Software Updates

feat/app-controls into feat/app-swarm

• Integrates the feat/app-controls builder branch from the app swarm (iOS Controls,
• postal-code-first addresses, Pix/BNPL/Apple Pay checkout) so the three
• features can be reviewed and deployed together.

iOS Controls to curate the retail app's Home

• /admin/ios (listed under Core): hero slide editor with real photos or video per piece/collection, caption, sub-caption and autoplay; Featured picker with editable title; per-piece video mode (autoplay, tap to play, photo only); per-collection cover picker; shelf order and visibility; phone-frame preview; published timestamp. en/pt/es copy.
• Publishing is a server action on the page itself, so the feature adds only two routes (the page and the public endpoint) against Vercel's route cap. Managers and owners publish (requireKaturaAdmin admits EMPLOYEE by default); employees with Products access can view. Saves are audit-logged with old and new values, and a save over someone else's newer publish is refused instead of silently overwriting it.
• GET /api/app/home resolves the stored ids against the live catalog on every request: only ACTIVE public pieces (no custom-ring orders, no Trunk Show specials), photos/videos must still belong to their item, deleted collections drop out, new collections join the shelf order. Edge-cached for a minute; returns configured:false on failure so the app keeps its built-in Home. The resolver is pure and unit-tested.

Pix for the iOS app, BNPL for US orders, Apple Pay quotes

• PATCH /api/create-payment-intent confirms an existing checkout PaymentIntent with Pix server-side (CPF/CNPJ validated, client secret as the credential) and returns the QR / copia-e-cola code. Same order, same webhook. Codes expire after 30 min, inside the reservation sweeper's in-flight grace, so the sweeper never cancels a code still being paid.
• POST now returns the intent's resolved payment_method_types, so the app offers Pix only when Stripe really made it available (dashboard setting, BRL, under the 3,000 USD Pix cap).
• POST { quoteOnly: true } prices the bag for a partial address with no side effects (no customer, order, hold or superseding). The iOS Apple Pay sheet uses it to show the same shipping/tax/total the charge will use. Own rate-limit bucket so re-quotes never eat the checkout allowance.
• House allowlist: opt-in BNPL (affirm, klarna, afterpay_clearpay) for USD product orders. They settle to the house in full on success, so they pass the settled-funds rule; gift-card purchases do not opt in (providers prohibit stored value). Stripe enforces each provider's amount window.
• Webhook records payment_intent.processing as Payment PROCESSING.
• Web Payment Element lists Apple Pay / Google Pay first, adds Klarna to the USD order.

postal-code lookup route for every country, shared by web and iOS

• GET /api/address/lookup?country=XX&postalCode=... resolves a ZIP / CEP /
• postcode to street, neighborhood, city and state server-side, so the iOS app
• and the web checkout get the same answers and no client needs a new
• third-party fetch (the CSP's connect-src silently blocks those).
• Providers, all free and keyless, each with a 3 s timeout and a fallback:
• ViaCEP -> BrasilAPI for Brazil (street, bairro, city, UF); GeoAPI.pt ->
• Zippopotam for Portugal (street when the code maps to one, locality,
• district); postcodes.io for full UK postcodes (London boroughs post as
• London); Zippopotam for ~60 more countries including US, CA, MX, ES. State
• codes are only returned when they match the checkout's own pickers (US, CA,
• MX incl. DIF->CMX, BR); Spain gets its province from the code's first two
• digits. Canada gets the province only, because Zippopotam's FSA names are
• districts, not mailing cities.
• Answers are static: cached in memory (30 d found, 1 d not found, never
• "unavailable") and at the CDN via Cache-Control; 60/min per IP.
• The web checkout now calls the route instead of ViaCEP/Zippopotam directly
• and asks for the postal code first for every country that has one. This also
• fixes Mexico, where the state picker hid the only postal code field while
• the form still required it, so Mexican shoppers could not continue.

never print the GitHub token when a repo-stats clone fails

• git's error message repeats the clone URL, x-access-token included, and
• the warning printed its first 100 characters into every Vercel build log.
• Log only git's stderr, with the token and anything token-shaped masked.

one locale rewrite per store route; back under Vercel's route cap

• The Sign in with Apple/Google deploy built but failed to upload with
• too_many_routes (2049 > 2048). Each store route had two beforeFiles
• rewrites, /route and /route/:path*, but :path* already matches the bare
• path (checked against the manifest regex: /route, /route/, /route/a/b
• match, /routex does not) and compiles to /en/route. Dropping the
• redundant rule frees 52 routes.

handle Sign in with Apple server-to-server notifications

• Apple posts a signed notice when a customer stops using Sign in with
• Apple for KATURA, deletes their Apple Account, or switches Hide My Email
• forwarding. POST /api/auth/apple/notifications verifies the JWT (Apple
• JWKS, issuer, bundle id or Services ID audience) and, for
• consent-revoked and account-delete, removes that Apple link so it can no
• longer sign in; the KATURA account and its orders stay. Every notice is
• audit-logged per user.

Sign in with Apple and Google for customers, web + iOS

• One resolver (src/lib/oauth/identity.ts, rules in identity-decision.ts) for web and native: existing identity -> sign in; signed-in Connect -> link; verified email match -> auto-link; else create a CUSTOMER with emailVerified and the register side effects (no newsletter, no WELCOME100). Staff / platform / non-zero-tenant / SaaS-owner / support-IT accounts are never signed in, created or linked.
• NextAuth: Google and Apple providers register only when their env vars exist; the signIn callback runs the resolver before Auth.js's second getUserByAccount, and the adapter's createUser/linkAccount now refuse to run. Apple client secret is an ES256 JWT signed from the .p8. state/nonce/PKCE (and callback-url) cookies are SameSite=None in production for Apple's form_post; the session cookie stays Lax.
• POST /api/auth/mobile/oauth: verifies Apple/Google ID tokens (jose, remote JWKS, iss/aud/nonce), exchanges Apple's authorization code for a refresh token, and mints the same NextAuth session cookie a browser sign-in gets.
• /api/account/sign-in-methods (GET, DELETE /{provider}, POST link-intent); change-password lets passwordless accounts set a first password; account deletion and unlinking revoke Apple tokens.
• /api/app/storefront gains auth flags; login/register get provider buttons and settings a Sign-in methods card (en + pt strings).
• Customer OAuth errors bounce from /employee-login back to the page the customer started on.

share new-customer side effects outside the register route

• Wishlist creation, the welcome email and the Brevo contact upsert move to
• src/lib/account/new-customer.ts so Sign in with Apple / Google sign-ups can
• run the same side effects. Register behaviour is unchanged (same order,
• lists, attributes, tags and log scope); the WELCOME100 gift card stays in
• the register route.

keep the native apps and local secrets out of CLI uploads

• vercel --prod failed with "Request body too large. Limit: 10mb": the CLI
• reads .vercelignore instead of .gitignore, so it tried to send ~160k
• files from the iOS/Android repos' build folders. Exclude those, the
• local asset folders and every .env file (Git deploys never had them;
• builds read Vercel's env vars).

universal links file names the real app and its paths

• The file still had the TEAM_ID placeholder and /product/, /collection/
• paths the site doesn't use, so katura1999.com links never opened the
• app. Now X6QHDNT477.com.katura.app with /products, /shop,
• /collections and /creations/trunkshow (with or without a locale prefix),
• the paths AppRouter handles; checkout stays on the web. Served as JSON.

every public collection gets a coverImage

• None of the six collections has an admin cover, so the retail app's
• editorial Home pages and collection covers stayed hidden. GET
• /api/collections and /api/collections/[slug] now add a computed
• coverImage: the admin cover, else the first admin mosaic pick (as the
• website's /collections tiles), else the lead piece's (featured, then
• newest) second photograph so it differs from the grid's first card.
• image itself is untouched, so admin never saves an automatic pick.

one KATURA-APPS workspace; hide the app repos under the website root

• The Katura workspace files listed katura1999 and katura-ios as separate
• roots, so katura-ios showed twice and the retail app not at all.
• Katura-Android and the two files committed inside migration folders
• pointed at paths that do not exist. Replace all of them with one
• workspace (website, retail iOS, Team iOS, Android) and exclude the app
• folders from the website root's tree, search and file watcher.

record campaign catalog fixes as applied

ring sizes start at 5; stop defaulting and re-flagging one-of-one

• Customer size pickers (PDP, design-your-ring, engagement design, ring builder, app config) start at US 5. Staff preference records keep the full range because they capture real measurements.
• 'One of one' meant 'one in stock', not 'cannot be made again'. New products default to false (form, admin API, schema default + migration), and the admin update route no longer sets it to true whenever an edit omits the field — that would have re-flagged every product on save.

make admin promotion codes work at checkout

• Add src/lib/promotions/resolve-promo-code.ts, the single resolver used by both the public preview (/api/promotions/validate) and the charge path, so the previewed discount is the charged discount. Enforces active window, usage/per-customer limits, new-customer, tags, product/collection targeting, exclusions, min purchase, max discount.
• Checkout tries promo codes first and falls through to gift cards on 404; shows the applied code with Remove and a discount line; sends promoCode to payment.
• create-payment-intent re-resolves server-side, subtracts the discount, taxes the discounted amount, zeroes shipping for FREE_SHIPPING, caps gift balance against the discounted total, records it on the order and in Stripe metadata. Ineligible codes are a hard 400.
• Stripe webhook records PromotionUsage and bumps currentUsage only on payment_intent.succeeded (idempotent per order).
• Gift-card redeem checks existence before the auth gate so guests who mistype see "Invalid code", not "Sign in"; both endpoints rate-limited.
• WELCOME100 is a config row for the signup welcome gift (already paid as gift balance) and is excluded from the coupon path.
• New checkoutPage i18n keys added to all 24 locale files (shallow merge).

stop losing drafts; publish edits immediately; crop and align images

• Writers were losing real work. The editor kept everything in React state alone,
• so a closed tab, a back-navigation, an expired session or a crash took the whole
• draft with it, silently and with no warning on the way out. A successful save
• then called router.push() straight back to the list, throwing the writer out of
• the piece they were mid-way through.
• Drafts now survive. use-article-draft.ts snapshots the form to localStorage on a
• 1s debounce and, on reopening, offers any snapshot that diverges from what the
• server sent — timestamped, with restore or keep-saved as an explicit choice, so
• nothing is ever silently overwritten. A beforeunload guard covers tab close and
• reload, Cancel confirms, and the snapshot is dropped only once the server has
• accepted the save. Where localStorage is unavailable (private browsing, full
• quota) the writer is told, rather than left with a false sense of safety. Save
• now stays put and reports the time; Save & close is a separate button, and a
• newly created article redirects to its own edit URL so a second save updates
• instead of creating a duplicate.
• Edits to published posts appear at once. [locale]/jewel-vox/page.tsx is ISR with
• revalidate = 3600 and its query sits behind unstable_cache(tags: ['articles']),
• and nothing ever invalidated either — so a correction to a live article could
• take an hour to show, which reads as "editing published posts is broken". Create,
• update, publish-toggle and delete now revalidate, wrapped so a cache hiccup can
• never fail an already-committed write. The [slug] pages were always dynamic and
• current; only the listings went stale.
• Images gain crop and alignment. Alignment is inferred back out of the inline
• style rather than stored in data-align, because lib/sanitize-html.ts allows

price the cost card honestly — DeepL at $25/M, Deepgram counted

• The per-meeting cost card used $5.49 per million characters for DeepL, which
• is the API Pro plan's monthly base fee, not the per-character rate ($25/M):
• every meeting's translation line was 4.5x too low. It also still said
• "browser speech recognition — no server STT cost", a comment from before the
• room moved to Deepgram Nova-3, so speech-to-text showed as $0.
• Now: DeepL at $25/M, and a Deepgram line at $0.0058/min over the sum of
• final transcript segment spans for the meeting — the floor of what Deepgram
• bills, since it meters the open stream including silence; the card says so.
• Both are computed from stored counts at render time, so past meetings are
• corrected on next view, no backfill.

stop the block rewinding on fragment merge; iOS save; reachable settings

• Both rooms: capped at 70vh (desktop min(34rem, 100vh-8rem)) and scrolling internally.
• Host: the three tallest sections — Preferred spoken language, Font, Recording — are now collapsed <details> disclosures. Native, so no state and no re-render path to get wrong.
• Translation is now one switch instead of a language list. ON means smart mode: everyone else's speech in YOUR own language, which is what almost everyone wants. Choosing a different target still exists, demoted to a link inside Settings — a language list is the wrong thing to put in front of someone mid-call.

direct in-call file sharing; make captions print without reprinting or jumping

• IncrementalTranslator re-appended the PRE-COMMIT tail the instant a chunk landed, so the chunk's own words printed twice and the duplicate was deleted a beat later. Fired every ~4 stable words, both rooms, every language pair. lastTailTrans is now cleared at the commit that takes ownership of those words. Reproduced by a regression test whose tails resolve out of order — the existing fixture resolved them synchronously, which forced the one interleaving where the bug cannot appear.

unbreak article saving; add image sizing and a live preview

• Saving has been impossible for any article without a category. The form sends
• categoryId: "" for "No category" (its default), the route passed that straight
• to Prisma, and Postgres rejected the row on Article_categoryId_fkey — 23503,
• verified against the live database. The writer saw only "Failed to create
• article". Both routes now normalise "" to null for categoryId and publishedAt,
• and answer failures with the actual reason: a P2003 names the field, a P2002
• names the clash, and zod issues come back per-field instead of a bare
• "Validation failed". Every one of the 275 existing articles was written by the
• cron through a different code path, which is why this went unnoticed.
• Image sizing: @tiptap/extension-image has no size control, and the public
• renderer forced prose-img:w-full over anything an author set — so images could
• only ever be full width. Images now carry a width attribute written as an
• INLINE style, which outranks the class, and a size bar (Small/Medium/Large/Full)
• appears whenever an image is selected. w-full remains the default, so existing
• articles are untouched; block+mx-auto centres the ones deliberately narrowed.
• Both `style` and `width` are already on the sanitizer allowlist, so the size
• survives publishing.
• Preview: a Write/Preview toggle renders the draft through ArticleContent — the
• same component the live article page uses — so images, spacing and typography
• are checked as they will ship. The editor stays mounted behind `hidden` so
• toggling does not discard undo history. Word count added alongside characters.