$GITHUB_OUTPUT"
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
       - name: Add or update preview comment
         uses: actions/github-script@v7
@@ -69,5 +69,5 @@ jobs:
       - run: cp wrangler.example.jsonc wrangler.jsonc
       - run: pnpm exec wrangler preview delete --name "pr-${{ github.event.pull_request.number }}" --skip-confirmation
         env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5

From 36d03b2011a978400db1e2498097c0246ad4224f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:34:04 +0100
Subject: [PATCH 08/16] fix(ci): migrate preview D1 database

---
 .github/workflows/worker-preview.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index 656ae8c02..1b80aa376 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -23,7 +23,7 @@ jobs:
       - run: cp wrangler.example.jsonc wrangler.jsonc
       - run: SKIP_ENV_VALIDATION=1 pnpm build
       - name: Apply preview database migrations
-        run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.jsonc
+        run: pnpm exec wrangler d1 migrations apply DB --remote --preview --config wrangler.jsonc
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5

From ec31dcdc82ad691dd2249627868e9bdfb4be2f03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:35:32 +0100
Subject: [PATCH 09/16] fix(ci): target isolated preview D1 migrations

---
 .github/workflows/worker-preview.yml |  2 +-
 wrangler.preview-migrations.jsonc    | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 wrangler.preview-migrations.jsonc

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index 1b80aa376..752b1d7f0 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -23,7 +23,7 @@ jobs:
       - run: cp wrangler.example.jsonc wrangler.jsonc
       - run: SKIP_ENV_VALIDATION=1 pnpm build
       - name: Apply preview database migrations
-        run: pnpm exec wrangler d1 migrations apply DB --remote --preview --config wrangler.jsonc
+        run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.preview-migrations.jsonc
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
diff --git a/wrangler.preview-migrations.jsonc b/wrangler.preview-migrations.jsonc
new file mode 100644
index 000000000..0e2eb3eeb
--- /dev/null
+++ b/wrangler.preview-migrations.jsonc
@@ -0,0 +1,12 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "splitpro-preview-migrations",
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "splitpro-preview",
+      "database_id": "7668fa6d-b120-4025-9bc6-2dae30c83657",
+      "migrations_dir": "migrations",
+    },
+  ],
+}

From a34716d89c8b49389568e82e020d3754cd1fc6f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:37:27 +0100
Subject: [PATCH 10/16] fix(ci): extract worker preview URL from output

---
 .github/workflows/worker-preview.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index 752b1d7f0..c4d8fa7b5 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -32,7 +32,7 @@ jobs:
         run: |
           output="$(pnpm exec wrangler preview --name "pr-${{ github.event.pull_request.number }}" --json)"
           printf '%s\n' "$output"
-          url="$(printf '%s' "$output" | jq -er '.preview.urls[0]')"
+          url="$(printf '%s' "$output" | node -e 'let output = ""; process.stdin.on("data", chunk => output += chunk); process.stdin.on("end", () => { const match = output.match(/"preview":\s*\{[\s\S]*?"urls":\s*\[\s*"([^"]+)"/); if (!match) process.exit(1); process.stdout.write(match[1]); });')"
           echo "url=$url" >> "$GITHUB_OUTPUT"
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}

From ae75a11de26c9246f57d10aafed612c5442c0f0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:38:32 +0100
Subject: [PATCH 11/16] fix(ci): use Wrangler D1 preview migrations

---
 .github/workflows/worker-preview.yml |  2 +-
 wrangler.example.jsonc               |  1 +
 wrangler.preview-migrations.jsonc    | 12 ------------
 3 files changed, 2 insertions(+), 13 deletions(-)
 delete mode 100644 wrangler.preview-migrations.jsonc

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index c4d8fa7b5..36b3bbfbe 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -23,7 +23,7 @@ jobs:
       - run: cp wrangler.example.jsonc wrangler.jsonc
       - run: SKIP_ENV_VALIDATION=1 pnpm build
       - name: Apply preview database migrations
-        run: pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.preview-migrations.jsonc
+        run: pnpm exec wrangler d1 migrations apply DB --remote --preview --config wrangler.jsonc
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
diff --git a/wrangler.example.jsonc b/wrangler.example.jsonc
index ba056f634..d3f6bf70a 100644
--- a/wrangler.example.jsonc
+++ b/wrangler.example.jsonc
@@ -24,6 +24,7 @@
       "binding": "DB",
       "database_name": "splitpro",
       "database_id": "00000000-0000-0000-0000-000000000000",
+      "preview_database_id": "7668fa6d-b120-4025-9bc6-2dae30c83657",
       "migrations_dir": "migrations",
     },
   ],
diff --git a/wrangler.preview-migrations.jsonc b/wrangler.preview-migrations.jsonc
deleted file mode 100644
index 0e2eb3eeb..000000000
--- a/wrangler.preview-migrations.jsonc
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "$schema": "node_modules/wrangler/config-schema.json",
-  "name": "splitpro-preview-migrations",
-  "d1_databases": [
-    {
-      "binding": "DB",
-      "database_name": "splitpro-preview",
-      "database_id": "7668fa6d-b120-4025-9bc6-2dae30c83657",
-      "migrations_dir": "migrations",
-    },
-  ],
-}

From 14cb8ee88567d0726b04dda5d80715af6fe3e232 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:40:58 +0100
Subject: [PATCH 12/16] fix(ui): tighten mobile landing page spacing

---
 src/pages/home.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pages/home.tsx b/src/pages/home.tsx
index 224afd9e0..441ffb5f7 100644
--- a/src/pages/home.tsx
+++ b/src/pages/home.tsx
@@ -66,7 +66,7 @@ export default function Home() {
         </nav>
         <div className="mx-auto mt-20 flex w-full items-start justify-center gap-16 px-4 lg:max-w-5xl lg:px-0">
           <div>
-            <div className="mb-32 text-center lg:mb-0 lg:h-[70vh] lg:text-left">
+            <div className="mb-12 text-center lg:mb-0 lg:h-[70vh] lg:text-left">
               <h1 className="max-w-3xl text-center text-2xl leading-loose font-semibold text-gray-100 lg:text-left lg:text-5xl lg:leading-16">
                 {t('hero.title_part1')}{' '}
                 <span className="text-primary font-bold">{t('hero.title_highlight')}</span>.
@@ -102,7 +102,7 @@ export default function Home() {
                   </Button>
                 </Link>
               </div>
-              <div className="mt-40" />
+              <div className="lg:mt-40" />
             </div>
             <div className="mt-8 mb-20 flex justify-center lg:hidden">
               <MobileScreenShot />

From a82a9d4bbeebde67b866c089e2acf3833f26ec64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:44:30 +0100
Subject: [PATCH 13/16] Revert "fix(ui): tighten mobile landing page spacing"

This reverts commit 2e8e7ec321b6693e63f2d988fd1b7e84eca32f08.
---
 src/pages/home.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pages/home.tsx b/src/pages/home.tsx
index 441ffb5f7..224afd9e0 100644
--- a/src/pages/home.tsx
+++ b/src/pages/home.tsx
@@ -66,7 +66,7 @@ export default function Home() {
         </nav>
         <div className="mx-auto mt-20 flex w-full items-start justify-center gap-16 px-4 lg:max-w-5xl lg:px-0">
           <div>
-            <div className="mb-12 text-center lg:mb-0 lg:h-[70vh] lg:text-left">
+            <div className="mb-32 text-center lg:mb-0 lg:h-[70vh] lg:text-left">
               <h1 className="max-w-3xl text-center text-2xl leading-loose font-semibold text-gray-100 lg:text-left lg:text-5xl lg:leading-16">
                 {t('hero.title_part1')}{' '}
                 <span className="text-primary font-bold">{t('hero.title_highlight')}</span>.
@@ -102,7 +102,7 @@ export default function Home() {
                   </Button>
                 </Link>
               </div>
-              <div className="lg:mt-40" />
+              <div className="mt-40" />
             </div>
             <div className="mt-8 mb-20 flex justify-center lg:hidden">
               <MobileScreenShot />

From 3dd0d12e54e750dc1a2d5a39e14f0abfe1c2e6e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:56:26 +0100
Subject: [PATCH 14/16] fix(ci): set preview auth host per PR

---
 .github/workflows/worker-preview.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
index 36b3bbfbe..9def1905d 100644
--- a/.github/workflows/worker-preview.yml
+++ b/.github/workflows/worker-preview.yml
@@ -21,6 +21,12 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile --prefer-offline
       - run: cp wrangler.example.jsonc wrangler.jsonc
+      - name: Configure preview auth URL
+        env:
+          PREVIEW_NAME: pr-${{ github.event.pull_request.number }}
+        run: |
+          preview_url="https://${PREVIEW_NAME}-splitpro.andrepascoa.workers.dev"
+          sed -i "s|https://replace-with-this-preview-url|${preview_url}|g" wrangler.jsonc
       - run: SKIP_ENV_VALIDATION=1 pnpm build
       - name: Apply preview database migrations
         run: pnpm exec wrangler d1 migrations apply DB --remote --preview --config wrangler.jsonc

From 943f34b811030817b995b0ad350af71fd83f07e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 00:58:45 +0100
Subject: [PATCH 15/16] fix(previews): initialize Access sessions safely

---
 worker/index.ts        | 2 +-
 wrangler.example.jsonc | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/worker/index.ts b/worker/index.ts
index 62332daa0..59de7a518 100644
--- a/worker/index.ts
+++ b/worker/index.ts
@@ -71,7 +71,7 @@ export default {
       headers.delete(PREVIEW_ACCESS_EMAIL_HEADER);
       headers.delete(PREVIEW_ACCESS_NAME_HEADER);
       headers.set(PREVIEW_ACCESS_EMAIL_HEADER, email);
-      if (identity.name) headers.set(PREVIEW_ACCESS_NAME_HEADER, identity.name);
+      if (identity?.name) headers.set(PREVIEW_ACCESS_NAME_HEADER, identity.name);
       request = new Request(request, { headers });
     }
 
diff --git a/wrangler.example.jsonc b/wrangler.example.jsonc
index d3f6bf70a..580bd9e7e 100644
--- a/wrangler.example.jsonc
+++ b/wrangler.example.jsonc
@@ -69,6 +69,8 @@
   "previews": {
     "vars": {
       "NEXTAUTH_URL": "https://replace-with-this-preview-url",
+      "NEXTAUTH_SECRET": "preview-only-secret-change-at-runtime",
+      "NODE_ENV": "production",
       "DEFAULT_HOMEPAGE": "/balances",
       "ENABLE_SENDING_INVITES": "false",
       "DISABLE_EMAIL_SIGNUP": "true",

From 018536a9c191c2785b0c0cdc0916f9c82971bf40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20P=C3=A1scoa?= <andre@pascoa.org>
Date: Mon, 12 Oct 2026 01:06:35 +0100
Subject: [PATCH 16/16] fix: refresh settle-up amount after expenses

---
 src/components/Friend/Settleup.tsx | 41 ++++++++++++++++++------------
 1 file changed, 25 insertions(+), 16 deletions(-)

diff --git a/src/components/Friend/Settleup.tsx b/src/components/Friend/Settleup.tsx
index d783c8ec1..682b5064d 100644
--- a/src/components/Friend/Settleup.tsx
+++ b/src/components/Friend/Settleup.tsx
@@ -1,6 +1,6 @@
 import { SplitType, type User } from '~/server/db/types';
 import { ArrowRightIcon } from 'lucide-react';
-import React, { useState } from 'react';
+import React, { useEffect, useState } from 'react';
 import { toast } from 'sonner';
 
 import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
@@ -27,29 +27,26 @@ export const SettleUp: React.FC<
   const { data } = useSession();
   const currentUser = data?.user;
   const invalidateExpenseQueries = useInvalidateExpenseQueries();
-
-  if (!currentUser) {
-    return null;
-  }
-
-  if (!balances) {
-    return (
-      <Button size="sm" variant="outline" responsiveIcon disabled>
-        <span className="xs:inline hidden">{t('actions.settle_up')}</span>
-      </Button>
-    );
-  }
+  const availableBalances = balances ?? [];
 
   const [balanceToSettle, setBalanceToSettle] = useState<MinimalBalance | undefined>(
-    1 < balances.length ? undefined : balances[0],
+    1 === availableBalances.length ? availableBalances[0] : undefined,
   );
   const [amount, setAmount] = useState<bigint>(
-    1 < balances.length ? 0n : BigMath.abs(balances[0]?.amount ?? 0n),
+    1 === availableBalances.length ? BigMath.abs(availableBalances[0]?.amount ?? 0n) : 0n,
   );
   const [amountStr, setAmountStr] = useState<string>(
     getCurrencyHelpersCached(balanceToSettle?.currency ?? '').toUIString(amount),
   );
 
+  useEffect(() => {
+    const nextBalance = 1 === balances?.length ? balances[0] : undefined;
+    const nextAmount = BigMath.abs(nextBalance?.amount ?? 0n);
+    setBalanceToSettle(nextBalance);
+    setAmount(nextAmount);
+    setAmountStr(getCurrencyHelpersCached(nextBalance?.currency ?? '').toUIString(nextAmount));
+  }, [balances, getCurrencyHelpersCached]);
+
   const isCurrentUserPaying = 0 > (balanceToSettle?.amount ?? 0);
 
   function onSelectBalance(balance: MinimalBalance) {
@@ -126,6 +123,18 @@ export const SettleUp: React.FC<
     }
   }, [balanceToSettle]);
 
+  if (!currentUser) {
+    return null;
+  }
+
+  if (!balances) {
+    return (
+      <Button size="sm" variant="outline" responsiveIcon disabled>
+        <span className="xs:inline hidden">{t('actions.settle_up')}</span>
+      </Button>
+    );
+  }
+
   return (
     <AppDrawer
       trigger={children}
@@ -142,7 +151,7 @@ export const SettleUp: React.FC<
     >
       {!balanceToSettle ? (
         <div>
-          {balances?.map((b) => (
+          {availableBalances.map((b) => (
             <div
               key={`${b.friendId}-${b.currency}-${b.groupId ?? 'null'}`}
               onClick={() => onSelectBalance(b)}