Software Updates

deletion removes saved addresses and strips PII from orders

• Account deletion anonymized the User but a user update never cascades, so
• saved Address rows survived, and orders kept email, phone and full
• shipping/billing addresses. It now deletes the addresses and, on every order
• of the user, sets email to the same anonymized address, clears phone, gift
• message and customer notes, and reduces addresses to country, state and a
• 3-character postal prefix (tax/accounting). Amounts, items, dates and status
• are kept. Repeat calls reuse the anonymized email (idempotent); the audit
• entry records counts.

public product allowlist; stop leaking costPrice and order internals

• GET /api/products, /api/products/[id], /api/collections/[slug] and the
• wishlist returned full Product rows: costPrice, vendor, supplier stock ids,
• Shopify ids, click analytics, isRosserOnly, storefrontId, tenantId, and
• variant costPerItem. New src/lib/products/public-product.ts is an explicit
• Prisma select + runtime serializer; every key the iOS retail app decodes
• (Product/Collection/Wishlist CodingKeys) is kept with the same shape, pinned
• by a unit test. Verified against production data: only private keys removed,
• no iOS key lost, same 97 products / 6 collections.
• Public lists now also force status ACTIVE (a ?status=DRAFT param used to
• expose unpublished pieces) and Katura storefront / non-Rosser-only; product
• detail 404s for anything the PDP would 404.
• /api/orders/[id]: OWNER/MANAGER keep the full view; the order's owner gets a
• customer-safe allowlist (no internalNotes, commission, Shopify/ShipStation
• metadata, attribution; product via the public allowlist); anyone else gets
• 404, not 401. PUT wrote trackingNumber/carrier/shippedAt/deliveredAt onto
• Order (no such columns -> 500); they now go to the latest Shipment.

handle canceled intents, keep Order.total in USD, zero-decimal amounts

• payment_intent.canceled was subscribed but unhandled, so Payment rows stayed PENDING. It now marks the Payment CANCELLED, cancels the order if it is still PENDING and releases its stock hold exactly once.
• payment_intent.succeeded overwrote Order.total (USD) with the charged foreign-currency amount (KAT-MT38YEVO: 192.17 BRL as the USD total). A non-USD charge now goes to chargedAmount/currency, matching what create-payment-intent writes; Payment.amount stays USD (metadata.amountUSD). Receipt/ops emails, Brevo LAST_ORDER_TOTAL and User.totalSpent use the USD total. The Purchase CAPI event (value + charged currency, event_source_url) is unchanged. Historical rows are not rewritten.
• centsToDecimal divided zero-decimal currencies (JPY/KRW/CLP/PYG/HUF/IDR/VND) by 100; it now uses the currency config via src/lib/currency/stripe-amount.ts, the exact inverse of toSmallestCurrencyUnit.
• succeeded is idempotent on Stripe retries (no second gift-balance deduction, stock decrement or email).
• A payment that succeeds after its hold was released re-deducts stock; if that oversells, the order is noted, ops is alerted, and it is not auto-exported to ShipStation.
• payment_failed only cancels/releases a still-PENDING order.

expire one-of-one stock holds after 20 minutes without payment

• A PaymentIntent-backed checkout hold lives 20 min from order creation.
• PDP, cart add, Meta/Google feeds, bundles and wholesale templates treat expired holds as released (read-only groupBy, only when reserved > 0).
• The checkout routes release expired holds on the cart's products, and the customer's own previous PENDING checkout (same email or user), before the stock check, so stacking is gone.
• Releasing cancels the Stripe PaymentIntent FIRST (a stale form can't be paid against released stock); processing / succeeded intents, and requires_action (3DS, Pix QR) under 60 min, keep their hold.
• PENDING -> CANCELLED is a conditional update and stock is released only by the winner, never below zero, on the same inventory row reserve uses.
• cleanup-orders now runs every 15 min (never */5) as the backstop; the legacy 4 h / 30 min path is unchanged for orders without a PaymentIntent and no longer "releases" stock for manual orders that never reserved it.
• The mobile PaymentIntent and Checkout Session routes reserved on EVERY inventory row of a product; they now reserve on one.

open the size picker when the scroll to it actually ends

• A fixed 450 ms delay sometimes fired before the smooth scroll settled on
• slower phones, so the picker opened off screen or not at all. Open on
• `scrollend`, with a 900 ms fallback where the event is unsupported.

keep the primary action on screen on phones

• "Continue to Payment" sat 1,750-2,150 px down on a phone. Below lg the
• existing submit button (now with the running total above it) is
• position:sticky at the bottom of the viewport while the form is on
• screen, and settles in place at the end of the form; the Pay button in
• PaymentForm gets the same treatment. Form fields get scroll-margin so a
• focused input scrolls clear of the bar. Same buttons, same handlers — no
• change to payment logic, validation, analytics or API calls.

put name, price and a working Add to Bag on a phone's first screen

• adds to bag through useAddToCart (same action, analytics, redirect);
• reads "Select size" when a ring size is required and unchosen (or ring variants are still loading); a tap scrolls to and opens the picker, which gets a highlight and a "requires a size" line. The main button does the same instead of a toast;
• links to the consultation for INQUIRY_ONLY/SHOWCASE as well as price-on-request (it used to offer Add to Bag for those);
• stays disabled when out of stock. It still hides while the in-page CTA is visible (now tracked on the button row, not the whole actions block) and marks <html data-sticky-buy-bar> so the WhatsApp widget steps aside; ProductActions shows an in-flow WhatsApp link on phones instead.

stop the WhatsApp widget covering buy buttons on phones

• Tooltip is closed by default; it appears at most once per session, on desktop only, after 30 s and 600 px of scrolling, and hides itself.
• On phones the button steps aside on any page that mounts a sticky buy bar (html[data-sticky-buy-bar], globals.css) and below lg on /cart and /checkout, where the pay action is sticky.
• New WhatsAppInlineLink for pages to keep an in-flow chat entry.

keep the gift-card popup off ad landings and the buy flow

• the session did not start on a paid click (fbclid, gclid, smart_link, or utm_medium=paid|cpc|paid_social) — remembered in sessionStorage;
• the route is not /cart or /checkout(/*), checked client-side on every navigation;
• >= 45 s since the session's first page view and >= 50% scroll depth on the current page;
• not shown in the last 7 days (localStorage).

extract the add-to-cart action into useAddToCart

• AddToCartButton's click handler (variant check, cart API call via
• useCart().addItem — which fires GA4/Meta/CAPI AddToCart — and the
• redirect-to-cart success feedback) moves into a hook so the PDP's sticky
• mobile bar can run the exact same action instead of scrolling to it.
• Adds an optional onMissingVariant callback so a caller can open its own
• size picker instead of the "please select a ring size" toast.
• No behaviour change for existing callers.

stage catalog + smart-link fixes from the campaign post-mortem

• Pending SQL, to apply with the next deploy: normalise trunk-show tag
• misspellings (incl. the campaign's main landing pendant), fix the
• 'Diaond' gemstone typo, attach productIds to the September smart links
• and strip the stray utm_source=chatgpt.com from the bracelet link.

give the PaymentIntent Purchase event its event_source_url

• Meta requires event_source_url on action_source=website events. The
• Checkout-Session path already sent it (session.success_url); the
• PaymentIntent path — every web embedded checkout and every native-app
• order — did not, so those Purchases were most likely rejected. No order
• has yet exercised this path in production.

ignore the nested katura-retail-ios repo

add customer-safe order history API for the retail app

• GET /api/account/orders returns the signed-in user's own orders (newest
• first, max 50) with an explicit field allowlist: money as numbers,
• paymentStatus from the latest Payment, tracking from the latest
• non-voided Shipment. Ownership mirrors /account/orders: user resolved by
• session email, orders by userId, tenant-zero scoped.

add /api/app/storefront so the apps price and sell like the site

• detectedCountry from x-vercel-ip-country (what the website uses)
• the country -> currency table, display rounding rules and exchange rates, straight from src/lib/currency
• the flat shipping table from src/lib/shipping/flat-rates.ts, the same numbers /api/create-payment-intent charges
• the Stripe publishable key, so the app's key always matches the server's live/test mode

make admin promotion codes work at checkout

• Add src/lib/promotions/resolve-promo-code.ts, the single resolver used by both the public preview (/api/promotions/validate) and the charge path, so the previewed discount is the charged discount. Enforces active window, usage/per-customer limits, new-customer, tags, product/collection targeting, exclusions, min purchase, max discount.
• Checkout tries promo codes first and falls through to gift cards on 404; shows the applied code with Remove and a discount line; sends promoCode to payment.
• create-payment-intent re-resolves server-side, subtracts the discount, taxes the discounted amount, zeroes shipping for FREE_SHIPPING, caps gift balance against the discounted total, records it on the order and in Stripe metadata. Ineligible codes are a hard 400.
• Stripe webhook records PromotionUsage and bumps currentUsage only on payment_intent.succeeded (idempotent per order).
• Gift-card redeem checks existence before the auth gate so guests who mistype see "Invalid code", not "Sign in"; both endpoints rate-limited.
• WELCOME100 is a config row for the signup welcome gift (already paid as gift balance) and is excluded from the coupon path.
• New checkoutPage i18n keys added to all 24 locale files (shallow merge).

stop losing drafts; publish edits immediately; crop and align images

• Writers were losing real work. The editor kept everything in React state alone,
• so a closed tab, a back-navigation, an expired session or a crash took the whole
• draft with it, silently and with no warning on the way out. A successful save
• then called router.push() straight back to the list, throwing the writer out of
• the piece they were mid-way through.
• Drafts now survive. use-article-draft.ts snapshots the form to localStorage on a
• 1s debounce and, on reopening, offers any snapshot that diverges from what the
• server sent — timestamped, with restore or keep-saved as an explicit choice, so
• nothing is ever silently overwritten. A beforeunload guard covers tab close and
• reload, Cancel confirms, and the snapshot is dropped only once the server has
• accepted the save. Where localStorage is unavailable (private browsing, full
• quota) the writer is told, rather than left with a false sense of safety. Save
• now stays put and reports the time; Save & close is a separate button, and a
• newly created article redirects to its own edit URL so a second save updates
• instead of creating a duplicate.
• Edits to published posts appear at once. [locale]/jewel-vox/page.tsx is ISR with
• revalidate = 3600 and its query sits behind unstable_cache(tags: ['articles']),
• and nothing ever invalidated either — so a correction to a live article could
• take an hour to show, which reads as "editing published posts is broken". Create,
• update, publish-toggle and delete now revalidate, wrapped so a cache hiccup can
• never fail an already-committed write. The [slug] pages were always dynamic and
• current; only the listings went stale.
• Images gain crop and alignment. Alignment is inferred back out of the inline
• style rather than stored in data-align, because lib/sanitize-html.ts allows

price the cost card honestly — DeepL at $25/M, Deepgram counted

• The per-meeting cost card used $5.49 per million characters for DeepL, which
• is the API Pro plan's monthly base fee, not the per-character rate ($25/M):
• every meeting's translation line was 4.5x too low. It also still said
• "browser speech recognition — no server STT cost", a comment from before the
• room moved to Deepgram Nova-3, so speech-to-text showed as $0.
• Now: DeepL at $25/M, and a Deepgram line at $0.0058/min over the sum of
• final transcript segment spans for the meeting — the floor of what Deepgram
• bills, since it meters the open stream including silence; the card says so.
• Both are computed from stored counts at render time, so past meetings are
• corrected on next view, no backfill.

stop the block rewinding on fragment merge; iOS save; reachable settings

• Both rooms: capped at 70vh (desktop min(34rem, 100vh-8rem)) and scrolling internally.
• Host: the three tallest sections — Preferred spoken language, Font, Recording — are now collapsed <details> disclosures. Native, so no state and no re-render path to get wrong.
• Translation is now one switch instead of a language list. ON means smart mode: everyone else's speech in YOUR own language, which is what almost everyone wants. Choosing a different target still exists, demoted to a link inside Settings — a language list is the wrong thing to put in front of someone mid-call.

direct in-call file sharing; make captions print without reprinting or jumping

• IncrementalTranslator re-appended the PRE-COMMIT tail the instant a chunk landed, so the chunk's own words printed twice and the duplicate was deleted a beat later. Fired every ~4 stable words, both rooms, every language pair. lastTailTrans is now cleared at the commit that takes ownership of those words. Reproduced by a regression test whose tails resolve out of order — the existing fixture resolved them synchronously, which forced the one interleaving where the bug cannot appear.

unbreak article saving; add image sizing and a live preview

• Saving has been impossible for any article without a category. The form sends
• categoryId: "" for "No category" (its default), the route passed that straight
• to Prisma, and Postgres rejected the row on Article_categoryId_fkey — 23503,
• verified against the live database. The writer saw only "Failed to create
• article". Both routes now normalise "" to null for categoryId and publishedAt,
• and answer failures with the actual reason: a P2003 names the field, a P2002
• names the clash, and zod issues come back per-field instead of a bare
• "Validation failed". Every one of the 275 existing articles was written by the
• cron through a different code path, which is why this went unnoticed.
• Image sizing: @tiptap/extension-image has no size control, and the public
• renderer forced prose-img:w-full over anything an author set — so images could
• only ever be full width. Images now carry a width attribute written as an
• INLINE style, which outranks the class, and a size bar (Small/Medium/Large/Full)
• appears whenever an image is selected. w-full remains the default, so existing
• articles are untouched; block+mx-auto centres the ones deliberately narrowed.
• Both `style` and `width` are already on the sanitizer allowlist, so the size
• survives publishing.
• Preview: a Write/Preview toggle renders the draft through ArticleContent — the
• same component the live article page uses — so images, spacing and typography
• are checked as they will ship. The editor stays mounted behind `hidden` so
• toggling does not discard undo history. Word count added alongside characters.

morphing captions, guest roster, Brevo outage visibility

• Translated captions render word-by-word with stable keys; revisions cross-fade in place instead of erasing and retyping. Incremental translator no longer shrinks/duplicates at chunk seams; finalized lines are pre-seeded from the live caption (admin + guest rooms).
• Guest join stores the invite email on the participant; Virgil gets a participant roster in context and resolves first names to invited addresses before asking. Send-email failures surface the provider's reason (Brevo 401 IP allowlist) instead of a bare HTTP 500.
• Single invoice currency; line-item inputs show the matching symbol. Removed the client-only USD->BRL overwrite (its rate fetch was CSP blocked and always fell back to 5.75); replaced with a reference-only converter via /api/exchange-rates.
• "Pay now" or "Email me a reminder in 1/3/7 days" on the public invoice page and email; sent by the existing daily invoice-reminders cron. Hand-applied migration adds three nullable SalesInvoice columns; reads tolerate the columns being absent until it is applied.
• Approve/Send action no longer rendered twice in the Virgil panel.
• Brevo auth/IP-allowlist errors are classified as a system outage: the prospect stays queued, the tick stops, a red banner shows the outage, and an internal alert fires after two consecutive failures.
• Unsubscribe, hard bounce and spam complaint now suppress the prospect and cancel queued follow-ups; suppression is checked before every send.
• Inbox-poll heartbeat shown in the page header; opens/clicks recorded per prospect behind PROSPECTING_TRACK_OPENS.
• Dry-run-by-default scripts: reset-401-failures, backfill-suppressions.

QR intake for identity-safe agreements, in 24 languages

• The intake form's words moved out of two-language maps hardcoded in intake-form.tsx and intake.ts and into messages/*.json under Signing.intake, the same catalog the rest of the signing surface already used. Translated into all 24 locales; the completeness test now covers them.
• Stored intakefields labels no longer win over the catalog. A persisted label is frozen in the language it was typed in, so the admin was saving Portuguese labels that every scanner saw regardless of their language. IntakeFieldSpec .label is now an optional operator OVERRIDE, and the admin persists structure only — key, order, type, requiredness.
• formatSignedAt asks Intl for the time-zone name instead of printing a hardcoded "horário de Brasília", which was right in one language of 24.
• Enabled for the bilateral NDA (/sign/nda), contractor W-9 (/sign/w9), and employee W-4 (/sign/w4), alongside the existing image release.
• Deliberately NOT enabled for custom-order-deposit, engagement-ring-order, lab-grown-diamond-order, wholesale-agreement, growth-services-retainer, natural-stone-release, bench-jeweler and casting-house. The intake form asks for every placeholder that is not an operator constant, and on those the remaining placeholders are prices, deposit percentages and payment terms — a QR link would let the customer set their own deposit and sign it.
• The NDA drops {effective_date} (nobody is there to type it, and a counterparty dating their own NDA can backdate it) and fixes {purpose} as a constant, since a counterparty writing their own purpose narrows the confidentiality obligation they are signing.
• Intake now always collects an email, even when the wording never prints one. The completion email, the signer's copy, and the duplicate-submission guard all read signeremail, and deriving fields purely from placeholders left it null for most templates — the signer walked away with nothing.

run functions in pdx1, next to the Supabase us-west-2 database

• Every function was executing in gru1 (project default) while Postgres
• lives in Oregon: a single SELECT 1 cost ~0.5 s, POST /api/cart (~14
• sequential queries) ~7.6 s, /api/products 3.5 s, /api/search 2 s.
• Route-level preferredRegion exports (translate routes, iad1) still win.

Meta signal health, GA4 read side, email UTMs, internal-traffic guard

• Meta Marketing API client + /admin/marketing/signals page and API (dataset quality, audience sync); scripts meta:signals, meta:audiences
• GA4 Data API client + pnpm ga:report; setup docs for both
• src/lib/marketing/utm: withUtm / addUtmToEmailHtml / toUtmCampaign, applied to campaign tests, system-email previews/tests, welcome gift, abandoned cart, wedding, credit, gift-card and winback emails; /go short links forward incoming UTMs
• layout: GTM / gtag / Meta / X pixels and PageViewTracker never load on internal routes (server + inline early-return guard)
• .env.example: GA4 + Meta Marketing vars; drop the unused AIza key

split the console into tabs, badge the standard

• The board stacked six things on one page: autopilot, the build standard, a
• 7-day send schedule, the revenue goal, the AI cost panel, and the prospect
• list. The list is the only one touched daily, and it sat below several
• screens of machinery that gets adjusted weekly at most.
• Four tabs now, with the mode banner deliberately left ABOVE them — whether
• the board is live or in test mode must never be one click away:
• Pipeline the book (default — the only surface used daily)
• Autopilot the runner + everything the cron will send in 7 days
• Standard which generation made each lead's artifacts
• Numbers the goal, and what the AI is costing
• Nothing was deleted or rewritten; the existing blocks are wrapped in tab
• panels. The per-prospect tabs inside the list (prospect-tabs.tsx) are
• untouched — those bucket by next action and are a different axis.
• StandardPanel now reports its rollup upward so the Standard tab carries a
• count of what is below the current bar, and carries nothing when the answer
• is zero. It stays mounted (hidden) rather than being unmounted with its tab,
• so the badge is accurate on page load instead of only after you visit the
• tab it exists to send you to.
• On removing the re-analyze / process-again buttons: they already disappear
• on their own. Every one is guarded — the urgent block on
• wouldSendBelowStandard > 0, the defect table on byIssue.length > 0, the lead
• list on prospects.length > 0 — and a clean book renders "Every lead in play
• is at the current standard" instead. They are visible right now because the
• book is not clean (167 with no deck, 12 needing fresh research).
• Worth keeping them for the same reason: OUTREACH_GENERATION is 4 and the
• ladder has already moved 1 → 2 → 3 → 4, with generation.ts explicitly

named offer URLs + a full-record page per jeweler

• Apostrophes are stripped, not separated. "Grissom's" -> "grissoms", not "grissom-s", which looks broken on the one word that is theirs.
• Ligatures and stroked letters are mapped before NFD, which does not decompose them: "ætla" was becoming "tla". A URL carrying the wrong name is worse than one carrying none. Names that yield nothing usable (e.g. purely non-Latin) keep slug NULL and resolve by token — correct, not a gap.

rename the assistant Yen -> Virgil in user-facing text

• Code: cartRecoveryEnabled, autoReplyEnabled, applePayEnabled, TaskPriorityEnum, ActivityEntry, byEntity and friends all contain the substring "yEn".
• Copy: Hungarian "ingyenes" (free, x20), Turkish "yeni" (new, x7), Spanish "incluyendo", French "moyenne" all contain "yen".
• Money: "Japanese Yen" in currency/config.ts and exchange-rates.ts is the JPY label and is deliberately left alone.

one real mark, three colourways, and the surfaces that were typing it

• An agent swept the whole app for places rendering the wordmark as literal text
• instead of the logo. It found 37 across six areas, and one thing worth stating
• plainly: lib/signatures/branding.tsx already had a component that does this
• correctly, resolving the branding row with the real asset — but its only
• importer is the ADMIN preview page. The correct component shipped to us, and
• every public signer got the text stand-in.
• THE MISSING PIECE WAS AN ASSET, NOT A DECISION
• Several of these were deliberate workarounds. The prospecting deck covers even
• say so: "White wordmark for the dark cover — the navy logo.png is unreadable on
• navy." That was true. There was no white logo.
• There are now three colourways, generated from the source alpha so the
• letterform antialiasing is identical across all of them and only the ink
• differs: navy, black, white. Real files rather than CSS filters, because a PDF
• has no CSS — web and print now render the identical mark. Verified by
• compositing each on its intended ground and looking at it.
• FIXED HERE
• · the QR intake page — the first screen a walk-in sees after scanning
• · the signing page header and the post-signature screen
• · the expired/voided/completed status screen
• · the sign.katura1999.com landing header and footer
• · present mode, in white on its near-black ground
• · all three prospecting PDF covers — these are sales collateral
• Also removed three dead public routes under /s/[token] (complete, expired,
• unavailable). Nothing in the repo links to them, the live flow renders those
• states inline from the localized page, and they carried English-only copy and
• stale wordmarks — three more things to keep in step for no traffic.