Bring the Giellie agent's operating manual in line with the live production
state after the 2026-08-04 smoke test against https://wfdash.apphub.co.za.
Bugs / quirks documented (with workarounds):
- tools.discovery was unwired; now fixed in code (separate commit),
live server needs redeploy before response changes
- orders.list silently ignores 'filter'; only 'search' is honoured
- quotes.lookup returns opaque 'fetch failed' — use quotes.list instead
- collection_pool.list + sprint.list return 'Missing collection context'
- orders.get 'not found' for at least one valid id
- quotes.items.rewrite was incorrectly listed as an MCP tool (it's REST)
Architectural gaps documented:
- No quote_items.list MCP tool; quotes.create_from_email returns item
count only, so a freshly-ingested quote's item IDs can't be recovered
via the agent API
- is_processed is intentionally NOT in bulk_update_quote_items whitelist;
end-to-end create→price→render pipeline requires human in the UI
Credentials & endpoints now include every token the agent might need:
AGENT_API_KEY, PB admin email/password, n8n base URL + API key, six
n8n webhook URLs (rewriter, price-list match, PO send, AI insights,
markup approval, customer list, QB invoice creator), TomTom map key.
Other updates:
- Replaced stale base URL wfdash.davidels.dev with wfdash.apphub.co.za
- Bumped tool count 69 → 70 (tools.discovery added to catalog)
- Added three-way tool discovery guide (tools/list, tools.discovery,
GET /api/mcp)
- Added 'Quote PDF rendering' guide explaining the 422 gates,
status transitions, and letterhead codes
- Added change log at the bottom
- All worked examples updated to the correct host
Co-authored-by: Orca <help@stably.ai>
The tools.discovery tool was declared in the catalog (line 1300) but no
tools/call dispatch branch existed for it — every call fell through to
'Unknown tool: tools.discovery'. Functionality was reachable only via
the parallel GET /api/mcp endpoint, which the JSON-RPC-only MCP clients
in n8n couldn't use.
Add a real handler that returns the same `tools` array as tools/list,
wrapped in the standard JSON-RPC content envelope. Mirrors GET /api/mcp
for JSON-RPC-only clients.
Also add a Vitest case that asserts the catalog shape (array of tools,
each with name+description+inputSchema, and tools.discovery in the list).
Deployment note: this fix is in source; the live apphub.co.za server
runs a built bundle and will keep returning 'Unknown tool' until rebuilt.
Co-authored-by: Orca <help@stably.ai>
The archive sort comparator in both getOrdersArchiveData and
getQuotesArchiveData was:
if (av === undefined) return 1;
if (bv === undefined) return -1;
return (av > bv ? 1 : -1) * sortDir;
PocketBase returns `null` (not `undefined`) for unset fields
like `updated`, `email_body`, etc. The strict equality check
missed nulls, and the `av > bv` comparison where one side is
null fails the production tsc check (TS strict mode rejects
`null > string`).
Production build failed with:
./src/lib/server/orders-service.ts:687:13
Type error: 'av' is possibly 'null'.
Fix: use `== null` (which matches both null and undefined),
and use explicit > / < comparisons that return 0 on equality
rather than a fragile ternary that falls through.
Also fixed in the matching function in quotes-service.ts — the
same sort comparator was used in getQuotesArchiveData and would
fail the same way.
All 1331 tests pass; npm run build completes cleanly.
Co-authored-by: Orca <help@stably.ai>
The webview shortcut in the "Other" sidebar group now displays as
"Giellie" instead of "Hermes". Only the visible label changes — the
underlying /webview?src=hermes URL parameter and the ALLOWED-map
key in src/app/(app)/webview/page.tsx are untouched, since those
are internal identifiers (the URL key is what looks up the embeddable
iframe in the ALLOWED whitelist, not a user-facing string).
If you want the internal key renamed too, that's a follow-up that
needs to update both the sidebar link and the ALLOWED map in the
webview route in the same commit.
Co-authored-by: Orca <help@stably.ai>
Two document scans (2481x3508, A4 @ 300 DPI) that landed in the
repo root. Adding them per user request to commit everything in the
working tree. No code references either file — they're untracked
artifacts from the workspace, not source assets.
# Tracked here so they're not lost
Co-authored-by: Orca <help@stably.ai>
Parallel to the orders archive treatment. On the live PB the
'Completed' tab on /quotes held 7,849 of 8,466 quotes (93%) and
the 'All' tab was 8,454. Same shape as orders: a 4k-id IN clause
blowing past PB's filter cap, with 'Page 1 of 392' on the tab
that operators didn't actually use for active work.
This commit moves both buckets to a dedicated /quotes/archive
page so:
- Main /quotes is fast (active workflow: new, claimed,
pending_approval, cancelled, delivery_note, email_failed,
problem, templates = 542 quotes vs 8,466)
- Archive can be honest about pagination
- The badge counts on the main page stop being dominated by
'Completed (7,849)'
# Service layer
- getQuotesArchiveData(params) in src/lib/server/quotes-service.ts
- view: 'completed' (default, 7,849) or 'all' (8,466)
- Strategy: one getFullList on quotes (fields: id,status) to
populate the matching set AND the header counts in a single
walk, chunk by 100 ids (PB's URL/filter cap is between
4.5-6.7 KB), fire parallel getFullList queries on quotes
with deep expand, sort + paginate in memory
- Search hits quote_number, quote_reference, rfq_number,
company, customer
- /api/v1/quotes/archive thin route: page, perPage, search,
sort, view
# Page
- /quotes/archive/page.tsx: card list with header counts
(completed / all badges), view toggle (Completed | All),
search input, pagination footer. Click a quote to open
/quotes/[id] in detail.
# Main /quotes updates
- Completed + All removed from the tab strip
- Counts on the main page now exclude completed + all
- 'Archive' button in the page header takes the operator to
/quotes/archive
- Safety useEffect: if activeTab is completed/all (e.g.
stale URL or local state), reset to 'new'
# Tests
4 new tests in quotes-service.test.ts:
- Default 'completed' view returns only completed quotes,
counts header includes both
- 'all' view returns every counted-status quote
- Search by quote_number and quote_reference
- Empty result when no quotes match
# Also: webview tweaks by another agent
- /webview?src=hermes label in sidebar
- Hermes URL whitelist updated
- Some header text removed (the probe status remains)
Full suite: 1331/1331 pass.
Co-authored-by: Orca <help@stably.ai>
Work by another agent on the PO send flow. Adds a 'Resend' CTA
on the order detail page for POs that were already sent
(operator wants to send another copy to the supplier), plus
acceptance of the same flow from the modal. Includes:
- purchase-orders-service: accept 'sent' as a resend-from state
(in addition to 'draft' and 'mail_failed')
- send-po-modal: title flips to 'Resend Purchase Order ...' when
the PO was previously sent; 'Send' button becomes 'Resend'
- send-po-modal.test: covers the resend path
- orders/[id]/page: shows Resend button in the same sendable
state group as Send (was draft / mail_failed, now also 'sent')
- purchase-orders pdf route: updates docstring to reflect that
status is the outbound-email pipeline's responsibility
- stock-purchases pdf route: download URL uses file proxy for
admin-auth compatibility
Co-authored-by: Orca <help@stably.ai>
The 'Delivered' tab on /orders was broken \u2014 4,326 of 4,514 orders
(96%) have at least one delivered item. The old tab tried to
build a WHERE id IN (...) filter with 4,326 ids (~120 KB),
blowing past PB's ~4 KB filter cap and 400ing. This commit
moves historical orders to a dedicated page so:
- The main /orders view is fast (22-28 active orders, not 4.5k
historical)
- The archive can be honest about its pagination ('Page 1 of
217' is expected when looking for something from last month)
- The badge counts on the main page stop being dominated by
'Delivered (4,326)' / 'Cancelled (111)'
# Measured against the live PB
/api/v1/orders/archive?page=1&perPage=2 \u2014 15.2s cold, 6.5 KB
response. The 15s is the order_items.getFullList over 13,256
items (the bottleneck; PB paginates over many round-trips).
Per-row payload is the standard 5-6 KB for orders with deep
expand. Subsequent pages within the same minute would be much
faster since PB caches the order_items query.
# Service layer
- getOrdersArchiveData(params) in src/lib/server/orders-service.ts
- Returns paginated list of orders with \u22651 item in
(delivered, cancelled) status, plus per-status distinct
counts for the header totals
- Strategy: getFullList on order_items (ids + status only),
dedupe + per-status counts in one pass, chunk the order ids
by 100 (PB's URL/filter cap is between 4.5-6.7 KB) and fire
parallel getFullList queries on orders with deep expand
- Search hits order_number, company, customer, contact_name
- Sort defaults to -created, override via the sort param
- /api/v1/orders/archive thin route: page, perPage, search, sort
(no tab, no nocache \u2014 archive is one bucket, not a tab split)
# Page
- /orders/archive/page.tsx: card list with header counts
(delivered / cancelled badges), search input, pagination
footer. Click an order to open /orders/[id] in detail.
# Main /orders updates
- Delivered + Cancelled removed from the tab strip (passed
tabKeys=['new','processing','collection_pool','collected'] to
ItemStatusTabs)
- Counts on the main page now exclude delivered + cancelled
- 'Archive' button in the page header takes the operator to
/orders/archive
- Safety useEffect: if activeTab is delivered/cancelled (e.g.
stale URL or local state), reset to 'new'
# Tests
4 new tests in orders-service.test.ts:
- Returns orders with \u22651 delivered/cancelled item, plus counts
- Dedupe: one order with multiple matching items counts as 1
- Search by order_number and contact_name
- Empty result when no orders match
Full suite: 1321/1321 pass.
Co-authored-by: Orca <help@stably.ai>
# Regression: orders/quotes list lost customer/company/rep data
Last commit added a `fields` parameter to the orders and quotes
list queries to trim the wire payload. Measured on a stale test
result, looked like a 16x win. Actual: PB 0.26's `fields`
parameter is a HARD ALLOWLIST of MAIN record columns only \u2014
specifying it makes PB drop the entire `expand` payload from
the response. Result: customer, company, rep, quote names
disappeared from every order/quote card.
Verified against the live PB:
- With `fields`: expand is dropped, just relation IDs returned
- Without `fields`: expand works, full records (55-57 KB for
20 rows with deep expand)
Fix: remove the `fields` parameter from both list queries. The
slim-payload intent has to be paid at the schema level (cap the
unbounded text columns) rather than via PB query params.
The earlier '12x smaller' / '16x smaller' benchmarks were
measurements of the BROKEN response, not the working one. Real
wire sizes are unchanged from before the perf work \u2014 but the
other wins (server-side tab filter, combined status counts,
targeted users fetch, 60s counts cache) all still apply.
# Bonus: show contact_name on the order card
~76 of ~4.5k orders have `contact_name` set (the free-text
person the order is for, captured during email-intake when the
customer record is just the company). Added to the OrderCard
header between customer and rep, with a docstring explaining
the distinction from the customer relation and email_sender.
Added contact_name to the Order type and pinned the regression
with a test that asserts the orders list query does NOT pass
`fields` (so a future 'let's slim the payload' attempt
doesn't reintroduce the bug).
# REP label
The rep column on the order card now reads 'REP' (uppercase)
instead of 'rep' (lowercase). All 1312 tests pass.
Co-authored-by: Orca <help@stably.ai>
Same shape as the orders refactor \u2014 applied to the quotes page,
with a fix for a long-standing tab-count bug along the way.
# Measured against the live PB (8,466 quotes, 4,514 orders, 25,612 items)
Before:
- 22 parallel per-status getList(1, 1) queries for the badge
counts: 2.6s wall time (no quotes.status index)
- 64 KB JSON response for 20 quotes with full deep-expand
(45+ fields per quote, including unbounded email_body)
- Page footer shows 'Page 1 of N' where N is the global count
\u2014 'Completed' tab had 7,849 quotes = 'Page 1 of 393'
After (no PB index, just code):
- 1 combined counts query: 138ms (19x faster)
- 5.5 KB JSON response (12x smaller)
- Server-side tab filter: page 1 of N reflects the tab's set
- Cancelled tab badge now correctly counts rejected+cancelled
# Server-side read model
- getQuotesDashboardData in src/lib/server/quotes-service.ts
- tab-scoped list + global counts in one round-trip
- tab param drives a server-side filter (status IN (...) for
workflow tabs, relation filter for delivery_note, is_template
for templates, excludeTemplate for 'all')
- pagination reflects the active tab's matching set, not the
global ~8.5k quote count
- getQuoteStatusTabCounts: one combined getFullList with all
17 counted statuses ORed (fields: 'status'), deduped in memory.
Replaces 22 separate per-status scans. Cached 60s on the server
with bypassCache option for future realtime refetches.
- /api/v1/quotes/list thin route: validates tab against
QUOTE_TAB_ORDER, threads tab + nocache params to the service.
# Slim wire payload
- fields param on the orders list: just the columns the page reads
+ per-expand limits (quote.quote_number doesn't need
email_body, company.company doesn't need its address field, etc.)
- Dropped the customer.company 3-level expand (the page never read
expand.customer.expand.company \u2014 only expand.company.company,
which is a direct relation from quote)
- searchQuotesWithItems: same fields added, with
fetchQuoteItemsForQuotes now accepting fields
# Bonus bug: 'Cancelled' tab badge was always empty
The old getQuoteStatusCounts mapped both 'cancelled' AND 'rejected'
to the 'completed' count, so the page's 'Cancelled' tab badge
showed 0 even when 60+ rejected quotes existed. The page's
tabFilters separately grouped them under 'cancelled', so a quote
that was rejected showed up in the list but not the count.
The new QUOTE_TAB_STATUSES in the service layer is the canonical
mapping (cancelled absorbs both statuses). Page constants and
service constants now derive from the same source \u2014 no more drift.
# Index migration
scripts/migrations/2026-08-04-add-quotes-status-index.ts. Idempotent.
The live PB has no quotes.status index today (verified by hitting
/api/collections/quotes). With the index, the combined counts
query drops from 138ms to sub-10ms on the live instance.
# Tests
6 new tests in quotes-service.test.ts:
- QUOTE_TAB_STATUSES contract (cancelled absorbs rejected,
no empty status lists unless special-cased)
- getQuoteStatusTabCounts buckets correctly into tabs
- Cache hit returns the same counts on second call
- bypassCache: true sees new state
- getQuotesDashboardData end-to-end: tab-scoped items +
global counts
- Regression guard for the cancelled/rejected bug
Mock infrastructure upgrade: the quotes-service mock's where
function is now a proper recursive-descent filter parser (handles
nested || inside parens, empty quoted values). getList mock now
returns totalPages.
Full suite: 1312/1312 pass.
Co-authored-by: Orca <help@stably.ai>
Three rounds of fixes for the /orders page:
#1 Correctness \u2014 server-side tab filter
- Add `tab` query param to /api/v1/orders/list; the route validates
it against TAB_GROUP_ORDER and threads it to getOrdersDashboardData.
- listOrdersWithItems now resolves order ids for the tab via
getOrderIdsForTabGroup (using the existing tabGroupFilter helper),
then fetches just those orders. The footer pagination reflects
the matching set ("Page 1 of N"), not the global 4520-order
count ("Page 1 of 226"). The "Processing (4)" badge now
matches what page 1 actually shows.
- Client: fetchOrders depends on activeTab, so switching tabs
triggers a fresh server-side query. The redundant visibleOrders
client filter is removed. The empty state now nudges the operator
to busy tabs ("Busy tabs: New (12) \u00b7 Delivered (4)").
#2 Perf \u2014 combined counts + targeted users + slim deep expand
- getOrderItemStatusTabCounts collapses 6 parallel per-tab
getFullList calls into ONE combined query, with batch: 5000.
6 filter scans \u2192 1 scan; ~9x fewer internal round-trips.
Bumped cache TTL 30s \u2192 60s.
- Replaced users.getFullList with fetchRepUsersForOrders \u2014 only
fetches the user ids the loaded orders actually reference.
- Dropped potential_quote from the deep expand (list view only
checks the field's existence).
- Added a migration script for the order_items.item_status index
(scripts/migrations/2026-08-04-...). Idempotent: the live PB
already has the index per the schema export, so the script
no-ops on most installs; documented as the recommended manual
step in case an older instance is missing it.
#3 Perf \u2014 wire-payload limits on deep expand
- The quotes collection has unbounded text fields (email_body,
email_message). Without limiting, the orders deep-expand was
dragging the full email body of every linked quote into the
list response \u2014 20 orders with deep expand = 1-5 MB JSON.
- The orders list now passes a `fields` param with the
`expandField.subfield` syntax PB supports: only
`quote.quote_number`, `company.company`, `customer.customer`,
`customer.rep.{id,name,email}` come back, not the full records.
- The items query likewise limits fields to the 8 columns the list
view + search predicate actually read; the supplier expand (not
rendered per-line) is dropped.
Tests: 22 new tests in orders-service.test.ts (tab filter, cache
bypass, combined-query call count, pagination honesty, field-list
contract). Full suite: 1306/1306 pass. The mock's where helper was
upgraded to support || and != / =~ / !~ operators, and the
getFullList mock now honours the filter arg.
Realtime: debounce bumped 300ms \u2192 1000ms, and the realtime path
passes nocache=1 so the 30/60s tab-counts cache is bypassed on
changes the operator just made.
Co-authored-by: Orca <help@stably.ai>
Three review-modal polish items rolled up:
1. Persisted line items now expose a description input in edit mode
(mirroring the existing qty / selling inputs). The save route +
the orders service's `updateOrderItemsPrices` accept the new
`description` field and write `description` + `po_description`
together (rejecting a blank description per row, with a
per-row failure entry so the operator can retry just those).
2. The source-of-truth panel now ALWAYS renders the email body, not
only when there are no attachments. The body is collapsed by
default and capped at `max-h-40` so the email stays a secondary
audit block instead of pushing the operator's real work
(line items + attachments) down the page. The toggle button is
unchanged.
3. The chip strip and file list inside the source-of-truth panel
were using `key={a.id}`. `orderAttachementsToQuotes` synthesizes
every attachment with `id: order.id` (PB file URLs need
`/files/{collectionId}/{recordId}/{filename}`), so a multi-file
order was throwing 'Encountered two children with the same key'.
Switched to `key={a.filename}` — unique per file in the
multi-file field, leaves the file URL untouched.
The Order type grew `email_subject`, `email_sender`,
`email_body`, and `email_message_id`. These columns exist in the
live PB (the local `pb_schema-2.json` snapshot is reference-only
per AGENTS.md, so the drift is expected). `getOrderReviewData`
prefers the order's own `email_body` and falls back to the
related `quote.email_body` for legacy orders that pre-date the
snapshot columns — quoting the operator's outbound is better than
showing '(no body)'.
Co-authored-by: Orca <help@stably.ai>
The order list and order sprint pages were rendering the rep column
with a raw PocketBase record id, which the operator could not
recognize. The data layer now resolves the rep through the user's
name:
- New `resolveRepDisplayName` helper (`src/lib/order-rep.ts`) takes
the customer record's `expand.rep`, the `customer.rep` relation
id, the legacy `orders.rep` text snapshot, and an admin-resolved
user map, and returns a name (or empty when only an unresolved PB
id is present).
- The orders service now fetches the user list alongside the order
page/counts query and resolves the rep on the way out, so the
client receives a `repName` per row. New endpoints
`/api/v1/orders/list` and `/api/v1/orders/[id]/review` expose
the read model; the page and sprint calls go through them.
- The list card and the sprint table + mobile card render the
resolved name. An opaque PB id is never displayed.
Migrates `/orders` off `pb-helpers.ts` per the data-layer
discipline, and adds a shared browser-session helper for
`Authorization: Bearer <PB token>` validation in route handlers
that serve the dashboard UI (vs. the agent API).
Co-authored-by: Orca <help@stably.ai>
The /webview page embeds supplier portals in an iframe. When the
target sets X-Frame-Options: DENY or frame-ancestors 'none' the
browser silently renders a blank iframe with no visible signal
to the operator that the load failed — the page just looks empty
and it's not obvious whether the portal is down or whether the
operator is hitting an embed restriction.
Surface the most common cause up-front:
- Server-side HEAD probe before render: fetches the target URL
with `redirect: "manual"` and a 5s timeout. The probe bypasses
browser frame restrictions (it's a server-to-server call) and
reports the raw HTTP status, including 302 redirects (counted
as `ok` since suppliers often gate their portals behind a
login redirect).
- Status badge in the header next to the URL: green dot +
`up (200)` when reachable, amber dot + `HTTP <status>` for
non-2xx, amber dot + `unreachable` on network / timeout
failures. Title attribute carries the full probe detail.
- Banner placeholder inside the iframe container when JS is
disabled (defensive — the existing iframe is JS-required).
The badge gives the operator an immediate "is this a portal
problem or an embed problem?" answer before they spend time
clicking around inside the iframe.
Co-authored-by: Orca <help@stably.ai>
The photo-strip chips on the collection-confirm page used to call
`window.open(url, "_blank")` for the supplier invoice, kicking the
operator out to a new tab to verify the invoice against the items
table. That tab switch broke the side-by-side comparison the
operator actually wants to do — look at a line on the invoice,
look at the same line in the table, look back.
Replace that flow with a floating, draggable invoice viewer
that lives on the page:
- New `InvoiceViewer` component renders the PDF in an `<iframe>`
against the existing `/api/v1/files/order_items/<id>/` route,
which already serves PDFs with `Content-Disposition: inline`.
- Desktop: floating box anchored to the bottom-right (720×560),
header is draggable. Position is clamped to the viewport so
the close button can't be dragged off-screen. State lives in
the component; not persisted to localStorage.
- Mobile (≤ 640px): full-screen panel (`100vw × 100dvh`,
border-radius 0). Drag affordance, grip icon, and "Viewing"
badge are dropped — they're meaningless on touch or when the
panel fills the screen. Layout flips live on viewport change
via a small `useMediaQuery` hook.
- Zoom controls: + / − / Reset with discrete levels
(50 / 75 / 100 / 125 / 150 / 200 / 300%). The % display is
itself a click-to-reset button. Implemented as
`transform: scale()` on the iframe with a pre-shrunk CSS box
(`${100 / zoom}%`) and a `${zoom * 100}%` scrollable wrapper
so scrollbars appear at higher zoom levels. CSS-resize-only
does not work for PDF iframes — the browser's native PDF
viewer caches the initial render size and ignores post-load
CSS resizes, so the page content never actually re-renders.
`transform: scale()` works around that across Chrome / Safari
/ Firefox.
- "Open in new tab" header button is preserved as an opt-in
escape hatch (landscape invoices, full-page viewing).
The PhotoStrip no longer opens a new tab by default. Clicking a
chip calls a page-level `onOpen` handler that toggles the viewer
(open / swap / close); the matching chip is highlighted with
`aria-pressed="true"` + a primary variant so the operator knows
which invoice is open. Clicking the active chip closes the
viewer. The chip falls back to `window.open(...)` only when no
`onOpen` is passed, so the strip stays usable in isolation.
Tests: 126 pass across the collection-confirm suite. New tests
cover viewer open / close (X + Esc), drag math + drag-bail-out
on header buttons, the active-state highlight, swap-on-different
chip, the in-viewer new-tab escape hatch, every zoom level +
clamping + reset, the PDF wrapper / iframe transform math at
multiple zooms, and the desktop ↔ mobile layout flip on a
mocked viewport change.
Co-authored-by: Orca <help@stably.ai>
Lightweight dashboard view surfaced under the 'Other' sidebar group
for client-facing use cases that need a stripped-down WFDash
surface (e.g. embed iframe, kiosk mode).
Co-authored-by: Orca <help@stably.ai>
Blocks order-item edits when the operator saves below the 22% markup
threshold and routes them through a manager-approval gate before the
item can be processed.
- new `order-item-margin-approval-service` saves the submitted draft,
stamps `item_status='approval_needed'`, then fires the configured
n8n webhook; webhook failure leaves the item blocked and returns
`webhookFired=false`
- new POST /api/v1/order-items/[id]/request-margin-approval browser
endpoint gates the same flow with source='order_process' |
'order_sprint'
- new `MarginApprovalDialog` shared by both order-process and
order-sprint process surfaces — single source of truth for the
submit/audit-note flow
- new `approval_needed` / `approval_rejected` item statuses; the
order-process save path now returns 'blocked' when an item is in
approval_needed so the operator can't re-edit past the gate
- order-sprint-process-modal now uses the same dialog so the
below-threshold flow is consistent across both entry points
Tests: 21 new (service + route + sprint modal), 1231 → 1242 passing.
Co-authored-by: Orca <help@stably.ai>
The single office bin is the only location, so the field is
unused. Strip it from everywhere the operator sees it:
PDF (stock-item-stocktake-document.tsx):
- Drop Location column + gapMaxLocation from styles, header, rows
- Re-balance widths: Name 23% → 28%, Status 12% → 18%
(the freed space makes Name properly readable again)
Stock list page (src/app/(app)/stock/page.tsx):
- Drop Location TableHead + TableCell
- Drop location state + input + submit-handler field from the
New stock item modal
- Drop 'location' from the modal JSDoc field list
Stock detail page (src/app/(app)/stock/[id]/page.tsx):
- Drop the MapPin + item.location display in the header
- Drop the now-unused MapPin import from lucide-react
Fulfill-from-stock dialog (src/components/stock/fulfill-from-stock-dialog.tsx):
- Drop location from the search predicate
- Drop location from the placeholder text
- Drop the '· {item.location}' display in the row
Note: the location field stays on the StockItem type and PB
schema for backward compatibility — removing it from the type
would break any code that still references it, and removing it
from the PB schema is a backend migration. The field is just
no longer surfaced anywhere.
Co-authored-by: Orca <help@stably.ai>
PDF:
- Add Location column between Max and Status (4% gap on each side)
- Re-balance widths: Name 28% → 23%, Status 18% → 12% to make room
- Total still 100% (with consistent 4% gaps between data columns)
- Update JSDoc to reflect new column + sort
Service:
- Sort by expanded supplier name (with item name as secondary sort)
- Items without a supplier sort to the end
- PB-side sort becomes 'supplier,name' so the JS comparator does
fewer swaps on large lists
- PB can't sort by an expanded relation's field, so the JS
re-sort is what actually produces the printable grouping
Tests:
- Update mock to handle 'expand: supplier' and populate
expand.supplier.suppliername on each row
- Update mock to handle comma-separated sort lists (PB accepts
'supplier,name')
- Add a 'sorts items with no supplier to the end' test
- Update existing sort test to cover multi-supplier grouping
Co-authored-by: Orca <help@stably.ai>
The previous 2% gapSkUName was too subtle to read as a column
separator — it was being absorbed by the empty space at the end
of the SKU column. Bumping to 4% (and trimming Name from 30%
to 28% to keep the total at 100%) makes the gap clearly visible
regardless of how long the SKU text is.
Co-authored-by: Orca <help@stably.ai>
- Add width: 100% to table/thead/tr so the row actually fills
the landscape A4 page width (was collapsing to ~70% of page)
- Move Status to the rightmost column with right-aligned bold
'Out of stock' as the visual anchor operator scans for
- Drop the trailing spacer column
- Re-balance widths: Name gets the lion's share (30%), Supplier
shrinks (11%), Current/Min/Max narrower (6/5/6%) and pushed
further right with explicit gap columns
- Small 2% gap between SKU and Name, 4% gaps between the
other pairs so the eye groups {SKU, Name, Supplier} as 'what'
and {Current, Min, Max, Status} as 'how much / how urgent'
Co-authored-by: Orca <help@stably.ai>
The previous layout had numeric columns (Current, Min, Max —
right-aligned) flush against the Status column (left-aligned).
A row like '100In stock' read as a single mashed string
because there was no whitespace between the right edge of the
Max column and the left edge of the Status column.
Fix: add paddingRight: 8 to the three numeric columns and
paddingLeft: 8 to the Status column. Right-aligned numbers
now end 8pt before the column boundary, and the Status text
starts 8pt inside its column — visible gap between columns,
even with the Status sitting right next to Max.
Co-authored-by: Orca <help@stably.ai>
Visual layout cleanup on the Stocktake PDF:
- Zebra-stripe alternating rows (subtle slate-50 on even rows,
white on odd) so adjacent rows scan easily.
- Drop the Location column — one less thing to fit on the page,
and the operator has the /stock detail page for that.
- Rename the Target column header to 'Max' (user-facing naming).
- Move the Status column to the right edge and make it bold +
colour-coded using STOCK_STATUS_STYLES[status].hex, matching
the on-screen badge palette.
- Widen the Name column (18%→24%) so full stock-item names read
in one line for most rows.
- Redistribute remaining widths so the table still totals 100%
of the landscape A4 page width.
Column widths now: SKU 10 / Name 24 / Supplier 18 / Current 9 /
Min 8 / Max 9 / Status 16 / spacer 6 (= 100%).
Co-authored-by: Orca <help@stably.ai>
The original Stocktake PDF columns (Name, SKU, Location, Unit,
Current qty, blank Actual, Supplier) didn't match what the
operator sees on /stock. They pointed at the wrong list — they
worked for a blank-column walk-through stocktake form, but the
user wants to print the /stock list as it appears on screen.
This rewrite makes the Stocktake PDF mirror the /stock table
column-for-column:
- SKU, Name, Supplier, Current, Min, Target, Location, Status
- Status derived via getStockStatus + STOCK_STATUS_STYLES so
it matches the on-screen badge label
- Current qty now renders with the unit suffix (matching the
on-screen cell)
- Target renders '—' when null/undefined/0, matching /stock
Also:
- Switched to landscape A4 to give 8 columns room (was
portrait).
- Added a copy of the 'Download Stocktake PDF' button on the
/stock page next to 'New stock item' — both /stock and
/stock-orders now expose the same endpoint. Button uses the
same plain <a target='_blank' rel='noopener'> pattern as
the existing stock-orders buttons, with aria-hidden on the
Download icon.
- Added a test on /stock for the new link (href, target,
rel). 33/33 tests pass.
Co-authored-by: Orca <help@stably.ai>
Both new routes — GET /api/v1/stock-purchases/list-pdf and
GET /api/v1/stock-items/stocktake-pdf — were gated on
`assertAgentAuth`, which requires an `Authorization: Bearer
<AGENT_API_KEY>` header. Browser <a target='_blank'> clicks
don't send that header, so the buttons returned 401
'Unauthorized'.
The existing single-PO PDF route at
/api/v1/stock-purchases/[id]/pdf doesn't gate on
`assertAgentAuth` — it relies on the in-app session and uses
the admin PB instance. The two list PDFs are the same shape
(throwing reports, in-app origin, admin-scoped reads) so the
fix is to drop the gate. Auth now matches the single-PO PDF
and the invoicing delivery-note PDFs.
- Removed `assertAgentAuth(req)` from both routes; dropped the
`agent-auth` import and the unused `req` parameter.
- Updated route JSDoc to describe the new auth contract and
reference the single-PO PDF route as the precedent.
- Updated both route tests: dropped the 'returns 401 when auth
is missing' case (no longer applicable) and the
`AGENT_API_KEY` env-setup boilerplate. Test names updated
to reflect the new contract — 'no auth required'.
Co-authored-by: Orca <help@stably.ai>
\`req.nextUrl.origin\` inside the Next.js process resolves to the
container bind address (e.g. \`0.0.0.0:3000\`), which the n8n
container can't reach — the v4 workflow's outcome callback
fails with \`ECONNREFUSED 0.0.0.0:3000\` and the stock PO gets
stuck on \`sending\` because the dashboard never receives the
status-flip callback.
Mirror the customer-PO route: build the callback URL from
\`process.env.DASHBOARD_URL\` (with trailing-slash trim). When
\`DASHBOARD_URL\` is unset the outcomeUrl is empty, and the
workflow's "outcomeUrl missing" branch fires cleanly.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
- scripts/2026-08-03-load-husqvarna-cart.ts: parses two cart
screenshots into a stock_purchase draft.
- scripts/2026-08-03-load-yg1-quote-soq078608.ts: extracts YG-1
quote SOQ078608 into a stock_purchase draft.
- scripts/2026-08-03-merge-yg1-drafts.ts: consolidates the new
YG-1 draft with the existing PO26073102STK into a single
PO26080301STK.
Source images (img1_*.png, img2_*.png) are kept alongside the
husqvarna loader so the parse step is reproducible. The
stock-orders-after.png screenshot documents the page state after
the recent wrap + PDF-download fixes.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
The send-email route's auto-PDF block did an internal
\`fetch(/api/v1/stock-purchases/[id]/pdf)\` to render a PDF when
the operator hit Send on a stock PO without one. Cloudflare's
loopback filter rejects that self-call with a network-level
error before Next.js sees it, surfacing as 'fetch failed' in the
modal (status rolled to draft, route returned 500 with code
'pdf_failed').
Extract the PDF generation into \`generateStockPurchasePdf\` on
the service layer so the send-email route can render the PDF
in-process. Same pattern as the customer-PO flow's
\`generatePurchaseOrderPdf\`. The route stays a thin shim that
maps \`StockPurchasePdfValidationError\` to 422.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
Two review follow-ups from the code-quality reviewer:
- Switch the two new PDF-button tests from getByTestId to
getByRole('link', { name }) so visible-label regressions fail.
Add a rel='noopener' assertion so the security contract on
target='_blank' is locked down.
- Add aria-hidden='true' to both <Download> icons. The visible
text already supplies each link's accessible name, but marking
the icon decorative explicitly is more robust to future
library behavior changes.
Co-authored-by: Orca <help@stably.ai>
Two UX improvements on the /stock-orders list:
- Number + Supplier cells now wrap long text instead of
clipping. Uses whitespace-normal + break-words + max-w-[200px]
on the cell, plus a row-level py-3 bump so wrapped cells look
balanced with single-line rows.
- Two new outline buttons next to 'New Stock Item':
'Download Stocktake PDF' -> /api/v1/stock-items/stocktake-pdf
'Download Orders PDF' -> /api/v1/stock-purchases/list-pdf
Both open the PDF in a new tab via target=_blank; the browser
handles the download.
Co-authored-by: Orca <help@stably.ai>
Two changes:
- Filename dates now use the Africa/Johannesburg timezone rather than
UTC, so a download generated at 00:30 SAST gets today's date
(not yesterday's). The renderer call still uses ISO UTC for
generatedAtIso — that's an audit timestamp, not a human-readable
date. One 'now' is captured at the top so the two values can't
drift across a millisecond boundary.
- The 200 tests now assert Content-Disposition (including the
filename), Cache-Control, the service arguments, and the
renderer arguments. vi.useFakeTimers pins the clock so the
filename is deterministic.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
Two list-report endpoints wired to the new PDF renderers. Both
auth via assertAgentAuth, ignore query params (always all rows),
and return application/pdf with attachment Content-Disposition.
The Stocktake PDF is sourced from the new listStockItemsForStocktake
service helper; the Orders PDF reuses the existing listStockPurchases
with perPage=200.
Co-authored-by: Orca <help@stably.ai>
Move the thead <View> out of the table and onto the page itself
with the @react-pdf/renderer 'fixed' prop, so reports that span
multiple A4 pages still label their columns. Without this, page 2+
of a long stock-orders report or stocktake would show data without
column headers — making the right-hand 'Actual' column on the
stocktake and the value columns on the orders list unreadable.
Co-authored-by: Orca <help@stably.ai>
Two new @react-pdf/renderer documents backed by renderStockPurchaseListPdf
and renderStockItemStocktakePdf in render.tsx. The Orders PDF mirrors
the on-screen table; the Stocktake PDF adds a blank 'Actual' column
for the operator to fill in during the walk-through. Both inherit
the toString() → Buffer pattern so they run under the same jsdom
test setup as the other PDF renderers.
Co-authored-by: Orca <help@stably.ai>
The mock's getFullList is now a vi.fn so the call args can be inspected. Each test asserts expand: 'supplier' was passed, so a regression that drops the expand (e.g. a copy-paste from the dashboard read) fails fast instead of silently shipping rows without supplier names.
Co-authored-by: Orca <help@stably.ai>
Returns active stock items sorted by name with supplier expanded,
for the new Stocktake PDF download endpoint. Distinct from the
dashboard's low-stock query: stocktake wants every SKU
alphabetically, not the under-stocked ones first.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
Same operator-flow fix we made for customer POs in 79b9309: sending a
stock PO no longer auto-flips the linked stock_purchase_items from
`collection_pool` to `assigned_to_driver`. Items now stay in
`collection_pool` after the supplier email goes out; the operator
marks them ready-to-collect from the stock-order page only after the
supplier confirms, and that's the action that promotes them to
`assigned_to_driver` (so the driver-app sees them as ready).
Without this, the stock-order "PO Sent" state was invisible — the
items jumped straight to driver-ready the moment the email left,
before any supplier confirmation. Now the PO Sent → Ready to Collect
→ Assign Driver flow is observable end-to-end.
3 new tests, full suite 1210/1210 passing.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
5 tasks: stock-items service helper, two PDF document components +
render helpers, two GET endpoints, UI changes (wrap + buttons).
TDD per task with test-first steps. Final task is full-repo
verification + manual smoke checklist.
Co-authored-by: Orca <help@stably.ai>
Two small additions to /stock-orders:
- Wrap long text in Number + Supplier columns
- Two PDF download buttons (Stocktake PDF, Orders PDF)
Both PDFs always include all rows, ignore the active status
filter and pagination. No persistence — throwaway reports.
Design reviewed: covers architecture, data model, API contract,
error handling, testing, and manual smoke. No new PB schema,
no new types.
Co-authored-by: Orca <help@stably.ai>
The dashboard's send-email route fires the n8n webhook unconditionally
once pre-send validation passes. If a PO has no generated PDF (legacy
state — `documents` empty + `documents_history: [null]`), n8n tries to
download from PB with an empty filename, gets a 404, and the webhook
returns HTTP 500. The operator sees "Webhook returned HTTP 500. Status
reverted to mail_failed." with no indication of the actual cause.
Add a PDF-existence guard in `sendPurchaseOrderEmail` using the same
`documents` → `documents_history` fallback chain the route uses to
compute `latestFilename`. When both are empty / unusable, return a
`no_pdf` failure that flips the PO to `mail_failed` with a clear
operator-facing message BEFORE the webhook fires.
While here, rename the misleading `code: "no_pdf"` on the line-items
check to `code: "no_line_items"` — the old code name was wrong (it
checked for linked items, not PDFs) and would have collided with the
new `no_pdf` guard.
The new guard also filters null entries out of `documents_history`
before calling `.find()` / `.file` — the legacy `[null]` shape was
making the old route code throw.
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Orca <help@stably.ai>
The total-value case now locates each cell by its column header so a
regression that swapped Ordered (R) and Received (R) would fail. The
edit-draft case now closes the modal after Edit and asserts
editPurchaseId resets to '', so a regression that leaked the id into
a subsequent 'New' click would fail.
Co-authored-by: Orca <help@stably.ai>
The seven pre-existing assertions on the quick-draft modal and edit
button now exercise the new client component. New case confirms
ordered_value/received_value render in the row. Uses Intl-format
substring assertions because the currency glyph/spacing varies by
ICU version.
Co-authored-by: Orca <help@stably.ai>
- Header (title, description, Reorder, + New stock order) now
renders unconditionally, so operators can navigate away even when
the list query throws.
- Full error is logged server-side via console.error; the user
sees a generic 'Failed to load stock orders. Please try again.'
message that doesn't leak PB URLs, admin env var names, or
filter syntax.
Co-authored-by: Orca <help@stably.ai>
Reads searchParams (status, page), validates both, calls
listStockPurchases via the admin PB, and renders the new
StockOrdersTable client component. Drops the legacy direct-PB
read path per AGENTS.md data-access discipline.
The old page.test.tsx is removed; its assertions are mirrored
in the new StockOrdersTable.test.tsx (next task).
Co-authored-by: Orca <help@stably.ai>
- Disabled pagination links (Previous at page 1, Next at last page)
now also set tabIndex=-1 and preventDefault on click, so keyboard
users can't activate them when at the boundary. aria-disabled +
pointer-events-none blocked only mouse clicks.
- Row click uses useRouter().push() instead of window.location.href
for a soft navigation that preserves client state (consistent
with the original /stock-orders page).
Co-authored-by: Orca <help@stably.ai>
Holds the QuickDraftModal open state, renders status filter tabs as <Link>s to ?status=..., and adds two new columns (Ordered R, Received R) showing per-row aggregates from the service layer.\n\nReplaces <Button asChild><Link/></Button> with <Link className={cn(buttonVariants(...))}> because the project's Button (built on @base-ui/react/button) doesn't support asChild. Visually identical; preserves navigation semantics.
Co-authored-by: Orca <help@stably.ai>
- Catch block now preserves error.status so assertAgentAuth's 401
surfaces as 401, not 500. Matches sibling /api/v1/stock-purchases
pattern.
- page/perPage parsing falls back to documented defaults on
non-numeric or zero input rather than passing NaN to the service.
- Add 2 tests covering the auth-status and pagination boundaries.
Co-authored-by: Orca <help@stably.ai>
Thin wrapper around listStockPurchases that validates the status
param against STOCK_PURCHASE_STATUS_VALUES (400 on bad input) and
caps perPage at 200. Mirrors the agent-auth pattern used by the
other v1 list routes.
Co-authored-by: Orca <help@stably.ai>
Add ordered_value and received_value to StockPurchaseListRow. Each is
Σ line.{quantity|quantity_received} × line.cost_price, rounded to 2dp.
Replaces countItemsForPurchase with summarizeItemsForPurchase so the
per-row N+1 returns all three numbers in one fetch (no extra round
trip).
Co-authored-by: Orca <help@stably.ai>
