Software Updates

wire Settings gear, add createCalendar/listCalendars tools, sanitize leaked function-call tags, ship OpenClaw playbooks doc

• /admin/calendar Settings gear now opens a real dialog: list calendars + add new color category (name + GCal palette)
• Yen tools: listCalendars + createCalendar (rate-limited, dup-name guarded). Now Yen can make color categories for mom on request.
• System prompt: explicit instructions to NEVER emit <function=..></function> tags in text and to STOP saying 'I cant' when a tool exists. Lists the GCal palette so Yen picks sensible defaults.
• Chat route: belt-and-suspenders sanitizeAssistantText() strips any leaked function/tool tags before persistence + reply.
• docs/openclaw-playbooks.md: 10 ranked OpenClaw playbooks tied to revenue, build order, and Mac-mini deployment notes.

remove stray commit-message file

add Agents nav item + /admin/agents OpenClaw playbooks page

Phase 2 — Memory, Sub-Agents, Heartbeats, Multi-Channel

• YenMemory table (VeraExtMemory) with importance 1-10
• importance >= 8 always loaded into the chat system prompt
• Tools: rememberFact, recallMemories, forgetMemory
• Admin UI at /admin/yen/memories
• YenAgent + YenAgentRun tables
• agent-runner.ts: reusable agentic loop with tool whitelist
• Security: agents CANNOT self-approve gated tools (logs to YenGuardrailEvent)
• Tools: createAgent, listAgents, runAgent
• REST API: /api/admin/yen/agents (+ [id], [id]/run)
• Admin UI at /admin/yen/agents — describe an agent in plain English, Yen calls createAgent and writes the system prompt herself
• YenHeartbeat table with cron expression + optional pre-condition
• Vercel Cron at /api/cron/yen-heartbeats (every minute)
• Zero-dep 5-field cron matcher in src/lib/yen/cron.ts
• Records lastFiredAt, lastStatus, lastError, fireCount
• YenChannelLink table (provider, externalId unique)
• /api/integrations/telegram/webhook scaffold with secret verification
• Inbound messages run via runAgent() with same guardrails + memory
• draftProductDescription — rewrites product copy on product pages
• triageOrder — comprehensive order snapshot with customer history
• 5 new Prisma models in prisma/schema/yen-extensions.prisma (mapped VeraExt*)
• Idempotent SQL: prisma/add-yen-extensions.sql
• Migration helper: scripts/run-yen-extensions-migration.ts (already applied)
• Soft-gates added: createAgent, runAgent
• Rate limits added for all 9 new tools
• vercel.json: heartbeat cron entry (every minute, CRON_SECRET-guarded)

document Yen — agentic AI assistant (20 tools, guardrails, page-aware bubble)

humanize errors + page-aware floating bubble + UI polish

• New humanizeProviderError() in chat route translates Groq/OpenAI/Ollama errors into plain English: rate limits, invalid keys, model not found, 503/502/504, context-length, generic 4xx — never leaks raw JSON.
• Server returns retryAfterSeconds when applicable; UI uses it to size toast duration.
• Cleaner copy for missing API keys and Ollama-unreachable states.
• New <YenBubble /> component (src/components/admin/yen-bubble.tsx). Fixed bottom-right gradient FAB, hidden on /admin/yen.
• Derives PageContext from pathname (product / order / project / customer / collection / etc.) and POSTs it alongside the user message. Resets conversation on navigation so each page gets its own scoped chat.
• Mounted globally in src/app/admin/layout.tsx (sibling of AdminShell).
• Writes seoTitle / seoDescription directly to the Product row.
• System prompt now tells Yen: when on a product page and asked to improve SEO, call updateProductSeo with the in-context productId.
• Rate-limited (20/min). Not soft-gated — designed for the 'write it right before my eyes' UX the user described.
• Bubble shows quick-action chips on product pages.
• framer-motion message arrival animations (spring, layout-aware).
• New TypingDots indicator replaces spinner.
• Soft glow behind Yen avatar in header + welcome screen.
• Stagger animation on suggested-prompt cards + hover lift/shadow.
• Error toasts now show humanized message + detail with smart duration.

add 5 new tools — calendar edit/cancel, channel summary, deep analytics

• cancelCalendarEvent → SOFT_GATED_TOOLS (requires Approve)
• rate limits added: findCalendarEvents 60/min, updateCalendarEvent 30/min, cancelCalendarEvent 10/min, summarizeChannel 20/min, analyzeBusinessMetrics 30/min
• Capability list updated
• Three new workflow patterns documented: 6) editing/cancelling events (always findCalendarEvents first) 7) channel summaries (3-5 bullet TL;DR with citations) 8) analytics (compareToPrevious for trend questions, always include 1-2 actionable insights)

teach Yen 'today' + month-default + reject past dates

• Human date ('Friday, April 24, 2026')
• Local time in America/New_York
• Current ISO timestamp
• Current year + month spelled out
• Explicit rule: bare dates default to current year, never 2024

coerce null tool-call arguments to {} (priceUsd NPE)

• Groq llama-3.3 occasionally emits 'null' as the JSON arguments string
• for zero-arg tools (e.g. listTasks). JSON.parse('null') -> null, then
• evaluateGuard(...).args.priceUsd threw:
• Cannot read properties of null (reading 'priceUsd')
• Two-layer fix:
• 1. yen/chat/route.ts: after JSON.parse, coerce non-object/array/null
• results to {} before passing to evaluateGuard or the tool handler.
• 2. yen/guardrails.ts: evaluateGuard now defensively wraps args so a
• null/undefined value can't crash the spend-gate check.

override stale per-conversation Ollama modelName on Groq/OpenAI

• Real root cause of the persistent 'qwen2.5:14b-instruct' Groq error:
• the chat route was sending conversation.modelName (persisted in DB
• from earlier sessions) verbatim — so once a conversation got an
• Ollama tag baked in, every subsequent message kept sending it to
• Groq even after fixing the env var and adding the provider guard.
• Fix: when conversation.modelName looks like an Ollama tag (contains
• ':') and the active provider isn't Ollama, ignore it and use
• provider.model. Also propagated the same guard to vera/providers.ts
• for the legacy /api/admin/vera/chat route.

ignore Ollama-style YEN_MODEL/VERA_MODEL on Groq/OpenAI

• Stale env var VERA_MODEL=qwen2.5:14b-instruct (left over from local
• Ollama development) was being forwarded to Groq, producing:
• model_not_found: 'qwen2.5:14b-instruct'
• Now if the override contains ':' (Ollama tag syntax) and the active
• provider isn't Ollama, log a warning and fall through to the
• provider's built-in default (Groq -> llama-3.3-70b-versatile,
• OpenAI -> gpt-4o).

restore Vera@@map + auto-open CAD preview on ?tab=cad

• 4 model @@map directives restored to Vera* (VeraConversation/Message/ToolCall/GuardrailEvent)
• 3 enum @@map directives ADDED for VeraMessageRole / VeraToolStatus / VeraGuardrailKind (these match the existing CREATE TYPE names)

self-host HDR + click CAD row to preview + loading skeleton

• Self-host studio_small_03_1k.hdr at /public/hdri/ (1.6 MB, served by Vercel CDN, same-origin, no CORS, no third-party CDN throttling)
• Replace <Environment preset='studio' /> with files='/hdri/...'
• Fixes 'Could not load studio_small_03_1k.hdr: NetworkError' which was caused by the drei default CDN being unreachable/throttled
• Click anywhere on a CAD file row (3D-capable file types) → opens 3D preview automatically. Old explicit '3D View & Casting' button still works for keyboard/touch users; row also responds to Enter/Space.
• Hover state + cursor change signal the row is interactive.
• Nested buttons (View, Download, Delete, etc.) still work via closest('button, a, input, textarea') guard.
• Add /admin/projects/[id]/loading.tsx skeleton so the page shows structure instantly during the client-side fetch instead of a blank screen + spinner. Doesn't change the actual API speed but makes the wait feel ~3x faster.

Phase 1 Meetings — schedule video meetings from channel header

• Zero config. Works today.
• Phase 1.5 swap to Google Meet only requires editing src/lib/calendar/meet-provider.ts::createMeetingUrl — call-sites do not change.
• ChatMessage now has metadata Json? and replyToId String? in the Prisma schema. These columns already existed in the DB (used by messages/route.ts raw SQL); the schema file was just out of sync. Added an idempotent migration prisma/add-chat-message-metadata.sql that ADDs the columns IF NOT EXISTS, safe to re-run.

rename AI assistant Vera → Yen (per user request — daughter's name)

• System prompt (Yen identity, Yen warm/professional tone)
• Page header h1, welcome screen, composer placeholder, thinking state
• Empty-state copy (en + pt-BR)
• Guardrails panel header
• Permission label: 'Yen AI Assistant'
• Sidebar nav label (en/pt): 'Yen AI' / 'Yen IA'
• Search keywords now include both 'yen' and 'vera' for transition

comprehensive dark-mode pass — add dark: siblings to 62 light-only Tailwind classes across 28 admin files

• Auto-fixed light-mode-only Tailwind utility classes that were causing black text on dark backgrounds in admin pages. Previous audit only matched className="..." attributes; this pass also catches strings inside cn()/clsx() ternaries and template literals.
• Mapping:
• text-{gray,slate,stone,zinc,neutral}-700 → + dark:text-*-300
• text-{gray,slate,stone,zinc,neutral}-800 → + dark:text-*-200
• text-{gray,slate,stone,zinc,neutral}-900 → + dark:text-*-100
• text-black → + dark:text-white
• bg-white → + dark:bg-stone-900
• Top fixed files: mobile-data-view, mobile-forms, mobile-nav, EmailBuilder, BlockPreview, EmailCanvas, visual-email-editor, employee-profile-client, projects-client, taxes-client, shipping-client, blog-editor-client, openclaw-dashboard.

kill 3s send/load delays, add read receipts + sidebar split; lock @fsafasf

• Investigated @fsafasf (philbrewerton868@gmail.com): was an OWNER-role account created 2026-04-08 that never logged in (no sessions, no events, no chat history). Locked down: role demoted OWNER→CUSTOMER, isActive=false, sessions cleared. Only 2 OWNER accounts remain (Rosser, Lee) — both with recent valid logins.
• Added investigation scripts: scripts/find-fsafasf.ts, audit-fsafasf.ts, lockdown-fsafasf.ts (for reference)
• handleSendMessage() now OPTIMISTIC: temp message appears instantly, input clears immediately, input refocuses. Server response swaps temp→real id. Failed sends marked with ⚠️ prefix for retry visibility. Kills the 3-sec send delay on /admin/messages.
• Realtime INSERT subscription now skips own-user inserts (already rendered optimistically) and dedupes by id, eliminating the double-render that caused echo/delay.
• Dropped the per-channel messageCount subquery from GET /channels — it was unused client-side (unreadCount was hardcoded 0) and was the main cause of the 3-sec page-load delay for users with many channels.
• Channels endpoint now returns cm."lastReadAt" in each member row
• MessageBubble renders ⏳ (pending) / ✓ (sent) / ✓✓ (read by someone else) on own messages. Computed client-side from channel members' lastReadAt.
• Sidebar now splits channels into two sections with uppercase headers: · Direct Messages (1-on-1 DMs) · Channels (groups, projects, announcements)
• Count badge per section. Empty states per section. Preserves search.
• docs/messenger/MEETINGS_VOIP_CALENDAR_PLAN.md: 4-phase plan · Phase 1: Google Meet button → Katura calendar event + chat card (1 day) · Phase 2: Instant Meet link (15 min) · Phase 3: WebRTC + LiveKit (or Jitsi iframe shortcut) — deferred · Phase 4: Calendar↔chat deep linking
• docs/messenger/INTERNAL_SHARING_PLAN.md: share picker in composer · Phase 1: Product + JewelryProject + Order cards (1.5 days) · Phase 2: CAD, Drive, Customer cards · Phase 3: Calendar, Analytics, Media cards · All fits in existing ChatMessage.metadata JSONB — no schema changes

Ollama provider abstraction + health-check; docs: OpenClaw integration map + admin audit; fix(orders): dark-mode text

• New src/lib/vera/providers.ts implements getVeraProvider() which resolves the active LLM from VERA_PROVIDER env var: ollama (default, free local) -> http://localhost:11434/v1 groq (free hosted) -> https://api.groq.com/openai/v1 openai (paid) -> https://api.openai.com/v1
• chat/route.ts is now provider-agnostic. The OPENAI_API_KEY hard 503 is replaced with a per-provider validation; default Ollama needs no key.
• stripImagePartsForTextOnly() converts image_url parts to text markers when the active provider is text-only (Ollama/Groq) so multimodal history doesn't 400 the request.
• estimateCostCents() returns 0 for free providers; powers the upcoming cost-tracking dashboard. Persisted via existing VeraMessage.costCents column.
• pingVeraProvider() health probe used by the new monitoring test.
• New conversations now persist modelProvider + modelName so we can mix providers per-conversation later.
• New synthetic-test 'Integration: Vera AI Provider' calls pingVeraProvider() at the configured baseUrl. Returns: pass -> provider reachable AND configured model in /models degraded -> provider reachable, model name not found in catalog fail -> provider unreachable / timed out Visible immediately on /admin/developer/health.
• A full uptime-tracker (sparkline over last year) requires a new UptimeCheck Prisma model + cron + history API; documented as Phase 2 in the audit doc rather than shipping half-built.
• Audited all admin/**/*.tsx — 12 offenders found, 7 real (orders page is the only high-traffic one). Fixed all 5 visible text-stone-{700,900} sites on /admin/orders with dark: siblings.
• Full audit + remediation list lives in docs/ADMIN_AUDIT_2026-04-23.md.
• New docs/ai/OPENCLAW_INTEGRATION_OPPORTUNITIES.md walks through all 17 experiments in /admin/openclaw and pins each to a specific file/component as the integration point. Includes:
• Phase 1 (this week) — concierge, reviews, cart-recovery
• Phase 2 (this month) — revenue briefing, health diagnose, support triage, store copywriting, content drafter
• Phase 3 (this quarter)— sentry root-cause, deploy guard, outreach, trials, ads, referrals, trade-shows, seo, wholesale All zero-cost on Ollama/Groq, with hard-blocked pricing/refund decisions and write-access kept human-only.
• 13 client components in /admin lack useAdminTranslations. High-impact (payroll-dashboard, marketing, crm-appointments) vs low-impact (stella, enterprise) ranked in the audit doc.
• Recommended approach: lint rule + bulk OpenClaw 'translate' skill rather than hand-translating 13 files.
• Added VERA_PROVIDER / VERA_MODEL / OLLAMA_BASE_URL / GROQ_API_KEY with sensible defaults (Ollama). Existing OPENAI_API_KEY is now optional.

instant Create Group close + colored @mentions; fix(orders): surface real sales-rep errors + optimistic UI; feat(admin): HelpTip component (EN/PT/ES)

• optimistically updates the row immediately
• surfaces the actual server error (status + details) in a toast so we can finally see WHY it fails when it does
• re-syncs from the server on failure to undo the optimistic update
• src/components/admin/HelpTip.tsx: a tiny, self-contained '?' icon popover with built-in EN / PT / ES support (auto-detects the NEXT_LOCALE cookie). Drop in next to any field, header, or stat: <HelpTip en="..." pt="..." es="..." /> Wired up first instance on the orders Sales Rep table column.
• Spanish locale (#9) was already 100% wired: 'es' is in src/i18n/config.ts, messages/es.json has 5000+ translated lines, and both LanguageSelector + CurrencySelector iterate locales[] so Spanish appears in every language picker automatically.

replace broken raw SQL with Prisma findMany

• Messenger: Add Members / New Conversation dialog (no users appeared)
• @-mention autocomplete (always empty)
• Employee admin page

cad links visible, harden mention search, real brevo errors, url-synced tabs

• CAD Files tab now also shows files attached via the polymorphic CadFileLink table (i.e. linked from /admin/design or the CAD library), not just direct uploads. Each linked file gets the same '3D View & Casting' button which opens the existing STLPreviewDialog with casting cost in all metals.
• Tab is URL-synced (?tab=cad) so each stage is shareable and back/forward works without refetching.
• Eager activityLog include reduced from 50 -> 10 (huge perf win on the initial GET; full list still available via the activity tab endpoint).
• GET now returns a Supabase publicUrl alongside each linked CadFile so consumers can render previews without knowing the bucket layout.
• @-mention autocomplete now matches against email handle, full email, first name, and strips a leading '@' (typing '@stella' or 'stella' both work).
• Empty Add Members state explains *why* nobody appears (no users in directory vs. no match) and console-warns when /api/admin/users returns zero — the most common cause of 'cant find Stella'.
• sendBrevoEmail() now captures Brevo's response messageId on success and parses + logs the structured error body on failure.
• Send route forces sender.email = BREVO_FROM_EMAIL (verified Brevo sender) and routes replies back via replyTo. This eliminates Brevo's silent-drop behavior when fromAccount.email isn't a verified sender.
• UI surfaces the Brevo messageId on success (or a warning if Brevo didn't return one) instead of a fake 'sent' toast.

allow @-prefixed search and email-handle match in Add Members dialog

• Strip leading '@' from member search query so typing '@stella' matches user 'Stella'
• Match against email handle (part before @) and first name in addition to full name/email
• Resolves bug where typing '@Stella' showed no available team members

searchable member picker, persist wizard fields across steps

• Added a search input above the member list. Filters teammates by name OR email as you type. Auto-focuses when the dialog opens so you can start typing immediately. Empty-state copy distinguishes 'no matches' from 'none yet'.
• The existing checkboxes were fine, but with no search and an unscrolled list, it looked like the dialog was inert. The search makes it obvious the picker is interactive and resolves the user-reported 'cannot create chat' UX.
• Cleared memberSearch/newChannelName/selectedMembers when the dialog closes (Cancel, Esc, click-outside) so the next open starts fresh.
• Bug: 'title required' on submit even though the user filled in step 1. Root cause: AnimatePresence with mode='wait' was unmounting each step when the user clicked Continue, so by the time they reached step 4 only step-4 inputs were in the DOM. new FormData(e.currentTarget) therefore contained budget/dates only — title (step 1), description (step 2), metals (step 3) were all lost.
• Fix: keep all four <motion.section> blocks mounted at all times and use the 'hidden' attribute + animate opacity/x to show only the current one. This way every named field is in the DOM throughout the wizard and FormData captures the full payload on submit.
• Switched AnimatePresence mode from 'wait' to 'sync' since nothing actually unmounts anymore. Added an inline NOTE comment so the next person doesn't accidentally re-introduce the regression by 'cleaning up' the always-mounted sections.

unwrap API responses + add @-mentions, browser notifications, photo cache-bust

• Messenger crashed with 'k.filter is not a function' when opening /admin/messages. Root cause: setChannels(data) was assigning the raw {channels: [...]} envelope instead of the array, so subsequent .filter() calls threw. Now unwrap every API response (channels, messages, users, send-message, create-channel) defensively and fall back to [] on any non-array shape or non-OK response.
• Wrapped users.filter(...) and channels.filter(...) in Array.isArray() guards to prevent any future regressions.
• handleCreateChannel now reads data.channel.id (the API returns {channel, success}) so newly-created chats actually open after creation.
• Type @ in the composer to get a 6-row dropdown of teammates filtered by handle/name. ArrowUp/ArrowDown to navigate, Enter/Tab to insert, Esc to close. Click also works. Inserts as @firstname which the backend already parses into ChatMention rows.
• Added Notification.permission state + an in-line banner that asks for permission the first time a logged-in user opens Messenger.
• Subscribed to ALL ChatMessage inserts (filtered client-side to channels you belong to). Notifications fire when a message arrives in a non-active channel OR when @yourhandle mentions you in any channel. Clicking the notification focuses the tab and opens that channel.
• Skips notifications for messages you sent yourself.
• Team page now appends a ?t=<timestamp> cache-buster to the avatar URL after upload so browsers and Supabase edge caches don't serve the previous bytes.
• (If the photo still doesn't render, verify the Supabase 'employees' bucket is set to Public — see supabase/storage-policies-employees.sql)

nav translation keys, dark-mode polish, full PT for Vera + Messenger

• Add nav.veraAi + nav.messages to type/EN/PT (sidebar was rendering raw key strings)
• Vera page dark-mode fixes:
• REJECTED + RUNNING tool-call status chips now have dark variants
• Assistant message bubble has explicit text-foreground (no more black-on-dark)
• Replaced invalid h-4.5/w-4.5 Tailwind utilities with h-4/w-4
• All Vera page UI strings now bilingual (EN + PT) via locale-aware tr() helper
• Welcome screen, suggested prompts, sidebar, guardrails panel, header, composer, toasts, tool-call chip approve/reject, footer disclaimer
• Messenger component fully translated to PT
• Header, search, channel list, member counts, edited badge, dropdown menu, composer placeholder, empty states, new-conversation dialog
• NotAuthorized 403 screen now reads its locale from useAdminTranslations

move ssr:false dynamic import into a client wrapper

• page.tsx → Server Component, exports metadata, renders <MessagesPageClient />
• messages-client.tsx → 'use client', owns the dynamic ssr:false import

page-level permissions, sidebar messenger, dashboard financial gate

• Removed Messages button from the top header — moved into the sidebar Business Tools group as nav.messages → /admin/messages (in-house Supabase Messenger, NOT Slack)
• Moved Vera AI from Overview group into Business Tools (top of group) alongside Messages, Email, Calendar, Tasks, Storage
• New /api/admin/me/permissions endpoint returns role + perm rows + a derived canSeeFinancials flag for the current user
• Sidebar (desktop + mobile) now hides any nav item whose pageSlug has canView=false. Default-open: missing rows mean allowed
• Owners are never filtered
• Admin server layout now blocks direct URL access — server-side render of NotAuthorized component (with manager-contact CTA) when the route maps to a slug that user can't view
• Middleware forwards x-pathname as a *request* header so server components can route-guard via headers().get('x-pathname')
• New 'dashboard-financials' permission slug added to ADMIN_PAGES (toggleable from Team → Member → Access Controls tab)
• Server-side payload sanitization: revenue total + per-order $ amounts are stripped from the response before it reaches the client when the user lacks dashboard-financials.canView
• Revenue stat tile is hidden entirely; recent orders show '—' instead of $

in-house AI assistant with hard-rail guardrails

• parsePhotoToProject: GPT-4o vision turns photos of 3x5 cards/sketches into structured project plans with tasks
• createProject / createTask / listProjects: native CRUD
• searchNivodaDiamonds: returns mm dimensions for setting matching
• searchStullerSettings: filters by metal/karat/prongs/center stone size
• listUpcomingEvents: calendar awareness
• Order delete/cancel/refund, product delete/price-edit
• Financial edits, payroll, invoices, journal entries, cap table, taxes
• Team add/remove, permissions, password reset
• Customer data export, audit log changes
• Stripe charges/refunds/webhook edits
• sendEmail, placeNivodaOrder, placeStullerOrder, createDraftOrder
• Any tool call over $250 USD
• Every tool call persisted with status, args, result, durationMs, affected entity
• VeraGuardrailEvent append-only log of every block/gate

smart email→calendar AI parser, tasks↔calendar sync, QBO schema

• TaskCalendarLink schema + idempotent migration (DUE_DATE / TIME_BLOCK / MEETING / WORKED_ON)
• src/lib/tasks/calendar-sync.ts service (5 functions, fully error-isolated):
• ensureUserTasksCalendar — auto-provisions 'My Tasks' calendar (#7986CB Lavender)
• syncTaskDueDateEvent — idempotent upsert; respects user-detached events
• removeTaskDueDateEvent — pre-delete cleanup
• findFreeSlots — 30min-aligned conflict-free slot finder
• scheduleTaskTimeBlock — drag-task-to-slot helper
• Wired fire-and-forget into POST/PUT/DELETE task routes (never blocks task writes)
• Priority emoji prefixes on synced events (🔥 URGENT / ⚡ HIGH / 📋 default)
• New routes: /api/admin/calendar/free-slots, /api/admin/tasks/[id]/schedule
• New 'parseEventFromEmail' action: GPT-4o-mini extracts events from email body
• Detects: meetings (with Zoom/Meet/Teams URLs), flights (departure + arrival as 2 events), hotels (all-day check-in), restaurant reservations, generic appointments
• Returns confidence-scored structured events with title/start/end/location/notes
• Resolves relative dates ('tomorrow', 'next Monday') against email receivedAt
• New 'createParsedEvent' action: one-click add suggestion to calendar
• Beautiful smart banner UI in email reading pane:
• Auto-triggered on message open (fire-and-forget)
• Google-Calendar-style date tile (red MMM + day + weekday)
• Confidence badge (High / Likely / Best guess)
• Per-event Add button + global dismiss
• Multi-event support (e.g. round-trip flights → both legs)
• prisma/schema/quickbooks.prisma + idempotent migration
• QboConnection (encrypted OAuth tokens, refresh window tracking)
• QboEntityMapping (bidirectional with echo-loop hash + canonical-side flag)
• QboAccountMapping (user-mapped Chart-of-Accounts purposes)
• QboSyncJob (resumable, cursor-based, multi-direction)
• Implementation per docs/integrations/QUICKBOOKS_INTEGRATION_PLAN.md

resolve 'failed to load invoices' + add tasks-calendar + QuickBooks plans

• Client was reading data.invoices but API returns { data: [...] }
• Client was passing ?limit=25 but API reads ?take=
• Fixed client to use json.data ?? json.invoices fallback + correct param
• Added invoices alias to API response for backward compatibility
• Better error logging (console.error preserves the actual error)
• Stats reset to zero when result list is empty (was leaving stale numbers)
• docs/tasks/TASKS_CALENDAR_INTEGRATION_PLAN.md
• One new model: TaskCalendarLink (kinds: DUE_DATE, TIME_BLOCK, MEETING, WORKED_ON)
• Auto-place on due date, drag-to-schedule, smart agenda at /admin/tasks/now
• Conflict detection via User.weeklyCapacityHours
• Per-user 'My Tasks' calendar auto-provisioned
• 6-phase rollout, 2 weeks to MVP
• docs/integrations/QUICKBOOKS_INTEGRATION_PLAN.md
• QBO entity mapping: Order→SalesReceipt, Refund→RefundReceipt, ContractorInvoice→Bill, Customer/Vendor/Item upserts, payroll JournalEntry
• Schema: QboConnection, QboEntityMapping, QboSyncJob queue, QboAccountMapping
• Encrypted token storage, OAuth flow, 5-tab admin UI
• Sync triggers wired into existing Stripe webhooks + invoice routes
• 5-phase rollout, 4 weeks to 'stop manual bookkeeping'
• One QBO file per LegalEntity, accrual basis, cash basis edge cases noted

Asana parity audit + CAD file cross-system linkage

• Comprehensive gap analysis vs Asana with 4 tiers (20 gaps)
• Tier 1: ProjectVisibility enum + ProjectMember + Team/TeamMember (private/team/tenant boards), CustomField, TaskTemplate, TaskWatcher
• Tier 2: multi-homing, sections, milestones, forms, status updates
• Tier 3: Goals/OKRs, Portfolios, Workload heatmap, Rules engine
• Explicit shared-vs-private board model with sidebar mockup
• 6-phase rollout plan + Phase-1 PR file list (~1500 LOC)
• Notes where we already beat Asana (AI prio, risk tracking, sprints+time tracking included, multi-tenant, in-house messenger hand-off)
• prisma/schema/cad-files.prisma — CadFile (Supabase Storage mirror) + CadFileLink polymorphic join with CadFileLinkType enum (PRODUCT/TASK/PROJECT/JEWELRY_PROJECT)
• prisma/add-cad-file-linkage.sql — idempotent DDL migration
• /api/admin/cad/links — POST/GET/DELETE with auto-upsert of CadFile row
• /api/admin/cad/link-targets — search picker for products/tasks/projects/jewelry-projects
• src/components/admin/cad/link-cad-file-dialog.tsx — tabbed picker, debounced search, current-links chips with one-click unlink, 'Already linked' badges
• New 'Link to product / task / project' menu item in file dropdown
• New link icon in grid hover row
• Drive-style multi-segment clickable breadcrumb (Home > Bridal > Engagement > ...)
• /admin/products → Product
• /admin/tasks → Task
• /admin/projects → JewelryProject (jewelry production model)
• Future-proofed for dev Project model

restore in-house Slack-replacement messenger + iOS integration guide

• HeaderChat top-bar Messages button now opens /admin/messages (was redirecting to Slack since Feb 2026)
• /admin/messages page renders the full <Messenger /> component (Supabase realtime, channels, DMs, group chats) — replaces the 'moved to Slack' interim card
• Add /api/user route returning { id, name, email, image, bubbleColor } — required by the Messenger client and the iOS app
• scripts/apply-messenger-migration.mjs — idempotent runner that applies scripts/db-migrations/applied-sql/messaging/add_internal_messenger.sql AND adds ChatMessage + ChatChannelMember to the supabase_realtime publication
• Migration applied to production (tables present, counts 0/0/0)
• docs/messenger/IOS_INTEGRATION.md — complete Swift wiring guide for the Katura iOS app workspace covering: WKWebView NextAuth cookie hand-off, Codable models, ChatService REST client, Supabase realtime channel subscription, SwiftUI view skeleton, optional Supabase RLS policies, push notification roadmap

trust bar, financing display, sticky mobile CTA, /promise + /ring-sizer + /custom-design landing pages, anonymised recent-purchases ticker (off by default), polished 404, footer service row

• TrustBar mounted site-wide above footer (Lifetime Warranty / 30-Day Returns / GIA / Free Insured Shipping)
• FinancingDisplay shown under PDP price ('as low as $X/mo') — pure display widget; real Affirm/Klarna flow remains in unchanged Stripe Payment Element
• StickyMobileAddToCart bar on PDP — mobile only, scroll-to only, NEVER submits to cart (single source of truth for cart adds stays ProductActions)
• /promise — 6 promise cards + concierge CTA
• /ring-sizer — free ring sizer landing + form, posts to new /api/marketing/ring-sizer (creates EngagementLead, Brevo confirm email, list sync; idempotent on email)
• /custom-design — 4-step process landing with transparent pricing
• /api/social-proof/recent-purchases — anonymised (first initial + city only, jittered timestamps, 5-min cache); RecentPurchasesTicker mounted off-by-default behind NEXT_PUBLIC_RECENT_PURCHASES_TICKER env flag
• Polished /not-found with 3-card next-step grid
• Footer 'Why Katura' service row (Promise / Custom Design / Free Ring Sizer / Financing)

comprehensive CRO recommendations for first-sale push

• 15-section diagnostic + prescription doc covering:
• 1. Honest funnel diagnosis (you're traffic-starved, not conversion-starved)
• 2. Trust signals (trust bar, reviews, press, BBB, founder photos)
• 3. Risk reversal & urgency (warranty, free ring sizer, honest urgency)
• 4. Checkout friction (Apple Pay, address autocomplete, ETAs, recovery)
• 5. Lead capture (First Look popup, quizzes, lead magnets, Stella surfacing)
• 6. Product page polish (360°, hand models, AR, certificates, financing)
• 7. /custom-design landing page outline (the moat)
• 8. Paid acquisition playbook (Meta + Google + influencers)
• 9. Technical SEO + Core Web Vitals + schema.org
• 10. Email & retention sequences (welcome, AC, browse, post-purchase, anniversary)
• 11. Social proof (UGC feed, recent purchases ticker, customer stories)
• 12. 10 quick technical wins
• 13. Measurement: events to wire before optimising anything
• 14. 30-day prioritised plan (week-by-week, eng + marketing)
• 15. What NOT to do
• 16. The one thing that matters most: paid traffic + capture + drip
• Lives at docs/marketing/CONVERSION-RECOMMENDATIONS-2026-04-22.md

elegant redesign of /account/orders pages

• Soft gradient page background (stone-50 → white) for atelier feel.
• Hero header with eyebrow ('Your Atelier'), display-serif title, brand voice copy, and order count below.
• Empty state: brand-aligned amber/stone gradient icon badge, 'Your story begins here' headline, larger CTA.
• Removed boxy CardHeader; merged into padded CardContent.
• Top accent bar (amber gradient) for premium feel.
• Display-serif order number, eyebrow label, hover lift + shadow, product image scale-on-hover, animated 'View details →' arrow.
• Mini progress dots: larger (28px), ring-offset for current stage, shadows on completed steps, smoother transitions, stage labels exposed via title attr.
• Same gradient background + hero header treatment for consistency.
• Wider container (max-w-5xl) for breathing room.
• Need Help card → 'Need a hand?' concierge card with amber accent.

customer-facing 3D viewer for custom designs

• New CustomerCadViewer client wrapper that dynamic-imports STLPreviewDialog with showCastingPanel={false} (hides internal weight/cost data from clients).
• Order detail page now fetches JewelryProjectOrderLink → project → approved CAD files and renders a 'Your Custom Design' card with per-file 'View in 3D' buttons. Only files with approvedAt set are exposed to customers.
• STLPreviewDialog: new showCastingPanel prop (default true for backward compat with admin call sites). When false, side panel + volume callback are skipped so the canvas takes the full width.
• Filters to viewable 3D extensions (stl/obj/3dm/step/iges/gltf/glb/ply).