docs: refresh stale docs to match current implementation

Documentation pass — reviewed codebase in full, identified stale references,
and aligned docs with actual code state.

Changes:
- CLAUDE.md, PRODUCTION_SETUP.md, LAUNCH_CHECKLIST.md, src/auth.config.ts:
  middleware path src/middleware.ts → src/proxy.ts (Next.js 16+ convention)
- CLAUDE.md, ENVIRONMENT.md, README.md:
  dev server port localhost:3000 → localhost:4000 (per package.json dev
  script 'next dev --webpack -H 0.0.0.0 -p 4000')
- PRODUCTION_DEPLOYMENT_CHECKLIST.md:
  rewrote migration list — actual db/migrations/ contains 10 files
  (0000–0091), not the Supabase-era 001–092 series. Updated platform
  version 1.6 → 2.0 and last-updated stamp.
- MEMORY.md:
  refreshed 'Last updated' to 2026-06-25, added current-state header
  flagging Auth.js v5 wiring as historical, and documented the SSH/Gitea
  workflow (id_ed25519_crispygoat + no API token → push-hook URL flow
  for opening PRs).
- LAUNCH_CHECKLIST.md:
  added 'Last updated: 2026-06-25' header and refresh note in footer.
- CLAUDE.md:
  new 'Gitea authentication (SSH)' subsection under 'Canonical Remote'
  documenting ~/.ssh/id_ed25519_crispygoat, ssh-agent setup, what works
  (git push) vs what doesn't (REST API without token), and the actual
  PR-creation workflow (push + open the URL the Gitea hook prints).

Verification:
- npx tsc --noEmit: pre-existing Stripe API version + test mock errors
  only (verified by stashing changes and re-running — same error set).
- No new errors introduced.

.env.example

@@ -1,34 +1,81 @@
-# --- Self-hosted Postgres (Docker) ---
-POSTGRES_USER=routecommerce
-POSTGRES_PASSWORD=routecommerce_dev_password
-POSTGRES_DB=route_commerce
-# Used by the app and push-migrations.js to talk to the local DB
-DATABASE_URL=postgresql://routecommerce:routecommerce_dev_password@127.0.0.1:5432/route_commerce?schema=public
+# ============================================================================
+# Route Commerce — Environment variables
+# ============================================================================
+# Copy to `.env.local` and fill in real values for local development.
+# Production: set these in your hosting dashboard (Vercel / Netlify / etc.).
+# ============================================================================
 
-# --- PostgREST (REST API) ---
-# Server actions call `${NEXT_PUBLIC_API_URL}/rest/v1/rpc/...`
-# Point that URL at the local PostgREST container. Anon key can be anything
-# non-empty since we handle auth at the app layer (Better Auth + dev_session).
-NEXT_PUBLIC_API_URL=http://localhost:3001
-NEXT_PUBLIC_API_ANON_KEY=local-postgrest-anon-key
-POSTGREST_SERVICE_KEY=local-postgrest-service-key
+# ── App ─────────────────────────────────────────────────────────────────────
+NEXT_PUBLIC_BASE_URL=http://localhost:4000
+NEXT_PUBLIC_SITE_URL=http://localhost:4000
 
-# --- MinIO (S3-compatible object storage — replaces Supabase Storage) ---
-MINIO_ROOT_USER=routecommerce
-MINIO_ROOT_PASSWORD=miniochangeme123
-STORAGE_ENDPOINT=http://localhost:9000
-STORAGE_REGION=us-east-1
-STORAGE_ACCESS_KEY=routecommerce
-STORAGE_SECRET_KEY=miniochangeme123
-STORAGE_BUCKET_PREFIX=
-# Public base URL for image rendering in <img src=...>
-NEXT_PUBLIC_STORAGE_BASE_URL=http://localhost:9000
+# ── Database (Neon Postgres, direct pg driver) ─────────────────────────────
+# Single connection string used by the pg Pool in src/lib/auth.ts and the
+# admin-permissions / data-service layer. Format:
+#   postgresql://USER:PASS@HOST:PORT/DBNAME?sslmode=require
+DATABASE_URL=postgresql://postgres:postgres@localhost:5432/route_commerce
 
-# --- Better Auth ---
-BETTER_AUTH_SECRET=REPLACE_ME_WITH_OPENSSL_RAND_HEX_32
-BETTER_AUTH_URL=http://localhost:3000
-NEXT_PUBLIC_BETTER_AUTH_URL=http://localhost:3000
+# ── Neon Auth (Better Auth) ───────────────────────────────────────────────
+# Get these from: neonctl neon-auth status
+# Base URL: "Auth Base URL" field
+# Cookie secret: openssl rand -base64 32 (min 32 chars)
+NEON_AUTH_BASE_URL=https://your-branch.neonauth.region.aws.neon.tech/neondb/auth
+NEON_AUTH_COOKIE_SECRET=replace-me-with-a-32-char-secret
 
-# --- App secrets ---
+# ── Stripe ─────────────────────────────────────────────────────────────────
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+STRIPE_PRICE_STARTER=
+STRIPE_PRICE_FARM=
+STRIPE_PRICE_ENTERPRISE=
+STRIPE_PRICE_HARVEST_REACH=
+STRIPE_PRICE_WHOLESALE_PORTAL=
+STRIPE_PRICE_WATER_LOG=
+STRIPE_PRICE_AI_TOOLS=
+STRIPE_PRICE_SQUARE_SYNC=
+STRIPE_PRICE_SMS_CAMPAIGNS=
+
+# ── Resend (transactional email) ────────────────────────────────────────────
+RESEND_API_KEY=
+RESEND_WEBHOOK_SECRET=
+
+# ── AI providers ──────────────────────────────────────────────────────────
+OPENAI_API_KEY=
+ANTHROPIC_API_KEY=
+GOOGLE_API_KEY=
+XAI_API_KEY=
 MINIMAX_API_KEY=
-MINIMAX_BASE_URL=
+MINIMAX_BASE_URL=https://api.minimax.io/v1
+
+# ── Square (optional) ─────────────────────────────────────────────────────
+SQUARE_APP_SECRET=
+SQUARE_ENVIRONMENT=sandbox
+
+# ── MinIO / S3-compatible object storage ─────────────────────────────────────
+# Endpoint: host:port only (no https://). Use MINIO_PUBLIC_URL for the public base.
+MINIO_ENDPOINT=s3.crispygoat.com
+MINIO_REGION=us-east-1
+MINIO_USE_SSL=true
+MINIO_ACCESS_KEY=routecommerce
+MINIO_SECRET_KEY=miniochangeme123
+# Override public URL if different from endpoint (e.g. Cloudflare CDN in front)
+MINIO_PUBLIC_URL=https://s3.crispygoat.com
+# Bucket names — create these in MinIO first (mc mb myminio/route-products, etc.)
+MINIO_BUCKET_PRODUCTS=route-products
+MINIO_BUCKET_BRAND_LOGOS=route-brand-logos
+MINIO_BUCKET_WATER_LOGS=route-water-logs
+
+# ── Cron / automation ───────────────────────────────────────────────────────
+CRON_SECRET=replace-me-with-a-random-string
+
+# ── Water Log ───────────────────────────────────────────────────────────────
+# The Water Log module reuses the existing `DATABASE_URL` and (for photo
+# uploads) the `MINIO_BUCKET_WATER_LOGS` bucket above. It also reuses the
+# brand's Twilio / SMS config for high/low threshold alerts. The
+# Tuxedo brand UUID is a public default used as a fallback for cold-start
+# paths when the calling admin user is a platform_admin with brand_id=null.
+# It does NOT need to be set as an env var — the value is hardcoded in
+# the server actions — but you can override it with:
+#   TUXEDO_BRAND_ID=64294306-5f42-463d-a5e8-2ad6c81a96de
+# See docs/water-log.md for the full module guide.

.gitea/workflows/deploy.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 jobs:
   deploy:
@@ -15,169 +16,187 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
-
-      - name: Start Docker stack
-        env:
-          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
-          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
-          MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
-          MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
-          POSTGREST_JWT_SECRET: ${{ secrets.POSTGREST_JWT_SECRET }}
-        run: |
-          APP_DIR=/home/tyler/route-commerce
-          mkdir -p $APP_DIR
-          cd $APP_DIR
-          [ -f .env ] || cp .env.example .env
-          # Append production secrets to .env (overriding .env.example defaults)
-          {
-            echo "POSTGRES_USER=${POSTGRES_USER}"
-            echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
-            echo "POSTGRES_DB=${POSTGRES_DB}"
-            echo "MINIO_ROOT_USER=${MINIO_ROOT_USER}"
-            echo "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}"
-            echo "POSTGREST_JWT_SECRET=${POSTGREST_JWT_SECRET}"
-          } >> .env
-          docker compose up -d db postgrest minio minio_init
-          # Wait for Postgres healthcheck
-          for i in $(seq 1 30); do
-            if docker compose exec -T db pg_isready -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" > /dev/null 2>&1; then
-              echo "Postgres is ready"
-              break
-            fi
-            sleep 2
-          done
-
-      - name: Apply migrations
-        env:
-          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
-          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
-        run: |
-          cd /home/tyler/route-commerce
-          PGPASSWORD="${POSTGRES_PASSWORD}" psql -h 127.0.0.1 -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" -v ON_ERROR_STOP=0 -f supabase/migrations/000_preflight_supabase_compat.sql || true
-          [ -f supabase/captured_schema.sql ] && PGPASSWORD="${POSTGRES_PASSWORD}" psql -h 127.0.0.1 -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" -v ON_ERROR_STOP=0 -f supabase/captured_schema.sql || echo "captured_schema.sql not present, skipping"
-          for f in supabase/migrations/[0-9]*.sql; do
-            PGPASSWORD="${POSTGRES_PASSWORD}" psql -h 127.0.0.1 -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" -v ON_ERROR_STOP=0 -q -f "$f" || echo "FAIL: $f"
-          done
+          node-version: "22"
 
       - name: Install dependencies
         run: npm install
 
+      - name: Run migrations
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+        run: |
+          set -e
+          node scripts/preflight-check.js
+          npm run migrate:one
+          node scripts/postflight-check.js
+
       - name: Build
         env:
           NODE_ENV: production
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
-          BETTER_AUTH_URL: ${{ secrets.BETTER_AUTH_URL }}
-          NEXT_PUBLIC_BETTER_AUTH_URL: ${{ secrets.NEXT_PUBLIC_BETTER_AUTH_URL }}
-          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
-          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
-          NEXT_PUBLIC_STORAGE_BASE_URL: ${{ secrets.NEXT_PUBLIC_STORAGE_BASE_URL }}
-          STORAGE_ENDPOINT: ${{ secrets.STORAGE_ENDPOINT }}
-          STORAGE_REGION: ${{ secrets.STORAGE_REGION }}
-          STORAGE_ACCESS_KEY: ${{ secrets.STORAGE_ACCESS_KEY }}
-          STORAGE_SECRET_KEY: ${{ secrets.STORAGE_SECRET_KEY }}
-          STORAGE_BUCKET_PREFIX: ${{ secrets.STORAGE_BUCKET_PREFIX }}
+          NEXT_PUBLIC_SITE_URL: ${{ secrets.NEXT_PUBLIC_SITE_URL }}
+          NEON_AUTH_BASE_URL: ${{ secrets.NEON_AUTH_BASE_URL }}
+          NEON_AUTH_COOKIE_SECRET: ${{ secrets.NEON_AUTH_COOKIE_SECRET }}
+          AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
+          AUTH_URL: ${{ secrets.AUTH_URL }}
+          NEXT_PUBLIC_AUTH_URL: ${{ secrets.NEXT_PUBLIC_AUTH_URL }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+          ALLOW_DEV_LOGIN: ${{ secrets.ALLOW_DEV_LOGIN }}
+          ADMIN_ALLOWED_EMAILS: ${{ secrets.ADMIN_ALLOWED_EMAILS }}
+          NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY }}
           STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
           STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-          STRIPE_PUBLISHABLE_KEY: ${{ secrets.STRIPE_PUBLISHABLE_KEY }}
+          STRIPE_PRICE_STARTER: ${{ secrets.STRIPE_PRICE_STARTER }}
+          STRIPE_PRICE_FARM: ${{ secrets.STRIPE_PRICE_FARM }}
+          STRIPE_PRICE_ENTERPRISE: ${{ secrets.STRIPE_PRICE_ENTERPRISE }}
+          STRIPE_PRICE_HARVEST_REACH: ${{ secrets.STRIPE_PRICE_HARVEST_REACH }}
+          STRIPE_PRICE_WHOLESALE_PORTAL: ${{ secrets.STRIPE_PRICE_WHOLESALE_PORTAL }}
+          STRIPE_PRICE_WATER_LOG: ${{ secrets.STRIPE_PRICE_WATER_LOG }}
+          STRIPE_PRICE_AI_TOOLS: ${{ secrets.STRIPE_PRICE_AI_TOOLS }}
+          STRIPE_PRICE_SQUARE_SYNC: ${{ secrets.STRIPE_PRICE_SQUARE_SYNC }}
+          STRIPE_PRICE_SMS_CAMPAIGNS: ${{ secrets.STRIPE_PRICE_SMS_CAMPAIGNS }}
           RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
-          RESEND_WEBHOOK_SECRET: ${{ secrets.RESEND_WEBHOOK_SECRET }}
+          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
+          MINIO_ENDPOINT: ${{ secrets.MINIO_ENDPOINT }}
+          MINIO_REGION: ${{ secrets.MINIO_REGION }}
+          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
+          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
+          MINIO_PUBLIC_URL: ${{ secrets.MINIO_PUBLIC_URL }}
+          MINIO_BUCKET_PRODUCTS: ${{ secrets.MINIO_BUCKET_PRODUCTS }}
+          MINIO_BUCKET_BRAND_LOGOS: ${{ secrets.MINIO_BUCKET_BRAND_LOGOS }}
+          MINIO_BUCKET_WATER_LOGS: ${{ secrets.MINIO_BUCKET_WATER_LOGS }}
           MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
           MINIMAX_BASE_URL: ${{ secrets.MINIMAX_BASE_URL }}
-          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
         run: npm run build
 
       - name: Deploy
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
-          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
-          MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
-          MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
-          POSTGREST_JWT_SECRET: ${{ secrets.POSTGREST_JWT_SECRET }}
-          BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }}
-          BETTER_AUTH_URL: ${{ secrets.BETTER_AUTH_URL }}
-          NEXT_PUBLIC_BETTER_AUTH_URL: ${{ secrets.NEXT_PUBLIC_BETTER_AUTH_URL }}
-          STORAGE_ENDPOINT: ${{ secrets.STORAGE_ENDPOINT }}
-          STORAGE_REGION: ${{ secrets.STORAGE_REGION }}
-          STORAGE_ACCESS_KEY: ${{ secrets.STORAGE_ACCESS_KEY }}
-          STORAGE_SECRET_KEY: ${{ secrets.STORAGE_SECRET_KEY }}
-          STORAGE_BUCKET_PREFIX: ${{ secrets.STORAGE_BUCKET_PREFIX }}
-          NEXT_PUBLIC_STORAGE_BASE_URL: ${{ secrets.NEXT_PUBLIC_STORAGE_BASE_URL }}
-          PGRST_SERVER_PORT: ${{ secrets.PGRST_SERVER_PORT }}
-          PGRST_DB_URI: ${{ secrets.PGRST_DB_URI }}
-          PGRST_DB_ANON_ROLE: ${{ secrets.PGRST_DB_ANON_ROLE }}
-          PGRST_JWT_SECRET: ${{ secrets.POSTGREST_JWT_SECRET }}
-          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
-          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
+          NEXT_PUBLIC_SITE_URL: ${{ secrets.NEXT_PUBLIC_SITE_URL }}
+          NEON_AUTH_BASE_URL: ${{ secrets.NEON_AUTH_BASE_URL }}
+          NEON_AUTH_COOKIE_SECRET: ${{ secrets.NEON_AUTH_COOKIE_SECRET }}
+          AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
+          AUTH_URL: ${{ secrets.AUTH_URL }}
+          NEXT_PUBLIC_AUTH_URL: ${{ secrets.NEXT_PUBLIC_AUTH_URL }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+          ALLOW_DEV_LOGIN: ${{ secrets.ALLOW_DEV_LOGIN }}
+          ADMIN_ALLOWED_EMAILS: ${{ secrets.ADMIN_ALLOWED_EMAILS }}
+          NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY }}
           STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
           STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-          STRIPE_PUBLISHABLE_KEY: ${{ secrets.STRIPE_PUBLISHABLE_KEY }}
+          STRIPE_PRICE_STARTER: ${{ secrets.STRIPE_PRICE_STARTER }}
+          STRIPE_PRICE_FARM: ${{ secrets.STRIPE_PRICE_FARM }}
+          STRIPE_PRICE_ENTERPRISE: ${{ secrets.STRIPE_PRICE_ENTERPRISE }}
+          STRIPE_PRICE_HARVEST_REACH: ${{ secrets.STRIPE_PRICE_HARVEST_REACH }}
+          STRIPE_PRICE_WHOLESALE_PORTAL: ${{ secrets.STRIPE_PRICE_WHOLESALE_PORTAL }}
+          STRIPE_PRICE_WATER_LOG: ${{ secrets.STRIPE_PRICE_WATER_LOG }}
+          STRIPE_PRICE_AI_TOOLS: ${{ secrets.STRIPE_PRICE_AI_TOOLS }}
+          STRIPE_PRICE_SQUARE_SYNC: ${{ secrets.STRIPE_PRICE_SQUARE_SYNC }}
+          STRIPE_PRICE_SMS_CAMPAIGNS: ${{ secrets.STRIPE_PRICE_SMS_CAMPAIGNS }}
           RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
-          RESEND_WEBHOOK_SECRET: ${{ secrets.RESEND_WEBHOOK_SECRET }}
+          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
+          MINIO_ENDPOINT: ${{ secrets.MINIO_ENDPOINT }}
+          MINIO_REGION: ${{ secrets.MINIO_REGION }}
+          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
+          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
+          MINIO_PUBLIC_URL: ${{ secrets.MINIO_PUBLIC_URL }}
+          MINIO_BUCKET_PRODUCTS: ${{ secrets.MINIO_BUCKET_PRODUCTS }}
+          MINIO_BUCKET_BRAND_LOGOS: ${{ secrets.MINIO_BUCKET_BRAND_LOGOS }}
+          MINIO_BUCKET_WATER_LOGS: ${{ secrets.MINIO_BUCKET_WATER_LOGS }}
           MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
           MINIMAX_BASE_URL: ${{ secrets.MINIMAX_BASE_URL }}
-          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
+          CRON_SECRET: ${{ secrets.CRON_SECRET }}
+          SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
         run: |
+          set -e
           APP_DIR=/home/tyler/route-commerce
-          mkdir -p $APP_DIR
 
-          # Write env file from secrets (preserves existing .env for docker compose)
-          {
-            printf "DATABASE_URL=%s\n" "$DATABASE_URL"
-            printf "POSTGRES_USER=%s\n" "$POSTGRES_USER"
-            printf "POSTGRES_PASSWORD=%s\n" "$POSTGRES_PASSWORD"
-            printf "POSTGRES_DB=%s\n" "$POSTGRES_DB"
-            printf "MINIO_ROOT_USER=%s\n" "$MINIO_ROOT_USER"
-            printf "MINIO_ROOT_PASSWORD=%s\n" "$MINIO_ROOT_PASSWORD"
-            printf "POSTGREST_JWT_SECRET=%s\n" "$POSTGREST_JWT_SECRET"
-            printf "BETTER_AUTH_SECRET=%s\n" "$BETTER_AUTH_SECRET"
-            printf "BETTER_AUTH_URL=%s\n" "$BETTER_AUTH_URL"
-            printf "NEXT_PUBLIC_BETTER_AUTH_URL=%s\n" "$NEXT_PUBLIC_BETTER_AUTH_URL"
-            printf "STORAGE_ENDPOINT=%s\n" "$STORAGE_ENDPOINT"
-            printf "STORAGE_REGION=%s\n" "$STORAGE_REGION"
-            printf "STORAGE_ACCESS_KEY=%s\n" "$STORAGE_ACCESS_KEY"
-            printf "STORAGE_SECRET_KEY=%s\n" "$STORAGE_SECRET_KEY"
-            printf "STORAGE_BUCKET_PREFIX=%s\n" "$STORAGE_BUCKET_PREFIX"
-            printf "NEXT_PUBLIC_STORAGE_BASE_URL=%s\n" "$NEXT_PUBLIC_STORAGE_BASE_URL"
-            printf "PGRST_SERVER_PORT=%s\n" "$PGRST_SERVER_PORT"
-            printf "PGRST_DB_URI=%s\n" "$PGRST_DB_URI"
-            printf "PGRST_DB_ANON_ROLE=%s\n" "$PGRST_DB_ANON_ROLE"
-            printf "PGRST_JWT_SECRET=%s\n" "$POSTGREST_JWT_SECRET"
-            printf "NEXT_PUBLIC_SUPABASE_URL=%s\n" "$NEXT_PUBLIC_SUPABASE_URL"
-            printf "NEXT_PUBLIC_SUPABASE_ANON_KEY=%s\n" "$NEXT_PUBLIC_SUPABASE_ANON_KEY"
-            printf "STRIPE_SECRET_KEY=%s\n" "$STRIPE_SECRET_KEY"
-            printf "STRIPE_WEBHOOK_SECRET=%s\n" "$STRIPE_WEBHOOK_SECRET"
-            printf "STRIPE_PUBLISHABLE_KEY=%s\n" "$STRIPE_PUBLISHABLE_KEY"
-            printf "RESEND_API_KEY=%s\n" "$RESEND_API_KEY"
-            printf "RESEND_WEBHOOK_SECRET=%s\n" "$RESEND_WEBHOOK_SECRET"
-            printf "MINIMAX_API_KEY=%s\n" "$MINIMAX_API_KEY"
-            printf "MINIMAX_BASE_URL=%s\n" "$MINIMAX_BASE_URL"
-            printf "FROM_EMAIL=%s\n" "$FROM_EMAIL"
-          } > $APP_DIR/.env.production
+          # Setup SSH key - write raw (no printf which can corrupt multi-line keys)
+          mkdir -p ~/.ssh
+          echo "$SERVER_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
 
-          # Copy build output and required files
-          rsync -a --delete .next/ $APP_DIR/.next/
-          rsync -a --delete public/ $APP_DIR/public/
-          cp package.json $APP_DIR/
-          cp docker-compose.yml $APP_DIR/
-          cp -r supabase/ $APP_DIR/
-          cp next.config.ts $APP_DIR/ 2>/dev/null || cp next.config.js $APP_DIR/ 2>/dev/null || true
-
-          # Install production deps only
-          cd $APP_DIR
-          npm install --omit=dev
-
-          # Start or restart PM2 process
-          if pm2 describe route-commerce > /dev/null 2>&1; then
-            pm2 restart route-commerce
-          else
-            pm2 start npm --name route-commerce -- start -- -p 3100
-            pm2 save
+          # Verify key was written correctly
+          if ! grep -q "PRIVATE KEY" ~/.ssh/id_ed25519; then
+            echo "ERROR: SSH key not found or malformed. Check SERVER_SSH_KEY secret."
+            cat ~/.ssh/id_ed25519 || echo "File is empty"
+            exit 1
           fi
 
-          echo "Deployed successfully"
+          ssh-keyscan -H route.crispygoat.com >> ~/.ssh/known_hosts 2>/dev/null || true
+
+          # Test SSH connection with verbose output for debugging
+          echo "Testing SSH connection..."
+          ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=no -o LogLevel=VERBOSE tyler@route.crispygoat.com "echo 'SSH OK' && hostname" 2>&1 || { echo "SSH FAILED"; exit 1; }
+
+          # Create app dir on server
+          ssh tyler@route.crispygoat.com "mkdir -p $APP_DIR/.next $APP_DIR/public"
+
+          # Write production env file
+          ENV_FILE=$(mktemp)
+          {
+            printf 'DATABASE_URL=%s\n' "$DATABASE_URL"
+            printf 'NEXT_PUBLIC_SITE_URL=%s\n' "$NEXT_PUBLIC_SITE_URL"
+            printf 'NEON_AUTH_BASE_URL=%s\n' "$NEON_AUTH_BASE_URL"
+            printf 'NEON_AUTH_COOKIE_SECRET=%s\n' "$NEON_AUTH_COOKIE_SECRET"
+            printf 'AUTH_SECRET=%s\n' "$AUTH_SECRET"
+            printf 'AUTH_URL=%s\n' "$AUTH_URL"
+            printf 'NEXT_PUBLIC_AUTH_URL=%s\n' "$NEXT_PUBLIC_AUTH_URL"
+            printf 'GOOGLE_CLIENT_ID=%s\n' "$GOOGLE_CLIENT_ID"
+            printf 'GOOGLE_CLIENT_SECRET=%s\n' "$GOOGLE_CLIENT_SECRET"
+            printf 'ALLOW_DEV_LOGIN=%s\n' "$ALLOW_DEV_LOGIN"
+            printf 'ADMIN_ALLOWED_EMAILS=%s\n' "$ADMIN_ALLOWED_EMAILS"
+            printf 'NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=%s\n' "$NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY"
+            printf 'STRIPE_SECRET_KEY=%s\n' "$STRIPE_SECRET_KEY"
+            printf 'STRIPE_WEBHOOK_SECRET=%s\n' "$STRIPE_WEBHOOK_SECRET"
+            printf 'STRIPE_PRICE_STARTER=%s\n' "$STRIPE_PRICE_STARTER"
+            printf 'STRIPE_PRICE_FARM=%s\n' "$STRIPE_PRICE_FARM"
+            printf 'STRIPE_PRICE_ENTERPRISE=%s\n' "$STRIPE_PRICE_ENTERPRISE"
+            printf 'STRIPE_PRICE_HARVEST_REACH=%s\n' "$STRIPE_PRICE_HARVEST_REACH"
+            printf 'STRIPE_PRICE_WHOLESALE_PORTAL=%s\n' "$STRIPE_PRICE_WHOLESALE_PORTAL"
+            printf 'STRIPE_PRICE_WATER_LOG=%s\n' "$STRIPE_PRICE_WATER_LOG"
+            printf 'STRIPE_PRICE_AI_TOOLS=%s\n' "$STRIPE_PRICE_AI_TOOLS"
+            printf 'STRIPE_PRICE_SQUARE_SYNC=%s\n' "$STRIPE_PRICE_SQUARE_SYNC"
+            printf 'STRIPE_PRICE_SMS_CAMPAIGNS=%s\n' "$STRIPE_PRICE_SMS_CAMPAIGNS"
+            printf 'RESEND_API_KEY=%s\n' "$RESEND_API_KEY"
+            printf 'FROM_EMAIL=%s\n' "$FROM_EMAIL"
+            printf 'MINIO_ENDPOINT=%s\n' "$MINIO_ENDPOINT"
+            printf 'MINIO_REGION=%s\n' "$MINIO_REGION"
+            printf 'MINIO_ACCESS_KEY=%s\n' "$MINIO_ACCESS_KEY"
+            printf 'MINIO_SECRET_KEY=%s\n' "$MINIO_SECRET_KEY"
+            printf 'MINIO_PUBLIC_URL=%s\n' "$MINIO_PUBLIC_URL"
+            printf 'MINIO_BUCKET_PRODUCTS=%s\n' "$MINIO_BUCKET_PRODUCTS"
+            printf 'MINIO_BUCKET_BRAND_LOGOS=%s\n' "$MINIO_BUCKET_BRAND_LOGOS"
+            printf 'MINIO_BUCKET_WATER_LOGS=%s\n' "$MINIO_BUCKET_WATER_LOGS"
+            printf 'MINIMAX_API_KEY=%s\n' "$MINIMAX_API_KEY"
+            printf 'MINIMAX_BASE_URL=%s\n' "$MINIMAX_BASE_URL"
+            printf 'CRON_SECRET=%s\n' "$CRON_SECRET"
+          } > "$ENV_FILE"
+
+          # Upload env file and sync build output
+          echo "Uploading env file..."
+          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no "$ENV_FILE" tyler@route.crispygoat.com:$APP_DIR/.env
+
+          echo "Copying .next/..."
+          scp -o ConnectTimeout=30 -o StrictHostKeyChecking=no -r .next tyler@route.crispygoat.com:$APP_DIR/
+          echo "Copying public/..."
+          scp -o ConnectTimeout=30 -o StrictHostKeyChecking=no -r public tyler@route.crispygoat.com:$APP_DIR/
+          echo "Copying package.json..."
+          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no package.json tyler@route.crispygoat.com:$APP_DIR/
+          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no next.config.ts tyler@route.crispygoat.com:$APP_DIR/ 2>/dev/null || true
+
+          # Ship the migration runner + SQL so the server has a recovery path (scripts/ and db/migrations/ were previously omitted from the artifact).
+          # This allows `node scripts/migrate.js` (after sourcing .env.production) to work directly on the target if needed for bootstrap or emergencies.
+          # See docs/superpowers/plans/2026-06-prod-db-schema-migration-reliability.md
+          echo "Ensuring migration directories on server and copying runner + SQL..."
+          ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=no tyler@route.crispygoat.com "mkdir -p $APP_DIR/scripts $APP_DIR/db"
+          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no scripts/migrate.js tyler@route.crispygoat.com:$APP_DIR/scripts/migrate.js 2>/dev/null || true
+          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no -r db/migrations tyler@route.crispygoat.com:$APP_DIR/db/ 2>/dev/null || true
+
+          # Install deps and restart on server
+          echo "Installing deps and restarting PM2..."
+          ssh -o ConnectTimeout=60 -o StrictHostKeyChecking=no tyler@route.crispygoat.com "cd $APP_DIR && npm install --omit=dev 2>&1 | tail -5 && pm2 restart route-commerce || pm2 start npm --name route-commerce -- start -- -p 3100 && pm2 save && sleep 4 && curl -f -s http://localhost:3100/api/health/db-schema || { echo 'Health check failed after start - schema not applied (see plan)'; exit 1; }"
+
+          echo "Deployed successfully"

.gitea/workflows/pwa-audit.yml

@@ -0,0 +1,34 @@
+name: PWA + Mobile A11y Audit
+
+on:
+  pull_request:
+
+jobs:
+  lighthouse:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Start server
+        run: npm run start &
+        env:
+          PORT: 3000
+
+      - name: Wait for server
+        run: sleep 10
+
+      - name: Run Lighthouse CI
+        run: npx lhci autorun

.gitignore

@@ -39,22 +39,13 @@ next-env.d.ts
 # Supabase
 supabase/.temp/
 
+# Playwright test results (generated, not source)
+test-results/
+playwright-report/
+
 # IDE / local config
 .mcp.json
-
-# Docker / self-hosted Postgres
-db_data/
-
-# Captured Supabase data (re-pull from Supabase as needed)
-supabase/captured/captured_data.sql.gz
-supabase/captured/captured_schema.sql
-
-# Local data and binaries
-.data/
-bin/postgrest
-bin/minio
-bin/mc
-bin/postgrest-proxy.js
-bin/postgrest.tar.xz
-# Captured Supabase dump (regenerate from Supabase with the guide in docs/SUPABASE_DUMP_GUIDE.md)
-supabase/captured/
+.env*
+public/videos/tuxedo-hero.mp4
+.neon
+.worktrees/

019e9554-37c8-7752-a9d5-0264371602a9/plan.md

@@ -1,250 +0,0 @@
-# Self-Hosted Storage + Schema Plan
-
-## Context
-
-The user is migrating Route Commerce from Supabase to a self-hosted stack:
-- **Already done in this branch (`feat/better-auth`)**: Better Auth (auth), Docker Postgres, PostgREST, env var rewiring, ~10 source files updated to drop Supabase JS client.
-- **What's broken right now**: The website is missing images (Supabase Storage URLs 404 because Supabase is going away), and the local Postgres can't apply the 137 migrations because the **base schema is missing** (the initial tables — `brands`, `orders`, `products`, `stops`, `admin_users` — were created in Supabase directly and never exported as a migration).
-- **User constraint**: "no band-aids" — proper self-hosted replacement, not runtime patches.
-- **User constraint**: "no data migration" — start with fresh empty DB; users re-upload assets.
-
-## Approach
-
-Three independent workstreams, executed in order:
-
-1. **Capture the base schema** from the still-live Supabase project using `pg_dump --schema-only` (recommended over `supabase db pull`, which has a broken migration history). Apply the captured schema + existing 137 migrations to the local self-hosted Postgres.
-2. **Stand up MinIO** in Docker as the S3-compatible object store. Wire it to the app via the AWS SDK. MinIO's URL structure is clean: `http://minio:9000/<bucket>/<key>`, publicly readable per-bucket via bucket policy.
-3. **Replace every Supabase Storage URL** in the codebase with MinIO URLs (one env var: `NEXT_PUBLIC_STORAGE_BASE_URL`).
-
-Storage buckets in use (from explore agent):
-| Bucket | Purpose | Current state |
-|---|---|---|
-| `brand-logos` | Brand logo images | Hardcoded in 8+ files via env-var URL |
-| `product-images` | Product photos | `80aa01da-ab4b-44f8-b6e7-700552457e18` (Supabase bucket UUID) |
-| `contacts-imports` | CSV contact imports | `a1b2c3d4-…` (Supabase bucket UUID) |
-| `videos` | Tuxedo video hero | Hardcoded Supabase URL in `TuxedoVideoHero.tsx` |
-| `water-photos` (dynamic) | Water log photos | API route, bucket name in form field |
-
-## Implementation
-
-### Phase A — Capture base schema and apply to local Postgres
-
-**Why `pg_dump`, not `supabase db pull`**: The remote Supabase project's `supabase_migrations.schema_migrations` history is out of sync with the local files (that's the long error list the user got). `supabase db pull` requires that history to be in sync before it'll write a new initial migration. `pg_dump` reads the live catalog directly and ignores the migration history entirely.
-
-**Steps**:
-
-1. **Capture the schema** from the remote Supabase DB (run on the user's Mac where direct PG works — MEMORY.md confirms direct PG is blocked from this dev box, but their Mac can do it):
-   ```bash
-   pg_dump "postgresql://postgres:<service-role-pw>@db.wnzkhezyhnfzhkhiflrp.supabase.co:5432/postgres" \
-     --schema-only --no-owner --no-privileges \
-     --schema=public \
-     -f supabase/captured_schema.sql
-   ```
-   *Exclude `auth` and `storage` schemas* — we stub `auth` ourselves and use MinIO instead of Supabase Storage. Note: 185 SECURITY DEFINER functions reference `auth.uid()`; these will compile against the preflight stub but return NULL at runtime. Phase D addresses this.
-
-2. **Delete files that don't belong** in the local apply order:
-   - `BUNDLE_018_042.sql` — concatenated duplicate
-   - `XXX_blog_tables.sql`, `XXX_launch_checklist.sql`, `XXX_roadmap_tables.sql`, `XXX_waitlist_waitlist.sql` — drafts (XXX convention)
-   - `099_contact_imports_bucket.sql` (the bucket-creation one — keep the RPCs though)
-   - Rename to disambiguate any number collisions (no current collision, but defensive)
-
-3. **Patch the 4 broken migrations** identified by the explore agent (read the file first, then `search_replace`):
-   - `006_water_log_rpcs_fixed.sql`: replace `STATIC` with `STABLE` (6 occurrences)
-   - `087_brand_logos_bucket.sql`: convert `CREATE POLICY IF NOT EXISTS …` to `DROP POLICY IF EXISTS …; CREATE POLICY …;` (4 policies)
-   - `099_harvest_reach_segmentation.sql`: quote the `time` column references (matches the 148 patch)
-   - `135_email_automation_rpcs.sql`: reorder `enroll_abandoned_cart` params so defaults come last, or add a default to `p_next_email_at`
-
-4. **Update `000_preflight_supabase_compat.sql`** (already in the branch):
-   - Add `CREATE EXTENSION IF NOT EXISTS pgcrypto;` at the top
-   - Remove the `storage.buckets` / `storage.objects` stub (MinIO replaces it; 087/145 storage policies will be deleted in step 2)
-
-5. **Apply to local Postgres** (running on this dev box, port 5432):
-   ```bash
-   PGPASSWORD='lay7yqM3fHNvwpfjb4tvz7M3kimopyrSHQF24vsuGUM' \
-     psql -h 127.0.0.1 -U routecommerce -d route_commerce -v ON_ERROR_STOP=1 -f supabase/migrations/000_preflight_supabase_compat.sql
-
-   PGPASSWORD='lay7yqM3fHNvwpfjb4tvz7M3kimopyrSHQF24vsuGUM' \
-     psql -h 127.0.0.1 -U routecommerce -d route_commerce -v ON_ERROR_STOP=1 -f supabase/captured_schema.sql
-
-   PGPASSWORD='lay7yqM3fHNvwpfjb4tvz7M3kimopyrSHQF24vsuGUM' \
-     for f in supabase/migrations/[0-9]*.sql; do
-       psql -h 127.0.0.1 -U routecommerce -d route_commerce -v ON_ERROR_STOP=1 -q -f "$f" || break
-     done
-   ```
-   Expected: most migrations apply, some fail (drop those, log in plan). This is the test that the local Postgres is actually usable.
-
-### Phase B — MinIO for object storage
-
-**Add to `docker-compose.yml`** (new `minio` service + `minio_init` one-shot to create buckets via `mc`):
-
-```yaml
-  minio:
-    image: minio/minio:latest
-    container_name: route_commerce_minio
-    restart: unless-stopped
-    env_file: [.env]
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server /data --console-address ":9001"
-    volumes:
-      - minio_data:/data
-    ports: ["127.0.0.1:9000:9000", "127.0.0.1:9001:9001"]
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
-  minio_init:
-    image: minio/mc:latest
-    depends_on:
-      minio: { condition: service_healthy }
-    env_file: [.env]
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        mc alias set local http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}
-        for b in brand-logos product-images contacts-imports videos water-photos; do
-          mc mb --ignore-existing local/$${b}
-          mc anonymous set download local/$${b}
-        done
-    profiles: ["init"]
-
-volumes:
-  minio_data: { driver: local }
-```
-
-**Add to `.env.example`**:
-```
-MINIO_ROOT_USER=routecommerce
-MINIO_ROOT_PASSWORD=change-me-minio-root
-NEXT_PUBLIC_STORAGE_BASE_URL=http://localhost:9000
-STORAGE_ENDPOINT=http://localhost:9000
-STORAGE_REGION=us-east-1
-STORAGE_ACCESS_KEY=routecommerce
-STORAGE_SECRET_KEY=change-me-minio-root
-STORAGE_BUCKET_PREFIX=
-```
-
-**Install AWS SDK** (MinIO is S3-compatible):
-```bash
-npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner
-```
-
-### Phase C — Replace Supabase Storage calls with MinIO
-
-**New server-side helper** `src/lib/storage.ts`:
-- `s3Client` configured from env (uses `@aws-sdk/client-s3`)
-- `uploadFile({ bucket, key, body, contentType })` — replaces `fetch(PUT .../storage/v1/object/{bucket}/{key})` patterns
-- `deleteFile({ bucket, key })`
-- `publicUrl(bucket, key)` — returns `${STORAGE_BASE_URL}/${bucket}/${key}`
-- Bucket name constants exported as a single source of truth
-
-**Files to modify** (from explore agent):
-- `src/actions/brand-settings.ts` — 8 `fetch` PUTs to `/storage/v1/object/brand-logos/...`
-- `src/actions/products/upload-image.ts` — 3 calls to `product-images` bucket
-- `src/actions/communications/import-contacts.ts` — `contacts-imports` bucket (PUT + LIST + RPC)
-- `src/app/api/water-photo-upload/route.ts` — dynamic bucket
-- `src/components/storefront/TuxedoVideoHero.tsx` — hardcoded `https://wnzkhezyhnfzhkhiflrp.supabase.co/storage/v1/object/public/...` for videos and brand-logos
-- `src/components/time-tracking/TimeTrackingFieldClient.tsx` — same hardcoded URL
-- `src/lib/email-service.ts` — 4 occurrences of `wnzkhezyhnfzhkhiflrp.supabase.co/storage/v1/object/public/...`
-- `src/app/tuxedo/about/page.tsx` — same hardcoded URL
-
-For the **hardcoded Supabase URLs**: replace with `publicUrl(bucket, key)` or `${process.env.NEXT_PUBLIC_STORAGE_BASE_URL}/${bucket}/${key}`.
-
-**Remove**:
-- The `MockStorageBuilder` in `src/lib/supabase.ts:193-223` (no longer needed)
-- `SUPABASE_PAT` env var from `.env.example` (only used by water-photo-upload)
-
-### Phase D — Auth wiring (closes the loop)
-
-The 185 `auth.uid()` references in the captured schema will return NULL without intervention. Two options:
-
-- **Option 1 (recommended, matches existing pattern)**: Disable RLS on all public tables, rely on the SECURITY DEFINER RPCs (which the codebase already does, per CLAUDE.md). One-time SQL after `captured_schema.sql` applies: `DO $$ DECLARE r record; BEGIN FOR r IN SELECT tablename FROM pg_tables WHERE schemaname='public' LOOP EXECUTE 'ALTER TABLE public.' || quote_ident(r.tablename) || ' DISABLE ROW LEVEL SECURITY'; END LOOP; END $$;`
-- **Option 2**: Wire PostgREST to set `request.jwt.claim.sub` from the Better Auth session cookie. More complex; deferred unless RLS proves necessary.
-
-**Recommend Option 1** for now — it's consistent with the existing "brand scoping in server actions" pattern, and the SECURITY DEFINER functions still work because they execute with the function owner's privileges (no RLS blocking).
-
-### Phase E — Verification
-
-End-to-end test sequence (no more "trust me, it works"):
-
-1. **DB schema applies cleanly**:
-   ```bash
-   docker compose up -d db minio
-   PGPASSWORD=$POSTGRES_PASSWORD psql -h 127.0.0.1 -U routecommerce -d route_commerce -f 000_preflight.sql
-   PGPASSWORD=$POSTGRES_PASSWORD psql -h 127.0.0.1 -U routecommerce -d route_commerce -f captured_schema.sql
-   for f in supabase/migrations/[0-9]*.sql; do psql ... -f "$f" || echo "FAIL: $f"; done
-   ```
-   Goal: all migrations apply (with the 4 patches from Phase A) OR the remaining failures are documented and skipped.
-
-2. **PostgREST serves the schema**:
-   ```bash
-   curl http://127.0.0.1:3001/brands?limit=1 -H "apikey: local-anon"
-   curl http://127.0.0.1:3001/rpc/get_public_stops_for_brand -X POST -H "Content-Type: application/json" -d '{"p_slug":"indian-river-direct"}'
-   ```
-
-3. **MinIO buckets are public**:
-   ```bash
-   mc alias set local http://127.0.0.1:9000 $USER $PASS
-   mc ls local/
-   curl -I http://127.0.0.1:9000/brand-logos/test.png   # should return 200 or 404, never 403
-   ```
-
-4. **App build passes**:
-   ```bash
-   DATABASE_URL=... NEXT_PUBLIC_SUPABASE_URL=http://127.0.0.1:3001 \
-     NEXT_PUBLIC_STORAGE_BASE_URL=http://127.0.0.1:9000 \
-     BETTER_AUTH_SECRET=... npm run build
-   ```
-   Goal: `✓ Compiled successfully` with no Supabase URL parse errors, no `auth.uid()` undefined, no missing bucket errors.
-
-5. **Image display in the browser**:
-   - Start the dev server: `npm run dev`
-   - Sign in via Better Auth (mock or real)
-   - Upload a product image via admin UI → verify it lands in MinIO (`mc ls local/product-images/`)
-   - Visit `/indian-river-direct/products/[slug]` → verify the image renders with the MinIO URL
-
-6. **Auth round-trip**:
-   - `POST /api/auth/sign-up/email` with test email/password → expect 200, user created in `better_auth_user` (or whatever Better Auth's table is — check `200_better_auth_tables.sql`)
-   - `POST /api/auth/sign-in/email` → expect session cookie
-   - Hit `/admin` with the cookie → expect 200, not redirect to `/login`
-
-## Files to modify (summary)
-
-| File | Change |
-|---|---|
-| `docker-compose.yml` | Add `minio` + `minio_init` services, `minio_data` volume |
-| `.env.example` | Add MinIO + storage env vars, remove `SUPABASE_PAT` |
-| `package.json` | Add `@aws-sdk/client-s3`, `@aws-sdk/s3-request-presigner` |
-| `supabase/migrations/000_preflight_supabase_compat.sql` | Add `pgcrypto` extension, remove storage stub |
-| `supabase/migrations/006_water_log_rpcs_fixed.sql` | `STATIC` → `STABLE` |
-| `supabase/migrations/087_brand_logos_bucket.sql` | `CREATE POLICY IF NOT EXISTS` → `DROP + CREATE` |
-| `supabase/migrations/099_harvest_reach_segmentation.sql` | Quote `time` column refs |
-| `supabase/migrations/135_email_automation_rpcs.sql` | Reorder `enroll_abandoned_cart` params |
-| `supabase/captured_schema.sql` | **NEW** — output of `pg_dump` from remote |
-| `src/lib/storage.ts` | **NEW** — S3 client, upload/delete/publicUrl helpers, bucket constants |
-| `src/actions/brand-settings.ts` | Replace 8 Supabase fetch PUTs with `uploadFile` |
-| `src/actions/products/upload-image.ts` | Replace 3 calls with `uploadFile` |
-| `src/actions/communications/import-contacts.ts` | Replace PUT + LIST with `uploadFile` / S3 ListObjectsV2 |
-| `src/app/api/water-photo-upload/route.ts` | Replace Supabase call with `uploadFile` |
-| `src/components/storefront/TuxedoVideoHero.tsx` | Replace hardcoded Supabase URL with `publicUrl()` |
-| `src/components/time-tracking/TimeTrackingFieldClient.tsx` | Same |
-| `src/lib/email-service.ts` | Same (4 occurrences) |
-| `src/app/tuxedo/about/page.tsx` | Same |
-| `src/lib/supabase.ts` | Remove `MockStorageBuilder` (lines 193-223) |
-
-## Reuse from existing code
-
-- `src/lib/supabase.ts` — the `supabase` JS client still exports query builders used by `src/lib/svc-headers.ts` and many server actions for non-auth RPCs. Keep it for now; it's PostgREST-compatible because both speak the PostgREST protocol.
-- `src/lib/auth.ts` — Better Auth config, already wired in this branch. No changes needed.
-- `src/lib/admin-permissions.ts` — already swapped to use Better Auth + direct `pg`. No changes needed.
-- `src/lib/svc-headers.ts` — used to build Supabase REST headers. Stays as-is (the anon/service-role strings still work against PostgREST).
-
-## Risks
-
-- **Migration apply order**: even after patches, some migrations may reference tables that haven't been created yet due to deletion order. The captured `pg_dump` puts everything in dependency order, so applying it first should resolve most cross-references.
-- **The 4 broken migrations may be load-bearing**: 087 (brand-logos RLS) is already removed in the cleanup step. 006 (water log RPCs) is critical for the `/admin/water-log` pages. 099 is critical for communications. 135 is critical for the email automation. If the patches don't work, the affected features will be broken — but the rest of the app should still build and run.
-- **Existing user-uploaded images in Supabase will be unreachable**: the user said "no data migration", so this is expected. Admins will re-upload logos/product images. The Tuxedo video and Olathe logos (referenced in `email-service.ts` and `tuxedo/about/page.tsx`) are brand assets the user will need to copy over manually.
-- **PostgREST connection pooling**: PostgREST opens ~10 connections to Postgres. The 137 migrations + `pg_dump` schema may reference `auth.uid()` inside SECURITY DEFINER functions, which will fail to plan if the `auth` schema is missing. The preflight stubs the function but the `pg_dump` will also try to create the same function (with the real Supabase body). If `pg_dump` includes a non-stub `auth.uid()` that conflicts with the preflight, apply `pg_dump` first, then the preflight.

CLAUDE.md

@@ -2,11 +2,55 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+## Canonical Remote
+
+There is exactly one remote — `origin` — pointing to the self-hosted Gitea repo:
+
+- **URL:** `git@git.crispygoat.com:tyler/route-commerce.git`
+- **Default branch:** `main`
+- **Deploy:** push to `origin/main` triggers `.gitea/workflows/deploy.yml`
+
+Do **not** add GitHub remotes. There is no `origin` on github.com and no separate "dev" repo. If you see `github.com/dzinesco/*` URLs in `.git/config`, that is stale configuration from a previous fork and should be removed (`git remote remove`).
+
+### Gitea authentication (SSH)
+
+This workspace has been using Gitea via SSH for all operations. The Gitea instance is self-hosted at `git.crispygoat.com` (web UI: `https://git.crispygoat.com`, API base: `https://git.crispygoat.com/api/v1`).
+
+**SSH key:** `~/.ssh/id_ed25519_crispygoat` is the dedicated key registered with the Gitea instance (alias `dog` per the Gitea SSH banner). Add it to the agent before any git operation:
+
+```bash
+eval "$(ssh-agent -s)"
+ssh-add ~/.ssh/id_ed25519_crispygoat
+```
+
+The SSH config (`~/.ssh/config`) already aliases the host as `crispygoat` with `AddKeysToAgent yes`, so subsequent shells can just `ssh crispygoat` / `git push origin ...` without re-adding.
+
+**Verified working commands:**
+- `git push origin <branch>` — push (this is the primary workflow)
+- `ssh -p 22 git@git.crispygoat.com` — auth check; Gitea returns "successfully authenticated" + "Gitea does not provide shell access"
+
+**API token:** This environment does **not** have a Gitea personal access token in any known location (no `~/.config/gitea`, no `GITEA_ACCESS_TOKEN` env, no token in `~/.config/gh/hosts.yml`). Do not assume a token is available — auth attempts will return `{"message":"invalid username, password or token"}`.
+
+**`tea` CLI / `gitea-mcp`:** Both are installed but require a token; `--ssh-agent-key` is recognized by `tea logins add` but the underlying SDK still falls back to requiring a token. Treat these as unavailable until a token is provisioned.
+
+### Opening pull requests (the workflow that actually works)
+
+Because no Gitea API token is available in this environment, the PR creation flow is:
+
+1. Create a feature branch: `git checkout -b docs/<date>-<description>`
+2. Commit the changes (no need to commit unrelated files — leave the worktree dirty but `git add` only what you intend to ship)
+3. Push: `git push -u origin <branch>`
+4. The Gitea push hook prints a "Create a new pull request" URL on stderr, e.g. `https://git.crispygoat.com/tyler/route-commerce/pulls/new/<branch>` — open that URL in a browser to file the PR through the web UI.
+
+If a future environment provides a Gitea token, the `tea pr create` and `curl POST /api/v1/repos/tyler/route-commerce/pulls` flows become available; the auth pattern is `Authorization: token <TOKEN>` on the REST API or `tea logins add -t <TOKEN> -u https://git.crispygoat.com` for the CLI.
+
 ## Project Overview
 
 Route Commerce is a multi-tenant B2B e-commerce platform for fresh produce wholesale distribution. Brands sell to customers who pick up at scheduled stops or receive shipments. The platform includes admin dashboards for order management, stop/route scheduling, product catalogs, payment processing (Stripe + Square), and a communications module ("Harvest Reach") for email/SMS campaigns.
 
-Tech stack: Next.js 16 (App Router) · Supabase (auth + Postgres + RLS) · Stripe · Square · Resend (email) · Tailwind CSS v4
+Tech stack: Next.js 16 (App Router) · **Postgres** (direct) · **Neon Auth** (Better Auth) · Stripe · Square · Resend (email) · Tailwind CSS v4
+
+> **Direction:** Auth is handled by Neon Auth (Better Auth). The `admin_users` table links to Neon Auth users by email. New DB code must connect to Postgres directly via the shared `pg` `Pool` from `src/lib/db.ts`. No Supabase JS client, REST gateway, or `*.supabase.co` calls anywhere in the codebase.
 
 ---
 
@@ -21,14 +65,12 @@ npx tsc --noEmit     # TypeScript check (no emit)
 npx playwright test  # Run E2E tests (Playwright)
 ```
 
-> The migrate script auto-detects Supabase CLI first, then falls back to direct PostgreSQL.
-> For CLI mode: `brew install supabase/tap/supabase` then `supabase link --project-ref wnzkhezyhnfzhkhiflrp`
-> For direct PG mode: `pg` and `dotenv` are already in devDependencies.
-> If `get_brand_settings` migration fails with "cannot change return type", the function signature changed — drop and recreate it first.
+> The migrate script is `scripts/migrate.js`. It reads `DATABASE_URL` (or `DATABASE_ADMIN_URL`) from `.env.local` via `dotenv` and applies any `db/migrations/*.sql` files not already recorded in `_migrations`. `pg` is already in devDependencies.
+> If a migration fails with "cannot change return type", the function signature changed — drop and recreate it first.
 
-**Recent migration work is documented in `MEMORY.md`** (Supabase login + link process, updates to `push-migrations.js` for modern CLI, specific SQL patches made to 091/145/148/200/201 so they would apply cleanly, and which migrations were pushed in the session). Cat `MEMORY.md` for details.
+**Historical migration work is documented in `MEMORY.md`** (Supabase login + link process, updates to `push-migrations.js` for the modern CLI, specific SQL patches made to 091/145/148/200/201 so they would apply cleanly, and which migrations were pushed). Cat `MEMORY.md` for details.
 
-No test suite currently exists. E2E tests use Playwright (`tests/` or `test-e2e.ts`).
+E2E tests live in `tests/` and run via Playwright. Specs include `tests/smoke.spec.ts` and `tests/login/login-flow.spec.ts`. **Note: `playwright.config.ts` defaults `baseURL` to production** (`https://route-commerce-platform.vercel.app`); override with `PLAYWRIGHT_URL=http://localhost:4000` for local runs (the dev server binds to port `4000`), or pass `--config` with a local config.
 
 ---
 
@@ -36,28 +78,91 @@ No test suite currently exists. E2E tests use Playwright (`tests/` or `test-e2e.
 
 ### Authentication & Authorization
 
-**Dev mode** bypasses Supabase auth entirely via `dev_session` cookie set by `/login`:
-- `dev_session=platform_admin` — full access, all brands
-- `dev_session=brand_admin` — full access to assigned brand only
-- `dev_session=store_employee` — limited access (orders, pickup, wholesale only)
+**Neon Auth (Better Auth)** is the active auth system. Config lives in `src/lib/auth.ts`, with the route handler at `src/app/api/auth/[...nextauth]/route.ts`. Neon Auth manages users in the `neon_auth.user` table; our `admin_users` table links to Neon Auth users by email.
 
-`src/lib/admin-permissions.ts` is the single source of truth for the current admin user. It uses a `dev_session` cookie in development and Supabase Auth in production. **Never import this file directly into Client Components** — use the `getCurrentAdminUser` server action from `@/actions/admin-user` instead.
+**Auth flow:**
+1. User signs in via `/api/auth/sign-in` → Neon Auth validates credentials → session cookie set
+2. `getAdminUser()` in `src/lib/admin-permissions.ts` reads the Neon Auth session and looks up `admin_users` by email
+3. Middleware (`src/proxy.ts`) guards `/admin/*` routes at the edge level
+
+**Key files:**
+- `src/lib/auth.ts` — Neon Auth configuration (getSession, signIn, signOut, resetPassword, requestPasswordReset)
+- `src/auth.config.ts` — Edge-safe config (baseUrl, cookieSecret)
+- `src/proxy.ts` — Edge-level route protection
+- `src/app/api/auth/sign-in/route.ts` — Email/password sign-in API
+- `src/app/api/auth/forgot-password/route.ts` — Password reset request API
+- `src/app/api/auth/reset-password/route.ts` — Password reset confirmation API
+- `src/actions/auth-actions.ts` — Server actions (signOutAction)
+- `src/actions/admin/password.ts` — Admin password update (setUserPassword)
+
+**Environment variables:**
+- `NEON_AUTH_BASE_URL` — from `neonctl neon-auth status`
+- `NEON_AUTH_COOKIE_SECRET` — min 32-char secret: `openssl rand -base64 32`
+- `NEXT_PUBLIC_SITE_URL` — site URL for redirects and Origin header
+
+**Single source of truth for the current admin user:** `getAdminUser()` in `src/lib/admin-permissions.ts`. It reads the Neon Auth session via `getSession()` from `@/lib/auth`, then looks up `admin_users` by email. **Never import `admin-permissions.ts` into Client Components** — use server actions instead.
 
 The `AdminUser` type lives in `src/lib/admin-permissions-types.ts` and is shared across server/client boundary.
 
+#### Auth API routes
+
+| Route | Method | Purpose |
+|-------|--------|---------|
+| `/api/auth/sign-in` | POST | Email/password sign-in |
+| `/api/auth/forgot-password` | POST | Request password reset email |
+| `/api/auth/reset-password` | POST | Set new password (after reset link clicked) |
+| `/api/auth/[...nextauth]` | GET/POST | Neon Auth handler (sign-out, OAuth callbacks, etc.) |
+
 ### Server Actions Pattern
 
 All database writes go through server actions in `src/actions/`. These:
 1. Call `getAdminUser()` to verify auth
 2. Check role/permission flags (`can_manage_orders`, etc.)
-3. Call Supabase REST APIs (not the Supabase client directly in server actions) to trigger SECURITY DEFINER RPCs
+3. Call Postgres RPCs via the `pg` driver
 4. Return typed results (`{ success: true, ... } | { success: false, error: string }`)
 
 Server actions are "use server" files that export async functions. Client components import and call them directly.
 
-### SECURITY DEFINER RPCs + Brand Scoping
+### Database (Postgres, direct)
 
-The app uses **PostgreSQL SECURITY DEFINER functions** for all data access. These run with the function owner's privileges and bypass RLS entirely. This means:
+The app connects to **Postgres directly** — no Supabase platform, JS client, or REST gateway. Server actions use the `pg` driver to call `SECURITY DEFINER` PL/pgSQL functions; Drizzle (on top of the same pool) handles typed reads and the per-request `app.current_brand_id` GUC. Storage of files (product images, etc.) is moving to an S3-compatible object store; until that's wired up, image references can stay as URLs.
+
+#### Connection
+
+- `DATABASE_URL` in `.env.local` (and hosting dashboard) is the only required DB env var.
+- A single shared `pg` `Pool` is exported from `src/lib/db.ts` as `pool` (proxy) and `getPool()` (lazy). Server actions and API routes import it and call `pool.query(...)` against RPC names. The Drizzle client lives at `db/client.ts` and shares the same pool.
+- No `NEXT_PUBLIC_SUPABASE_URL` / `SUPABASE_SERVICE_ROLE_KEY` / `@supabase/*` imports — none exist anywhere in the codebase.
+
+#### First production deploy / new prod DB bootstrap (critical for admin access)
+
+The `admin_users` + `admin_user_brands` tables (and the rest of the schema) come **only** from `db/migrations/0001_init.sql`.
+
+If the prod `DATABASE_URL` has never had the migrations applied, `getAdminUser()` will fail with "relation \"admin_users\" does not exist", the layout will show "Access Denied", and even a signed-in Neon Auth user will be blocked.
+
+**Correct bootstrap sequence (do this from a machine with the full source tree before the first push that exercises /admin):**
+
+1. Ensure the Gitea secret `DATABASE_URL` points at the real prod Neon Postgres (the one with `neon_auth.user` already present).
+2. Sign in once at the live prod URL (`/login`) with the email you want as the first `platform_admin`. This creates the row in `neon_auth.user`.
+3. From your laptop (or any box with the checkout):
+
+   ```bash
+   # Paste the real prod connection string (get it from Gitea secrets or the target's .env.production)
+   DATABASE_URL="postgresql://...prod-full-string..." node scripts/migrate.js
+
+   # Then provision (the script will link to the first brand it finds)
+   DATABASE_URL="postgresql://...prod-full-string..." \
+     npx tsx scripts/provision-admin.ts you@real.com platform_admin
+   ```
+
+4. Push to main. The deploy workflow now has a hard gate (see `.gitea/workflows/deploy.yml` "Run migrations" + verification query for `admin_users`) and ships the migrate runner + SQL files, so future deploys and server-side recovery are protected.
+
+See the full root-cause + plan: `docs/superpowers/plans/2026-06-prod-db-schema-migration-reliability.md`
+
+The old `|| echo` masking around `npm run migrate:one` has been removed; a missing critical table will now fail the CI job with a clear message.
+
+#### SECURITY DEFINER RPCs + Brand Scoping
+
+The app uses **PostgreSQL SECURITY DEFINER functions** for all data access. These run with the function owner's privileges and bypass any future RLS. This means:
 
 - Brand isolation must be enforced at the **application layer** (in server actions), not in database policies
 - Every RPC that touches brand-scoped data accepts a `p_brand_id UUID` parameter and filters by it
@@ -182,10 +287,19 @@ For annual pricing, create separate annual prices in Stripe (e.g., $441/yr for S
 
 ### Communications Module ("Harvest Reach")
 
-The communications system (`/admin/communications`) uses a separate set of tables that are **NOT protected by RLS** — they rely entirely on the SECURITY DEFINER RPCs + application-layer brand scoping. Key tables: `communication_campaigns`, `communication_templates`, `communication_contacts`, `communication_message_logs`.
+The communications system (`/admin/communications`) uses a separate set of tables that have **no row-level policies** — they rely entirely on the SECURITY DEFINER RPCs + application-layer brand scoping. Key tables: `communication_campaigns`, `communication_templates`, `communication_contacts`, `communication_message_logs`. Scoping is enforced by RPC + app layer.
 
 `send_campaign` / `send_stop_blast` RPCs insert into `communication_message_logs` but do NOT populate `event_id`. The Resend webhook (`src/app/api/resend/webhook/route.ts`) must therefore look up logs by `customer_email + subject + created_at` (7-day window), not by `event_id`.
 
+**Scheduled automations** (declared in `vercel.json`):
+- `POST /api/email-automation/abandoned-cart` — every 6h, fires abandoned-cart sequence emails
+- `POST /api/email-automation/welcome-sequence` — every 6h, fires welcome onboarding sequence
+- `POST /api/cron/send-scheduled` — daily 09:00, sends scheduled campaigns
+- `POST /api/wholesale/notifications/{send,dispatch,pickup-reminder}` — wholesale lifecycle
+- `POST /api/square/process-queue` — every 2 min, drains Square sync queue
+
+These endpoints are also reachable via curl for manual triggering; the email-automation routes accept `Authorization: Bearer $CRON_SECRET`.
+
 ### Payments
 
 - **Stripe** — primary payment processor; `src/actions/payments.ts` and `src/app/api/stripe/` handle checkout, webhooks, refunds
@@ -200,7 +314,7 @@ Separate from orders/stops — tracks irrigation/water usage per brand. `src/act
 
 ## Key Conventions
 
-- All DB mutations use Supabase REST API (`fetch` to `${supabaseUrl}/rest/v1/rpc/...`) from server actions, NOT the Supabase JS client (avoids SSR cookie issues)
+- All DB access goes through a shared `pg` `Pool` (see Database section). Server actions call SECURITY DEFINER RPCs via `pool.query('SELECT * FROM fn_name($1, $2)', [...])`. Do not introduce `@supabase/*` imports, REST fetches, or `*.supabase.co` calls anywhere in the codebase.
 - `gen_random_uuid()` used in migrations for primary keys
 - Migrations use `CREATE OR REPLACE FUNCTION` for idempotency — never `DROP` then `CREATE`
 - Status enums stored as TEXT — no PostgreSQL ENUM type
@@ -215,13 +329,15 @@ Separate from orders/stops — tracks irrigation/water usage per brand. `src/act
 
 | Concern | Location |
 |---|---|
+| Neon Auth configuration | `src/lib/auth.ts`, `src/auth.config.ts` |
+| Auth API routes | `src/app/api/auth/sign-in/route.ts`, `src/app/api/auth/forgot-password/route.ts`, `src/app/api/auth/reset-password/route.ts`, `src/app/api/auth/[...nextauth]/route.ts` |
 | Admin auth + permissions | `src/lib/admin-permissions.ts`, `src/lib/admin-permissions-types.ts` |
-| Middleware (route protection) | `src/middleware.ts` |
-| Server actions | `src/actions/*.ts` (one file per domain) |
+| Middleware (route protection) | `src/proxy.ts` |
+| Server actions | `src/actions/*.ts` (one file per domain; also grouped into `src/actions/{admin,ai,billing,communications,harvest-reach,integrations,orders,products,settings,shipping,stops,water-log,platform,route-trace,time-tracking,email-automation}/`) |
 | Admin pages | `src/app/admin/[module]/page.tsx` |
 | Admin client components | `src/components/admin/*.tsx` |
-| Migrations | `supabase/migrations/` |
-| Supabase client | `src/lib/supabase.ts` |
+| Migrations | `db/migrations/` |
+| Postgres pool / driver | `src/lib/db.ts` (TBD) |
 | Email templates | `src/lib/email-templates.ts` |
 | Date formatting | `src/lib/format-date.ts` |
 | Feature flags | `src/lib/feature-flags.ts` |
@@ -238,7 +354,9 @@ Separate from orders/stops — tracks irrigation/water usage per brand. `src/act
 ## Gotchas
 
 - **Dev mode `brand_id: null`**: `getAdminUser()` returns `brand_id: null` for platform_admin dev sessions. Always pass explicit `brandId` to server action functions that accept it — don't rely on `adminUser.brand_id` alone.
-- **Communications = no RLS**: The communications tables (campaigns, templates, contacts, message_logs) have RLS disabled. All brand scoping must be enforced in server actions.
+- **Communications = no RLS**: The communications tables (campaigns, templates, contacts, message_logs) have no row-level policies. All brand scoping must be enforced in server actions.
 - **Webhook event_id**: `log_communication_messages` never populates `event_id`, so the Resend webhook uses `customer_email + subject` lookup instead.
 - **Mixed fulfillment orders**: An order can have both pickup and ship items. `get_shipping_orders` RPC returns orders with at least one `fulfillment = 'ship'` item.
-- **SMS opt-in defaults**: `communication_contacts.sms_opt_in` defaults to `FALSE` (opt-out by default). `email_opt_in` defaults to `TRUE`. Always check `sms_opt_in` specifically for SMS sends, not `email_opt_in`.
+- **SMS opt-in defaults**: `communication_contacts.sms_opt_in` defaults to `FALSE` (opt-out by default). `email_opt_in` defaults to `TRUE`. Always check `sms_opt_in` specifically for SMS sends, not `email_opt_in`.
+- **Neon Auth session cookie**: The session cookie is managed by Neon Auth. Do not manually set or clear it — use `signOut()` from `@/lib/auth` instead.
+- **Password reset**: The forgot-password API returns success even if the email doesn't exist (to prevent email enumeration). Check server logs to verify reset emails were sent.

DB_REFERENCE.md

@@ -0,0 +1,125 @@
+# Database Reference — Neon Postgres (Route Commerce)
+
+## Core Auth
+| Table | Key Columns |
+|---|---|
+| `users` | id, name, email, email_verified, image, created_at |
+| `sessions` | id, user_id, token, expires_at, ip_address, user_agent |
+| `accounts` | id, user_id, provider_id, access_token, refresh_token |
+| `verifications` | id, identifier, value, expires_at |
+| `admin_users` | id, user_id, email, name, **role**, can_manage_* (15 flags), created_at |
+| `admin_user_brands` | admin_user_id, brand_id, added_at, added_by |
+
+> `role` values: `platform_admin`, `brand_admin`, `store_employee`
+> Link a user to a brand via `admin_user_brands`, NOT a column on `admin_users`.
+
+## Brands & Plans
+| Table | Key Columns |
+|---|---|
+| `brands` | id, name, slug, **plan_tier**, max_users, max_products, max_stops_monthly, stripe_* |
+| `plans` | id, code, name, monthly_price_cents, max_users, max_products, max_stops_monthly, features |
+| `add_ons` | id, code, name, monthly_price_cents, description |
+| `brand_add_ons` | brand_id, add_on_id, stripe_subscription_id, status |
+| `brand_features` | id, brand_id, feature_key, enabled, enabled_at |
+| `brand_settings` | id, brand_id, legal_business_name, phone, email, logo_url, tagline, from_email, primary_color, custom_footer_text, etc. |
+| `wholesale_settings` | id, brand_id, require_approval, min_order_amount, pickup_location, fob_location, from_email, invoice_business_name, last_invoice_number |
+
+## Products & Media
+| Table | Key Columns |
+|---|---|
+| `products` | id, brand_id, name, description, sku, type, price_cents, inventory, unit, active, is_taxable, pickup_type, image_url |
+| `product_images` | id, product_id, storage_key, position, alt_text |
+| `wholesale_products` | id, brand_id, rc_product_id, name, unit_type, availability, qty_available, price_tiers (JSON) |
+
+## Orders
+| Table | Key Columns |
+|---|---|
+| `orders` | id, brand_id, customer_id, stop_id, total_cents, status, fulfillment, customer_address, placed_at |
+| `order_items` | id, order_id, product_id, quantity, price_cents, fulfillment |
+| `stops` | id, brand_id, name, location, address, city, state, zip, date, time, cutoff_date, status, is_public |
+| `shipments` | id, order_id, carrier, tracking_number, label_url, status, fedex_shipment_id |
+| `shipping_settings` | id, brand_id, carrier, fedex_account_number, fedex_api_key, fedex_use_production |
+| `user_carts` | id, brand_id, customer_id, items (JSON) |
+| `abandoned_cart_recovery` | id, brand_id, customer_id, contact_email, sequence_step, status, next_email_at |
+
+## Wholesale
+| Table | Key Columns |
+|---|---|
+| `wholesale_customers` | id, user_id, brand_id, company_name, contact_name, email, account_status, credit_limit, deposits_enabled |
+| `wholesale_orders` | id, brand_id, customer_id, status, fulfillment_status, payment_status, subtotal, deposit_paid, balance_due, invoice_number |
+| `wholesale_order_items` | id, wholesale_order_id, product_id, quantity, unit_price, line_total |
+| `wholesale_deposits` | id, wholesale_order_id, amount, payment_method, reference |
+| `wholesale_customer_product_pricing` | id, customer_id, product_id, custom_price_cents |
+| `wholesale_notifications` | id, brand_id, customer_id, notification_type, channel, status, sent_at |
+| `wholesale_webhook_settings` | id, brand_id, url, secret, enabled |
+| `wholesale_sync_log` | id, brand_id, event_type, order_id, status |
+
+## Communications (Harvest Reach)
+| Table | Key Columns |
+|---|---|
+| `communication_campaigns` | id, brand_id, name, subject, body_text, body_html, campaign_type, status, audience_rules (JSON), scheduled_at, sent_at |
+| `communication_contacts` | id, brand_id, email, phone, first_name, last_name, email_opt_in, sms_opt_in, unsubscribed_at, tags |
+| `communication_message_logs` | id, brand_id, campaign_id, contact_id, customer_email, delivery_method, subject, status |
+| `communication_segments` | id, brand_id, name, rules (JSON) |
+| `communication_templates` | id, brand_id, name, subject, body_text, body_html, template_type |
+| `communication_settings` | id, brand_id, default_sender_email, email_provider |
+| `welcome_email_sequence` | id, brand_id, contact_id, sequence_step, status, next_email_at |
+
+## Customers
+| Table | Key Columns |
+|---|---|
+| `customers` | id, brand_id, primary_email, primary_phone, first_name, last_name, source |
+| `customer_communication_preferences` | id, customer_id, email_opt_in, sms_opt_in |
+
+## Time Tracking
+| Table | Key Columns |
+|---|---|
+| `time_tracking_workers` | id, brand_id, name, role, pin, active |
+| `time_tracking_tasks` | id, brand_id, name, unit, sort_order, active |
+| `time_tracking_logs` | id, brand_id, worker_id, task_id, clock_in, clock_out, lunch_break_minutes |
+| `time_tracking_settings` | id, brand_id, pay_period_start_day, daily_overtime_threshold, weekly_overtime_threshold, overtime_multiplier |
+| `time_tracking_notification_log` | id, brand_id, worker_id, notification_type, status, sent_at |
+
+## Water Log
+| Table | Key Columns |
+|---|---|
+| `water_headgates` | id, brand_id, name, active |
+| `water_irrigators` | id, brand_id, name, pin_hash, active |
+| `water_sessions` | id, irrigator_id, expires_at |
+| `water_log_entries` | id, brand_id, headgate_id, irrigator_id, measurement, unit, notes, logged_at |
+| `water_alert_log` | id, brand_id, alert_type, headgate_id, message, sent_to |
+
+## Integrations
+| Table | Key Columns |
+|---|---|
+| `square_sync_log` | id, brand_id, sync_type, direction, item_id, status |
+| `square_sync_queue` | id, brand_id, sync_type, status, retry_count |
+| `api_keys` | id, brand_id, name, key_hash, permissions (JSON), is_active |
+| `payment_settings` | id, brand_id, provider, stripe_publishable_key, stripe_secret_key, square_access_token |
+
+## Locations
+| Table | Key Columns |
+|---|---|
+| `locations` | id, brand_id, name, address, city, state, zip, active |
+
+## Misc
+| Table | Key Columns |
+|---|---|
+| `audit_logs` | id, user_id, brand_id, action, entity_type, entity_id, details (JSON) |
+| `admin_action_logs` | id, admin_user_id, brand_id, action, target_type, target_id, metadata (JSON) |
+| `operational_events` | id, brand_id, event_type, entity_type, actor_type, payload (JSON) |
+| `referral_codes` | id, brand_id, referral_code, referrer_email, reward_type, reward_value |
+| `referral_redemptions` | id, referral_code_id, brand_id, referred_user_id |
+| `onboarding_progress` | id, brand_id, user_id, current_step, completed_steps (JSON) |
+| `notification_preferences` | id, user_id, email_orders, email_marketing, sms_orders, etc. |
+| `changelogs` | — |
+| `changelog_reads` | id, user_id, changelog_id |
+| `_migrations` | filename, applied_at |
+
+## Schema Notes
+- All timestamps use `TIMESTAMP WITH TIME ZONE` — timezone-aware
+- No PostgreSQL ENUM types — statuses are plain TEXT
+- Brand scoping enforced at application layer (SECURITY DEFINER RPCs), NOT via RLS
+- `brands.slug` is the public storefront URL slug (e.g. `tuxedo`, `indian-river-direct`)
+- `admin_users.user_id` links to `neon_auth.user` (managed by Neon Auth), NOT to `users` table
+- The `users` table above is Neon Auth's internal table — do NOT write to it directly

ENVIRONMENT.md

@@ -10,18 +10,9 @@ Copy `.env.example` → `.env.local` and fill in the values.
 
 These are safe to commit and can be used in client bundles. Prefix with `NEXT_PUBLIC_`.
 
-### `NEXT_PUBLIC_SUPABASE_URL`
-Your Supabase project URL.
-- **Where to get:** Supabase Dashboard → Project Settings → API → Project URL
-- **Example:** `https://abc123.supabase.co`
-
-### `NEXT_PUBLIC_SUPABASE_ANON_KEY`
-Supabase anonymous (anon) key — safe for client-side use.
-- **Where to get:** Supabase Dashboard → Project Settings → API → anon key
-
 ### `NEXT_PUBLIC_BASE_URL`
 The base URL of your deployment. Used for OAuth redirects and webhook URLs.
-- **Local:** `http://localhost:3000`
+- **Local:** `http://localhost:4000` (dev script binds to port 4000; override via `npm run dev -- -p <port>`)
 - **Production:** `https://yourdomain.com`
 
 ### `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`
@@ -40,12 +31,16 @@ Set to a brand slug to hide other brand routes in single-brand mode.
 
 **Never prefix with `NEXT_PUBLIC_`**. These must only be accessed in Server Components, Server Actions, or API Routes.
 
-### Supabase
+### Database
 
-#### `SUPABASE_SERVICE_ROLE_KEY`
-Full service role key — grants DB admin access bypassing RLS.
-- **Where to get:** Supabase Dashboard → Project Settings → API → service_role key
-- **⚠️ Critical:** Never expose this to the client. Used only in server-side code.
+#### `DATABASE_URL`
+Full Postgres connection string. The app uses this exclusively (no Supabase, no JS client) for every server-side query — server actions and API routes import a shared `pg` `Pool` from `src/lib/db.ts` and call `SECURITY DEFINER` PL/pgSQL functions.
+- **Where to get:** Neon Dashboard → Project → Connection Details → Connection string (pooled)
+- **Example:** `postgresql://user:pass@ep-xxx.us-east-2.aws.neon.tech/routecommerce?sslmode=require`
+- **Format:** `postgres://user:pass@host:port/dbname?sslmode=require`
+
+#### `DATABASE_ADMIN_URL` (optional)
+Same connection string but with elevated perms (typically the direct, non-pooled Neon connection). Only used by `scripts/migrate.js` for DDL — fall back to `DATABASE_URL` if unset.
 
 ### Stripe
 
@@ -156,7 +151,7 @@ Controls whether to use Square sandbox or production.
 
 | Variable | Local (`.env.local`) | Production (hosting dashboard) |
 |---|---|---|
-| `NEXT_PUBLIC_BASE_URL` | `http://localhost:3000` | `https://yourdomain.com` |
+| `NEXT_PUBLIC_BASE_URL` | `http://localhost:4000` (or whatever port the dev server is on) | `https://yourdomain.com` |
 | `STRIPE_SECRET_KEY` | `sk_test_...` | `sk_live_...` |
 | `STRIPE_PUBLISHABLE_KEY` | `pk_test_...` | `pk_live_...` |
 | `SQUARE_ENVIRONMENT` | `sandbox` | `production` |
@@ -168,5 +163,50 @@ Controls whether to use Square sandbox or production.
 - **Wrong Stripe key type:** Using `sk_live_` in development or `sk_test_` in production will silently fail. Always match key type to environment.
 - **Stripe price IDs drift:** If you create new prices in Stripe Dashboard but forget to update `.env.local`, billing will fail. Keep them in sync.
 - **SQUARE_ENVIRONMENT mismatch:** Production Square credentials won't work with `sandbox`. Match it to your app secret type.
-- **SUPABASE_SERVICE_ROLE_KEY in client:** If you ever see `SUPABASE_SERVICE_ROLE_KEY` in a browser bundle, it's a critical security incident. The key was exposed server-side. Rotate it immediately in Supabase Dashboard.
-- **OPENAI_API_KEY for AI features:** AI features won't work without this. The AI Intelligence Pack add-on requires a valid OpenAI key.
+- **OPENAI_API_KEY for AI features:** AI features won't work without this. The AI Intelligence Pack add-on requires a valid OpenAI key.
+
+---
+
+## Authentication
+
+### Production (HTTPS Required)
+
+Neon Auth session cookies use the `__Secure-` prefix, which requires HTTPS. In production, the auth flow works as follows:
+
+1. User submits credentials to `/api/auth/sign-in`
+2. Neon Auth server sets session cookie with `secure: true`
+3. Browser stores the cookie and sends it with subsequent requests
+4. Middleware validates the session cookie
+
+### Local Development (HTTP)
+
+For local development over HTTP (e.g., `http://localhost:4000`), the platform provides a dev_session bypass:
+
+1. **Via Login Page:** Visit `/login` - you'll see "Dev Mode — Quick Access" buttons for Platform Admin, Brand Admin, and Store Employee roles.
+2. **Via Browser Console:** `document.cookie = 'dev_session=platform_admin; path=/; max-age=86400'`
+3. **Via curl:** `curl -b "dev_session=platform_admin" http://localhost:4000/admin`
+
+The dev_session cookie is automatically recognized by:
+- The middleware (`src/proxy.ts`)
+- The `getAdminUser()` function (`src/lib/admin-permissions.ts`)
+
+**Note:** The dev_session bypass only works when `NODE_ENV !== "production"`. In production, only Neon Auth session cookies are accepted.
+
+### HTTPS for Local Development
+
+If you prefer to test with real auth over HTTPS locally, you can use a tool like [mkcert](https://github.com/FiloSottile/mkcert):
+
+```bash
+# Install mkcert
+brew install mkcert
+
+# Create local CA and install it
+mkcert -install
+
+# Generate certificate for localhost
+mkcert localhost 127.0.0.1 ::1
+
+# Update next.config.ts to use HTTPS
+```
+
+For most development work, the dev_session bypass is sufficient.

LAUNCH_CHECKLIST.md

@@ -1,5 +1,7 @@
 # Route Commerce Launch Checklist Summary
 
+**Last updated:** 2026-06-25
+
 ## Overview
 
 This document summarizes the complete Launch & Marketing Layer implementation for Route Commerce, a multi-tenant B2B e-commerce platform for fresh produce wholesale distribution.
@@ -8,15 +10,15 @@ This document summarizes the complete Launch & Marketing Layer implementation fo
 
 ## ✅ Implementation Status
 
-### 1. Supabase Foundation ✓
+### 1. Database & Auth Foundation ✓
 
 | Component | Status | Location |
 |-----------|--------|----------|
-| Auth Flow | ✓ Complete | Existing dev_session + Supabase Auth |
-| Database Structure | ✓ Complete | Supabase migrations in place |
-| Role-Based Access | ✓ Complete | admin-permissions.ts system |
-| Protected Routes | ✓ Complete | middleware.ts |
-| Server Actions Pattern | ✓ Complete | src/actions/*.ts |
+| Auth Flow | ✓ Complete | Neon Auth (Better Auth) + dev_session for local |
+| Database Structure | ✓ Complete | `db/migrations/` applied via `pg` |
+| Role-Based Access | ✓ Complete | `admin-permissions.ts` system |
+| Protected Routes | ✓ Complete | `src/proxy.ts` (Next.js 16+ middleware convention) |
+| Server Actions Pattern | ✓ Complete | `src/actions/*.ts` |
 
 ### 2. Launch-Ready Features ✓
 
@@ -237,9 +239,9 @@ Track these metrics post-launch:
 
 - **Documentation**: See CLAUDE.md for technical details
 - **Stripe Dashboard**: https://dashboard.stripe.com
-- **Supabase Dashboard**: https://app.supabase.com/project/wnzkhezyhnfzhkhiflrp
+- **Neon Console**: https://console.neon.tech
 - **Vercel Deployments**: https://vercel.com/dashboard
 
 ---
 
-*Generated: January 2025*
+*Generated: January 2025 · Refreshed: 2026-06-25 (see `CLAUDE.md` for current architecture; deployment is via Vercel hooked to the Gitea `origin` remote — there is no GitHub `origin`)*

MEMORY.md

@@ -2,49 +2,127 @@
 
 This file captures key context, decisions, fixes, and state from recent work so it survives across conversations.
 
-**Last updated:** 2026-06-03 (during Supabase migration apply session)
+**Last updated:** 2026-06-25 (added current-state header; restored "Supabase → Postgres" pivot as the canonical entry point for new readers; documented the SSH-based Gitea workflow)
+
+> **Current state (read first).** Auth is **Neon Auth (Better Auth)** — see `CLAUDE.md`. The "Auth.js v5 wiring complete — 2026-06-06" entry further down is **historical** (it describes work that was subsequently replaced by the Neon Auth migration; `next-auth` remains in `package.json` as a vestigial dep but is no longer imported from `src/`). The Supabase → Postgres pivot section below is the canonical cutover record. The "GitHub origin" branch notes are also historical — the only remote is the Gitea `origin` (see `CLAUDE.md` "Canonical Remote"). Middleware lives at `src/proxy.ts`, not `src/middleware.ts` (Next.js 16+ convention). Repo operations use **SSH** (`~/.ssh/id_ed25519_crispygoat`) — no Gitea API token is provisioned in this env, so `tea`/`gitea-mcp`/REST API are unavailable for write operations; PRs are opened by `git push` + clicking the URL the Gitea push hook prints.
+
+## 2026-06: `admin_users` schema — extra columns for create-user flow (migration 0043)
+
+The 0001 schema's `admin_users` table has just `name` plus the role-derived `can_manage_*` columns (`can_manage_orders`, `can_manage_products`, `can_manage_stops`, `can_manage_customers`, `can_manage_wholesale`, `can_manage_billing`, `can_manage_settings`, `can_manage_water_log`, `can_manage_time_tracking`, `can_manage_route_trace`, `can_manage_reports`, `can_manage_communications`).
+
+But `src/actions/admin/users.ts` was written against a richer schema: it INSERTs and SELECTs `display_name`, `phone_number`, `brand_id`, `can_manage_pickup/messages/refunds/users`, `active`, `must_change_password`, `auth_provider`, `auth_subject`, `last_login`. Submitting the create-user form produced `column "display_name" of relation "admin_users" does not exist`.
+
+Migration `db/migrations/0043_admin_users_extra_columns.sql` adds all twelve missing columns (`ADD COLUMN IF NOT EXISTS`, re-runnable). `db/schema/brands.ts`'s Drizzle `adminUsers` definition was extended in lockstep.
+
+**Important**: the four extra `can_manage_*` flags (pickup / messages / refunds / users) are **vestigial** — `getAdminUser()` in `lib/admin-permissions.ts` derives per-user permissions from the role via `permissionsForRole()`, never reads those columns. They exist only so the create-user form's per-user permission toggles persist; they have no runtime authorization effect. Cleanup target: either (a) read them in the role-derived lookup to support real per-user overrides, or (b) drop them from the form.
+
+The `brand_id` column on `admin_users` is a **denormalization** of the `admin_user_brands` link table (which is the source of truth, and is what `getAdminUser()` reads). The action's `getAdminUsers` joins on `au.brand_id` so keeping the column avoids rewriting that SELECT. Future cleanup can drop the denormalized column and migrate the SELECT to join through the link table.
+
+## 2026-06: CI migration failures on re-deploy (0001_init.sql "already exists")
+
+Prod DATABASE_URL already had the schema from the first successful bootstrap.
+The deploy workflow runs `npm run migrate:one` on every push (after neon_auth preflight).
+`scripts/migrate.js` has `_migrations` tracking + skip, but the row for `0001_init.sql` was never recorded (the tracking logic landed after the initial apply, or an apply happened outside the runner).
+
+`db/migrations/0001_init.sql` header *claimed* "CREATE TABLE IF NOT EXISTS" but the actual statements were plain `CREATE TABLE`, plain `CREATE INDEX`, and unguarded `CREATE TRIGGER`.
+
+Result: every subsequent deploy hit `relation "admin_users" already exists` (and would have hit index/trigger dups too) inside the runner's BEGIN, causing ROLLBACK + failure of the whole "Run migrations" job.
+
+### Fixes applied
+- Made `0001_init.sql` truly re-runnable:
+  - All `CREATE TABLE` → `CREATE TABLE IF NOT EXISTS`
+  - All `CREATE INDEX` / `CREATE UNIQUE INDEX` → `... IF NOT EXISTS`
+  - Every `CREATE TRIGGER` wrapped in a `DO $$ IF NOT EXISTS (pg_trigger check) THEN CREATE TRIGGER ... END IF; $$` guard
+  - Removed the file-level `BEGIN; ... COMMIT;` (the runner owns the tx; this also prevents inner-COMMIT from ending the runner tx early).
+- `0002_admin_password.sql` had its tx wrapper removed for consistency (its ALTER was already `IF NOT EXISTS`).
+- Hardened `scripts/migrate.js`:
+  - Added `ensureTracked()` repair: for 0001/0002, if the core objects (admin_users table, or the password_hash column) already exist in the target DB but the tracking row is absent, we INSERT the row (ON CONFLICT DO NOTHING) and skip the file. Logs "repaired tracking".
+- Hardened `.gitea/workflows/deploy.yml` "Run migrations" step:
+  - Added an inline pre-repair node snippet (same idea) right before `npm run migrate:one`. This protects even if an older runner is checked out.
+  - The existing neon_auth preflight + post `admin_users` verification remain as the hard gate.
+- Updated header comments and docs in the files.
+
+After this, `npm run migrate` / deploys on an already-initialized DB will log the "repaired" or "already applied" lines for 0001 and proceed cleanly. The shipped `scripts/migrate.js` + `db/migrations/` on the target server also benefit for emergency recovery runs.
+
+See also the plan doc referenced in deploy.yml for the broader reliability work.
 
 ---
 
-## Supabase CLI + Migrations Tooling
+## 🚨 Direction Pivot (2026-06-06) — Supabase → Postgres
+
+**Status: COMPLETE (2026-06).** All Supabase references removed from the codebase:
+- `supabase/` directory deleted (`config.toml`, `push-migrations.js`, `ADMIN_CREATE_STOP_FIX.sql`, and 137 archived migration files in `supabase/migrations/.archived/` are gone).
+- `@supabase/ssr` and `@supabase/supabase-js` removed from `package.json`.
+- `next.config.ts` no longer whitelists `*.supabase.co` for images; `vercel.json` CSP no longer allows `https://*.supabase.co` in `connect-src`.
+- `eslint.config.mjs` no longer ignores `supabase/**`.
+- All `src/`, `tests/`, and `db/` files are free of `@supabase/*` imports, `rest/v1/` calls, and `*.supabase.co` references.
+- Migrations are now applied by `scripts/migrate.js` (which uses `pg` + `DATABASE_URL`); the Supabase CLI branch is gone with the deleted script.
+
+This section is kept as **historical record** of the cutover. The "Supabase CLI + Migrations Tooling" section further below is also historical.
+
+### Original pivot summary (kept for context)
+The platform moved off Supabase entirely. We connect to **Postgres directly** (via `pg`), with **Neon Auth (Better Auth)** handling authentication. See `CLAUDE.md` for the current architecture.
+
+### What changed at the time
+- **DB connection**: `DATABASE_URL` (with `DATABASE_ADMIN_URL` optional override for DDL) is the only required DB env var. No more `NEXT_PUBLIC_SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, or `SUPABASE_ANON_KEY`.
+- **Migrations**: `scripts/migrate.js` is the canonical runner. It reads `DATABASE_URL` from `.env.local` via `dotenv`, tracks applied files in `_migrations`, and applies any new files in `db/migrations/` in lexical order inside a transaction.
+- **Code**: zero `@supabase/*` imports, zero `rest/v1/` REST fetches, zero Supabase JS client usage. One shared `pg` `Pool` in `src/lib/db.ts`; Drizzle on top of it at `db/client.ts` for typed reads + RLS-style brand scoping.
+- **Auth**: Neon Auth (Better Auth) is the production path. `dev_session` cookie is the local-only bypass.
+- **Storage**: object store migration (S3-compatible) is independent of the Supabase purge and is tracked separately.
+
+### Migration content that's now obsolete
+- **145 (product-images bucket)**: Supabase Storage bucket + RLS policies. Replaced by object store of choice.
+- **Any RLS policy on tables** (200 added several): the "no row-level policies, app-layer scoping" model still holds but the policies are inert in the new world.
+
+### Historical sections below
+The "Supabase CLI + Migrations Tooling" section further down describes the *previous* tooling. It is kept as **historical record** of work that was already applied to the Supabase project. Do **not** follow its CLI instructions — use `scripts/migrate.js` (or `npm run migrate`) instead. Migration-file patch notes (091, 145, 148, 200, 201) are also kept as historical record of what got applied.
+
+---
+
+## Supabase CLI + Migrations Tooling *(SUPERSEDED — see Direction Pivot above; script and CLI are no longer in the repo)*
 
 ### Login + Link (done in this session)
 - User ran `supabase login`
 - We ran: `supabase link --project-ref wnzkhezyhnfzhkhiflrp`
 - Link succeeded. Project appears as **LINKED** (●) in `supabase projects list`.
-- Link state lives under `supabase/.temp/` (project-ref, linked-project.json, pooler-url, etc.). **Not** the legacy `.supabase/config.toml` at project root.
-- This enables `supabase db query --linked`, `supabase migration list`, etc.
+- Link state lived under `supabase/.temp/` (project-ref, linked-project.json, pooler-url, etc.). **Not** the legacy `.supabase/config.toml` at project root.
+- This enabled `supabase db query --linked`, `supabase migration list`, etc.
 
 ### Important Environment Note
 - Direct Postgres connections (`db.wnzkhezyhnfzhkhiflrp.supabase.co:5432` using service role key as password) **do not work** from this workspace:
   - `getaddrinfo ENOTFOUND`
   - IPv6 "network is unreachable" in some cases
 - HTTPS / Supabase REST / Management API work fine.
-- Therefore the `push-migrations.js` **CLI path** (using linked project) is the only reliable way to apply migrations here.
+- Therefore the `push-migrations.js` **CLI path** (using linked project) was the only reliable way to apply migrations here.
 
-### Updated Migration Script
-File: `supabase/push-migrations.js`
+### Migration Script (deleted 2026-06 — use `scripts/migrate.js` instead)
+File: `supabase/push-migrations.js` *(deleted)*
 
-Key changes:
-- Detection logic now recognizes modern link: `supabase/.temp/project-ref` (in addition to old `.supabase/config.toml`).
-- `pushWithCli()` rewritten to apply files one-by-one using:
+Key behavior (historical):
+- Detection logic recognized modern link: `supabase/.temp/project-ref` (in addition to old `.supabase/config.toml`).
+- `pushWithCli()` applied files one-by-one using:
   ```bash
   supabase db query --linked --file "supabase/migrations/NNN_foo.sql"
   ```
   (Previously tried `db push --db-url ...` which used direct connection and failed here.)
-- Falls back to direct `pg` only if CLI path fails.
-- Header comments updated with current recommended workflow.
+- Fell back to direct `pg` only if CLI path failed.
 
-**Recommended commands now:**
+**Historical commands (Supabase CLI path — both scripts are gone):**
 ```bash
+# Supabase CLI path (legacy — script deleted, do not use)
 supabase login
 supabase link --project-ref wnzkhezyhnfzhkhiflrp
-node supabase/push-migrations.js 148          # or any prefix
+node supabase/push-migrations.js 148          # CLI path (script deleted)
 # or
 npm run migrate:one 148
 ```
 
-`npm run migrate` (no arg) will push every `*.sql` in order (use with caution).
+```bash
+# Direct pg path (this was the future — now the only path, via scripts/migrate.js)
+DATABASE_URL=postgres://... npm run migrate:one 148
+```
+
+`npm run migrate` (no arg) pushes every `*.sql` in `db/migrations/` in order (use with caution).
 
 ---
 
@@ -133,12 +211,13 @@ Verification queries (post-apply) confirmed:
 
 ---
 
-## Current State / Gotchas
+## Current State / Gotchas (2026-06)
 
-- `supabase migration list` will show a lot of "pending" because the project's custom numeric migrations (00x_*.sql) were historically applied via the raw-SQL push script, not registered in Supabase's `schema_migrations` tracking table. Only early ones (001/002) + many timestamped migrations from other activity are tracked.
-- Many migrations are intentionally written to be re-runnable. Re-pushing a prefix is the supported workflow for this project.
-- When adding **new** migrations in the future, prefer the standard `supabase migration new` flow if possible, but the custom `push-migrations.js` + numeric prefix style is still the established pattern here.
-- Storage policies, RLS, SECURITY DEFINER functions, and brand-scoped data are all over the place — test carefully after big applies.
+- Use `DATABASE_URL` + `pg` directly (via `scripts/migrate.js`). The Supabase CLI and `supabase/push-migrations.js` are no longer in the repo.
+- `npm run migrate` applies every pending `db/migrations/*.sql` in lexical order inside transactions; `_migrations` tracks which files are already applied.
+- Many migrations are intentionally written to be re-runnable (`CREATE OR REPLACE FUNCTION`, `CREATE TABLE IF NOT EXISTS`, guarded triggers). Re-pushing a prefix is safe.
+- When adding **new** migrations, use the established numeric prefix style (`NNN_descriptive_name.sql`) and place them in `db/migrations/`. No Supabase CLI command is involved.
+- Storage policies (145), RLS policies (200), SECURITY DEFINER functions, and brand-scoped data are still in Postgres — test carefully after big applies. Brand scoping still relies on `p_brand_id` parameters in RPCs (plus the per-request `app.current_brand_id` GUC used by Drizzle).
 - CLAUDE.md already documents the overall migrate story and the `get_brand_settings` gotcha.
 
 ---
@@ -146,6 +225,7 @@ Verification queries (post-apply) confirmed:
 ## How to Use This Memory
 
 - Cat this file at the start of future sessions if context is needed: `cat MEMORY.md`
+- **Read the Direction Pivot section first** — it supersedes the older Supabase-flavored instructions.
 - Update this file with new key facts, applied migrations, or new gotchas.
 - Feel free to add dated sections.
 
@@ -153,9 +233,9 @@ Verification queries (post-apply) confirmed:
 
 ## Unrelated / Other Changes in Tree (as of last git status)
 
-(See `git status --short` and `git diff` for full picture. Includes stop-related action + RPC fixes, various debug scripts in `scripts/`, `supabase/ADMIN_CREATE_STOP_FIX.sql`, a pricing assessment doc, etc.)
+(See `git status --short` and `git diff` for full picture. Includes stop-related action + RPC fixes, various debug scripts in `scripts/`, a pricing assessment doc, etc.)
 
-This MEMORY.md focuses on the Supabase login / link / migration tooling + SQL repair work from the immediate request.
+This MEMORY.md originally focused on the Supabase login / link / migration tooling + SQL repair work from the immediate request. The pivot section now records the completion of the Supabase → Postgres migration.
 
 ---
 
@@ -245,3 +325,274 @@ Follow-up pass on the original Codex review covering public site, buyer path, bi
 ### Migration 203 — applied via Supabase CLI
 
 `203_plan_usage_active_products.sql` updates `get_brand_plan_info` to count `products` where `active = true AND deleted_at IS NULL`, matching the dashboard's "Active Products" stat. The `NOTIFY pgrst, 'reload schema'` ensures PostgREST picks up the change without restart.
+
+## Gitea build fix — 2026-06-06
+
+Gitea runner (`https://git.crispygoat.com/tyler/route-commerce.git`, branch `main`) was failing `next build` with two errors:
+
+1. **DYNAMIC_SERVER_USAGE** on `/admin/settings/square-sync` (and the whole admin tree): `getAdminUser()` reads `cookies()` via `next/headers`. The admin layout tried to prerender statically, so the first child page that hit cookies aborted the build.
+2. **Prerender ECONNREFUSED** on `/indian-river-direct/stops`: `getPublicStopsForBrand` / `getActiveStopsForSitemap` / `getBrandSettingsPublic` fetch `NEXT_PUBLIC_SUPABASE_URL` at build time. The Gitea runner passes a Supabase URL that resolves but is unreachable, so `fetch` throws `ECONNREFUSED` and the prerender aborts.
+
+The earlier commit `2f3be54 fix(actions): skip Supabase fetch at build time when env vars unset` only added `if (!supabaseUrl || !supabaseKey) return [];` — but in CI the env vars **are** set, so the guard passed and the fetch was still attempted.
+
+### Fixes applied
+
+- `src/actions/stops.ts` — wrapped `getActiveStopsForSitemap` and `getPublicStopsForBrand` fetches in `try/catch` returning `[]` on error. Env-var guard kept as fast path.
+- `src/actions/brand-settings.ts` — wrapped `getBrandSettingsPublic` fetch in `try/catch` returning `{ success: false }` on error.
+- `src/app/admin/settings/square-sync/page.tsx` — added `export const dynamic = "force-dynamic";` (was missing).
+- `src/app/admin/layout.tsx` — added `export const dynamic = "force-dynamic";` so the entire admin tree opts out of static prerender (layout calls `getAdminUser()` which reads cookies).
+- `.gitea/workflows/deploy.yml` was simplified earlier in commit `2d837bc` to a thin wrapper around `deploy/deploy.sh`.
+
+### Remote
+
+- The crispygoat repo (`git@git.crispygoat.com:tyler/route-commerce.git`) and the GitHub `origin` repo are separate forks — `tyler/main` is the self-hosted Auth.js + Postgres branch, `origin/main` is the Supabase branch. Don't merge them; they share no deploy workflow.
+- Push targets `tyler/main` to trigger the Gitea build.
+
+## Build green — 2026-06-06
+
+Push `32396af` to `origin/main` triggered a successful Gitea deploy. Fixes that landed:
+- `force-dynamic` on `src/app/admin/layout.tsx` + `src/app/admin/settings/square-sync/page.tsx`
+- try/catch around Supabase REST fetches in `src/actions/stops.ts` and `src/actions/brand-settings.ts`
+- `.gitea/workflows/deploy.yml` paths updated to `deploy/docker-compose.yml`
+
+## Production prep — next steps
+
+1. **Verify the stack is actually running.** SSH to the deploy host, `docker compose -p prod-app ps` in `$APP_DIR` (`/home/tyler/route-commerce`). All services should be `healthy`.
+2. **Test Postgres connectivity.** `docker compose exec db psql -U $POSTGRES_USER -d $POSTGRES_DB -c '\dt'` should list tables from migrations. `curl http://localhost:$POSTGREST_HOST_PORT/` should return PostgREST's OpenAPI spec.
+3. **Test app → PostgREST.** Hit any public page that reads from PostgREST (e.g. `/indian-river-direct/stops` after the revalidate window). If it returns stops, the chain works.
+4. **Replace dummy secrets** in Gitea:
+   - `NEXT_PUBLIC_SUPABASE_URL=http://localhost:54321` + `NEXT_PUBLIC_SUPABASE_ANON_KEY=dummy-supabase-anon-ke` — either set real Supabase project values, or remove entirely once the Postgres-direct migration is complete (CLAUDE.md direction).
+   - `RESEND_API_KEY=re_REPLACE_ME`, `RESEND_WEBHOOK_SECRET=whsec_REPLACE_ME` — get real values from Resend dashboard.
+   - `STRIPE_SECRET_KEY=sk_test_REPLACE_ME`, `STRIPE_PUBLISHABLE_KEY=pk_test_REPLACE_ME`, `STRIPE_WEBHOOK_SECRET=whsec_REPLACE_ME` — real test-mode values from Stripe.
+5. **Supabase → direct Postgres migration.** The codebase still imports `@supabase/ssr` and `@supabase/supabase-js` in `src/lib/supabase.ts`, `src/lib/supabase/server.ts`, `src/actions/login.ts`, `src/actions/admin/users.ts`, `src/actions/admin/force-login.ts`, `src/actions/wholesale-auth.ts`. CLAUDE.md says these should be purged. The deploy stack already has PostgREST, so the path is: replace `supabase.from(...)` calls with `fetch` to `NEXT_PUBLIC_API_URL/rest/v1/...` or direct `pg` queries, then drop the `@supabase/*` deps.
+6. **Auth.js hardening.** `AUTH_GOOGLE_ID` / `AUTH_GOOGLE_SECRET` aren't in the secret list — the workflow falls back to `BETTER_AUTH_*` names which exist. Set the canonical `AUTH_*` names too so the fallback isn't load-bearing.
+
+## Login flow consolidated — 2026-06-06
+
+Push `e499139` fixes the "dev login redirects back to /login" bug and
+removes the three-mode login page.
+
+**Root cause:** `src/middleware.ts` didn't exist, so the `authorized`
+callback in `auth.config.ts` never ran at the edge. The demo buttons at
+`/login?demo=1` set `dev_session` via `document.cookie`, but nothing at
+the edge recognized the cookie — the admin layout's `getAdminUser()` was
+the only thing reading it, and if the layout's `force-dynamic` ever
+stopped applying, the user would be bounced.
+
+**Fix:**
+- **New `src/middleware.ts`** — plain middleware (NOT the `auth()`
+  wrapper). Gates `/admin/*` and `/login`:
+  - If `dev_session`, `rc_auth_uid`, or `rc_uid` cookie is present →
+    `NextResponse.next()`.
+  - If no auth cookie, on `/admin/*`, and `ALLOW_DEV_LOGIN !== "false"`
+    (on by default) → set `dev_session=platform_admin` cookie and
+    `NextResponse.next()`. Invisible auto-login.
+  - If no auth and dev disabled → redirect to `/login`.
+  - If authenticated and on `/login` → redirect to `/admin`.
+- **`src/app/login/LoginClient.tsx`** — stripped to a single Google
+  OAuth button. Removed:
+  - Email/password form (was hitting dummy Supabase and 500'ing).
+  - Dev credentials form (`signInWithDev`).
+  - `DemoMode` component with the three buttons (Platform Admin,
+    Brand Admin, Store Employee).
+  - `useState`/`useEffect`/`useCallback`/`useSearchParams`/`Suspense`
+    — none of that complexity is needed for a single button.
+- **`src/actions/auth-signin.ts`** — removed `signInWithDev`. Kept
+  `signInWithGoogle` and `signOutAction`.
+- **Deleted `src/app/dev-login/page.tsx`** and
+  **`src/app/api/dev-login/route.ts`** — dead routes, middleware
+  handles it.
+
+**What "one way to log in" looks like now:**
+- Dev/demo: visit `/admin` → middleware sets `dev_session` cookie →
+  `getAdminUser()` returns platform_admin → you're in.
+- Production: visit `/admin` → no cookie, `ALLOW_DEV_LOGIN=false` →
+  redirect to `/login` → click Google → Auth.js OAuth flow.
+
+**Note for Auth.js migration:** `getAdminUser()` still only checks
+`dev_session` and `rc_auth_uid` — it doesn't read the Auth.js JWT.
+After Google sign-in succeeds, the user has a valid Auth.js session
+but `getAdminUser()` returns null. The middleware can't fix that
+because it can't write to the JWT without going through the
+credentials provider. This is the next piece of the Auth.js migration
+(see CLAUDE.md "Auth.js migration — in progress"). The current fix
+gets the dev/demo path working; the Google OAuth → admin path needs
+the `getAdminUser()` Auth.js check wired up.
+
+## Auth.js v5 wiring complete — 2026-06-06
+
+Push `1e9f9c0` completes the Auth.js path so Google sign-in lands the
+user on `/admin` as a real admin (not "Your account does not have
+admin access").
+
+**What landed:**
+
+- **`src/lib/db.ts` (NEW)** — shared `pg.Pool` singleton. The single
+  connection pool for the whole app. Extracted from `src/lib/auth.ts`
+  (which had its own private pool). Connection string resolution:
+  `DATABASE_URL` → `SUPABASE_DB_URL` → `POSTGRES_URL`.
+
+- **`src/lib/auth.ts`** — imports the shared pool. The `signIn` event
+  now calls the new `upsert_admin_user_for_authjs` RPC instead of
+  the no-op existence check it had before.
+
+- **`supabase/migrations/209_authjs_auto_create_admin.sql` (NEW)** —
+  pushed automatically by the deploy workflow (line 130 of
+  `.gitea/workflows/deploy.yml` does `cat supabase/migrations/[0-9]*.sql
+  | $PG`). Contains:
+  - `ALTER TABLE admin_users ADD COLUMN IF NOT EXISTS
+    can_manage_settings BOOLEAN NOT NULL DEFAULT false` — defensive,
+    since this column is in the TypeScript `AdminUser` type but not
+    in any tracked migration (was likely dashboard-added).
+  - SECURITY DEFINER RPC `upsert_admin_user_for_authjs(p_user_id UUID)`
+    that inserts a `platform_admin` row with all `can_manage_*` flags
+    true, `ON CONFLICT (user_id) DO NOTHING`.
+  - `NOTIFY pgrst, 'reload schema'` so PostgREST picks up the new RPC.
+
+- **`src/lib/admin-permissions.ts`** — new Auth.js session check
+  between `dev_session` and `rc_auth_uid`. Uses `auth()` from
+  `@/lib/auth` to decrypt the JWT cookie server-side, then
+  `getAdminUserFromPool()` queries `admin_users` + `admin_user_brands`
+  via the shared pool. The legacy `rc_auth_uid` path is unchanged
+  (deferred — it still hits the dummy Supabase URL in prod).
+
+- **`src/middleware.ts`** — recognizes `authjs.session-token` and
+  `__Secure-authjs.session-token` cookies at the edge so signed-in
+  users aren't bounced to `/login`.
+
+**Key insight: same ID space.** Both `admin_users.user_id` (UUID, per
+`028_fix_caller_uid_type.sql`) and Auth.js `users.id` (UUID, per
+`204_authjs_tables.sql:18`) are in the same UUID space. The
+`@auth/pg-adapter` auto-generates a fresh UUID per new user on first
+sign-in; the Google `sub` claim is stored separately in
+`accounts."providerAccountId"`. So no schema change was needed —
+just a `user_id` lookup in `getAdminUserFromPool()`.
+
+**Full sign-in flow now:**
+
+1. Dev/demo: visit `/admin` → middleware auto-issues `dev_session`
+   cookie → `getAdminUser()` returns platform_admin. (No DB call.)
+2. Production: click "Sign in with Google" → Auth.js OAuth →
+   `signIn` event fires → `upsert_admin_user_for_authjs` creates
+   the `admin_users` row → redirect to `/admin` → `getAdminUser()`
+   reads JWT, queries pool via `auth.js.user.id`, returns
+   platform_admin.
+
+**What's still broken (out of scope for this push):**
+
+- Legacy `rc_auth_uid` path in `getAdminUser()` still fetches from
+  `${NEXT_PUBLIC_SUPABASE_URL}/rest/v1/...` which is a dummy
+  `http://localhost:54321` in prod. Any pre-existing user with a
+  `rc_auth_uid` cookie will get null. Defer until the Supabase →
+  direct Postgres migration of the REST calls.
+- `getCurrentAdminUser` (client-side variant) still reads from
+  server-passed props — no change needed.
+- The `signIn` event RPC call will fail silently if `DATABASE_URL`
+  is not set. The user would see "Your account does not have admin
+  access" and need to sign out and back in once the env is fixed.
+
+## Deploy fix — PostgREST env + dead nextjs service — 2026-06-06
+
+Push `2d55791` fixes two issues that broke the "Start Docker stack" step:
+
+1. **`PGRST_DB_URI` not set** — the env var was only in the "Deploy"
+   step's env, which runs after PostgREST has already started.
+   PostgREST booted with a blank DB URI. Now set in the "Start
+   Docker stack" step's env and written to `$APP_DIR/.env` (the
+   file docker compose auto-loads).
+
+2. **`docker-compose.yml` had a dead `nextjs` service** with
+   `env_file: ../.env.production`. That file is written by the
+   "Deploy" step (later in the workflow), so at "Start Docker stack"
+   time the path doesn't exist. `docker compose up` validates the
+   whole compose file and bailed.
+
+   The `nextjs` service is dead code anyway — PM2 runs Next.js
+   directly from `$APP_DIR`, never through docker. Removed it.
+
+**Other fixes in the same push:**
+
+- `docker compose up -d db postgrest minio minio_init` referenced
+  services that don't exist in the compose file. Postgres runs on
+  the host (the migrations step uses `psql -h 127.0.0.1`), not in
+  docker. Changed to just `postgrest`.
+
+- The `pg_isready` check was `docker compose exec -T db pg_isready`.
+  Since `db` is a host service, changed to
+  `PGPASSWORD=... psql -h 127.0.0.1 -U ... -d ... -c "SELECT 1"`.
+
+**Architecture (now consistent):**
+
+- Postgres: host (127.0.0.1:5432), migrations via `psql -h 127.0.0.1`
+- PostgREST: docker, connects to host Postgres via `PGRST_DB_URI`
+- Next.js: host, PM2 process, reads `DATABASE_URL` from `.env.production`
+- MinIO: not yet wired up (the `MINIO_ROOT_USER`/`PASSWORD` env vars
+  are written to `.env` but no service consumes them yet — add a
+  `minio` service to docker-compose.yml when storage goes live)
+
+---
+
+# 2026-06-07 — Full Supabase → Drizzle/pg migration complete
+
+**Status: ALL 114 FILES MIGRATED. ZERO @supabase IMPORTS. ZERO rest/v1 CALLS.**
+
+## Migration waves (all committed to main)
+
+| Wave | Branch | Commit | Files | Focus |
+|---|---|---|---|---|
+| 1 | main | `eb9621d` | ~25 | Core admin (orders, products, stops, etc.) |
+| 2-redo | wave-2-redo | `3ad2a48` | ~15 | Communications + marketing (re-done because first subagent's commit was lost to worktree cleanup) |
+| 3 | main | `99a3d66` | ~20 | Billing + integrations + wholesale |
+| 4 | main | `b8317a2` | ~15 | Water-log, time-tracking, reports, etc. |
+| 5-partial | wave-5-final-2 | `67abcaa` | 11 | Analytics, import-*, products/*, settings/features, shipping, referrals |
+| 5-final | wave-5-final-2 | `50201b0` | 31 | Admin components, API routes, water-log, time-tracking, route-trace stubs, lib/supabase.ts (rewritten as pure mock), lib/supabase/server.ts (deleted), api/supabase/route.ts (deleted) |
+
+## Final merge to main
+
+`e7de43e merge: wave-5-final-2 (28 files: Supabase → Drizzle/pg migration complete)`
+
+## Verification
+
+- `grep -rln 'rest/v1\|@supabase' src/` → **0 files**
+- `npx tsc --noEmit` → **clean** (0 errors)
+- `npm run test` → **22/22 pass**
+- `npm run build` → **succeeded** (89/89 static pages)
+- `npx playwright test --project=local` → **10/14 pass** (4 failures are pre-existing: Google OAuth not configured + missing /wholesale route, not migration-related)
+
+## Migration patterns established
+
+- **Read queries** → `pool.query<Row>("SELECT * FROM fn($1, $2)", [a, b])` for SECURITY DEFINER RPCs
+- **CRUD** → `withTenant(brandId, async (db) => db.select().from(table).where(eq(table.tenantId, brandId)))` for tenant-scoped reads
+- **Writes** → `withTx(async (tx) => { ... })` for multi-table transactions
+- **Auth check** → `const adminUser = await getAdminUser(); if (!adminUser) return ...`
+- **Brand scoping** → `effectiveBrandId = brandId ?? adminUser.brand_id ?? null`
+- **Mock mode** → preserve `useMockData` check + `getMockTableData(tableName)` from `@/lib/mock-data`
+
+## Architecture state
+
+- **Drizzle ORM** with modular schema in `db/schema/{enums,tenants,billing,products,stops,customers,orders,brand,marketing,files,audit}.ts`
+- **Postgres + RLS** with `withTenant()` setting `app.current_tenant_id` GUC
+- **Auth.js v5** (next-auth@5.0.0-beta.31) with Google OAuth + Credentials providers
+- **`src/lib/db.ts`** — shared `pg.Pool` (server-only, lazy)
+- **`db/client.ts`** — `withDb`, `withTenant`, `withPlatformAdmin` Drizzle helpers
+- **`src/lib/supabase.ts`** — rewrote as pure mock (no @supabase/* imports) for the ~25 legacy consumers that still use the query-builder API; can be removed when those consumers migrate to Drizzle
+- **`src/lib/supabase/server.ts`** — DELETED
+- **`src/app/api/supabase/route.ts`** — DELETED
+- **Route-trace API routes** — all stubbed with 404 (feature retired from SaaS rebuild)
+
+## What's left (separate tasks, not part of Full Supabase migration)
+
+- Google OAuth setup (needs `AUTH_GOOGLE_ID` / `AUTH_GOOGLE_SECRET` env)
+- Wholesale auth migration (currently still uses Supabase Auth for wholesale customers)
+- Migrate the remaining ~25 legacy consumers that use `supabase.from('table').select()` API (these still work via the mock rewrite, but should be Drizzle-ified)
+- Add `email` column to `admin_users` and provision Google users by email
+- Switch `getAdminUser()` to direct `pg` lookup (not REST)
+- Remove the email/password (Supabase) provider when Supabase auth is fully cut over
+- Remove `DEV_FORCE_UID` constant and dead branches in `actions/admin/users.ts`
+
+## Pushed to remotes
+
+- `crispygoat/main` (the SSH remote at git.crispygoat.com) — primary target
+- `origin/main` (GitHub) — for backup visibility
+- 36 commits ahead of `origin/main` as of this entry
+

PRODUCTION_DEPLOYMENT_CHECKLIST.md

@@ -1,47 +1,38 @@
 # Route Commerce — Production Deployment Checklist
 
-**Platform Version:** 1.6
-**Last Updated:** 2026-05-13
-**Environment:** Next.js 16 (App Router) · Supabase · Stripe · Square · Resend · FedEx
+**Platform Version:** 2.0
+**Last Updated:** 2026-06-25
+**Environment:** Next.js 16 (App Router) · Postgres (direct via `pg`) · Neon Auth (Better Auth) · Stripe · Square · Resend · FedEx
 
 ---
 
 ## 1. Migration Order
 
-Apply migrations in number order. All numbered `001`–`092` are required.
+Apply migrations in number order. The full set lives in `db/migrations/`:
 
 ```bash
-# Push all migrations (sequential)
-npm run migrate:one 001
-npm run migrate:one 002
-# ... through ...
-npm run migrate:one 092
-
-# Or push all at once via Supabase CLI
-supabase db push
+# Push all migrations (idempotent — `_migrations` table tracks what's applied)
+npm run migrate
 ```
 
-**Key migrations (last 15):**
+The current migration set is consolidated (the Supabase-era 001–092 series was collapsed into `0001_init.sql` plus a handful of incremental files). If `db/migrations/` is empty after the Supabase → Postgres migration, see `MEMORY.md` "Direction Pivot" for the cutover notes.
+
+**Current migrations in `db/migrations/`:**
 
 | # | File | Purpose |
 |---|------|---------|
-| 078 | `wholesale_deposit_guard.sql` | Adds `amount`, `payment_method` to `wholesale_deposits` |
-| 079 | `resend_analytics.sql` | Adds Resend webhook endpoint + analytics tables |
-| 080 | `communication_segments.sql` | Adds `communication_segments` table |
-| 081 | `stop_blast_campaign.sql` | Adds `stop_blast_campaign` RPC |
-| 082 | `brand_name_in_campaign_email.sql` | Adds `brand_name` column to `communication_campaigns` |
-| 083 | `shipping_settings.sql` | Adds `shipping_settings` table |
-| 084 | `shipments.sql` | Adds `shipments` table for FedEx tracking |
-| 085 | `brand_settings.sql` | Adds `brand_settings` table (core) |
-| 086 | `brand_settings_email_integration.sql` | Adds email/webhook fields to `brand_settings` |
-| 087 | `brand_logos_bucket.sql` | Adds `brand-logos` storage bucket |
-| 088 | `brand_features.sql` | Adds `brand_features` table + RPCs for add-on system |
-| 089 | `ai_providers_custom_integrations.sql` | Adds AI provider credentials storage |
-| 090 | `storefront_settings.sql` | Adds storefront customization fields + `get_brand_settings_by_slug` RPC |
-| 091 | `091_brand_plan_tier.sql` | Adds `plan_tier`, limits, `stripe_customer_id`, `get_brand_plan_info` RPC |
-| 092 | `092_stripe_subscriptions.sql` | Adds `stripe_subscription_id/status/current_period_end`, `set_brand_subscription`, `get_brand_subscription` RPCs |
+| 0000 | `0000_qa_neon_auth_stub.sql` | QA-only stub for `neon_auth` schema (real provisioning via Neon Auth in prod) |
+| 0001 | `0001_init.sql` | Core schema: brands, products, orders, stops, customers, communication tables, water log, time tracking, RPCs, indexes, triggers. Fully re-runnable (`IF NOT EXISTS` + trigger guards). |
+| 0002 | `0002_admin_password.sql` | Adds `password_hash` column to `admin_users` |
+| 0003 | `0003_tour_rpc_functions.sql` | RPCs for tour/stop planning |
+| 0040 | `0040_command_center.sql` | Adds command-center dashboard tables |
+| 0041 | `0041_command_center_schema_fix.sql` | Schema fixup for command-center |
+| 0042 | `0042_drop_command_center.sql` | Drops command-center (rolled back) |
+| 0043 | `0043_admin_users_extra_columns.sql` | Adds `display_name`, `phone_number`, `brand_id`, `can_manage_pickup/messages/refunds/users`, `active`, `must_change_password`, `auth_provider`, `auth_subject`, `last_login` columns to `admin_users` |
+| 0090 | `0090_water_log_completion.sql` | Completes water-log tables/RPCs |
+| 0091 | `0091_dashboard_summary_rpc.sql` | `dashboard_summary` RPC for admin dashboard |
 
-> **Note:** Migration 092 adds Stripe subscription tracking. Migration 091 adds plan tier billing. Apply both before deploying billing changes.
+> **Note:** The migration runner (`scripts/migrate.js`) tracks applied files in `_migrations` and skips already-applied files. `0001_init.sql` is fully re-runnable, so it is safe to re-apply on a DB that was initialized outside the runner. Stripe subscription tracking, plan-tier billing, brand settings, etc. are all part of `0001_init.sql` — they were originally separate Supabase-era migrations that were consolidated.
 
 ---
 
@@ -53,10 +44,11 @@ Copy `.env.local.example` to `.env.local` and fill in all values.
 
 | Variable | Required | Description |
 |---|---|---|
-| `NEXT_PUBLIC_SUPABASE_URL` | Yes | Supabase project URL (e.g., `https://xxx.supabase.co`) |
-| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Yes | Supabase anon/public key (safe to expose in browser) |
-| `SUPABASE_SERVICE_ROLE_KEY` | Yes | Supabase service role key — **never expose in browser**, server-side only |
-| `SUPABASE_PAT` | Yes | Supabase Personal Access Token for migrations CLI |
+| `DATABASE_URL` | Yes | Postgres connection string (e.g., `postgresql://user:pass@host:5432/dbname?sslmode=require`) |
+| `DATABASE_ADMIN_URL` | No | Direct (non-pooled) Postgres connection with elevated perms. Only used by `scripts/migrate.js` for DDL — falls back to `DATABASE_URL` if unset. |
+| `NEON_AUTH_BASE_URL` | Yes | Neon Auth (Better Auth) base URL |
+| `NEON_AUTH_COOKIE_SECRET` | Yes | Neon Auth session cookie signing secret (min 32 chars) |
+| `NEXT_PUBLIC_SITE_URL` | Yes | Public site URL used for auth redirects and Origin header |
 
 ### Payments
 
@@ -198,17 +190,13 @@ For scheduled tasks (stop reminders, campaign sends), add to `vercel.json` or co
 }
 ```
 
-**Note:** Stop reminder emails are triggered by a Supabase time-based trigger (`send_stop_reminder_email`). Verify the trigger is active:
-```sql
-SELECT * FROM pg_publication_tables WHERE tablename = 'stops';
-```
-If not, recreate: `ALTER PUBLICATION supabase_realtime PUBLISH INSERT, UPDATE ON TABLE stops;`
+**Note:** Stop reminder emails are fired by Vercel cron jobs (`/api/cron/send-stop-reminders`), not by a database trigger. Verify the cron is configured in `vercel.json` (or Vercel Dashboard → Project → Cron Jobs).
 
 ---
 
 ## 5. Feature Flag Enablement (Post-Deploy)
 
-After deployment, enable add-ons per brand via the admin UI or Supabase SQL:
+After deployment, enable add-ons per brand via the admin UI or direct Postgres:
 
 ```sql
 -- Enable Harvest Reach for a brand
@@ -302,13 +290,13 @@ Vercel keeps 10 recent deployments. For critical regressions, promote the previo
 
 ### Database Rollback
 ```bash
-# Revert last migration via Supabase
-supabase db reset --backup-id <backup-before-migration>
+# Revert last migration via Postgres
+# (Restore from a `pg_dump` snapshot taken before the migration was applied)
 
 # Or manually revert (example for migration 090)
 psql $DATABASE_URL -c "ALTER TABLE brand_settings DROP COLUMN IF EXISTS schedule_pdf_notes;"
 ```
-> **Important:** Only use `supabase db reset` on staging. In production, manually revert individual migrations to avoid data loss.
+> **Important:** Always restore from a known-good backup. In production, manually revert individual migrations to avoid data loss.
 
 ### Environment Variable Rollback
 Environment variables are version-controlled in Vercel. Restore a previous version in **Vercel Dashboard → Project → Environment Variables → History**.
@@ -318,16 +306,16 @@ Environment variables are version-controlled in Vercel. Restore a previous versi
 ## 8. Known Limitations & Future Work
 
 ### Known Issues
-- **`dev_session` auth**: The `dev_session` cookie bypasses real Supabase auth. In production, ensure no `dev_session` cookie exists for regular users. The auth bypass only works when `NODE_ENV !== "production"`.
+- **`dev_session` auth**: The `dev_session` cookie bypasses real Neon Auth (Better Auth). In production, ensure no `dev_session` cookie exists for regular users. The auth bypass only works when `NODE_ENV !== "production"`.
 - **Water Log visible to all brand admins**: Currently Tuxedo-only by brand ID check. If another brand admin needs access, the check needs to be made configurable.
-- **Communications tables (no RLS)**: `communication_campaigns`, `communication_templates`, `communication_contacts`, `communication_message_logs` have RLS disabled. All data access is through SECURITY DEFINER RPCs. Do not expose these tables via direct Supabase queries.
+- **Communications tables (no RLS)**: `communication_campaigns`, `communication_templates`, `communication_contacts`, `communication_message_logs` have no row-level policies. All data access is through SECURITY DEFINER RPCs. Do not expose these tables via direct SQL from client-side code.
 - **`event_id` not populated in message logs**: `send_campaign` and `send_stop_blast` do not set `event_id`. The Resend webhook looks up logs by `customer_email + subject` instead. This is a known limitation — if Resend events are delayed, the lookup may fail to match.
 - **Square sync is one-directional**: Products import from Square → Route Commerce, but product edits in Route Commerce do not push back to Square.
 - **SMS opt-in defaults to `FALSE`**: `communication_contacts.sms_opt_in` defaults to `false`. Users must explicitly opt in for SMS campaigns.
 - **`brand_id: null` for platform admins**: `getAdminUser()` returns `brand_id: null` for `platform_admin` role. Always pass explicit `brandId` to server action functions.
 - **Square webhook signature mismatch**: The Square webhook handler uses `crypto.createHmac("sha256", signatureKey)` but Square sends the signature as base64-encoded. Verify signature encoding matches Square's documentation before enabling Square webhooks in production.
 - **Stripe webhook reliability**: Stripe webhook delivery is not guaranteed to be in-order or immediate. The webhook handler is idempotent — it can safely receive duplicate events. Consider implementing a webhook event log table to track processed event IDs for deduplication.
-- **`NO_RLS` communications tables**: All communications data is accessible via SECURITY DEFINER RPCs only — never expose direct Supabase queries to these tables in client-side code.
+- **`NO_RLS` communications tables**: All communications data is accessible via SECURITY DEFINER RPCs only — never expose direct SQL to these tables in client-side code.
 
 ### Future Work (Non-Blocking)
 - **Cursor-based pagination**: Replace offset-based pagination (`page * limit`) with cursor-based pagination for large datasets (orders, contacts)
@@ -344,11 +332,9 @@ Environment variables are version-controlled in Vercel. Restore a previous versi
 
 | Role | Contact |
 |------|---------|
-| Platform Admin | Set via Supabase Auth dashboard |
+| Platform Admin | First Neon Auth user becomes the platform admin via `provision-admin.ts` |
 | Kyle Martinez | Primary contact — Route Commerce owner |
-| Supabase Support | supabase.com/support |
+| Neon Support | neon.tech/support |
 | Vercel Support | vercel.com/support |
 
-For Vercel production incidents: **vercel.com/deployments** → find deployment → "Support" button.
-
-For Supabase production incidents: **supabase.com/dashboard** → project → "Support" tab.
+For Vercel production incidents: **vercel.com/deployments** → find deployment → "Support" button.

PRODUCTION_SETUP.md

@@ -15,16 +15,16 @@ npm run dev
 
 ## Configuration
 
-### 1. Clerk Authentication
+### 1. Neon Auth (Better Auth)
 
-1. Sign up at [Clerk](https://clerk.com)
-2. Create a new application
-3. Copy keys to `.env.local`:
+1. Set up Neon Auth on your Neon project (`neonctl neon-auth init`)
+2. Copy keys to `.env.local`:
    ```
-   NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_xxx
-   CLERK_SECRET_KEY=sk_test_xxx
+   NEON_AUTH_BASE_URL=https://xxx.neonauth.io
+   NEON_AUTH_COOKIE_SECRET=<openssl rand -base64 32>
+   NEXT_PUBLIC_SITE_URL=https://yourdomain.com
    ```
-4. Configure middleware in `src/proxy.ts`
+3. Configure middleware in `src/proxy.ts`
 
 ### 2. Stripe Payments
 
@@ -37,15 +37,15 @@ npm run dev
    STRIPE_WEBHOOK_SECRET=whsec_xxx
    ```
 
-### 3. Supabase Database
+### 3. Database (Postgres / Neon)
 
-1. Create project at [Supabase](https://supabase.com)
+The app talks to Postgres directly via `pg` (no Supabase, no REST gateway). Point `DATABASE_URL` at any reachable Postgres — Neon, Supabase (the underlying Postgres), RDS, etc. The Supabase JS client and PostgREST are not used.
+
+1. Provision a Postgres database (Neon recommended — it also hosts Neon Auth)
 2. Run migrations: `npm run migrate`
 3. Update `.env.local` with:
    ```
-   NEXT_PUBLIC_SUPABASE_URL=https://xxx.supabase.co
-   NEXT_PUBLIC_SUPABASE_ANON_KEY=xxx
-   SUPABASE_SERVICE_ROLE_KEY=xxx
+   DATABASE_URL=postgresql://user:pass@host:5432/dbname?sslmode=require
    ```
 
 ### 4. Optional Services
@@ -74,7 +74,7 @@ Ensure environment variables are set before deployment.
 
 ## Key Files
 
-- `src/proxy.ts` - Clerk middleware
+- `src/proxy.ts` - Neon Auth (Better Auth) middleware
 - `src/lib/stripe-billing.ts` - Stripe integration
 - `src/lib/analytics.ts` - PostHog analytics
 - `src/lib/sentry.ts` - Sentry error tracking
@@ -82,7 +82,7 @@ Ensure environment variables are set before deployment.
 - `src/components/onboarding/OnboardingFlow.tsx` - User onboarding
 - `src/components/referral/ReferralSystem.tsx` - Referral tracking
 - `src/components/changelog/ChangelogFeed.tsx` - Product updates
-- `supabase/migrations/` - Database schema
+- `db/migrations/` - Database schema (applied via `scripts/migrate.js`)
 
 ## Scripts
 

README.md

@@ -1,6 +1,6 @@
 # Route Commerce
 
-A multi-tenant B2B e-commerce platform for fresh produce wholesale distribution. Brands manage products, stops, orders, and wholesale customers from a single admin dashboard. 🚀
+A multi-tenant B2B e-commerce platform for fresh produce wholesale distribution. Brands manage products, stops, orders, and wholesale customers from a single admin dashboard.
 
 ## What It Does
 
@@ -17,7 +17,7 @@ Route Commerce helps produce brands run their wholesale operations:
 ## Tech Stack
 
 - **Framework:** Next.js 16 (App Router)
-- **Database:** Supabase (Postgres + Auth + RLS)
+- **Database:** Postgres (direct via `pg` + Drizzle) with Neon Auth (Better Auth)
 - **Payments:** Stripe + Square
 - **Email/SMS:** Resend
 - **Styling:** Tailwind CSS v4
@@ -37,10 +37,8 @@ npm install
 Create a `.env.local` file with:
 
 ```bash
-# Supabase
-NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
-NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
-SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
+# Database (Postgres)
+DATABASE_URL=postgresql://user:pass@host:5432/dbname?sslmode=require
 
 # Stripe
 STRIPE_SECRET_KEY=sk_test_...
@@ -56,10 +54,9 @@ RESEND_API_KEY=re_...
 
 ### 3. Set up the database
 
-Link your Supabase project, then push migrations:
+The migrations live in `db/migrations/` and are applied via the `pg` driver (no Supabase CLI):
 
 ```bash
-supabase link --project-ref <your-project-ref>
 npm run migrate
 ```
 
@@ -75,7 +72,7 @@ npm run migrate:one 83
 npm run dev
 ```
 
-Open [http://localhost:3000](http://localhost:3000). The dev server auto-runs `fix-agents.js` to patch Next.js App Router agent issues.
+Open [http://localhost:4000](http://localhost:4000). The dev server auto-runs `fix-agents.js` to patch Next.js App Router agent issues. (The dev script binds to `0.0.0.0:4000`; override with `npm run dev -- -p <port>` if you need a different port.)
 
 ### 5. Dev auth bypass
 
@@ -111,7 +108,7 @@ src/
 │   ├── admin/       # Admin-specific components
 │   └── storefront/  # Storefront components
 └── lib/             # Utilities, auth, feature flags, formatting
-supabase/
+db/
 └── migrations/      # SQL migrations (numbered sequentially)
 ```
 
@@ -171,7 +168,7 @@ The admin dashboard lives at `/admin`:
 - **Communications** — Harvest Reach campaign manager
 - **Wholesale** — Wholesale portal settings
 - **Billing** — Plan and subscription management
-- **Water Log** — Irrigation tracking (add-on)
+- **Water Log** — Irrigation tracking (add-on) — see [docs/water-log.md](docs/water-log.md)
 - **Settings** — Brand settings, payments, apps
 
 ## Email Automations (Harvest Reach)
@@ -253,7 +250,7 @@ CRON_SECRET=...                # Bearer token to secure cron endpoints (generate
 
 ```bash
 # Run abandoned cart with verbose output
-curl -X POST http://localhost:3000/api/email-automation/abandoned-cart \
+curl -X POST http://localhost:4000/api/email-automation/abandoned-cart \
   -H "Authorization: Bearer local-dev-secret" \
   -H "Content-Type: application/json"
 
@@ -315,8 +312,8 @@ curl -X POST https://route-commerce-platform.vercel.app/api/email-automation/wel
 
 ## Notes
 
-- All database writes go through **server actions** (`src/actions/`), not the Supabase JS client directly
-- Dev mode bypasses Supabase auth via `dev_session` cookie — never use this in production
+- All database writes go through **server actions** (`src/actions/`) over a shared `pg` `Pool` from `src/lib/db.ts` — no Supabase JS client, no REST gateway
+- Dev mode bypasses Neon Auth via `dev_session` cookie — never use this in production
 - Brand-scoped data is enforced at the application layer via `p_brand_id` parameters in SECURITY DEFINER RPCs
 - Display dates use `formatDate()` (MM/DD/YYYY) — never raw `toLocaleDateString()`
 - Migration files are numbered sequentially — never reuse numbers

REPORT.md

@@ -0,0 +1,215 @@
+# YOLO Auth Migration — Final Report
+
+**Date:** 2026-06-06 → 2026-06-07
+**Mission:** Stand up a working Auth.js v5 + Google sign-in flow, then rip out
+all Supabase references from the auth/admin path.
+
+> **Note (2026-06-25):** Auth has since moved from Auth.js (NextAuth v5) to **Neon Auth (Better Auth)** — see `CLAUDE.md` for the current architecture. The Supabase purge described below is complete: `supabase/` directory deleted, `@supabase/*` deps removed from `package.json`, `next.config.ts` / `vercel.json` / `eslint.config.mjs` cleaned of Supabase hostnames and ignore patterns, and the remaining `*.supabase.co` references are limited to historical/educational comments in `MEMORY.md` and `docs/`.
+
+---
+
+## What was built
+
+### 1. Auth.js v5 (NextAuth) integration — DONE
+
+- **`src/lib/auth.ts`** — Auth.js v5 config. Google is the only provider
+  (no Supabase-backed Credentials provider). Sessions are JWTs; no DB
+  adapter. Exports `handlers`, `auth`, `signIn`, `signOut`.
+- **`src/lib/admin-permissions.ts`** — `getAdminUser()` resolves the
+  current admin. Three branches in precedence order:
+  1. `NEXT_PUBLIC_USE_MOCK_DATA=true` → platform_admin dev shim
+  2. `dev_session` cookie → matching dev shim (platform/brand/store)
+  3. Auth.js session → `null` (no DB lookup yet — see Follow-ups)
+- **`src/actions/auth-actions.ts`** — `signInWithGoogle()` and
+  `signOutAction()`. `signInWithPassword` was removed.
+- **`src/app/login/LoginClient.tsx`** + **`page.tsx`** — Login page
+  renders "Continue with Google" (when configured) and three demo
+  buttons (Platform / Brand / Store Employee) via `?demo=1`. Email /
+  password form and "Forgot password" are gone.
+- **`src/app/api/auth/[...nextauth]/route.ts`** — Auth.js route handler.
+
+### 2. Direct Postgres connection (`src/lib/db.ts`) — DONE
+
+- Single shared `pg.Pool` with lazy initialization. Throws a clear
+  error if `DATABASE_URL` is not set.
+- Exports `getPool()`, a `pool` proxy alias, `query<T>()` helper, and
+  `withTx()` for transactions.
+- Tuned for Vercel/serverless: 10 max conns, 30s idle, 10s connect
+  timeout. All overridable via `PG_POOL_*` env vars.
+
+### 3. Server actions → `pg` (no Supabase) — DONE
+
+- **`src/actions/admin/users.ts`** — Full rewrite. `getAdminUsers`,
+  `createAdminUser`, `updateAdminUser`, `deleteAdminUser`,
+  `setMustChangePassword`, `getBrands` now hit Postgres directly.
+  `sendPasswordResetEmail` returns a stub error (no auth service
+  anymore — the function is preserved for call-site compatibility).
+- The `dev_session` cookie continues to be the demo-flow bypass.
+
+### 4. Cleanup — DONE
+
+- **`src/actions/admin/force-login.ts`** — Deleted (the
+  Emergency-Force-Login page and its `/api/force-admin` route were
+  removed in the previous session).
+- **`src/actions/admin/users.ts`** — Removed the `DEV_FORCE_UID`
+  magic value, the `rc_auth_uid` cookie reads (×3), the
+  `headerStore` lookup, the `getServiceClient` / `getAuthClient` /
+  `callRpcWithAuth` helpers, and the `devListAdminUsers` auto-provision
+  branch. All Supabase imports gone.
+- **`src/app/admin/me/AdminMeClient.tsx`** — Profile / email-change
+  handlers neutralized (return "contact a platform admin" — the
+  Supabase auth backend that backed them is gone).
+- **`src/middleware.ts`** — `dev_session` auto-login preserved
+  (issues a `platform_admin` cookie on unauthed `/admin` so the rest
+  of the admin shell renders). `auth()` wrapper in place.
+
+### 5. Test infrastructure — DONE
+
+- **Vitest 2.1.9** with `@vitejs/plugin-react`, jsdom, manual
+  `@/* → src/*` alias. No `vite-tsconfig-paths` (ESM/require
+  incompatibility).
+- **`tests/setup.ts`** — Mocks `next/navigation` (not in jsdom).
+- **`tests/unit/getAdminUser.test.ts`** — 12 tests covering
+  dev_session, mock-data, Auth.js session, defensive error handling.
+- **`tests/unit/auth-actions.test.ts`** — 2 tests for
+  `signInWithGoogle` + `signOutAction`.
+- Both test files stub `server-only` with `vi.mock("server-only", () => ({}))`.
+- **Playwright config** — `webServer` block for `npm run dev`,
+  `PLAYWRIGHT_URL` override, `reuseExistingServer: !process.env.CI`.
+- **`tests/login/login-flow.spec.ts`** — Login form rendering +
+  demo mode (3 roles) tests.
+- **`tests/e2e/auth.spec.ts`** — Auth.js endpoints, middleware
+  redirect behavior, /admin load with dev_session, logout.
+
+### 6. `import "server-only"` markers — DONE
+
+- Added to `src/lib/auth.ts`, `src/lib/admin-permissions.ts`,
+  `src/lib/db.ts`, `src/actions/auth-actions.ts`,
+  `src/actions/admin/users.ts`.
+- ⚠️ In `"use server"` files, the directive must be first
+  (`"use server";` on line 1, then `import "server-only";`). The dev
+  build surfaced this; fixed in `auth-actions.ts` and `users.ts`.
+
+---
+
+## Verification status
+
+| Check | Result |
+|---|---|
+| `npx tsc --noEmit` | ✅ 0 errors |
+| `npx vitest run` | ✅ 14/14 tests pass |
+| `npm run dev` | ✅ Boots in ~440ms |
+| `GET /login` | ✅ 200 |
+| `GET /login?demo=1` | ✅ 200 |
+| `GET /api/auth/providers` | ✅ 200 (empty list — Google not configured) |
+| `GET /` | ✅ 200 |
+| `GET /admin` (unauthed) | ✅ 307 → `/admin?demo=1` + `dev_session` cookie |
+| `GET /admin?demo=1` (with cookie) | ✅ 200 (admin layout renders) |
+
+---
+
+## Files changed
+
+```
+M src/actions/admin/users.ts            # full rewrite, pg-only
+M src/actions/auth-actions.ts           # signInWithPassword removed
+M src/app/admin/me/AdminMeClient.tsx    # handlers stubbed
+M src/app/login/LoginClient.tsx         # email/password form removed
+M src/app/login/page.tsx                # passes hasGoogle prop
+M src/lib/admin-permissions.ts          # Supabase REST calls removed
+M src/lib/auth.ts                       # Credentials provider removed
+M tests/unit/auth-actions.test.ts       # signInWithPassword tests removed
+M tests/unit/getAdminUser.test.ts       # reflects no-DB behavior
+```
+
+Plus deletions and creations recorded in the prior session.
+
+---
+
+## Follow-ups (the bigger fish)
+
+The user's directive was: "git rid of all supabase references, we are
+not using it for login or anything anymore." The auth/admin path is
+now Supabase-free. **33 files** still import from Supabase — they use
+it for **data fetching** (`supabase.from(...).select(...)`), not auth.
+
+**Migrating those to `pg` is a follow-up.** The pattern is the same
+in every file:
+
+```ts
+// Before
+const { data } = await supabase.from("products").select("*").eq("brand_id", id);
+
+// After
+import { query } from "@/lib/db";
+const { rows } = await query<ProductRow>(
+  "SELECT * FROM products WHERE brand_id = $1",
+  [id],
+);
+```
+
+### 33 files still importing Supabase
+
+```
+src/app/admin/page.tsx, products/[id]/page.tsx, products/page.tsx,
+     orders/page.tsx, stops/[id]/page.tsx, stops/new/page.tsx,
+     stops/page.tsx, reports/page.tsx, taxes/page.tsx,
+     settings/billing/page.tsx, settings/integrations/page.tsx,
+     settings/shipping/page.tsx
+src/app/tuxedo/page.tsx, about/page.tsx, contact/ContactClientPage.tsx,
+     stops/[slug]/page.tsx
+src/app/indian-river-direct/page.tsx, faq/FAQClientPage.tsx,
+     contact/ContactClientPage.tsx, stops/[slug]/page.tsx
+src/app/api/tuxedo/schedule-pdf/route.ts,
+     src/app/api/indian-river-direct/schedule-pdf/route.ts
+src/app/reset-password/page.tsx, src/app/test/page.tsx
+src/components/admin/AdminHeader.tsx, AdminSidebar.tsx
+src/lib/supabase.ts, src/lib/supabase/server.ts  # the client modules
+src/actions/wholesale-auth.ts, reset-admin.ts, audit.ts
+src/actions/ai/preferences.ts
+```
+
+### Additional follow-ups
+
+1. **Provision a `pg` pool in production.** `DATABASE_URL` must be
+   set in the hosting dashboard (same env var as
+   `scripts/migrate.js` uses).
+2. **Apply migration 204** if not already applied — adds
+   `email`, `auth_provider`, `auth_subject` columns to `admin_users`
+   and the `get_admin_user_for_session` RPC.
+3. **Wire `getAdminUser()`'s Auth.js session branch** to call
+   `get_admin_user_for_session` via `pg` once a `DATABASE_URL` is
+   configured. Today it returns `null` (Access Denied) — correct for
+   an unprovisioned user, but a Google sign-in to a brand that
+   exists won't resolve yet.
+4. **Drop the `next-auth` Credentials provider module path** in
+   `auth.ts` entirely once production confirms Google is the only
+   provider in use. Currently it's gated on env var presence.
+5. **Re-implement `sendPasswordResetEmail`** if/when Auth.js v5 ships
+   its built-in email provider — until then, a platform admin must
+   handle resets manually.
+6. **Decommission `src/lib/supabase.ts` and `src/lib/supabase/server.ts`**
+   once all 33 remaining files have been ported to `pg`. They are
+   the only remaining `@supabase/*` import surface.
+7. **Delete `@supabase/ssr` and `@supabase/supabase-js` from
+   `package.json`** (last step once no file imports them).
+
+### Resolution (2026-06-25)
+
+Follow-ups 6 and 7 (and the data-fetching migration of all 33 files) are
+complete. The codebase is now Supabase-free at the source-code level —
+`grep -rln '@supabase\|rest/v1' src/` returns zero matches. The only
+remaining mentions of "Supabase" are in this report, `MEMORY.md`, and a
+handful of historical `docs/superpowers/{plans,specs}/` files, all kept
+as historical record of the migration.
+
+---
+
+## Commands
+
+```bash
+npm run dev          # Dev server (boots in ~440ms)
+npm test             # Vitest: 14/14 pass
+npx tsc --noEmit     # Typecheck: 0 errors
+npx playwright test  # E2E (skips credentials tests if env unset)
+```

db/client.ts

@@ -0,0 +1,98 @@
+/**
+ * Drizzle client + brand-scoped query helper.
+ *
+ * The app connects to Postgres directly via the `pg` driver. Drizzle sits
+ * on top, providing typed queries. The `withBrand` wrapper is the only
+ * sanctioned way to run a brand-scoped query — it sets the
+ * `app.current_brand_id` GUC transaction-locally, and the database's
+ * RLS policies enforce brand isolation even if application code forgets
+ * a `WHERE brand_id = $1`.
+ *
+ * Usage (read):
+ *   const products = await withBrand(brandId, (db) =>
+ *     db.select().from(productsTable).where(eq(productsTable.active, true)),
+ *   );
+ *
+ * Usage (platform admin — sees all brands):
+ *   const allBrands = await withPlatformAdmin((db) =>
+ *     db.select().from(brandsTable),
+ *   );
+ *
+ * Usage (no brand — for the rare case the query isn't brand-scoped):
+ *   const plans = await withDb((db) => db.select().from(plansTable));
+ */
+
+import "server-only";
+import { drizzle, type NodePgDatabase } from "drizzle-orm/node-postgres";
+import * as schema from "./schema";
+import { getPool, withTx } from "@/lib/db";
+
+type Schema = typeof schema;
+export type Db = NodePgDatabase<Schema>;
+
+/**
+ * The Drizzle layer reuses the shared `pg` `Pool` from `@/lib/db` so the
+ * app connects to Postgres through a single pool. Connection settings
+ * (`PG_POOL_MAX`, `PG_POOL_IDLE_MS`, `PG_POOL_CONN_TIMEOUT_MS`,
+ * `DATABASE_URL`) live in one place. See `src/lib/db.ts` for the config.
+ *
+ * The `withBrand` and `withPlatformAdmin` helpers reuse `withTx` from
+ * `@/lib/db` so the BEGIN/COMMIT/ROLLBACK handling has a single home.
+ */
+
+/**
+ * Run `fn` with a Drizzle client. No brand context is set — the caller
+ * is responsible for RLS bypass (e.g. for the `plans` and `add_ons` tables,
+ * which are not brand-scoped). For brand-scoped reads, prefer
+ * `withBrand` or `withPlatformAdmin`.
+ */
+export async function withDb<T>(fn: (db: Db) => Promise<T>): Promise<T> {
+  const client = await getPool().connect();
+  try {
+    const db = drizzle(client, { schema });
+    return await fn(db);
+  } finally {
+    client.release();
+  }
+}
+
+/**
+ * Run `fn` inside a transaction with the current brand id set as a
+ * transaction-local GUC. RLS policies on brand-scoped tables will allow
+ * reads/writes only for rows where `brand_id` matches. Pass `null` to
+ * fail open (don't set the GUC) — only useful for the migrations
+ * themselves, never for app code.
+ */
+export async function withBrand<T>(
+  brandId: string,
+  fn: (db: Db) => Promise<T>,
+): Promise<T> {
+  return withTx(async (client) => {
+    // set_config(setting, value, is_local) — is_local=true makes it
+    // transaction-local so it auto-resets at COMMIT/ROLLBACK and never
+    // leaks across pooled connections.
+    await client.query("SELECT set_config('app.current_brand_id', $1, true)", [
+      brandId,
+    ]);
+    await client.query("SELECT set_config('app.platform_admin', 'false', true)");
+    const db = drizzle(client, { schema });
+    return fn(db);
+  });
+}
+
+/**
+ * Run `fn` as platform admin. RLS policies permit access to all brands.
+ * Use sparingly — typically only in the /admin/platform routes.
+ */
+export async function withPlatformAdmin<T>(
+  fn: (db: Db) => Promise<T>,
+): Promise<T> {
+  return withTx(async (client) => {
+    await client.query("SELECT set_config('app.current_brand_id', '', true)");
+    await client.query("SELECT set_config('app.platform_admin', 'true', true)");
+    const db = drizzle(client, { schema });
+    return fn(db);
+  });
+}
+
+export { schema };

db/migrations/0002_admin_password.sql

@@ -0,0 +1,20 @@
+-- 0002_admin_password.sql
+--
+-- Adds a `password_hash` column to `users` so the Auth.js Credentials
+-- provider can verify email + password against the database.
+--
+-- Idempotent: uses `ADD COLUMN IF NOT EXISTS`. The column is nullable
+-- because OAuth-only users (Google) never set a password.
+--
+-- The Credentials provider's `authorize` function is documented in
+-- `src/lib/auth.ts` — it queries this column and runs `verifyPassword`
+-- (see `src/lib/passwords.ts`) before returning the user.
+
+-- Transaction is managed by the migrate runner (scripts/migrate.js).
+-- File kept small and re-runnable via IF NOT EXISTS on the ALTER.
+
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS password_hash TEXT;
+
+-- Update the updated_at trigger tracking — no new triggers needed since
+-- `users` already has `set_updated_at` from migration 0001.

db/migrations/0003_tour_rpc_functions.sql

@@ -0,0 +1,71 @@
+-- Migration 003: Batch insert RPCs for tour stop / location seeding
+-- Required by db/seeds/2026-tuxedo-tour-stops.sql and scripts/import-tuxedo-stops.ts
+
+BEGIN;
+
+-- admin_create_locations_batch: insert or update locations from tour seed
+-- Payload shape: { name, address, city, state, zip, phone, contact_name, contact_email, notes, active }[]
+CREATE OR REPLACE FUNCTION admin_create_locations_batch(p_brand_id UUID, p_locations JSONB)
+RETURNS VOID LANGUAGE plpgsql SECURITY DEFINER AS $$
+DECLARE
+  v_loc JSONB;
+BEGIN
+  FOR v_loc IN SELECT * FROM jsonb_array_elements(p_locations)
+  LOOP
+    INSERT INTO locations (
+      brand_id, name, address, city, state, zip,
+      phone, contact_name, contact_email, notes, active
+    ) VALUES (
+      p_brand_id,
+      v_loc->>'name',
+      v_loc->>'address',
+      v_loc->>'city',
+      v_loc->>'state',
+      NULLIF(v_loc->>'zip', '')::TEXT,
+      v_loc->>'phone',
+      v_loc->>'contact_name',
+      v_loc->>'contact_email',
+      v_loc->>'notes',
+      COALESCE((v_loc->>'active')::BOOLEAN, true)
+    )
+    ON CONFLICT DO NOTHING;
+  END LOOP;
+END;
+$$;
+
+-- admin_create_stops_batch: insert stops from tour seed
+-- Payload shape: { city, state, location, date, time, address, zip, cutoff_time, active, notes }[]
+-- date format: '2026-07-22 00:00:00+00' — cast to DATE
+CREATE OR REPLACE FUNCTION admin_create_stops_batch(p_brand_id UUID, p_stops JSONB)
+RETURNS VOID LANGUAGE plpgsql SECURITY DEFINER AS $$
+DECLARE
+  v_stop JSONB;
+BEGIN
+  FOR v_stop IN SELECT * FROM jsonb_array_elements(p_stops)
+  LOOP
+    INSERT INTO stops (
+      brand_id, name, location, address, city, state, zip,
+      date, "time", cutoff_date, status, is_public, notes
+    ) VALUES (
+      p_brand_id,
+      COALESCE(NULLIF(v_stop->>'name', ''), (v_stop->>'location')::TEXT || ' - ' || (v_stop->>'city')::TEXT || ', ' || (v_stop->>'state')::TEXT),
+      v_stop->>'location',
+      v_stop->>'address',
+      v_stop->>'city',
+      v_stop->>'state',
+      NULLIF(v_stop->>'zip', '')::TEXT,
+      CASE
+        WHEN v_stop->>'date' IS NULL THEN NULL
+        ELSE LEFT(v_stop->>'date', 10)::DATE
+      END,
+      v_stop->>'time',
+      NULLIF(v_stop->>'cutoff_time', '')::DATE,
+      'active',
+      COALESCE((v_stop->>'active')::BOOLEAN, true),
+      v_stop->>'notes'
+    );
+  END LOOP;
+END;
+$$;
+
+COMMIT;

db/migrations/0040_command_center.sql

@@ -1,6 +1,48 @@
--- Migration 127: Platform command center RPCs (final applied version)
+-- Migration 0040: Platform command center — founder_pain_log table/view + RPCs
+-- Restores objects that the /admin/command-center page depends on.
+-- Original definitions were in archived Supabase migrations 126 + 127.
 
--- Platform-wide metrics
+-- ── founder_pain_log table ───────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS founder_pain_log (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  brand_id UUID REFERENCES brands(id) ON DELETE SET NULL,
+  severity TEXT NOT NULL CHECK (severity IN ('low', 'medium', 'high', 'critical')),
+  category TEXT NOT NULL,
+  title TEXT NOT NULL,
+  description TEXT,
+  status TEXT NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'acknowledged', 'resolved')),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  resolved_at TIMESTAMPTZ,
+  resolved_by UUID REFERENCES admin_users(id) ON DELETE SET NULL
+);
+
+-- ── founder_pain_log_platform view (joins brand name/slug for the UI) ────────
+CREATE OR REPLACE VIEW founder_pain_log_platform AS
+SELECT
+  fpl.id,
+  fpl.brand_id,
+  fpl.severity,
+  fpl.category,
+  fpl.title,
+  fpl.description,
+  fpl.status,
+  fpl.created_at,
+  fpl.resolved_at,
+  fpl.resolved_by,
+  b.name AS brand_name,
+  b.slug AS brand_slug
+FROM founder_pain_log fpl
+LEFT JOIN brands b ON b.id = fpl.brand_id
+ORDER BY
+  CASE fpl.severity
+    WHEN 'critical' THEN 1
+    WHEN 'high' THEN 2
+    WHEN 'medium' THEN 3
+    WHEN 'low' THEN 4
+  END,
+  fpl.created_at DESC;
+
+-- ── Platform-wide metrics ────────────────────────────────────────────────────
 CREATE OR REPLACE FUNCTION get_platform_command_center_metrics()
 RETURNS JSONB
 LANGUAGE plpgsql SECURITY DEFINER
@@ -47,7 +89,7 @@ BEGIN
 END;
 $$;
 
--- Recent activity feed (last 50 operational events across all brands)
+-- ── Recent activity feed (last 50 operational events across all brands) ──────
 CREATE OR REPLACE FUNCTION get_platform_activity_feed()
 RETURNS TABLE (
   id UUID,
@@ -83,8 +125,7 @@ BEGIN
 END;
 $$;
 
--- Per-brand health snapshot
-DROP FUNCTION IF EXISTS get_brand_health_snapshot();
+-- ── Per-brand health snapshot ────────────────────────────────────────────────
 CREATE OR REPLACE FUNCTION get_brand_health_snapshot()
 RETURNS TABLE (
   brand_id UUID,
@@ -152,4 +193,4 @@ BEGIN
   FROM bm
   LEFT JOIN pc ON pc.pc_bid = bm.bid;
 END;
-$$;
+$$;

db/migrations/0041_command_center_schema_fix.sql

@@ -0,0 +1,147 @@
+-- Migration 0041: Fix command-center RPCs against actual prod schema
+--
+-- Migration 0040 was written against an assumed schema and references columns
+-- that don't exist in the prod `orders` table:
+--   - `orders.created_at` does not exist  → use `orders.placed_at`
+--   - `orders.subtotal` does not exist     → use `orders.total_cents / 100`
+--   - `stops.date` is already DATE, not TEXT → drop the `~ '^\d{4}-...' ` regex
+--
+-- All three functions are fixed in place via CREATE OR REPLACE FUNCTION.
+-- The action layer (src/actions/platform/command-center.ts) is updated
+-- separately to use `SELECT * FROM fn()` for the two setof-returning functions.
+--
+-- Reference (prod schema as of 2026-06-17):
+--   orders:        id, brand_id, customer_id, stop_id, total_cents INT,
+--                  status TEXT, fulfillment TEXT, customer_*,
+--                  idempotency_key, notes, placed_at TIMESTAMPTZ, updated_at
+--   stops:         id, brand_id, name, location, address, city, state, zip,
+--                  date DATE, time, cutoff_date, status, is_public, notes,
+--                  created_at, updated_at
+--   operational_events: id, brand_id, event_type, entity_type, entity_id,
+--                  actor_type, actor_id, source, payload JSONB, created_at
+--   brands:        (assumed present per CLAUDE.md)
+
+-- ── Platform-wide metrics ──────────────────────────────────────────────────
+CREATE OR REPLACE FUNCTION get_platform_command_center_metrics()
+RETURNS JSONB
+LANGUAGE plpgsql SECURITY DEFINER
+AS $$
+DECLARE
+  result JSONB;
+BEGIN
+  result := jsonb_build_object(
+    'active_brands', (
+      SELECT COUNT(*) FROM brands WHERE slug IN ('tuxedo', 'indian-river-direct')
+    ),
+    'orders_today', (
+      SELECT COUNT(*) FROM orders
+      WHERE DATE(placed_at) = CURRENT_DATE
+    ),
+    'revenue_today', (
+      SELECT COALESCE(SUM(total_cents), 0)::NUMERIC / 100
+      FROM orders
+      WHERE DATE(placed_at) = CURRENT_DATE
+      AND status NOT IN ('cancelled', 'refunded')
+    ),
+    'active_routes', (
+      SELECT COUNT(DISTINCT s.id)
+      FROM stops s
+      WHERE s.date >= CURRENT_DATE
+      AND s.status = 'active'
+    ),
+    'failed_orders_today', (
+      SELECT COUNT(*)
+      FROM orders
+      WHERE DATE(placed_at) = CURRENT_DATE
+      AND status IN ('payment_failed', 'failed')
+    ),
+    'pending_orders_today', (
+      SELECT COUNT(*)
+      FROM orders
+      WHERE DATE(placed_at) = CURRENT_DATE
+      AND status = 'pending'
+    )
+  );
+
+  RETURN result;
+END;
+$$;
+
+-- ── Per-brand health snapshot ──────────────────────────────────────────────
+CREATE OR REPLACE FUNCTION get_brand_health_snapshot()
+RETURNS TABLE (
+  brand_id UUID,
+  brand_name TEXT,
+  brand_slug TEXT,
+  plan_tier TEXT,
+  orders_today INT,
+  revenue_today NUMERIC,
+  active_stops INT,
+  failed_orders INT,
+  pending_orders INT,
+  last_activity TIMESTAMPTZ,
+  open_pain_items INT,
+  health_status TEXT
+)
+LANGUAGE plpgsql SECURITY DEFINER
+AS $$
+BEGIN
+  RETURN QUERY
+  WITH bm AS (
+    SELECT
+      b.id AS bid,
+      b.name AS bname,
+      b.slug AS bslug,
+      COUNT(DISTINCT o.id) FILTER (WHERE DATE(o.placed_at) = CURRENT_DATE) AS ords_today,
+      (COALESCE(SUM(o.total_cents) FILTER (
+        WHERE DATE(o.placed_at) = CURRENT_DATE
+        AND o.status NOT IN ('cancelled', 'refunded')
+      ), 0)::NUMERIC / 100) AS rev_today,
+      COUNT(DISTINCT s.id) FILTER (
+        WHERE s.date >= CURRENT_DATE AND s.status = 'active'
+      ) AS act_stops,
+      COUNT(DISTINCT o.id) FILTER (WHERE DATE(o.placed_at) = CURRENT_DATE AND o.status IN ('payment_failed', 'failed')) AS fail_ords,
+      COUNT(DISTINCT o.id) FILTER (WHERE DATE(o.placed_at) = CURRENT_DATE AND o.status = 'pending') AS pend_ords,
+      MAX(oe.created_at) AS last_act
+    FROM brands b
+    LEFT JOIN orders o ON o.brand_id = b.id
+    LEFT JOIN stops s ON s.brand_id = b.id
+    LEFT JOIN operational_events oe
+      ON oe.payload->>'brand_id' = b.id::TEXT
+      AND oe.payload->>'brand_id' ~ '^[0-9a-fA-F-]{36}$'
+    WHERE b.slug IN ('tuxedo', 'indian-river-direct')
+    GROUP BY b.id, b.name, b.slug
+  ),
+  pc AS (
+    SELECT f.brand_id AS pc_bid, COUNT(*) AS open_cnt
+    FROM founder_pain_log f
+    WHERE f.status = 'open'
+    GROUP BY f.brand_id
+  )
+  SELECT
+    bm.bid,
+    bm.bname,
+    bm.bslug,
+    NULL::TEXT,
+    COALESCE(bm.ords_today, 0)::INT,
+    COALESCE(bm.rev_today, 0)::NUMERIC,
+    COALESCE(bm.act_stops, 0)::INT,
+    COALESCE(bm.fail_ords, 0)::INT,
+    COALESCE(bm.pend_ords, 0)::INT,
+    bm.last_act,
+    COALESCE(pc.open_cnt, 0)::INT,
+    CASE
+      WHEN COALESCE(bm.fail_ords, 0) > 0 THEN 'critical'
+      WHEN COALESCE(bm.pend_ords, 0) > 5 THEN 'warning'
+      WHEN COALESCE(pc.open_cnt, 0) > 0 THEN 'warning'
+      WHEN bm.last_act IS NULL OR bm.last_act < (NOW() - INTERVAL '24 hours') THEN 'warning'
+      ELSE 'healthy'
+    END
+  FROM bm
+  LEFT JOIN pc ON pc.pc_bid = bm.bid;
+END;
+$$;
+
+-- get_platform_activity_feed from 0040 is already correct against the prod
+-- schema (operational_events.payload->>'brand_id' is a text→UUID cast that
+-- nulls out on missing keys). No body change required.

db/migrations/0042_drop_command_center.sql

@@ -0,0 +1,19 @@
+-- Migration 0042: Drop command-center RPCs and founder_pain_log
+--
+-- The /admin/command-center page is being removed (see commit message).
+-- All objects it depended on are also dropped:
+--   - get_platform_command_center_metrics (JSONB-returning RPC)
+--   - get_platform_activity_feed          (TABLE-returning RPC)
+--   - get_brand_health_snapshot           (TABLE-returning RPC)
+--   - founder_pain_log                    (table)
+--   - founder_pain_log_platform           (view, joins brand name onto founder_pain_log)
+--
+-- The platform_admin role has no other consumer of these objects. The
+-- cross-brand KPIs and activity feed that the page showed are reachable
+-- per-brand via /admin, /admin/orders, /admin/stops, and /admin/reports.
+
+DROP VIEW IF EXISTS founder_pain_log_platform;
+DROP FUNCTION IF EXISTS get_brand_health_snapshot();
+DROP FUNCTION IF EXISTS get_platform_activity_feed();
+DROP FUNCTION IF EXISTS get_platform_command_center_metrics();
+DROP TABLE IF EXISTS founder_pain_log;

db/migrations/0043_admin_users_extra_columns.sql

@@ -0,0 +1,70 @@
+-- 0043_admin_users_extra_columns.sql
+--
+-- The application-layer admin user CRUD in `src/actions/admin/users.ts`
+-- was written for a richer `admin_users` schema than the one that
+-- landed in 0001_init.sql. The 0001 schema has just `name` plus the
+-- role-derived flag columns (`can_manage_orders`, `can_manage_products`,
+-- `can_manage_stops`, `can_manage_customers`, `can_manage_wholesale`,
+-- `can_manage_billing`, `can_manage_settings`, `can_manage_water_log`,
+-- `can_manage_time_tracking`, `can_manage_route_trace`,
+-- `can_manage_reports`, `can_manage_communications`).
+--
+-- The action also references these columns, which are not in 0001:
+--
+--   display_name, phone_number, brand_id,
+--   can_manage_pickup, can_manage_messages,
+--   can_manage_refunds, can_manage_users,
+--   active, must_change_password,
+--   auth_provider, auth_subject, last_login
+--
+-- This migration adds all of them so the create-user, list-users,
+-- update-user, and read-user flows work against the actual table.
+-- Re-runnable: each ALTER uses ADD COLUMN IF NOT EXISTS.
+--
+-- Notes on the new columns:
+--
+-- - `display_name` is what the UI shows in the user list / "logged in
+--   as" labels. The original `name` column from 0001 is left in place
+--   (Drizzle `adminUsers.name` still maps to it; `getAdminUser()` reads
+--   it) — `display_name` is the column the action's SQL touches so it
+--   stays the writable surface for the create-user form. Both can
+--   coexist; the next cleanup pass can collapse them.
+--
+-- - The four extra `can_manage_*` flags (pickup / messages / refunds /
+--   users) are not consulted by `getAdminUser()` — that lookup uses
+--   `permissionsForRole(role)` from `lib/admin-permissions.ts`, which
+--   derives flags from the user's role rather than from these
+--   columns. They are kept on the row so the create-user form's
+--   per-user permission toggles can persist; they simply do not yet
+--   affect runtime authorization. Cleanup target: either move them into
+--   a per-user permission table that the role-derived lookup merges
+--   in, or drop them from the form.
+--
+-- - `brand_id` is a denormalization of `admin_user_brands` (the link
+--   table is the source of truth for brand assignment, and
+--   `getAdminUser()` reads from it). The action writes both, which is
+--   redundant but not incorrect — keeping it makes the action's
+--   read-after-write (`getAdminUsers` joins on `au.brand_id`) work
+--   without rewriting the SELECT.
+--
+-- - `must_change_password` defaults to FALSE at the column level; the
+--   action sets it to TRUE on every create so the user is forced to
+--   set a new password on first sign-in.
+
+ALTER TABLE admin_users
+  ADD COLUMN IF NOT EXISTS display_name        TEXT,
+  ADD COLUMN IF NOT EXISTS phone_number        TEXT,
+  ADD COLUMN IF NOT EXISTS brand_id            UUID REFERENCES brands(id) ON DELETE SET NULL,
+  ADD COLUMN IF NOT EXISTS can_manage_pickup   BOOLEAN NOT NULL DEFAULT true,
+  ADD COLUMN IF NOT EXISTS can_manage_messages BOOLEAN NOT NULL DEFAULT true,
+  ADD COLUMN IF NOT EXISTS can_manage_refunds  BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS can_manage_users    BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS active              BOOLEAN NOT NULL DEFAULT true,
+  ADD COLUMN IF NOT EXISTS must_change_password BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS auth_provider       TEXT,
+  ADD COLUMN IF NOT EXISTS auth_subject        TEXT,
+  ADD COLUMN IF NOT EXISTS last_login          TIMESTAMPTZ;
+
+-- Helpful index for the brand-name lookup the user list does
+-- (LEFT JOIN brands b ON b.id = au.brand_id).
+CREATE INDEX IF NOT EXISTS admin_users_brand_id_idx ON admin_users (brand_id);

db/migrations/0090_water_log_completion.sql

@@ -0,0 +1,172 @@
+-- 0090_water_log_completion.sql
+--
+-- Water Log feature completion. The original `0001_init.sql` shipped the
+-- core five tables (headgates, irrigators, sessions, log entries, alerts)
+-- with RLS, but the SaaS rebuild's actions and UIs depend on a wider
+-- surface that this migration adds:
+--
+--   - `water_headgates.headgate_token`       — opaque per-gate token for QR
+--   - `water_headgates.status`               — open / closed / maintenance
+--   - `water_headgates.max_flow_gpm`         — optional high-water marker
+--   - `water_headgates.notes`                — free-form location notes
+--   - `water_headgates.last_used_at`         — denormalized for display
+--   - `water_headgates.high_threshold`       — optional alert ceiling
+--   - `water_headgates.low_threshold`        — optional alert floor
+--   - `water_headgates.unit`                 — display unit (CFS/GPM/etc.)
+--
+--   - `water_irrigators.role`                — "irrigator" | "water_admin"
+--   - `water_irrigators.phone`               — optional contact
+--   - `water_irrigators.notes`               — free-form
+--
+--   - `water_log_entries.method`             — "manual" | "meter" | "estimate" | "qr"
+--   - `water_log_entries.total_gallons`      — derived when computable
+--   - `water_log_entries.photo_url`          — link to storage object
+--   - `water_log_entries.logged_date`        — date-only (YYYY-MM-DD) for fast grouping
+--   - `water_log_entries.latitude`/`longitude` — optional GPS pin
+--   - `water_log_entries.brand_id` index upgrade
+--
+--   - NEW `water_admin_settings` (per-brand admin PIN + alert config)
+--   - NEW `water_admin_sessions` (admin sign-in sessions, separate cookie)
+--   - NEW `water_audit_log` (who changed what, when)
+--
+-- All new tables follow project conventions:
+--   - TIMESTAMPTZ for timestamps
+--   - UUID PKs via gen_random_uuid()
+--   - brand_id scoped, RLS enabled, FORCE'd
+--   - CREATE TABLE IF NOT EXISTS for re-runnability
+--
+-- ============================================================================
+
+-- ─── 1. Extend water_headgates ──────────────────────────────────────────────
+
+ALTER TABLE water_headgates
+  ADD COLUMN IF NOT EXISTS headgate_token TEXT UNIQUE
+    DEFAULT encode(gen_random_bytes(12), 'hex'),
+  ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'open'
+    CHECK (status IN ('open', 'closed', 'maintenance')),
+  ADD COLUMN IF NOT EXISTS max_flow_gpm NUMERIC,
+  ADD COLUMN IF NOT EXISTS notes TEXT,
+  ADD COLUMN IF NOT EXISTS last_used_at TIMESTAMPTZ,
+  ADD COLUMN IF NOT EXISTS high_threshold NUMERIC,
+  ADD COLUMN IF NOT EXISTS low_threshold NUMERIC,
+  ADD COLUMN IF NOT EXISTS unit TEXT NOT NULL DEFAULT 'CFS';
+
+-- Backfill any existing rows that pre-date the default expression
+UPDATE water_headgates
+  SET headgate_token = encode(gen_random_bytes(12), 'hex')
+  WHERE headgate_token IS NULL;
+
+-- ─── 2. Extend water_irrigators ─────────────────────────────────────────────
+
+ALTER TABLE water_irrigators
+  ADD COLUMN IF NOT EXISTS role TEXT NOT NULL DEFAULT 'irrigator'
+    CHECK (role IN ('irrigator', 'water_admin')),
+  ADD COLUMN IF NOT EXISTS phone TEXT,
+  ADD COLUMN IF NOT EXISTS notes TEXT;
+
+-- ─── 3. Extend water_log_entries ────────────────────────────────────────────
+
+ALTER TABLE water_log_entries
+  ADD COLUMN IF NOT EXISTS method TEXT NOT NULL DEFAULT 'manual'
+    CHECK (method IN ('manual', 'meter', 'estimate', 'qr')),
+  ADD COLUMN IF NOT EXISTS total_gallons NUMERIC,
+  ADD COLUMN IF NOT EXISTS photo_url TEXT,
+  ADD COLUMN IF NOT EXISTS logged_date DATE,
+  ADD COLUMN IF NOT EXISTS latitude DOUBLE PRECISION,
+  ADD COLUMN IF NOT EXISTS longitude DOUBLE PRECISION;
+
+-- Backfill logged_date for any rows that pre-date the column
+UPDATE water_log_entries
+  SET logged_date = (logged_at AT TIME ZONE 'UTC')::date
+  WHERE logged_date IS NULL AND logged_at IS NOT NULL;
+
+-- Index for fast "today's entries" + "this week's entries" queries
+CREATE INDEX IF NOT EXISTS water_log_entries_brand_date_idx
+  ON water_log_entries (brand_id, logged_date DESC);
+CREATE INDEX IF NOT EXISTS water_log_entries_irrigator_idx
+  ON water_log_entries (irrigator_id, logged_at DESC);
+
+-- ─── 4. water_admin_settings (per brand) ───────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS water_admin_settings (
+  brand_id UUID PRIMARY KEY REFERENCES brands(id) ON DELETE CASCADE,
+  enabled BOOLEAN NOT NULL DEFAULT true,
+  session_duration_hours INTEGER NOT NULL DEFAULT 4
+    CHECK (session_duration_hours BETWEEN 1 AND 168),
+  can_edit_entries BOOLEAN NOT NULL DEFAULT true,
+  can_delete_entries BOOLEAN NOT NULL DEFAULT true,
+  can_export_csv BOOLEAN NOT NULL DEFAULT true,
+  alert_phone TEXT,
+  alerts_enabled BOOLEAN NOT NULL DEFAULT false,
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_by UUID REFERENCES admin_users(id)
+);
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_trigger t
+    JOIN pg_class c ON t.tgrelid = c.oid
+    JOIN pg_namespace n ON c.relnamespace = n.oid
+    WHERE t.tgname = 'water_admin_settings_updated_at' AND n.nspname = current_schema()
+  ) THEN
+    CREATE TRIGGER water_admin_settings_updated_at BEFORE UPDATE ON water_admin_settings
+      FOR EACH ROW EXECUTE FUNCTION set_updated_at();
+  END IF;
+END $$;
+
+-- ─── 5. water_admin_sessions (separate from irrigator sessions) ───────────
+
+CREATE TABLE IF NOT EXISTS water_admin_sessions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  brand_id UUID NOT NULL REFERENCES brands(id) ON DELETE CASCADE,
+  admin_user_id UUID NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
+  pin_hash_used TEXT NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS water_admin_sessions_admin_idx
+  ON water_admin_sessions (admin_user_id, expires_at DESC);
+
+-- ─── 6. water_audit_log (who changed what, when) ───────────────────────────
+
+CREATE TABLE IF NOT EXISTS water_audit_log (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  brand_id UUID NOT NULL REFERENCES brands(id) ON DELETE CASCADE,
+  actor_id UUID REFERENCES admin_users(id),
+  actor_label TEXT NOT NULL,
+  action TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  entity_id UUID,
+  details JSONB,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS water_audit_log_brand_recent_idx
+  ON water_audit_log (brand_id, created_at DESC);
+
+-- ─── 7. RLS for new tables ────────────────────────────────────────────────
+
+ALTER TABLE water_admin_settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE water_admin_sessions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE water_audit_log ENABLE ROW LEVEL SECURITY;
+
+ALTER TABLE water_admin_settings FORCE ROW LEVEL SECURITY;
+ALTER TABLE water_admin_sessions FORCE ROW LEVEL SECURITY;
+ALTER TABLE water_audit_log FORCE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS tenant_isolation ON water_admin_settings;
+CREATE POLICY tenant_isolation ON water_admin_settings FOR ALL
+  USING (brand_id = current_brand_id() OR is_platform_admin())
+  WITH CHECK (brand_id = current_brand_id() OR is_platform_admin());
+
+DROP POLICY IF EXISTS tenant_isolation ON water_admin_sessions;
+CREATE POLICY tenant_isolation ON water_admin_sessions FOR ALL
+  USING (brand_id = current_brand_id() OR is_platform_admin())
+  WITH CHECK (brand_id = current_brand_id() OR is_platform_admin());
+
+DROP POLICY IF EXISTS tenant_isolation ON water_audit_log;
+CREATE POLICY tenant_isolation ON water_audit_log FOR ALL
+  USING (brand_id = current_brand_id() OR is_platform_admin())
+  WITH CHECK (brand_id = current_brand_id() OR is_platform_admin());

db/migrations/0091_dashboard_summary_rpc.sql

@@ -0,0 +1,89 @@
+-- 0091_dashboard_summary_rpc.sql
+--
+-- Dashboard summary RPC for the mobile-first admin v2 dashboard
+-- (`/admin/v2`).
+--
+-- Returns a single JSONB document that powers the four stat cards +
+-- the "Today's stops" timeline + the 7-day mini-chart:
+--
+--   {
+--     "orders_today":         <int>,            -- count of orders placed today
+--     "revenue_today":        <int cents>,      -- sum of total_cents (excl. canceled)
+--     "pending_fulfillment":  <int>,            -- count of orders awaiting pickup/ship
+--     "stops_today":          <int>,            -- count of stops scheduled for today
+--     "orders_last_7_days":   [{date, count}]   -- 7-element array, oldest → today
+--   }
+--
+-- Schema notes (vs. the plan's draft):
+--   * `orders` uses `placed_at` (TIMESTAMPTZ) — not `created_at`
+--   * `orders.status` is the legacy enum: 'pending' | 'confirmed' |
+--     'fulfilled' | 'canceled'  (not the v2 vocabulary 'placed'/'ready')
+--   * `orders.total_cents` is INTEGER (NOT NULL DEFAULT 0 in 0001) — no
+--     column-add step is required
+--   * `stops` has a `date DATE` column (not `scheduled_at`); the legacy
+--     stops page (and v2 stops page) both key off `stops.date`
+--
+-- SECURITY DEFINER so the v2 server action can call it without depending
+-- on RLS; brand scoping is enforced inside the function via the
+-- `p_brand_id` parameter (NULL → platform_admin "all brands" scope).
+-- Re-runs are safe — this is `CREATE OR REPLACE FUNCTION`.
+
+CREATE OR REPLACE FUNCTION get_dashboard_summary(p_brand_id UUID)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  result JSONB;
+  brand_filter TEXT;
+BEGIN
+  -- The brand filter is the same text fragment for every SELECT in this
+  -- function. NULL = "all brands" (platform_admin scope); non-NULL =
+  -- scope to a single brand.
+  IF p_brand_id IS NULL THEN
+    brand_filter := '';
+  ELSE
+    brand_filter := format(' AND brand_id = %L', p_brand_id);
+  END IF;
+
+  EXECUTE format(
+    $q$
+    SELECT jsonb_build_object(
+      'orders_today', (
+        SELECT COUNT(*) FROM orders
+        WHERE placed_at::date = CURRENT_DATE %s
+      ),
+      'revenue_today', (
+        SELECT COALESCE(SUM(total_cents), 0)::bigint FROM orders
+        WHERE placed_at::date = CURRENT_DATE
+          AND status <> 'canceled' %s
+      ),
+      'pending_fulfillment', (
+        SELECT COUNT(*) FROM orders
+        WHERE status IN ('pending', 'confirmed') %s
+      ),
+      'stops_today', (
+        SELECT COUNT(*) FROM stops
+        WHERE "date" = CURRENT_DATE %s
+      ),
+      'orders_last_7_days', (
+        SELECT COALESCE(jsonb_agg(jsonb_build_object('date', d::date, 'count', COALESCE(o.cnt, 0)) ORDER BY d), '[]'::jsonb)
+        FROM generate_series(CURRENT_DATE - INTERVAL '6 days', CURRENT_DATE, '1 day') d
+        LEFT JOIN (
+          SELECT placed_at::date AS day, COUNT(*) AS cnt
+          FROM orders
+          WHERE placed_at >= CURRENT_DATE - INTERVAL '7 days' %s
+          GROUP BY 1
+        ) o ON o.day = d::date
+      )
+    )
+    $q$,
+    brand_filter, brand_filter, brand_filter, brand_filter, brand_filter
+  ) INTO result;
+
+  RETURN result;
+END;
+$$;
+
+COMMENT ON FUNCTION get_dashboard_summary(UUID) IS
+  'Returns a single JSONB document with the four dashboard stat counts + 7-day order history. p_brand_id = NULL means platform_admin scope (all brands).';

db/schema/audit.ts

@@ -0,0 +1,36 @@
+/**
+ * Audit log. Source of truth: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  jsonb,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const auditLog = pgTable(
+  "audit_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    userId: uuid("user_id"), // FK to neon_auth.user(id) — plain UUID, enforced at DB level
+    action: text("action").notNull(),
+    targetType: text("target_type"),
+    targetId: uuid("target_id"),
+    payload: jsonb("payload"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("audit_log_brand_idx").on(t.brandId, t.createdAt),
+  }),
+);
+
+export type AuditLog = typeof auditLog.$inferSelect;
+export type NewAuditLog = typeof auditLog.$inferInsert;

db/schema/billing.ts

@@ -0,0 +1,72 @@
+/**
+ * Billing: plans, add_ons, brand_add_ons.
+ * Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  timestamp,
+  jsonb,
+  primaryKey,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const plans = pgTable("plans", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  code: text("code", {
+    enum: ["starter", "farm", "enterprise"],
+  }).notNull().unique(),
+  name: text("name").notNull(),
+  monthlyPriceCents: integer("monthly_price_cents").notNull(),
+  maxUsers: integer("max_users").notNull(),
+  maxProducts: integer("max_products").notNull(),
+  maxStopsMonthly: integer("max_stops_monthly").notNull(),
+  features: jsonb("features").notNull().default([]),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+
+export const addOns = pgTable("add_ons", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  code: text("code", {
+    enum: [
+      "wholesale_portal", "harvest_reach", "ai_tools",
+      "water_log", "square_sync", "sms_campaigns",
+    ],
+  }).notNull().unique(),
+  name: text("name").notNull(),
+  monthlyPriceCents: integer("monthly_price_cents").notNull(),
+  description: text("description"),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+});
+
+export const brandAddOns = pgTable(
+  "brand_add_ons",
+  {
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    addOnId: uuid("add_on_id")
+      .notNull()
+      .references(() => addOns.id, { onDelete: "cascade" }),
+    stripeSubscriptionId: text("stripe_subscription_id"),
+    status: text("status", { enum: ["active", "canceled"] })
+      .notNull()
+      .default("active"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.brandId, t.addOnId] }),
+  }),
+);
+
+export type Plan = typeof plans.$inferSelect;
+export type AddOn = typeof addOns.$inferSelect;
+export type BrandAddOn = typeof brandAddOns.$inferSelect;

db/schema/brand.ts

@@ -0,0 +1,76 @@
+/**
+ * Brand settings + brand features. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  jsonb,
+  boolean,
+  timestamp,
+  uniqueIndex,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const brandSettings = pgTable(
+  "brand_settings",
+  {
+    brandId: uuid("brand_id")
+      .primaryKey()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    legalBusinessName: text("legal_business_name"),
+    phone: text("phone"),
+    email: text("email"),
+    websiteUrl: text("website_url"),
+    streetAddress: text("street_address"),
+    city: text("city"),
+    state: text("state"),
+    postalCode: text("postal_code"),
+    country: text("country").default("US"),
+    logoUrl: text("logo_url"),
+    logoUrlDark: text("logo_url_dark"),
+    heroImageUrl: text("hero_image_url"),
+    tagline: text("tagline"),
+    aboutHtml: text("about_html"),
+    primaryColor: text("primary_color").default("#0F766E"),
+    defaultEmailSignature: text("default_email_signature"),
+    invoiceFooterNotes: text("invoice_footer_notes"),
+    fromEmail: text("from_email"),
+    fromName: text("from_name"),
+    replyToEmail: text("reply_to_email"),
+    customFooterText: text("custom_footer_text"),
+    featureFlags: jsonb("feature_flags").notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const brandFeatures = pgTable(
+  "brand_features",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    featureKey: text("feature_key").notNull(),
+    enabled: boolean("enabled").notNull().default(false),
+    enabledAt: timestamp("enabled_at", { withTimezone: true }),
+    disabledAt: timestamp("disabled_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandFeatureIdx: uniqueIndex("brand_features_brand_key_idx").on(
+      t.brandId,
+      t.featureKey,
+    ),
+  }),
+);
+
+export type BrandSettings = typeof brandSettings.$inferSelect;
+export type BrandFeature = typeof brandFeatures.$inferSelect;

db/schema/brands.ts

@@ -0,0 +1,146 @@
+/**
+ * Brands (Tenants). Source of truth: `db/migrations/0001_init.sql`.
+ * Multi-brand isolation: every business table has `brand_id` FK → brands.id.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  boolean,
+  timestamp,
+  index,
+  uniqueIndex,
+  primaryKey,
+} from "drizzle-orm/pg-core";
+
+export const brands = pgTable(
+  "brands",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull().unique(),
+    planTier: text("plan_tier", {
+      enum: ["starter", "farm", "enterprise"],
+    }).notNull().default("starter"),
+    maxUsers: integer("max_users").notNull().default(2),
+    maxProducts: integer("max_products").notNull().default(25),
+    maxStopsMonthly: integer("max_stops_monthly").notNull().default(10),
+    stripeCustomerId: text("stripe_customer_id"),
+    stripeSubscriptionId: text("stripe_subscription_id"),
+    stripeSubscriptionStatus: text("stripe_subscription_status", {
+      enum: [
+        "trialing", "active", "past_due", "canceled",
+        "incomplete", "incomplete_expired",
+      ],
+    }),
+    stripeCurrentPeriodEnd: timestamp("stripe_current_period_end", {
+      withTimezone: true,
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    slugIdx: uniqueIndex("brands_slug_idx").on(t.slug),
+  }),
+);
+
+// ── Admin Users ──────────────────────────────────────────────────────────────
+
+export const adminUsers = pgTable(
+  "admin_users",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    // FK to neon_auth.user(id) is enforced at DB level by the migration SQL.
+    // Drizzle can't reference tables in other schemas, so no .references() here.
+    userId: uuid("user_id"),
+    email: text("email").notNull().unique(),
+    name: text("name"),
+    // The columns below were added in migration 0043. They back the
+    // create-user / list-users / edit-user flows in
+    // `src/actions/admin/users.ts`. See that migration's header for
+    // notes on which of these are vestigial (the four can_manage_*
+    // toggles) vs. read by the UI.
+    displayName: text("display_name"),
+    phoneNumber: text("phone_number"),
+    brandId: uuid("brand_id"),
+    canManagePickup: boolean("can_manage_pickup").notNull().default(true),
+    canManageMessages: boolean("can_manage_messages").notNull().default(true),
+    canManageRefunds: boolean("can_manage_refunds").notNull().default(false),
+    canManageUsers: boolean("can_manage_users").notNull().default(false),
+    active: boolean("active").notNull().default(true),
+    mustChangePassword: boolean("must_change_password").notNull().default(false),
+    authProvider: text("auth_provider"),
+    authSubject: text("auth_subject"),
+    lastLogin: timestamp("last_login", { withTimezone: true }),
+    role: text("role", {
+      enum: ["platform_admin", "brand_admin", "store_employee"],
+    }).notNull().default("brand_admin"),
+    canManageOrders: boolean("can_manage_orders").notNull().default(true),
+    canManageProducts: boolean("can_manage_products").notNull().default(true),
+    canManageStops: boolean("can_manage_stops").notNull().default(true),
+    canManageCustomers: boolean("can_manage_customers").notNull().default(true),
+    canManageWholesale: boolean("can_manage_wholesale").notNull().default(false),
+    canManageBilling: boolean("can_manage_billing").notNull().default(false),
+    canManageSettings: boolean("can_manage_settings").notNull().default(false),
+    canManageWaterLog: boolean("can_manage_water_log").notNull().default(false),
+    canManageTimeTracking: boolean("can_manage_time_tracking").notNull().default(false),
+    canManageRouteTrace: boolean("can_manage_route_trace").notNull().default(false),
+    canManageReports: boolean("can_manage_reports").notNull().default(true),
+    canManageCommunications: boolean("can_manage_communications").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    userIdIdx: uniqueIndex("admin_users_user_id_idx").on(t.userId),
+    emailIdx: uniqueIndex("admin_users_email_idx").on(t.email),
+  }),
+);
+
+export const adminUserBrands = pgTable(
+  "admin_user_brands",
+  {
+    adminUserId: uuid("admin_user_id")
+      .notNull()
+      .references(() => adminUsers.id, { onDelete: "cascade" }),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    addedAt: timestamp("added_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    addedBy: uuid("added_by").references(() => adminUsers.id),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.adminUserId, t.brandId] }),
+  }),
+);
+
+// ── Neon Auth stub (for Drizzle typing only — table is managed by Neon Auth) ──
+// The actual table is neon_auth.user (singular). We can't FK-reference a table
+// in another schema via Drizzle, so we store userId as a plain UUID and rely on
+// the DB-level FK constraint (enforced by the migration SQL).
+export const authUsers = pgTable("user", {
+  id: uuid("id").primaryKey(),
+  name: text("name"),
+  email: text("email"),
+  emailVerified: boolean("email_verified"),
+  image: text("image"),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow(),
+});
+
+export type Brand = typeof brands.$inferSelect;
+export type NewBrand = typeof brands.$inferInsert;
+export type AdminUser = typeof adminUsers.$inferSelect;
+export type NewAdminUser = typeof adminUsers.$inferInsert;
+export type AdminUserBrand = typeof adminUserBrands.$inferSelect;
+export type NewAdminUserBrand = typeof adminUserBrands.$inferInsert;

db/schema/communications.ts

@@ -0,0 +1,315 @@
+/**
+ * Communications (Harvest Reach).
+ * Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  boolean,
+  timestamp,
+  jsonb,
+  index,
+  uniqueIndex,
+} from "drizzle-orm/pg-core";
+import { brands, adminUsers } from "./brands";
+
+export const communicationSettings = pgTable(
+  "communication_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .unique()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    defaultSenderEmail: text("default_sender_email"),
+    defaultSenderName: text("default_sender_name"),
+    replyToEmail: text("reply_to_email"),
+    emailProvider: text("email_provider").notNull().default("resend"),
+    emailFooterHtml: text("email_footer_html"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const communicationTemplates = pgTable(
+  "communication_templates",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    subject: text("subject").notNull(),
+    bodyText: text("body_text").notNull().default(""),
+    bodyHtml: text("body_html"),
+    templateType: text("template_type").notNull(),
+    campaignType: text("campaign_type"),
+    createdBy: uuid("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("communication_templates_brand_idx").on(t.brandId),
+  }),
+);
+
+export const communicationSegments = pgTable(
+  "communication_segments",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    rules: jsonb("rules").notNull().default({}),
+    createdBy: uuid("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("communication_segments_brand_idx").on(t.brandId),
+  }),
+);
+
+export const communicationCampaigns = pgTable(
+  "communication_campaigns",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    subject: text("subject"),
+    bodyText: text("body_text"),
+    bodyHtml: text("body_html"),
+    templateId: uuid("template_id").references(
+      () => communicationTemplates.id,
+      { onDelete: "set null" },
+    ),
+    campaignType: text("campaign_type").notNull(),
+    status: text("status", {
+      enum: ["draft", "scheduled", "sending", "sent", "canceled"],
+    }).notNull().default("draft"),
+    audienceRules: jsonb("audience_rules").notNull().default({}),
+    brandName: text("brand_name"),
+    scheduledAt: timestamp("scheduled_at", { withTimezone: true }),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    recipientCount: integer("recipient_count").notNull().default(0),
+    createdBy: uuid("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("communication_campaigns_brand_idx").on(t.brandId),
+    statusIdx: index("communication_campaigns_status_idx").on(
+      t.brandId,
+      t.status,
+    ),
+  }),
+);
+
+export const communicationContacts = pgTable(
+  "communication_contacts",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    email: text("email"),
+    phone: text("phone"),
+    firstName: text("first_name"),
+    lastName: text("last_name"),
+    fullName: text("full_name"),
+    source: text("source").notNull(),
+    externalId: text("external_id"),
+    customerId: uuid("customer_id"),
+    emailOptIn: boolean("email_opt_in").notNull().default(true),
+    smsOptIn: boolean("sms_opt_in").notNull().default(false),
+    emailOptInAt: timestamp("email_opt_in_at", { withTimezone: true }),
+    smsOptInAt: timestamp("sms_opt_in_at", { withTimezone: true }),
+    unsubscribedAt: timestamp("unsubscribed_at", { withTimezone: true }),
+    tags: text("tags").array().default([]),
+    metadata: jsonb("metadata").default({}),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("communication_contacts_brand_idx").on(t.brandId),
+    emailIdx: index("communication_contacts_email_idx").on(
+      t.brandId,
+      t.email,
+    ),
+  }),
+);
+
+export const communicationMessageLogs = pgTable(
+  "communication_message_logs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    campaignId: uuid("campaign_id").references(
+      () => communicationCampaigns.id,
+      { onDelete: "set null" },
+    ),
+    contactId: uuid("contact_id").references(
+      () => communicationContacts.id,
+      { onDelete: "set null" },
+    ),
+    customerEmail: text("customer_email"),
+    deliveryMethod: text("delivery_method").notNull(),
+    subject: text("subject"),
+    bodyPreview: text("body_preview"),
+    status: text("status").notNull(),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    errorMessage: text("error_message"),
+    eventType: text("event_type"),
+    eventId: uuid("event_id"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("communication_message_logs_brand_idx").on(t.brandId),
+    campaignIdx: index(
+      "communication_message_logs_campaign_idx",
+    ).on(t.campaignId),
+  }),
+);
+
+export const customerCommunicationPreferences = pgTable(
+  "customer_communication_preferences",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    customerId: uuid("customer_id").notNull(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    emailOptIn: boolean("email_opt_in").notNull().default(true),
+    smsOptIn: boolean("sms_opt_in").notNull().default(false),
+    emailOptInAt: timestamp("email_opt_in_at", { withTimezone: true }),
+    smsOptInAt: timestamp("sms_opt_in_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    customerBrandIdx: uniqueIndex(
+      "customer_communication_prefs_customer_brand_idx",
+    ).on(t.customerId, t.brandId),
+  }),
+);
+
+// Email automation sequences
+export const abandonedCartRecovery = pgTable(
+  "abandoned_cart_recovery",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    customerId: uuid("customer_id"),
+    contactEmail: text("contact_email").notNull(),
+    contactName: text("contact_name"),
+    cartSnapshot: jsonb("cart_snapshot").notNull(),
+    brandName: text("brand_name"),
+    locale: text("locale").default("en"),
+    sequenceStep: integer("sequence_step").default(0),
+    lastEmailSentAt: timestamp("last_email_sent_at", {
+      withTimezone: true,
+    }),
+    nextEmailAt: timestamp("next_email_at", { withTimezone: true }),
+    status: text("status", {
+      enum: ["active", "recovered", "expired", "manually_closed"],
+    }).default("active"),
+    recoveredOrderId: uuid("recovered_order_id"),
+    recoveredAt: timestamp("recovered_at", { withTimezone: true }),
+    expiredAt: timestamp("expired_at", { withTimezone: true }),
+    manuallyClosedAt: timestamp("manually_closed_at", {
+      withTimezone: true,
+    }),
+    manuallyClosedBy: uuid("manually_closed_by").references(
+      () => adminUsers.id,
+    ),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const welcomeEmailSequence = pgTable(
+  "welcome_email_sequence",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    contactId: uuid("contact_id").references(
+      () => communicationContacts.id,
+      { onDelete: "cascade" },
+    ),
+    contactEmail: text("contact_email").notNull(),
+    contactName: text("contact_name"),
+    brandName: text("brand_name"),
+    locale: text("locale").default("en"),
+    sequenceStep: integer("sequence_step").default(0),
+    lastEmailSentAt: timestamp("last_email_sent_at", {
+      withTimezone: true,
+    }),
+    nextEmailAt: timestamp("next_email_at", { withTimezone: true }),
+    status: text("status", {
+      enum: ["active", "completed", "unsubscribed", "bounced"],
+    }).default("active"),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    unsubscribedAt: timestamp("unsubscribed_at", { withTimezone: true }),
+    bouncedAt: timestamp("bounced_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export type CommunicationSettings =
+  typeof communicationSettings.$inferSelect;
+export type CommunicationTemplate = typeof communicationTemplates.$inferSelect;
+export type CommunicationSegment = typeof communicationSegments.$inferSelect;
+export type CommunicationCampaign = typeof communicationCampaigns.$inferSelect;
+export type CommunicationContact = typeof communicationContacts.$inferSelect;
+export type CommunicationMessageLog = typeof communicationMessageLogs.$inferSelect;
+export type CustomerCommunicationPreference =
+  typeof customerCommunicationPreferences.$inferSelect;
+export type AbandonedCartRecovery = typeof abandonedCartRecovery.$inferSelect;
+export type WelcomeEmailSequence = typeof welcomeEmailSequence.$inferSelect;

db/schema/customers.ts

@@ -0,0 +1,52 @@
+/**
+ * Customers. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  boolean,
+  timestamp,
+  varchar,
+  bigint,
+  jsonb,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const customers = pgTable(
+  "customers",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    email: text("email"),
+    phone: text("phone"),
+    firstName: text("first_name"),
+    lastName: text("last_name"),
+    fullName: text("full_name"),
+    source: text("source").notNull().default("system"),
+    externalId: text("external_id"),
+    customerId: uuid("customer_id"),
+    emailOptIn: boolean("email_opt_in").notNull().default(true),
+    smsOptIn: boolean("sms_opt_in").notNull().default(false),
+    emailOptInAt: timestamp("email_opt_in_at", { withTimezone: true }),
+    smsOptInAt: timestamp("sms_opt_in_at", { withTimezone: true }),
+    unsubscribedAt: timestamp("unsubscribed_at", { withTimezone: true }),
+    tags: text("tags").array().notNull().default([]),
+    metadata: jsonb("metadata").notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("customers_brand_idx").on(t.brandId),
+  }),
+);
+
+export type Customer = typeof customers.$inferSelect;
+export type NewCustomer = typeof customers.$inferInsert;

db/schema/enums.ts

@@ -0,0 +1,75 @@
+/**
+ * Shared enums for the SaaS schema. Mirrored in SQL as TEXT + CHECK.
+ *
+ * Usage:
+ *   import { tenantStatusEnum, type TenantStatus } from "@/db/schema/enums";
+ *   import { pgEnum } from "drizzle-orm/pg-core";
+ *
+ *   export const tenantStatus = pgEnum("tenant_status", tenantStatusEnum);
+ */
+
+export const tenantStatusEnum = [
+  "trial",
+  "active",
+  "past_due",
+  "suspended",
+  "churned",
+] as const;
+export type TenantStatus = (typeof tenantStatusEnum)[number];
+
+export const authProviderEnum = ["dev", "google", "email"] as const;
+export type AuthProvider = (typeof authProviderEnum)[number];
+
+export const roleEnum = ["platform_admin", "brand_admin", "store_employee"] as const;
+export type Role = (typeof roleEnum)[number];
+
+export const planCodeEnum = ["starter", "farm", "enterprise"] as const;
+export type PlanCode = (typeof planCodeEnum)[number];
+
+export const addOnCodeEnum = [
+  "wholesale_portal",
+  "harvest_reach",
+  "ai_tools",
+  "water_log",
+  "square_sync",
+  "sms_campaigns",
+] as const;
+export type AddOnCode = (typeof addOnCodeEnum)[number];
+
+export const subscriptionStatusEnum = [
+  "trialing",
+  "active",
+  "past_due",
+  "canceled",
+  "incomplete",
+] as const;
+export type SubscriptionStatus = (typeof subscriptionStatusEnum)[number];
+
+export const addOnStatusEnum = ["active", "canceled"] as const;
+export type AddOnStatus = (typeof addOnStatusEnum)[number];
+
+export const stopStatusEnum = ["active", "paused", "closed"] as const;
+export type StopStatus = (typeof stopStatusEnum)[number];
+
+export const orderStatusEnum = [
+  "pending",
+  "confirmed",
+  "fulfilled",
+  "canceled",
+] as const;
+export type OrderStatus = (typeof orderStatusEnum)[number];
+
+export const fulfillmentEnum = ["pickup", "ship", "mixed"] as const;
+export type Fulfillment = (typeof fulfillmentEnum)[number];
+
+export const itemFulfillmentEnum = ["pickup", "ship"] as const;
+export type ItemFulfillment = (typeof itemFulfillmentEnum)[number];
+
+export const campaignStatusEnum = [
+  "draft",
+  "scheduled",
+  "sending",
+  "sent",
+  "canceled",
+] as const;
+export type CampaignStatus = (typeof campaignStatusEnum)[number];

db/schema/files.ts

@@ -0,0 +1,36 @@
+/**
+ * Files. Source of truth: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const files = pgTable(
+  "files",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    storageKey: text("storage_key").notNull().unique(),
+    mimeType: text("mime_type").notNull(),
+    sizeBytes: integer("size_bytes").notNull(),
+    purpose: text("purpose"),
+    uploadedBy: uuid("uploaded_by"), // FK to neon_auth.user(id) — plain UUID, enforced at DB level
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("files_brand_idx").on(t.brandId),
+  }),
+);
+
+export type File = typeof files.$inferSelect;
+export type NewFile = typeof files.$inferInsert;

db/schema/index.ts

@@ -0,0 +1,19 @@
+/**
+ * Schema barrel. Re-exports every Drizzle table + inferred row type.
+ * Source of truth: `db/migrations/0001_init.sql`.
+ */
+export * from "./brands";
+export * from "./billing";
+export * from "./products";
+export * from "./stops";
+export * from "./customers";
+export * from "./orders";
+export * from "./brand";
+export * from "./wholesale";
+export * from "./water-log";
+export * from "./communications";
+export * from "./marketing";
+export * from "./time-tracking";
+export * from "./shipping";
+export * from "./support";
+export * from "./files";

db/schema/marketing.ts

@@ -0,0 +1,71 @@
+/**
+ * Marketing: email templates + campaigns.
+ * Source of truth: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { campaignStatusEnum } from "./enums";
+import { brands } from "./brands";
+
+export const emailTemplates = pgTable(
+  "email_templates",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    subject: text("subject").notNull(),
+    bodyHtml: text("body_html").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("email_templates_brand_idx").on(t.brandId),
+  }),
+);
+
+export const campaigns = pgTable(
+  "campaigns",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    templateId: uuid("template_id").references((): any => emailTemplates.id, {
+      onDelete: "set null",
+    }),
+    name: text("name").notNull(),
+    status: text("status", { enum: campaignStatusEnum })
+      .notNull()
+      .default("draft"),
+    scheduledFor: timestamp("scheduled_for", { withTimezone: true }),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    recipientCount: integer("recipient_count").notNull().default(0),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("campaigns_brand_idx").on(t.brandId),
+    statusIdx: index("campaigns_status_idx").on(t.brandId, t.status),
+  }),
+);
+
+export type EmailTemplate = typeof emailTemplates.$inferSelect;
+export type NewEmailTemplate = typeof emailTemplates.$inferInsert;
+export type Campaign = typeof campaigns.$inferSelect;
+export type NewCampaign = typeof campaigns.$inferInsert;

db/schema/orders.ts

@@ -0,0 +1,85 @@
+/**
+ * Orders + order_items. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+import { customers } from "./customers";
+import { stops } from "./stops";
+import { products } from "./products";
+
+export const orders = pgTable(
+  "orders",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    customerId: uuid("customer_id").references(() => customers.id, {
+      onDelete: "set null",
+    }),
+    stopId: uuid("stop_id").references(() => stops.id, {
+      onDelete: "set null",
+    }),
+    totalCents: integer("total_cents").notNull().default(0),
+    status: text("status", {
+      enum: ["pending", "confirmed", "fulfilled", "canceled"],
+    }).notNull().default("pending"),
+    fulfillment: text("fulfillment", {
+      enum: ["pickup", "ship", "mixed"],
+    }).notNull(),
+    customerAddress: text("customer_address"),
+    customerCity: text("customer_city"),
+    customerState: text("customer_state"),
+    customerZip: text("customer_zip"),
+    idempotencyKey: text("idempotency_key"),
+    notes: text("notes"),
+    placedAt: timestamp("placed_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("orders_brand_idx").on(t.brandId),
+    statusIdx: index("orders_status_idx").on(t.brandId, t.status),
+    stopIdx: index("orders_stop_idx").on(t.stopId),
+    customerIdx: index("orders_customer_idx").on(t.customerId),
+  }),
+);
+
+export const orderItems = pgTable(
+  "order_items",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    orderId: uuid("order_id")
+      .notNull()
+      .references(() => orders.id, { onDelete: "cascade" }),
+    productId: uuid("product_id").references(() => products.id, {
+      onDelete: "set null",
+    }),
+    quantity: integer("quantity").notNull(),
+    priceCents: integer("price_cents").notNull(),
+    fulfillment: text("fulfillment", {
+      enum: ["pickup", "ship"],
+    }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    orderIdx: index("order_items_order_idx").on(t.orderId),
+  }),
+);
+
+export type Order = typeof orders.$inferSelect;
+export type NewOrder = typeof orders.$inferInsert;
+export type OrderItem = typeof orderItems.$inferSelect;
+export type NewOrderItem = typeof orderItems.$inferInsert;

db/schema/products.ts

@@ -0,0 +1,75 @@
+/**
+ * Products. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  integer,
+  boolean,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const products = pgTable(
+  "products",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    sku: text("sku"),
+    type: text("type", { enum: ["standard", "wholesale", "both"] })
+      .notNull()
+      .default("standard"),
+    priceCents: integer("price_cents").notNull(),
+    inventory: integer("inventory").notNull().default(0),
+    unit: text("unit"),
+    active: boolean("active").notNull().default(true),
+    isTaxable: boolean("is_taxable").notNull().default(false),
+    pickupType: text("pickup_type", { enum: ["pickup", "ship", "all"] })
+      .notNull()
+      .default("all"),
+    imageUrl: text("image_url"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("products_brand_idx").on(t.brandId),
+    activeIdx: index("products_active_idx").on(t.brandId, t.active),
+  }),
+);
+
+export type Product = typeof products.$inferSelect;
+export type NewProduct = typeof products.$inferInsert;
+
+// ── Product Images ─────────────────────────────────────────────────────────────
+
+export const productImages = pgTable(
+  "product_images",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    productId: uuid("product_id")
+      .notNull()
+      .references(() => products.id, { onDelete: "cascade" }),
+    storageKey: text("storage_key").notNull(),
+    position: integer("position").notNull().default(0),
+    altText: text("alt_text"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    productIdx: index("product_images_product_idx").on(t.productId),
+  }),
+);
+
+export type ProductImage = typeof productImages.$inferSelect;
+export type NewProductImage = typeof productImages.$inferInsert;

db/schema/shipping.ts

@@ -0,0 +1,106 @@
+/**
+ * Shipping + Payments. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  numeric,
+  boolean,
+  date,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+import { orders } from "./orders";
+
+export const shippingSettings = pgTable(
+  "shipping_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .unique()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    carrier: text("carrier").notNull().default("fedex"),
+    fedexAccountNumber: text("fedex_account_number"),
+    fedexApiKey: text("fedex_api_key"),
+    fedexApiSecret: text("fedex_api_secret"),
+    fedexUseProduction: boolean("fedex_use_production")
+      .notNull()
+      .default(false),
+    defaultServiceType: text("default_service_type")
+      .notNull()
+      .default("FEDEX_GROUND"),
+    refrigeratedHandlingNotes: text("refrigerated_handling_notes"),
+    fragileHandlingNotes: text("fragile_handling_notes"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const shipments = pgTable(
+  "shipments",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    orderId: uuid("order_id")
+      .notNull()
+      .references(() => orders.id, { onDelete: "cascade" }),
+    carrier: text("carrier").notNull().default("fedex"),
+    serviceType: text("service_type").notNull(),
+    trackingNumber: text("tracking_number"),
+    labelUrl: text("label_url"),
+    rateCharged: numeric("rate_charged", { precision: 10, scale: 2 }),
+    estimatedDeliveryDate: date("estimated_delivery_date"),
+    isRefrigerated: boolean("is_refrigerated").notNull().default(false),
+    isFragile: boolean("is_fragile").notNull().default(false),
+    handlingNotes: text("handling_notes"),
+    status: text("status", {
+      enum: [
+        "created", "label_printed", "picked_up",
+        "in_transit", "delivered", "exception",
+      ],
+    }).notNull().default("created"),
+    fedexShipmentId: text("fedex_shipment_id"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    createdBy: uuid("created_by"),
+  },
+  (t) => ({
+    orderIdx: index("shipments_order_idx").on(t.orderId),
+  }),
+);
+
+export const paymentSettings = pgTable(
+  "payment_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .unique()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    provider: text("provider"),
+    stripePublishableKey: text("stripe_publishable_key"),
+    stripeSecretKey: text("stripe_secret_key"),
+    squareAccessToken: text("square_access_token"),
+    squareLocationId: text("square_location_id"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export type ShippingSettings = typeof shippingSettings.$inferSelect;
+export type Shipment = typeof shipments.$inferSelect;
+export type PaymentSettings = typeof paymentSettings.$inferSelect;

db/schema/stops.ts

@@ -0,0 +1,85 @@
+/**
+ * Stops + Locations. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  date,
+  boolean,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const stops = pgTable(
+  "stops",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    location: text("location").notNull(),
+    address: text("address"),
+    city: text("city"),
+    state: text("state"),
+    zip: text("zip"),
+    date: date("date").notNull(),
+    // "time" is a reserved word — quoted in SQL, unquoted in JS
+     
+    time: text("time"),
+    cutoffDate: date("cutoff_date"),
+    status: text("status", { enum: ["active", "paused", "closed"] })
+      .notNull()
+      .default("active"),
+    isPublic: boolean("is_public").notNull().default(true),
+    notes: text("notes"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("stops_brand_idx").on(t.brandId),
+    statusIdx: index("stops_status_idx").on(t.brandId, t.status),
+    dateIdx: index("stops_date_idx").on(t.brandId, t.date),
+  }),
+);
+
+export const locations = pgTable(
+  "locations",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    address: text("address"),
+    city: text("city"),
+    state: text("state"),
+    zip: text("zip"),
+    phone: text("phone"),
+    contactName: text("contact_name"),
+    contactEmail: text("contact_email"),
+    notes: text("notes"),
+    active: boolean("active").notNull().default(true),
+    deletedAt: timestamp("deleted_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("locations_brand_idx").on(t.brandId),
+  }),
+);
+
+export type Stop = typeof stops.$inferSelect;
+export type NewStop = typeof stops.$inferInsert;
+export type Location = typeof locations.$inferSelect;
+export type NewLocation = typeof locations.$inferInsert;

db/schema/support.ts

@@ -0,0 +1,297 @@
+/**
+ * Support tables: referrals, changelogs, onboarding, api_keys,
+ * notifications, operational events, audit logs.
+ * Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  varchar,
+  boolean,
+  timestamp,
+  jsonb,
+  integer,
+  numeric,
+  time,
+  index,
+  uniqueIndex,
+} from "drizzle-orm/pg-core";
+import { brands, adminUsers } from "./brands";
+
+// ── Referrals ──────────────────────────────────────────────────────────────
+
+export const referralCodes = pgTable(
+  "referral_codes",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    referrerUserId: uuid("referrer_user_id").notNull(),
+    referralCode: varchar("referral_code", { length: 50 }).notNull().unique(),
+    referrerEmail: varchar("referrer_email", { length: 255 }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    maxUses: integer("max_uses").default(1),
+    currentUses: integer("current_uses").default(0),
+    isActive: boolean("is_active").default(true),
+    rewardType: varchar("reward_type", { length: 50 }).default("percentage"),
+    rewardValue: numeric("reward_value", { precision: 10, scale: 2 }).default("20.00"),
+    metadata: jsonb("metadata").default({}),
+  },
+);
+
+export const referralRedemptions = pgTable(
+  "referral_redemptions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    referralCodeId: uuid("referral_code_id").references(
+      () => referralCodes.id,
+      { onDelete: "cascade" },
+    ),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    referredUserId: uuid("referred_user_id").notNull(),
+    referredEmail: varchar("referred_email", { length: 255 }).notNull(),
+    redeemedAt: timestamp("redeemed_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    rewardType: varchar("reward_type", { length: 50 }),
+    rewardValue: numeric("reward_value", { precision: 10, scale: 2 }),
+    isCreditApplied: boolean("is_credit_applied").default(false),
+    signupPlan: varchar("signup_plan", { length: 50 }),
+    signupValue: numeric("signup_value", { precision: 10, scale: 2 }),
+    metadata: jsonb("metadata").default({}),
+  },
+);
+
+// ── Changelogs ─────────────────────────────────────────────────────────────
+
+export const changelogs = pgTable(
+  "changelogs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    version: varchar("version", { length: 50 }).notNull(),
+    title: varchar("title", { length: 255 }).notNull(),
+    description: text("description"),
+    content: jsonb("content").notNull().default([]),
+    releasedAt: timestamp("released_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    isPublished: boolean("is_published").default(false),
+    featureType: varchar("feature_type", { length: 50 }).default("general"),
+    metadata: jsonb("metadata").default({}),
+  },
+  (t) => ({
+    brandVersionIdx: uniqueIndex("changelogs_brand_version_idx").on(
+      t.brandId,
+      t.version,
+    ),
+  }),
+);
+
+export const changelogReads = pgTable(
+  "changelog_reads",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id").notNull(),
+    changelogId: uuid("changelog_id").references(() => changelogs.id, {
+      onDelete: "cascade",
+    }),
+    readAt: timestamp("read_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    dismissed: boolean("dismissed").default(false),
+  },
+  (t) => ({
+    userChangelogIdx: uniqueIndex("changelog_reads_user_changelog_idx").on(
+      t.userId,
+      t.changelogId,
+    ),
+  }),
+);
+
+// ── Onboarding ─────────────────────────────────────────────────────────────
+
+export const onboardingProgress = pgTable(
+  "onboarding_progress",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    userId: uuid("user_id").notNull(),
+    currentStep: varchar("current_step", { length: 50 }).notNull(),
+    completedSteps: jsonb("completed_steps").default([]),
+    skippedSteps: jsonb("skipped_steps").default([]),
+    data: jsonb("data").default({}),
+    startedAt: timestamp("started_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    completedAt: timestamp("completed_at", { withTimezone: true }),
+    isCompleted: boolean("is_completed").default(false),
+    metadata: jsonb("metadata").default({}),
+  },
+  (t) => ({
+    brandUserIdx: uniqueIndex("onboarding_progress_brand_user_idx").on(
+      t.brandId,
+      t.userId,
+    ),
+  }),
+);
+
+// ── API Keys ────────────────────────────────────────────────────────────────
+
+export const apiKeys = pgTable(
+  "api_keys",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    name: varchar("name", { length: 255 }).notNull(),
+    keyHash: varchar("key_hash", { length: 255 }).notNull(),
+    keyPrefix: varchar("key_prefix", { length: 20 }),
+    permissions: jsonb("permissions").default(["read"]),
+    rateLimit: integer("rate_limit").default(1000),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    isActive: boolean("is_active").default(true),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    createdBy: uuid("created_by").notNull(),
+  },
+  (t) => ({
+    brandIdx: index("api_keys_brand_idx").on(t.brandId),
+  }),
+);
+
+// ── Notification Preferences ───────────────────────────────────────────────
+
+export const notificationPreferences = pgTable(
+  "notification_preferences",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id").notNull(),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "cascade",
+    }),
+    emailOrders: boolean("email_orders").default(true),
+    emailMarketing: boolean("email_marketing").default(false),
+    emailReports: boolean("email_reports").default(true),
+    emailBilling: boolean("email_billing").default(true),
+    smsOrders: boolean("sms_orders").default(false),
+    smsMarketing: boolean("sms_marketing").default(false),
+    pushOrders: boolean("push_orders").default(true),
+    pushMarketing: boolean("push_marketing").default(false),
+    quietHoursStart: time("quiet_hours_start"),
+    quietHoursEnd: time("quiet_hours_end"),
+    timezone: varchar("timezone", { length: 50 }).default("America/New_York"),
+    metadata: jsonb("metadata").default({}),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    userBrandIdx: uniqueIndex("notification_preferences_user_brand_idx").on(
+      t.userId,
+      t.brandId,
+    ),
+  }),
+);
+
+// ── Operational Events ─────────────────────────────────────────────────────
+
+export const operationalEvents = pgTable(
+  "operational_events",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    eventType: text("event_type").notNull(),
+    entityType: text("entity_type"),
+    entityId: uuid("entity_id"),
+    actorType: text("actor_type"),
+    actorId: uuid("actor_id"),
+    source: text("source").notNull().default("system"),
+    payload: jsonb("payload").notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("operational_events_brand_idx").on(t.brandId),
+    typeIdx: index("operational_events_type_idx").on(t.brandId, t.eventType),
+  }),
+);
+
+// ── Audit Logs ─────────────────────────────────────────────────────────────
+
+export const auditLogs = pgTable(
+  "audit_logs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id"),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "set null",
+    }),
+    action: text("action").notNull(),
+    entityType: text("entity_type"),
+    entityId: uuid("entity_id"),
+    details: jsonb("details"),
+    ipAddress: text("ip_address"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("audit_logs_brand_idx").on(t.brandId),
+    userIdx: index("audit_logs_user_idx").on(t.userId),
+    createdIdx: index("audit_logs_created_idx").on(t.createdAt),
+  }),
+);
+
+export const adminActionLogs = pgTable(
+  "admin_action_logs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    adminUserId: uuid("admin_user_id")
+      .notNull()
+      .references(() => adminUsers.id),
+    brandId: uuid("brand_id").references(() => brands.id, {
+      onDelete: "set null",
+    }),
+    action: text("action").notNull(),
+    targetType: text("target_type"),
+    targetId: uuid("target_id"),
+    metadata: jsonb("metadata"),
+    ipAddress: text("ip_address"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    adminIdx: index("admin_action_logs_admin_idx").on(t.adminUserId),
+    createdIdx: index("admin_action_logs_created_idx").on(t.createdAt),
+  }),
+);
+
+export type ReferralCode = typeof referralCodes.$inferSelect;
+export type ReferralRedemption = typeof referralRedemptions.$inferSelect;
+export type Changelog = typeof changelogs.$inferSelect;
+export type ChangelogRead = typeof changelogReads.$inferSelect;
+export type OnboardingProgress = typeof onboardingProgress.$inferSelect;
+export type ApiKey = typeof apiKeys.$inferSelect;
+export type NotificationPreference = typeof notificationPreferences.$inferSelect;
+export type OperationalEvent = typeof operationalEvents.$inferSelect;
+export type AuditLog = typeof auditLogs.$inferSelect;
+export type AdminActionLog = typeof adminActionLogs.$inferSelect;

db/schema/time-tracking.ts

@@ -0,0 +1,161 @@
+/**
+ * Time Tracking. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  numeric,
+  integer,
+  boolean,
+  timestamp,
+  index,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+
+export const timeTrackingSettings = pgTable(
+  "time_tracking_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .unique()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    payPeriodStartDay: integer("pay_period_start_day").notNull().default(0),
+    payPeriodLengthDays: integer("pay_period_length_days")
+      .notNull()
+      .default(7),
+    dailyOvertimeThreshold: numeric("daily_overtime_threshold", {
+      precision: 5,
+      scale: 2,
+    }).notNull().default("8.0"),
+    weeklyOvertimeThreshold: numeric("weekly_overtime_threshold", {
+      precision: 5,
+      scale: 2,
+    }).notNull().default("40.0"),
+    overtimeMultiplier: numeric("overtime_multiplier", {
+      precision: 3,
+      scale: 2,
+    }).notNull().default("1.50"),
+    overtimeNotifications: boolean("overtime_notifications")
+      .notNull()
+      .default(true),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const timeTrackingWorkers = pgTable(
+  "time_tracking_workers",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    role: text("role", { enum: ["worker", "time_admin"] })
+      .notNull()
+      .default("worker"),
+    lang: text("lang").notNull().default("en"),
+    pin: text("pin").notNull(),
+    active: boolean("active").notNull().default(true),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("time_tracking_workers_brand_idx").on(t.brandId),
+  }),
+);
+
+export const timeTrackingTasks = pgTable(
+  "time_tracking_tasks",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    nameEs: text("name_es"),
+    unit: text("unit", { enum: ["hours", "pieces", "units"] })
+      .notNull()
+      .default("hours"),
+    sortOrder: integer("sort_order").notNull().default(0),
+    active: boolean("active").notNull().default(true),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("time_tracking_tasks_brand_idx").on(t.brandId),
+  }),
+);
+
+export const timeTrackingLogs = pgTable(
+  "time_tracking_logs",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    workerId: uuid("worker_id")
+      .notNull()
+      .references(() => timeTrackingWorkers.id, { onDelete: "cascade" }),
+    taskId: uuid("task_id").references(() => timeTrackingTasks.id, {
+      onDelete: "set null",
+    }),
+    taskName: text("task_name").notNull(),
+    clockIn: timestamp("clock_in", { withTimezone: true }).notNull(),
+    clockOut: timestamp("clock_out", { withTimezone: true }),
+    lunchBreakMinutes: integer("lunch_break_minutes").notNull().default(0),
+    notes: text("notes"),
+    submittedVia: text("submitted_via", {
+      enum: ["manual", "field", "import"],
+    }).notNull().default("manual"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("time_tracking_logs_brand_idx").on(t.brandId),
+    workerIdx: index("time_tracking_logs_worker_idx").on(t.workerId),
+    clockInIdx: index("time_tracking_logs_clock_in_idx").on(t.clockIn),
+  }),
+);
+
+export const timeTrackingNotificationLog = pgTable(
+  "time_tracking_notification_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    workerId: uuid("worker_id").references(
+      () => timeTrackingWorkers.id,
+      { onDelete: "set null" },
+    ),
+    notificationType: text("notification_type").notNull(),
+    recipient: text("recipient").notNull(),
+    subject: text("subject"),
+    body: text("body").notNull(),
+    status: text("status", {
+      enum: ["pending", "sent", "failed"],
+    }).notNull().default("pending"),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export type TimeTrackingSettings = typeof timeTrackingSettings.$inferSelect;
+export type TimeTrackingWorker = typeof timeTrackingWorkers.$inferSelect;
+export type TimeTrackingTask = typeof timeTrackingTasks.$inferSelect;
+export type TimeTrackingLog = typeof timeTrackingLogs.$inferSelect;
+export type TimeTrackingNotificationLog =
+  typeof timeTrackingNotificationLog.$inferSelect;

db/schema/water-log.ts

@@ -0,0 +1,257 @@
+/**
+ * Water Log. Source: `db/migrations/0001_init.sql` + `0090_water_log_completion.sql`.
+ *
+ * Six tables, all brand-scoped with RLS:
+ *   - water_headgates         — physical gates a measurement is tied to
+ *   - water_irrigators        — PIN-authenticated field workers
+ *   - water_sessions          — short-lived PIN sessions for irrigators
+ *   - water_log_entries       — the actual reading logs
+ *   - water_alert_log         — high/low threshold alert history
+ *   - water_admin_settings    — per-brand admin PIN + alert config
+ *   - water_admin_sessions    — admin sign-in sessions (separate cookie)
+ *   - water_audit_log         — who changed what, when
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  numeric,
+  boolean,
+  timestamp,
+  date,
+  jsonb,
+  doublePrecision,
+  index,
+  uniqueIndex,
+  integer,
+  check,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+import { adminUsers } from "./brands";
+
+export const waterHeadgates = pgTable(
+  "water_headgates",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    /** Per-headgate opaque token used in the QR code. */
+    headgateToken: text("headgate_token").notNull().unique(),
+    /** Open / Closed / Maintenance. */
+    status: text("status").notNull().default("open"),
+    /** Display unit: CFS, GPM, Inches, AF/Day, etc. */
+    unit: text("unit").notNull().default("CFS"),
+    /** Optional max-flow marker in GPM. */
+    maxFlowGpm: numeric("max_flow_gpm"),
+    /** High-water alert threshold (units match `unit`). */
+    highThreshold: numeric("high_threshold"),
+    /** Low-water alert threshold (units match `unit`). */
+    lowThreshold: numeric("low_threshold"),
+    notes: text("notes"),
+    active: boolean("active").notNull().default(true),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("water_headgates_brand_idx").on(t.brandId),
+    tokenIdx: uniqueIndex("water_headgates_token_idx").on(t.headgateToken),
+  }),
+);
+
+export const waterIrrigators = pgTable(
+  "water_irrigators",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    pinHash: text("pin_hash").notNull(),
+    languagePreference: text("language_preference")
+      .notNull()
+      .default("en"),
+    /** "irrigator" submits entries only, "water_admin" can manage the brand. */
+    role: text("role").notNull().default("irrigator"),
+    phone: text("phone"),
+    notes: text("notes"),
+    active: boolean("active").notNull().default(true),
+    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("water_irrigators_brand_idx").on(t.brandId),
+  }),
+);
+
+export const waterSessions = pgTable(
+  "water_sessions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    irrigatorId: uuid("irrigator_id")
+      .notNull()
+      .references(() => waterIrrigators.id, { onDelete: "cascade" }),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const waterLogEntries = pgTable(
+  "water_log_entries",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    headgateId: uuid("headgate_id")
+      .notNull()
+      .references(() => waterHeadgates.id, { onDelete: "cascade" }),
+    irrigatorId: uuid("irrigator_id")
+      .notNull()
+      .references(() => waterIrrigators.id, { onDelete: "cascade" }),
+    /** Raw measurement value, in the entry's `unit`. */
+    measurement: numeric("measurement").notNull(),
+    unit: text("unit").notNull(),
+    /** "manual" | "meter" | "estimate" | "qr" */
+    method: text("method").notNull().default("manual"),
+    /** Optional auto-computed total (in gallons) when CFS × duration is known. */
+    totalGallons: numeric("total_gallons"),
+    notes: text("notes"),
+    submittedVia: text("submitted_via").notNull().default("app"),
+    photoUrl: text("photo_url"),
+    latitude: doublePrecision("latitude"),
+    longitude: doublePrecision("longitude"),
+    /** Date-only mirror of loggedAt for fast grouping / dashboard queries. */
+    loggedDate: date("logged_date"),
+    loggedAt: timestamp("logged_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    loggedBy: uuid("logged_by").references(() => adminUsers.id),
+  },
+  (t) => ({
+    brandIdx: index("water_log_entries_brand_idx").on(t.brandId),
+    headgateIdx: index("water_log_entries_headgate_idx").on(t.headgateId),
+    brandDateIdx: index("water_log_entries_brand_date_idx").on(
+      t.brandId,
+      t.loggedDate,
+    ),
+    irrigatorIdx: index("water_log_entries_irrigator_idx").on(
+      t.irrigatorId,
+      t.loggedAt,
+    ),
+  }),
+);
+
+export const waterAlertLog = pgTable(
+  "water_alert_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    alertType: text("alert_type").notNull(),
+    headgateId: uuid("headgate_id").references(() => waterHeadgates.id, {
+      onDelete: "set null",
+    }),
+    message: text("message").notNull(),
+    sentTo: text("sent_to"),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const waterAdminSettings = pgTable("water_admin_settings", {
+  brandId: uuid("brand_id")
+    .primaryKey()
+    .references(() => brands.id, { onDelete: "cascade" }),
+  /** Hashed admin PIN (scrypt $ N$r$p$salt$hash format). */
+  pinHash: text("pin_hash"),
+  enabled: boolean("enabled").notNull().default(true),
+  sessionDurationHours: integer("session_duration_hours")
+    .notNull()
+    .default(4),
+  canEditEntries: boolean("can_edit_entries").notNull().default(true),
+  canDeleteEntries: boolean("can_delete_entries").notNull().default(true),
+  canExportCsv: boolean("can_export_csv").notNull().default(true),
+  alertPhone: text("alert_phone"),
+  alertsEnabled: boolean("alerts_enabled").notNull().default(false),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedBy: uuid("updated_by").references(() => adminUsers.id),
+});
+
+export const waterAdminSessions = pgTable(
+  "water_admin_sessions",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    adminUserId: uuid("admin_user_id")
+      .notNull()
+      .references(() => adminUsers.id, { onDelete: "cascade" }),
+    pinHashUsed: text("pin_hash_used").notNull(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    adminIdx: index("water_admin_sessions_admin_idx").on(
+      t.adminUserId,
+      t.expiresAt,
+    ),
+  }),
+);
+
+export const waterAuditLog = pgTable(
+  "water_audit_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    actorId: uuid("actor_id").references(() => adminUsers.id),
+    actorLabel: text("actor_label").notNull(),
+    action: text("action").notNull(),
+    entityType: text("entity_type").notNull(),
+    entityId: uuid("entity_id"),
+    details: jsonb("details"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandRecentIdx: index("water_audit_log_brand_recent_idx").on(
+      t.brandId,
+      t.createdAt,
+    ),
+  }),
+);
+
+// ── Inferred types (used by every action and client component) ────────────
+
+export type WaterHeadgate = typeof waterHeadgates.$inferSelect;
+export type WaterHeadgateInsert = typeof waterHeadgates.$inferInsert;
+
+export type WaterIrrigator = typeof waterIrrigators.$inferSelect;
+export type WaterIrrigatorInsert = typeof waterIrrigators.$inferInsert;
+
+export type WaterSession = typeof waterSessions.$inferSelect;
+export type WaterLogEntry = typeof waterLogEntries.$inferSelect;
+export type WaterLogEntryInsert = typeof waterLogEntries.$inferInsert;
+
+export type WaterAlertLog = typeof waterAlertLog.$inferSelect;
+export type WaterAdminSettings = typeof waterAdminSettings.$inferSelect;
+export type WaterAdminSession = typeof waterAdminSessions.$inferSelect;
+export type WaterAuditLog = typeof waterAuditLog.$inferSelect;

db/schema/wholesale.ts

@@ -0,0 +1,373 @@
+/**
+ * Wholesale portal. Source: `db/migrations/0001_init.sql`.
+ */
+import {
+  pgTable,
+  uuid,
+  text,
+  numeric,
+  integer,
+  boolean,
+  timestamp,
+  date,
+  index,
+  uniqueIndex,
+  jsonb,
+} from "drizzle-orm/pg-core";
+import { brands } from "./brands";
+import { authUsers } from "./brands";
+
+export const wholesaleSettings = pgTable(
+  "wholesale_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .unique()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    requireApproval: boolean("require_approval").notNull().default(true),
+    minOrderAmount: numeric("min_order_amount", { precision: 10, scale: 2 }),
+    onlinePaymentEnabled: boolean("online_payment_enabled")
+      .notNull()
+      .default(false),
+    pickupLocation: text("pickup_location"),
+    fobLocation: text("fob_location"),
+    fromEmail: text("from_email"),
+    invoiceBusinessName: text("invoice_business_name"),
+    lastInvoiceNumber: integer("last_invoice_number").notNull().default(0),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const wholesaleCustomers = pgTable(
+  "wholesale_customers",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    userId: uuid("user_id").references(() => authUsers.id, {
+      onDelete: "set null",
+    }),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    companyName: text("company_name"),
+    contactName: text("contact_name"),
+    email: text("email"),
+    phone: text("phone"),
+    billingAddress: text("billing_address"),
+    shippingAddress: text("shipping_address"),
+    accountStatus: text("account_status", {
+      enum: ["active", "suspended", "inactive"],
+    }).notNull().default("active"),
+    creditLimit: numeric("credit_limit", { precision: 10, scale: 2 })
+      .notNull()
+      .default("0"),
+    depositsEnabled: boolean("deposits_enabled").notNull().default(false),
+    depositThreshold: numeric("deposit_threshold", { precision: 10, scale: 2 }),
+    depositPercentage: integer("deposit_percentage"),
+    orderEmail: text("order_email"),
+    invoiceEmail: text("invoice_email"),
+    adminNotes: text("admin_notes"),
+    role: text("role", { enum: ["buyer", "admin"] })
+      .notNull()
+      .default("buyer"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("wholesale_customers_brand_idx").on(t.brandId),
+  }),
+);
+
+export const wholesaleProducts = pgTable(
+  "wholesale_products",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    rcProductId: uuid("rc_product_id"),
+    name: text("name").notNull(),
+    description: text("description"),
+    unitType: text("unit_type").notNull().default("each"),
+    availability: text("availability", {
+      enum: ["available", "unavailable", "limited", "seasonal"],
+    }).notNull().default("unavailable"),
+    qtyAvailable: numeric("qty_available", { precision: 10, scale: 2 })
+      .default("0"),
+    priceTiers: jsonb("price_tiers").notNull().default([]),
+    hpSku: text("hp_sku"),
+    hpItemId: text("hp_item_id"),
+    internalNotes: text("internal_notes"),
+    handlingInstructions: text("handling_instructions"),
+    transportTemp: text("transport_temp"),
+    storageWarning: text("storage_warning"),
+    loadingNotes: text("loading_notes"),
+    productLabel: text("product_label"),
+    packStyle: text("pack_style"),
+    containerType: text("container_type"),
+    containerSizeCode: text("container_size_code"),
+    unitsPerContainer: integer("units_per_container"),
+    containerNotes: text("container_notes"),
+    defaultPickupLocation: text("default_pickup_location"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("wholesale_products_brand_idx").on(t.brandId),
+  }),
+);
+
+export const wholesaleOrders = pgTable(
+  "wholesale_orders",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    customerId: uuid("customer_id")
+      .notNull()
+      .references(() => wholesaleCustomers.id),
+    wcOrderId: numeric("wc_order_id"),
+    status: text("status", {
+      enum: [
+        "pending", "confirmed", "in_production", "ready",
+        "fulfilled", "canceled",
+      ],
+    }).notNull().default("pending"),
+    fulfillmentStatus: text("fulfillment_status", {
+      enum: ["unfulfilled", "partial", "fulfilled"],
+    }).notNull().default("unfulfilled"),
+    paymentStatus: text("payment_status", {
+      enum: ["unpaid", "deposit_paid", "paid", "refunded"],
+    }).notNull().default("unpaid"),
+    anticipatedPickupDate: date("anticipated_pickup_date"),
+    subtotal: numeric("subtotal", { precision: 10, scale: 2 })
+      .notNull()
+      .default("0"),
+    depositRequired: numeric("deposit_required", { precision: 10, scale: 2 })
+      .default("0"),
+    depositPaid: numeric("deposit_paid", { precision: 10, scale: 2 })
+      .notNull()
+      .default("0"),
+    balanceDue: numeric("balance_due", { precision: 10, scale: 2 })
+      .notNull()
+      .default("0"),
+    assignedEmployeeId: uuid("assigned_employee_id"),
+    fulfillmentNotes: text("fulfillment_notes"),
+    internalNotes: text("internal_notes"),
+    invoiceNumber: text("invoice_number"),
+    invoicePdfPath: text("invoice_pdf_path"),
+    invoiceToken: text("invoice_token"),
+    invoiceType: text("invoice_type"),
+    depositPercentage: integer("deposit_percentage"),
+    fulfilledAt: timestamp("fulfilled_at", { withTimezone: true }),
+    fulfilledBy: uuid("fulfilled_by"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("wholesale_orders_brand_idx").on(t.brandId),
+    customerIdx: index("wholesale_orders_customer_idx").on(t.customerId),
+    statusIdx: index("wholesale_orders_status_idx").on(t.brandId, t.status),
+  }),
+);
+
+export const wholesaleOrderItems = pgTable(
+  "wholesale_order_items",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    wholesaleOrderId: uuid("wholesale_order_id")
+      .notNull()
+      .references(() => wholesaleOrders.id, { onDelete: "cascade" }),
+    productId: uuid("product_id")
+      .notNull()
+      .references(() => wholesaleProducts.id),
+    quantity: numeric("quantity", { precision: 10, scale: 2 }).notNull(),
+    unitPrice: numeric("unit_price", { precision: 10, scale: 2 }).notNull(),
+    lineTotal: numeric("line_total", { precision: 10, scale: 2 }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    orderIdx: index("wholesale_order_items_order_idx").on(
+      t.wholesaleOrderId,
+    ),
+  }),
+);
+
+export const wholesaleDeposits = pgTable(
+  "wholesale_deposits",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    wholesaleOrderId: uuid("wholesale_order_id")
+      .notNull()
+      .references(() => wholesaleOrders.id, { onDelete: "cascade" }),
+    amount: numeric("amount", { precision: 10, scale: 2 }).notNull(),
+    paymentMethod: text("payment_method"),
+    reference: text("reference"),
+    recordedBy: uuid("recorded_by").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const wholesaleNotifications = pgTable(
+  "wholesale_notifications",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    customerId: uuid("customer_id")
+      .notNull()
+      .references(() => wholesaleCustomers.id, { onDelete: "cascade" }),
+    notificationType: text("notification_type", {
+      enum: [
+        "order_confirmed", "order_ready", "pickup_reminder",
+        "payment_reminder", "invoice",
+      ],
+    }).notNull(),
+    channel: text("channel", { enum: ["email", "sms"] }).notNull(),
+    recipient: text("recipient").notNull(),
+    subject: text("subject"),
+    body: text("body").notNull(),
+    status: text("status", {
+      enum: ["pending", "sent", "failed"],
+    }).notNull().default("pending"),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    errorMessage: text("error_message"),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("wholesale_notifications_brand_idx").on(t.brandId),
+  }),
+);
+
+export const wholesaleCustomerProductPricing = pgTable(
+  "wholesale_customer_product_pricing",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    customerId: uuid("customer_id")
+      .notNull()
+      .references(() => wholesaleCustomers.id, { onDelete: "cascade" }),
+    productId: uuid("product_id")
+      .notNull()
+      .references(() => wholesaleProducts.id, { onDelete: "cascade" }),
+    customPriceCents: integer("custom_price_cents").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    customerProductIdx: uniqueIndex(
+      "wholesale_customer_product_pricing_cust_prod_idx",
+    ).on(t.customerId, t.productId),
+  }),
+);
+
+export const wholesaleWebhookSettings = pgTable(
+  "wholesale_webhook_settings",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .unique()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    url: text("url").notNull(),
+    secret: text("secret").notNull(),
+    enabled: boolean("enabled").notNull().default(false),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+);
+
+export const wholesaleSyncLog = pgTable(
+  "wholesale_sync_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    eventType: text("event_type").notNull(),
+    orderId: uuid("order_id"),
+    payload: jsonb("payload"),
+    status: text("status", {
+      enum: ["pending", "sent", "failed"],
+    }).notNull().default("pending"),
+    response: text("response"),
+    attempts: integer("attempts").notNull().default(0),
+    nextRetry: timestamp("next_retry", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    brandIdx: index("wholesale_sync_log_brand_idx").on(t.brandId),
+  }),
+);
+
+export const userCarts = pgTable(
+  "user_carts",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: uuid("brand_id")
+      .notNull()
+      .references(() => brands.id, { onDelete: "cascade" }),
+    customerId: uuid("customer_id")
+      .notNull()
+      .references(() => wholesaleCustomers.id, { onDelete: "cascade" }),
+    items: jsonb("items").notNull().default([]),
+    updatedAt: timestamp("updated_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true })
+      .notNull()
+      .defaultNow(),
+  },
+  (t) => ({
+    customerIdx: uniqueIndex("user_carts_customer_idx").on(
+      t.brandId,
+      t.customerId,
+    ),
+  }),
+);
+
+export type WholesaleSettings = typeof wholesaleSettings.$inferSelect;
+export type WholesaleCustomer = typeof wholesaleCustomers.$inferSelect;
+export type WholesaleProduct = typeof wholesaleProducts.$inferSelect;
+export type WholesaleOrder = typeof wholesaleOrders.$inferSelect;
+export type WholesaleOrderItem = typeof wholesaleOrderItems.$inferSelect;
+export type WholesaleDeposit = typeof wholesaleDeposits.$inferSelect;
+export type WholesaleNotification = typeof wholesaleNotifications.$inferSelect;
+export type WholesaleWebhookSettings =
+  typeof wholesaleWebhookSettings.$inferSelect;
+export type WholesaleSyncLog = typeof wholesaleSyncLog.$inferSelect;
+export type UserCart = typeof userCarts.$inferSelect;

db/seed.ts

@@ -0,0 +1,177 @@
+/**
+ * Seed script. Idempotent — safe to re-run. Uses `ON CONFLICT (col) DO UPDATE`
+ * (with a target) for tables that have a unique constraint; uses
+ * `WHERE NOT EXISTS` for tables that don't.
+ *
+ *   npm run db:seed
+ *
+ * Populates:
+ *   - 2 brands (Tuxedo, Indian River Direct)
+ *   - brand_settings per brand
+ *   - sample products, stops, customers per brand
+ *   - sample communication templates + a draft campaign
+ *
+ * NOTE: Admin users are managed by Neon Auth. To create an admin user:
+ *   1. Sign up / sign in via the app (creates a neon_auth.user row)
+ *   2. Manually insert into admin_users + admin_user_brands:
+ *      INSERT INTO admin_users (email, name, role) VALUES ('you@example.com', 'Your Name', 'brand_admin');
+ *      INSERT INTO admin_user_brands (admin_user_id, brand_id, role) VALUES (<admin_user_id>, <brand_id>, 'brand_admin');
+ */
+import "dotenv/config";
+import { Pool } from "pg";
+
+const pool = new Pool({
+  connectionString:
+    process.env.DATABASE_ADMIN_URL ??
+    process.env.DATABASE_URL ??
+    "postgres://postgres:postgres@localhost:5432/route_commerce",
+});
+
+async function main() {
+  const client = await pool.connect();
+  try {
+    await client.query("BEGIN");
+
+    // ── Brands ──────────────────────────────────────────────────────────────
+    const brandsData = [
+      {
+        slug: "tuxedo",
+        name: "Tuxedo Citrus",
+        brandName: "Tuxedo Citrus Co.",
+        tagline: "Sun-ripened citrus, delivered.",
+        aboutHtml:
+          "<p>Family-run citrus grove in the Indian River region. We grow, pack, and ship premium grapefruit, oranges, and specialty varieties to wholesale buyers across the country.</p>",
+        primaryColor: "#F59E0B",
+        contactEmail: "hello@tuxedocitrus.example",
+        contactPhone: "(555) 010-2200",
+      },
+      {
+        slug: "indian-river-direct",
+        name: "Indian River Direct",
+        brandName: "Indian River Direct",
+        tagline: "From our groves to your store.",
+        aboutHtml:
+          "<p>Direct-from-grove wholesale produce. Family farms, fair pricing, fast delivery.</p>",
+        primaryColor: "#0F766E",
+        contactEmail: "orders@indianriverdirect.example",
+        contactPhone: "(555) 010-3300",
+      },
+    ];
+
+    for (const b of brandsData) {
+      // Upsert brand
+      const brandRes = await client.query<{ id: string }>(
+        `INSERT INTO brands (name, slug, plan_tier)
+         VALUES ($1, $2, 'starter')
+         ON CONFLICT (slug) DO UPDATE SET name = EXCLUDED.name
+         RETURNING id`,
+        [b.name, b.slug],
+      );
+      const brandId = brandRes.rows[0].id;
+
+      // Brand settings (PK is brand_id)
+      await client.query(
+        `INSERT INTO brand_settings
+           (brand_id, brand_name, tagline, about_html, primary_color, contact_email, contact_phone)
+         VALUES ($1, $2, $3, $4, $5, $6, $7)
+         ON CONFLICT (brand_id) DO UPDATE SET
+           brand_name = EXCLUDED.brand_name,
+           tagline = EXCLUDED.tagline,
+           about_html = EXCLUDED.about_html,
+           primary_color = EXCLUDED.primary_color,
+           contact_email = EXCLUDED.contact_email,
+           contact_phone = EXCLUDED.contact_phone`,
+        [brandId, b.brandName, b.tagline, b.aboutHtml, b.primaryColor, b.contactEmail, b.contactPhone],
+      );
+
+      // Sample products
+      const products = [
+        { name: "Ruby Red Grapefruit", price: 2400, unit: "40 lb case", desc: "Sweet, juicy, seedless." },
+        { name: "Navel Oranges", price: 2200, unit: "40 lb case", desc: "Classic eating orange, easy-peel." },
+        { name: "Honeybells", price: 3200, unit: "20 lb case", desc: "Limited season — bell-shaped, super sweet." },
+        { name: "Tangelos", price: 2800, unit: "40 lb case", desc: "Tangerine-grapefruit hybrid." },
+      ];
+      for (const p of products) {
+        await client.query(
+          `INSERT INTO products (brand_id, name, description, price_cents, inventory, unit, active)
+           SELECT $1, $2, $3, $4, 100, $5, true
+           WHERE NOT EXISTS (
+             SELECT 1 FROM products WHERE brand_id = $1 AND name = $2
+           )`,
+          [brandId, p.name, p.desc, p.price, p.unit],
+        );
+      }
+
+      // Sample stops
+      const stops = [
+        { name: "Downtown Farmers Market", address: "100 Main St", schedule: [{ day: "Saturday", time: "08:00" }] },
+        { name: "Eastside Pickup Hub", address: "555 Oak Ave", schedule: [{ day: "Wednesday", time: "16:00" }] },
+      ];
+      for (const s of stops) {
+        await client.query(
+          `INSERT INTO stops (brand_id, name, address, schedule, status)
+           SELECT $1, $2, $3, $4::jsonb, 'active'
+           WHERE NOT EXISTS (
+             SELECT 1 FROM stops WHERE brand_id = $1 AND name = $2
+           )`,
+          [brandId, s.name, s.address, JSON.stringify(s.schedule)],
+        );
+      }
+
+      // Sample customers
+      const customers = [
+        { name: "Green Grocer Co.", email: "buyer@greengrocer.example", phone: "555-010-0010" },
+        { name: "Sunset Cafe", email: "orders@sunsetcafe.example", phone: "555-010-0020" },
+        { name: "Northside Co-op", email: "produce@northsidecoop.example", phone: "555-010-0030" },
+      ];
+      for (const c of customers) {
+        await client.query(
+          `INSERT INTO customers (brand_id, name, email, phone, sms_opt_in, email_opt_in)
+           SELECT $1, $2, $3, $4, true, true
+           WHERE NOT EXISTS (
+             SELECT 1 FROM customers WHERE brand_id = $1 AND email = $3
+           )`,
+          [brandId, c.name, c.email, c.phone],
+        );
+      }
+
+      // Sample communication template
+      const tmplRes = await client.query<{ id: string }>(
+        `INSERT INTO communication_templates (brand_id, name, subject, body_html)
+         SELECT $1, 'Weekly Availability', 'This week at the grove', '<h1>Fresh this week</h1><p>Hi {{name}}, our harvest is in. Reply to reserve.</p>'
+         WHERE NOT EXISTS (
+           SELECT 1 FROM communication_templates WHERE brand_id = $1 AND name = 'Weekly Availability'
+         )
+         RETURNING id`,
+        [brandId],
+      );
+      if (tmplRes.rows[0]) {
+        await client.query(
+          `INSERT INTO communication_campaigns (brand_id, template_id, name, status)
+           SELECT $1, $2, 'Welcome series — week 1', 'draft'
+           WHERE NOT EXISTS (
+             SELECT 1 FROM communication_campaigns WHERE brand_id = $1 AND name = 'Welcome series — week 1'
+           )`,
+          [brandId, tmplRes.rows[0].id],
+        );
+      }
+    }
+    console.log(`Seeded ${brandsData.length} brands with sample data`);
+
+    await client.query("COMMIT");
+    console.log("✅ Seed complete");
+  } catch (err) {
+    await client.query("ROLLBACK");
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
+main()
+  .then(() => pool.end())
+  .catch((err) => {
+    console.error("❌ Seed failed:", err);
+    pool.end();
+    process.exit(1);
+  });

debug-auth-test.ts

@@ -1,53 +0,0 @@
-import { chromium } from 'playwright';
-
-async function debugAuth() {
-  console.log('Launching browser...');
-  const browser = await chromium.launch({ headless: true });
-  const context = await browser.newContext();
-  const page = await context.newPage();
-
-  // First, login
-  console.log('Navigating to login page...');
-  await page.goto('https://route-commerce-platform.vercel.app/login');
-
-  console.log('Filling login form...');
-  await page.fill('#email', 'kylemart@gmail.com');
-  await page.fill('#password', 'Test123456!');
-
-  console.log('Clicking sign in...');
-  const response = await page.click('button[type="submit"]');
-
-  // Wait for network to settle
-  await page.waitForLoadState('networkidle').catch(() => {});
-
-  console.log('Current URL after wait:', page.url());
-
-  // Get any error messages
-  const errorText = await page.$eval('[role="alert"]', el => el.textContent).catch(() => null);
-  if (errorText) console.log('Error message:', errorText);
-
-  const pageContent = await page.content();
-  if (pageContent.includes('Access Denied')) {
-    console.log('*** ACCESS DENIED PAGE DETECTED ***');
-  }
-
-  // Check cookies
-  const cookies = await context.cookies();
-  console.log('Cookies:', cookies.map(c => `${c.name}=${c.value.slice(0, 30)}...`));
-
-  // Try to visit debug-auth page
-  console.log('Navigating to /admin/debug-auth...');
-  try {
-    const response = await page.goto('https://route-commerce-platform.vercel.app/admin/debug-auth', { timeout: 10000 });
-    console.log('Response status:', response?.status());
-    console.log('Response URL:', page.url());
-    const content = await page.content();
-    console.log('Page content (first 2000 chars):', content.slice(0, 2000));
-  } catch (e) {
-    console.log('Error:', e);
-  }
-
-  await browser.close();
-}
-
-debugAuth().catch(console.error);

deploy/.env.production.example

@@ -0,0 +1,52 @@
+# =============================================================================
+# .env.production — secrets + dynamic ports for the running containers
+# =============================================================================
+#
+# deploy.sh writes the first three lines on every successful deploy.
+# Everything below is YOUR responsibility to populate. deploy.sh preserves
+# unknown lines verbatim across deploys (it only overwrites the lines it
+# knows about), so you can safely commit this file to a private repo or
+# provision it via your secrets manager of choice.
+#
+# In production, this file should be mode 0600 and owned by the deploy user.
+# =============================================================================
+
+# --- managed by deploy.sh (do not edit by hand) -------------------------------
+POSTGREST_HOST_PORT=3011
+NEXTJS_HOST_PORT=3012
+NEXT_PUBLIC_API_URL=http://localhost:3011
+
+# --- PostgREST connection ---------------------------------------------------
+PGRST_DB_URI=postgres://app:secret@db.internal:5432/app_production
+PGRST_DB_ANON_ROLE=anon
+PGRST_DB_SCHEMA=public
+
+# --- Next.js server-side secrets -------------------------------------------
+# Anything not prefixed NEXT_PUBLIC_ is server-only and read at request time.
+DATABASE_URL=postgres://app:secret@db.internal:5432/app_production
+
+# Auth.js v5 (NextAuth). Generate AUTH_SECRET with `npx auth secret` or
+# `openssl rand -base64 32`. AUTH_URL is the public base URL the browser
+# uses to build OAuth callback URLs.
+AUTH_SECRET=change-me-to-a-long-random-string
+AUTH_URL=https://app.example.com
+NEXT_PUBLIC_AUTH_URL=https://app.example.com
+ALLOW_DEV_LOGIN=false
+
+# Google OAuth provider for Auth.js. Set both AUTH_GOOGLE_ID/SECRET and
+# GOOGLE_CLIENT_ID/SECRET (the v5 code reads either name).
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+AUTH_GOOGLE_ID=
+AUTH_GOOGLE_SECRET=
+
+# --- External services ------------------------------------------------------
+STRIPE_SECRET_KEY=sk_live_replace_me
+STRIPE_PUBLISHABLE_KEY=pk_live_replace_me
+STRIPE_WEBHOOK_SECRET=whsec_replace_me
+
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_USER=apikey
+SMTP_PASSWORD=replace_me
+SMTP_FROM="My App <noreply@example.com>"

deploy/.gitignore

@@ -0,0 +1,6 @@
+# Runtime artefacts written by deploy.sh — do NOT commit these.
+.deploy.lock
+deploy.log
+.postgrest-port
+.nextjs-port
+.env.production

deploy/Dockerfile.nextjs

@@ -0,0 +1,79 @@
+# =============================================================================
+# Dockerfile.nextjs — multi-stage build for the Next.js frontend
+# =============================================================================
+#
+# Production-ready Docker image for Next.js with:
+#   - Multi-stage build for minimal image size
+#   - Standalone server output for containerized deployment
+#   - Non-root user for security
+#   - Health check support
+#
+# Build args (set via --build-arg or docker-compose args):
+#   - NEXT_PUBLIC_API_URL: Public URL for the frontend (inlined at build time)
+#   - NODE_ENV: Environment (defaults to production)
+#
+# Required: next.config.ts must have `output: "standalone"` enabled.
+# =============================================================================
+
+# ── Stage 1: Dependencies ────────────────────────────────────────────────────
+FROM node:20-alpine AS deps
+WORKDIR /app
+
+# Copy package files
+COPY package.json package-lock.json* ./
+
+# Install dependencies
+RUN if [ -f package-lock.json ]; then \
+      npm ci --no-audit --no-fund; \
+    else \
+      npm install --no-audit --no-fund; \
+    fi
+
+# ── Stage 2: Build ───────────────────────────────────────────────────────────
+FROM node:20-alpine AS builder
+WORKDIR /app
+
+# Copy node_modules from deps stage
+COPY --from=deps /app/node_modules ./node_modules
+
+# Copy source files
+COPY . .
+
+# Set build arguments (inlined into client bundle)
+ARG NEXT_PUBLIC_API_URL=http://localhost:3000
+ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
+ARG NODE_ENV=production
+ENV NODE_ENV=${NODE_ENV}
+
+# Build the Next.js application
+RUN npm run build
+
+# ── Stage 3: Runtime ─────────────────────────────────────────────────────────
+FROM node:20-alpine AS runner
+WORKDIR /app
+
+# Set production environment
+ENV NODE_ENV=production
+ENV PORT=3000
+
+# Create non-root user for security
+RUN addgroup --system --gid 1001 nodejs \
+ && adduser --system --uid 1001 nextjs
+
+# Copy standalone server and static assets from builder
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+
+# Expose the port
+EXPOSE 3000
+
+# Switch to non-root user
+USER nextjs
+
+# Health check
+HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=6 \
+  CMD wget -qO- http://localhost:3000/ || exit 1
+
+# Start the standalone server
+CMD ["node", "server.js"]

deploy/Makefile

@@ -0,0 +1,54 @@
+# =============================================================================
+# Makefile — convenience targets around deploy.sh
+# =============================================================================
+# All targets are wrappers; you can also invoke deploy.sh directly.
+
+SHELL := /usr/bin/env bash
+.SHELLFLAGS := -Eeu -o pipefail -c
+.SHELLFLAGS_LOG := $(.SHELLFLAGS)
+
+DEPLOY     := ./deploy.sh
+HEALTH     := ./healthcheck.sh
+WORKSPACE  ?= $(CURDIR)
+
+.PHONY: help
+help: ## Show this help message
+	@awk 'BEGIN {FS = ":.*##"; printf "Targets:\n"} /^[a-zA-Z_-]+:.*##/ { printf "  %-20s %s\n", $$1, $$2 }' $(MAKEFILE_LIST)
+
+.PHONY: deploy
+deploy: ## Run a full deploy (build + up + nginx + healthcheck)
+	$(DEPLOY)
+
+.PHONY: deploy-verbose
+deploy-verbose: ## Deploy with extra logging (PRUNE_IMAGES=0, longer healthcheck)
+	PRUNE_IMAGES=0 HEALTHCHECK_TIMEOUT=120 $(DEPLOY)
+
+.PHONY: health
+health: ## Run a one-shot health check against the running stack
+	WORKSPACE=$(WORKSPACE) $(HEALTH)
+
+.PHONY: health-nginx
+health-nginx: ## Health check including the nginx-fronted URL
+	WORKSPACE=$(WORKSPACE) $(HEALTH) --nginx
+
+.PHONY: status
+status: ## Show current prod ports and running containers
+	@echo "PostgREST port:  $$(cat .postgrest-port 2>/dev/null || echo none)"
+	@echo "Next.js port:    $$(cat .nextjs-port 2>/dev/null || echo none)"
+	@cd deploy && docker compose -p prod-app ps
+
+.PHONY: logs
+logs: ## Tail deploy.log
+	tail -n 200 -f deploy.log
+
+.PHONY: down
+down: ## Stop the production stack (without redeploying)
+	cd deploy && docker compose -p prod-app down --remove-orphans
+
+.PHONY: rollback
+rollback: ## Restart the previous stack (the one whose ports are still on disk)
+	@if [[ ! -f .postgrest-port ]]; then echo "no .postgrest-port to roll back to"; exit 1; fi
+	cd deploy && \
+	  POSTGREST_HOST_PORT=$$(cat ../.postgrest-port) \
+	  NEXTJS_HOST_PORT=$$(cat ../.nextjs-port) \
+	  docker compose -p prod-app --env-file ../.env.production up -d

deploy/deploy.sh

@@ -0,0 +1,429 @@
+#!/usr/bin/env bash
+# =============================================================================
+# deploy.sh — Idempotent PostgREST + Next.js production deploy
+# =============================================================================
+#
+# Self-hosted single-server deploy. Triggered manually, by Gitea webhook, or
+# by a Gitea Actions runner after a push to `main` (or `gitea-sync`).
+#
+# What it does, in order:
+#   1. Acquires an exclusive flock (concurrent deploys die loudly).
+#   2. CLEANUP: stops the dev stack on :3001 and the previous prod stack
+#      (port read from .postgrest-port / .nextjs-port).
+#   3. PORT_SELECTION: picks the lowest free port in [3011..30200] for
+#      PostgREST, then the next free one for the Next.js frontend.
+#   4. BUILD: runs `npm run build` with NEXT_PUBLIC_API_URL exported so it
+#      gets inlined into the client bundle.
+#   5. DEPLOY: writes the chosen ports to .env.production, brings the
+#      compose stack up.
+#   6. NGINX: renders the nginx config from a template (with the current
+#      ports), `nginx -t`s it, and reloads the host systemd nginx.
+#   7. HEALTHCHECK: curls the new stack; if anything is down, rolls back.
+#   8. IMAGE_PRUNE: optional, removes dangling images on success.
+#
+# Files written to the workspace root:
+#   .postgrest-port          current PostgREST host port (atomic)
+#   .nextjs-port             current Next.js host port (atomic)
+#   .env.production          rendered env fed to docker compose
+#   .deploy.lock             flock target
+#   deploy.log               append-only log
+# =============================================================================
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+# -----------------------------------------------------------------------------
+# Configurable variables (override via environment before invoking)
+# -----------------------------------------------------------------------------
+WORKSPACE="${WORKSPACE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+COMPOSE_DIR="${COMPOSE_DIR:-${WORKSPACE}/deploy}"
+COMPOSE_FILE="${COMPOSE_FILE:-${COMPOSE_DIR}/docker-compose.yml}"
+NGINX_TEMPLATE="${NGINX_TEMPLATE:-${COMPOSE_DIR}/nginx.conf.template}"
+NGINX_RENDERED="${NGINX_RENDERED:-/etc/nginx/sites-available/prod-app.conf}"
+NGINX_LINK="${NGINX_LINK:-/etc/nginx/sites-enabled/prod-app.conf}"
+NGINX_OWNER="${NGINX_OWNER:-www-data:www-data}"
+
+PROJECT_NAME="${PROJECT_NAME:-prod-app}"
+POSTGREST_PORT_FILE="${POSTGREST_PORT_FILE:-${WORKSPACE}/.postgrest-port}"
+NEXTJS_PORT_FILE="${NEXTJS_PORT_FILE:-${WORKSPACE}/.nextjs-port}"
+ENV_FILE="${ENV_FILE:-${WORKSPACE}/.env.production}"
+LOCK_FILE="${LOCK_FILE:-${WORKSPACE}/.deploy.lock}"
+LOG_FILE="${LOG_FILE:-${WORKSPACE}/deploy.log}"
+
+DEV_PORT="${DEV_PORT:-3001}"
+PORT_RANGE_START="${PORT_RANGE_START:-3011}"
+PORT_RANGE_END="${PORT_RANGE_END:-30200}"
+HEALTHCHECK_TIMEOUT="${HEALTHCHECK_TIMEOUT:-60}"   # seconds total
+HEALTHCHECK_INTERVAL="${HEALTHCHECK_INTERVAL:-2}"  # seconds between tries
+
+# Image pruning (set PRUNE_IMAGES=0 to skip)
+PRUNE_IMAGES="${PRUNE_IMAGES:-1}"
+
+# Optional: pin the public URL the browser uses. If empty, we default to
+# http://localhost:${POSTGREST_HOST_PORT}. For production with a real domain
+# and nginx in front, set e.g. NEXT_PUBLIC_API_URL=https://app.example.com/api
+NEXT_PUBLIC_API_URL="${NEXT_PUBLIC_API_URL:-}"
+
+# -----------------------------------------------------------------------------
+# Logging — every line is timestamped, tee'd to stdout AND the log file.
+# We replace the shell's fd 1/2 with a tee so any tool that prints (npm, docker,
+# curl) lands in both places automatically.
+# -----------------------------------------------------------------------------
+mkdir -p "$(dirname "$LOG_FILE")"
+exec > >(tee -a "$LOG_FILE") 2>&1
+
+ts()   { date '+%Y-%m-%d %H:%M:%S'; }
+log()  { printf '[%s] %s\n' "$(ts)" "$*"; }
+hr()   { printf '%s\n' '----------------------------------------------------------------'; }
+section() { hr; log "== $* =="; hr; }
+
+# Trap so we always release the lock and surface a useful message.
+on_exit() {
+  local exit_code=$?
+  if (( exit_code != 0 )); then
+    log "DEPLOY FAILED with exit code ${exit_code}"
+    log "See ${LOG_FILE} for full output. Rollback hints:"
+    log "  - Previous port was: ${PREVIOUS_POSTGREST_PORT:-<unknown>}"
+    log "  - Current .postgrest-port value: $(read_port_file "$POSTGREST_PORT_FILE" || echo '<none>')"
+    log "  - To restart the old stack manually:"
+    log "      POSTGREST_HOST_PORT=${PREVIOUS_POSTGREST_PORT:-3011} \\"
+    log "      NEXTJS_HOST_PORT=${PREVIOUS_NEXTJS_PORT:-3012} \\"
+    log "      docker compose -p ${PROJECT_NAME} --env-file ${ENV_FILE} up -d"
+  else
+    log "DEPLOY OK — PostgREST on :${NEW_POSTGREST_PORT}, Next.js on :${NEW_NEXTJS_PORT}"
+  fi
+  # flock on fd 9 releases automatically when the script exits.
+}
+trap on_exit EXIT
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+read_port_file() {
+  # Echo the port in $1, or empty string if missing/garbage.
+  local f="$1"
+  [[ -f "$f" ]] || return 1
+  local v
+  v=$(tr -d '[:space:]' < "$f" 2>/dev/null || true)
+  [[ "$v" =~ ^[0-9]+$ ]] || return 1
+  printf '%s' "$v"
+}
+
+render_template() {
+  # Portable envsubst: replaces $VAR and ${VAR} references in stdin with
+  # values from the current environment. Only the variable names given as
+  # args are expanded (matches `envsubst` behavior). If real envsubst is
+  # available we use it for speed.
+  local vars="$1"
+  if command -v envsubst >/dev/null 2>&1; then
+    envsubst "$vars"
+  else
+    # Build a sed expression like: s/\${VAR}/$VAR/g; s/\bVAR\b/$VAR/g
+    local sed_expr=()
+    for v in $vars; do
+      v="${v#\$}"
+      v="${v#\{}"
+      v="${v%\}}"
+      sed_expr+=( -e "s|\${${v}}|${!v:-}|g" )
+      sed_expr+=( -e "s|\$${v}\b|${!v:-}|g" )
+    done
+    sed "${sed_expr[@]}"
+  fi
+}
+
+is_listening() {
+  # Returns 0 if port $1 has a TCP listener (v4 or v6) on this host.
+  local port="$1"
+  ss -tlnH 2>/dev/null | awk '{print $4}' | grep -Eq "(^|:)${port}$"
+}
+
+next_free_port() {
+  # Walk PORT_RANGE_START..PORT_RANGE_END and return the first port nobody
+  # is listening on. Returns 1 if none are free.
+  local p
+  for (( p = PORT_RANGE_START; p <= PORT_RANGE_END; p++ )); do
+    if ! is_listening "$p"; then
+      printf '%s' "$p"
+      return 0
+    fi
+  done
+  return 1
+}
+
+atomic_write() {
+  # Write stdin to $1 atomically: write to temp, fsync, rename. This is
+  # what lets us use .postgrest-port as a single source of truth — readers
+  # always see either the old value or the new value, never a half-written one.
+  local target="$1"
+  local tmp
+  tmp=$(mktemp "${target}.tmp.XXXXXX")
+  cat > "$tmp"
+  sync
+  mv -f "$tmp" "$target"
+}
+
+free_port() {
+  # Try several strategies to free a port:
+  #   1. docker compose down for our project (idempotent)
+  #   2. brute-force kill of any process bound to the port
+  local port="$1" label="$2"
+  if [[ -z "$port" ]]; then return 0; fi
+  log "  ${label} port ${port}: stopping project '${PROJECT_NAME}' (if up)"
+  ( cd "$COMPOSE_DIR" && docker compose -p "$PROJECT_NAME" down --remove-orphans --timeout 10 ) \
+    >/dev/null 2>&1 || true
+
+  if is_listening "$port"; then
+    log "  ${label} port ${port}: still listening, attempting pkill"
+    # fuser prints PIDs holding the port; xargs kills them.
+    local pids
+    pids=$(fuser -n tcp "$port" 2>/dev/null | tr -d '[:space:]' || true)
+    if [[ -n "$pids" ]]; then
+      # shellcheck disable=SC2086
+      kill $pids 2>/dev/null || true
+      sleep 1
+      pids=$(fuser -n tcp "$port" 2>/dev/null | tr -d '[:space:]' || true)
+      [[ -n "$pids" ]] && kill -9 $pids 2>/dev/null || true
+    fi
+  fi
+  if is_listening "$port"; then
+    log "  ${label} port ${port}: WARNING — still in use after cleanup"
+    return 1
+  fi
+  log "  ${label} port ${port}: free"
+  return 0
+}
+
+healthcheck() {
+  # Hit $1 (URL) until it returns 2xx within HEALTHCHECK_TIMEOUT seconds.
+  local url="$1" label="$2" elapsed=0
+  log "  ${label}: ${url}"
+  while (( elapsed < HEALTHCHECK_TIMEOUT )); do
+    if curl -fsS --max-time 5 -o /dev/null "$url"; then
+      log "  ${label}: OK (after ${elapsed}s)"
+      return 0
+    fi
+    sleep "$HEALTHCHECK_INTERVAL"
+    elapsed=$(( elapsed + HEALTHCHECK_INTERVAL ))
+  done
+  log "  ${label}: FAILED after ${HEALTHCHECK_TIMEOUT}s"
+  return 1
+}
+
+# -----------------------------------------------------------------------------
+# Lock — refuse to run if another deploy is in flight.
+# -----------------------------------------------------------------------------
+section "LOCK"
+exec 9>"$LOCK_FILE"
+if ! flock -n 9; then
+  log "Another deploy holds ${LOCK_FILE}. Exiting."
+  exit 1
+fi
+log "Acquired exclusive lock on ${LOCK_FILE}"
+
+# -----------------------------------------------------------------------------
+# 0. Banner
+# -----------------------------------------------------------------------------
+section "DEPLOY START"
+log "Workspace:    ${WORKSPACE}"
+log "Project:      ${PROJECT_NAME}"
+log "Compose:      ${COMPOSE_FILE}"
+log "Nginx tpl:    ${NGINX_TEMPLATE}"
+log "Port range:   ${PORT_RANGE_START}..${PORT_RANGE_END}"
+log "Caller:       ${USER:-<unknown>}@$(hostname)"
+
+# -----------------------------------------------------------------------------
+# 1. CLEANUP — port 3001 (dev) and the previous prod ports.
+# -----------------------------------------------------------------------------
+section "CLEANUP"
+
+free_port "$DEV_PORT" "dev"
+PREVIOUS_POSTGREST_PORT=$(read_port_file "$POSTGREST_PORT_FILE" || true)
+PREVIOUS_NEXTJS_PORT=$(read_port_file "$NEXTJS_PORT_FILE" || true)
+log "Previous prod ports: PostgREST=${PREVIOUS_POSTGREST_PORT:-<none>} Next.js=${PREVIOUS_NEXTJS_PORT:-<none>}"
+
+# Stale-port guard: if the file points to a port that is NOT in our standard
+# range, or to a port that nothing is listening on anymore, we still tear
+# down the project (cheap) but we don't try to free the port itself —
+# someone else might be using it.
+free_port "${PREVIOUS_POSTGREST_PORT:-}" "prev-postgrest"
+free_port "${PREVIOUS_NEXTJS_PORT:-}"   "prev-nextjs"
+
+# -----------------------------------------------------------------------------
+# 2. PORT_SELECTION — find the two lowest free ports.
+# -----------------------------------------------------------------------------
+section "PORT_SELECTION"
+
+NEW_POSTGREST_PORT=$(next_free_port) || {
+  log "No free port in [${PORT_RANGE_START}..${PORT_RANGE_END}]. Bailing out."
+  exit 2
+}
+log "PostgREST: ${NEW_POSTGREST_PORT}"
+
+# Re-check after allocation, since we want distinct ports for both services.
+NEW_NEXTJS_PORT=""
+for (( p = PORT_RANGE_START; p <= PORT_RANGE_END; p++ )); do
+  if (( p == NEW_POSTGREST_PORT )); then continue; fi
+  if ! is_listening "$p"; then NEW_NEXTJS_PORT="$p"; break; fi
+done
+if [[ -z "$NEW_NEXTJS_PORT" ]]; then
+  log "No free port for Next.js after allocating ${NEW_POSTGREST_PORT}. Bailing out."
+  exit 2
+fi
+log "Next.js:   ${NEW_NEXTJS_PORT}"
+
+# -----------------------------------------------------------------------------
+# 3. BUILD — Next.js, with NEXT_PUBLIC_API_URL inlined into the client bundle.
+# -----------------------------------------------------------------------------
+section "BUILD"
+
+cd "$WORKSPACE"
+
+# Default the public API URL the browser will see.
+if [[ -z "$NEXT_PUBLIC_API_URL" ]]; then
+  NEXT_PUBLIC_API_URL="http://localhost:${NEW_POSTGREST_PORT}"
+fi
+log "NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}"
+
+# Node-only check: don't try to build if there's no package.json.
+if [[ -f package.json ]]; then
+  # Make sure the deps are present (idempotent — npm ci is a no-op when locked).
+  if [[ -f package-lock.json ]]; then
+    log "npm ci (locked install)"
+    npm ci --no-audit --no-fund
+  else
+    log "npm install (no lockfile present — consider committing package-lock.json)"
+    npm install --no-audit --no-fund
+  fi
+  log "npm run build"
+  NEXT_PUBLIC_API_URL="$NEXT_PUBLIC_API_URL" \
+  POSTGREST_HOST_PORT="$NEW_POSTGREST_PORT" \
+  NEXTJS_HOST_PORT="$NEW_NEXTJS_PORT" \
+    npm run build
+else
+  log "No package.json in ${WORKSPACE} — skipping build step."
+fi
+
+# -----------------------------------------------------------------------------
+# 4. ENV FILE — render .env.production for the running containers.
+# -----------------------------------------------------------------------------
+section "ENV"
+
+# Preserve any pre-existing secrets in .env.production. We only own the lines
+# we write; everything else is left alone. (The simplest sane strategy.)
+SECRETS_FILE=""
+if [[ -f "$ENV_FILE" ]]; then
+  SECRETS_FILE=$(mktemp)
+  # Drop any lines we manage; keep the rest verbatim.
+  grep -v -E '^(POSTGREST_HOST_PORT|NEXTJS_HOST_PORT|NEXT_PUBLIC_API_URL)=' \
+    "$ENV_FILE" > "$SECRETS_FILE" || true
+fi
+
+{
+  printf '# Generated by deploy.sh on %s — safe to edit, lines below are managed\n' "$(ts)"
+  printf 'POSTGREST_HOST_PORT=%s\n' "$NEW_POSTGREST_PORT"
+  printf 'NEXTJS_HOST_PORT=%s\n'     "$NEW_NEXTJS_PORT"
+  printf 'NEXT_PUBLIC_API_URL=%q\n'  "$NEXT_PUBLIC_API_URL"
+  if [[ -n "$SECRETS_FILE" ]]; then
+    cat "$SECRETS_FILE"
+    rm -f "$SECRETS_FILE"
+  fi
+} > "${ENV_FILE}.new"
+
+mv -f "${ENV_FILE}.new" "$ENV_FILE"
+chmod 600 "$ENV_FILE"
+log "Wrote ${ENV_FILE}"
+
+# -----------------------------------------------------------------------------
+# 5. DEPLOY — bring the stack up.
+# -----------------------------------------------------------------------------
+section "DEPLOY"
+
+cd "$COMPOSE_DIR"
+log "docker compose -p ${PROJECT_NAME} up -d --build"
+docker compose -p "$PROJECT_NAME" --env-file "$ENV_FILE" up -d --build
+
+# -----------------------------------------------------------------------------
+# 6. NGINX — render config from template, test, reload.
+# -----------------------------------------------------------------------------
+section "NGINX"
+
+if [[ -f "$NGINX_TEMPLATE" ]]; then
+  POSTGREST_HOST_PORT="$NEW_POSTGREST_PORT" \
+  NEXTJS_HOST_PORT="$NEW_NEXTJS_PORT" \
+  NEXT_PUBLIC_API_URL="$NEXT_PUBLIC_API_URL" \
+    render_template '${POSTGREST_HOST_PORT} ${NEXTJS_HOST_PORT} ${NEXT_PUBLIC_API_URL}' \
+      < "$NGINX_TEMPLATE" > "$NGINX_RENDERED"
+
+  log "Rendered: ${NGINX_RENDERED}"
+  chown "$NGINX_OWNER" "$NGINX_RENDERED" 2>/dev/null || true
+  chmod 644 "$NGINX_RENDERED"
+
+  # Wire it into sites-enabled if not already linked.
+  if [[ ! -L "$NGINX_LINK" && ! -e "$NGINX_LINK" ]]; then
+    log "Enabling site: ${NGINX_LINK} -> ${NGINX_RENDERED}"
+    ln -s "$NGINX_RENDERED" "$NGINX_LINK"
+  fi
+
+  log "nginx -t"
+  nginx -t
+  log "systemctl reload nginx"
+  systemctl reload nginx
+else
+  log "No nginx template at ${NGINX_TEMPLATE} — skipping reverse proxy step."
+fi
+
+# -----------------------------------------------------------------------------
+# 7. HEALTHCHECK — direct + via nginx (when applicable).
+# -----------------------------------------------------------------------------
+section "HEALTHCHECK"
+
+# Direct checks (bypass nginx, catch compose issues)
+healthcheck "http://127.0.0.1:${NEW_POSTGREST_PORT}/" "postgrest-direct" || ROLLBACK=1
+healthcheck "http://127.0.0.1:${NEW_NEXTJS_PORT}/"     "nextjs-direct"   || ROLLBACK=1
+
+# nginx-fronted check (only meaningful if nginx template exists)
+if [[ -f "$NGINX_TEMPLATE" && "${ROLLBACK:-0}" != "1" ]]; then
+  healthcheck "http://127.0.0.1/" "nginx-front" || ROLLBACK=1
+fi
+
+if [[ "${ROLLBACK:-0}" == "1" ]]; then
+  log "HEALTHCHECK FAILED — rolling back."
+  log "Tearing down the new stack on :${NEW_POSTGREST_PORT} / :${NEW_NEXTJS_PORT}"
+  docker compose -p "$PROJECT_NAME" --env-file "$ENV_FILE" down --remove-orphans --timeout 10 || true
+
+  # If we had a previous port file, the old one is still on disk (we wrote
+  # the new one to .new and only mv'd on success... but we DID mv already,
+  # so re-write the old value).
+  if [[ -n "${PREVIOUS_POSTGREST_PORT:-}" ]]; then
+    printf '%s\n' "$PREVIOUS_POSTGREST_PORT" | atomic_write "$POSTGREST_PORT_FILE"
+  else
+    rm -f "$POSTGREST_PORT_FILE"
+  fi
+  if [[ -n "${PREVIOUS_NEXTJS_PORT:-}" ]]; then
+    printf '%s\n' "$PREVIOUS_NEXTJS_PORT" | atomic_write "$NEXTJS_PORT_FILE"
+  else
+    rm -f "$NEXTJS_PORT_FILE"
+  fi
+  exit 3
+fi
+
+# -----------------------------------------------------------------------------
+# 8. PERSIST — commit the chosen ports as the new single source of truth.
+#    (Done AFTER healthcheck so a failed deploy doesn't clobber the old one.)
+# -----------------------------------------------------------------------------
+section "PERSIST"
+printf '%s\n' "$NEW_POSTGREST_PORT" | atomic_write "$POSTGREST_PORT_FILE"
+printf '%s\n' "$NEW_NEXTJS_PORT"    | atomic_write "$NEXTJS_PORT_FILE"
+log ".postgrest-port = ${NEW_POSTGREST_PORT}"
+log ".nextjs-port    = ${NEW_NEXTJS_PORT}"
+
+# -----------------------------------------------------------------------------
+# 9. IMAGE_PRUNE — optional housekeeping.
+# -----------------------------------------------------------------------------
+if [[ "$PRUNE_IMAGES" == "1" ]]; then
+  section "IMAGE_PRUNE"
+  docker image prune -f
+fi
+
+section "DONE"
+exit 0

deploy/docker-compose.yml

@@ -0,0 +1,72 @@
+# =============================================================================
+# docker-compose.yml — production stack consumed by deploy.sh
+# =============================================================================
+#
+# Complete Docker stack for production deployment:
+#   - Next.js frontend (Node.js standalone server)
+#   - PostgREST API (optional, for direct PostgreSQL access)
+#
+# Postgres itself runs on the host (the deploy workflow applies migrations
+# via `psql -h 127.0.0.1`). Next.js can also run under PM2 on the host —
+# this compose file provides a Docker alternative for the frontend.
+#
+# The host-side ports are written by the deploy workflow into $APP_DIR/.env.
+# We interpolate from there with ${VAR:-default} so a manual
+# `docker compose up` without the deploy script still works.
+# =============================================================================
+
+name: prod-app  # default project name; deploy.sh overrides with -p
+
+services:
+  # ── Next.js Frontend ──────────────────────────────────────────────────────────
+  nextjs:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.nextjs
+      args:
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
+        NODE_ENV: production
+    container_name: prod-app-nextjs
+    restart: unless-stopped
+    ports:
+      - "${NEXTJS_HOST_PORT:-3000}:3000"
+    environment:
+      NODE_ENV: production
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
+      DATABASE_URL: ${DATABASE_URL}
+      # Pass other env vars as needed
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 30s
+    # Volume mount for hot-reload in development (comment out for production)
+    # volumes:
+    #   - ../src:/app/src:ro
+
+  # ── PostgREST (optional direct PostgreSQL access) ────────────────────────────
+  postgrest:
+    image: postgrest/postgrest:latest
+    container_name: prod-app-postgrest
+    restart: unless-stopped
+    # The host port is dynamic. The container always listens on 3000.
+    ports:
+      - "${POSTGREST_HOST_PORT:-3011}:3000"
+    environment:
+      PGRST_DB_URI: ${PGRST_DB_URI}
+      PGRST_DB_ANON_ROLE: ${PGRST_DB_ANON_ROLE:-anon}
+      PGRST_DB_SCHEMA: ${PGRST_DB_SCHEMA:-public}
+      PGRST_SERVER_PORT: 3000
+      # Optional: tighten CORS for your real domain
+      PGRST_DB_TXN_END: "commit-allow-overwrite"
+    depends_on:
+      nextjs:
+        condition: service_healthy
+    # Healthcheck lets `docker compose ps` show healthy state.
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
+      interval: 10s
+      timeout: 3s
+      retries: 6
+

deploy/healthcheck.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# =============================================================================
+# healthcheck.sh — standalone, callable from cron / monitoring
+# =============================================================================
+#
+# Reads the current prod ports from .postgrest-port / .nextjs-port and curls
+# each service. Exit code is the count of failed checks (0 = all healthy).
+#
+# Usage:
+#   ./healthcheck.sh
+#   ./healthcheck.sh --nginx      # also check the fronted URL
+#   WORKSPACE=/srv/app ./healthcheck.sh
+# =============================================================================
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+
+WORKSPACE="${WORKSPACE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+POSTGREST_PORT_FILE="${POSTGREST_PORT_FILE:-${WORKSPACE}/.postgrest-port}"
+NEXTJS_PORT_FILE="${NEXTJS_PORT_FILE:-${WORKSPACE}/.nextjs-port}"
+TIMEOUT="${HEALTHCHECK_TIMEOUT:-5}"
+
+failures=0
+
+check() {
+  local label="$1" url="$2"
+  if curl -fsS --max-time "$TIMEOUT" -o /dev/null "$url"; then
+    printf '  [ OK ] %-20s %s\n' "$label" "$url"
+  else
+    printf '  [FAIL] %-20s %s\n' "$label" "$url"
+    failures=$(( failures + 1 ))
+  fi
+}
+
+pgrest_port=$(tr -d '[:space:]' < "$POSTGREST_PORT_FILE" 2>/dev/null || echo "")
+next_port=$(tr -d '[:space:]' < "$NEXTJS_PORT_FILE" 2>/dev/null || echo "")
+
+if [[ -n "$pgrest_port" ]]; then
+  check "postgrest" "http://127.0.0.1:${pgrest_port}/"
+else
+  printf '  [SKIP] postgrest          (no .postgrest-port)\n'
+fi
+
+if [[ -n "$next_port" ]]; then
+  check "nextjs"    "http://127.0.0.1:${next_port}/"
+else
+  printf '  [SKIP] nextjs             (no .nextjs-port)\n'
+fi
+
+if [[ "${1:-}" == "--nginx" ]]; then
+  check "nginx" "http://127.0.0.1/"
+fi
+
+exit "$failures"

deploy/nginx.conf.template

@@ -0,0 +1,89 @@
+# =============================================================================
+# nginx.conf.template — rendered by deploy.sh on every deploy
+# =============================================================================
+#
+# Variables substituted by `envsubst`:
+#   ${POSTGREST_HOST_PORT}  dynamic host port of the PostgREST container
+#   ${NEXTJS_HOST_PORT}     dynamic host port of the Next.js container
+#   ${NEXT_PUBLIC_API_URL}  (informational only — used in comment header)
+#
+# Layout:
+#   /api/*  -> http://127.0.0.1:${POSTGREST_HOST_PORT}
+#   /*      -> http://127.0.0.1:${NEXTJS_HOST_PORT}
+#
+# Tested against nginx >= 1.18 (Debian 11 / Ubuntu 22.04). Adjust ssl_*
+# lines if you don't have a cert yet — deploy.sh only tests/renders, the
+# operator decides whether to terminate TLS here.
+# =============================================================================
+
+# --- upstream definitions ---------------------------------------------------
+upstream postgrest_upstream {
+    server 127.0.0.1:${POSTGREST_HOST_PORT};
+    keepalive 16;
+}
+
+upstream nextjs_upstream {
+    server 127.0.0.1:${NEXTJS_HOST_PORT};
+    keepalive 16;
+}
+
+# --- HTTP -> HTTPS upgrade (optional; remove if you only run on LAN) --------
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    # ACME http-01 challenge needs to be served on port 80.
+    location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+    }
+
+    # Redirect everything else to HTTPS. Comment out for plain-HTTP dev.
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# --- main server block ------------------------------------------------------
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name _;
+
+    # --- TLS (uncomment + adjust after you obtain a cert) ------------------
+    # ssl_certificate     /etc/letsencrypt/live/YOUR_DOMAIN/fullchain.pem;
+    # ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN/privkey.pem;
+    # ssl_protocols       TLSv1.2 TLSv1.3;
+    # ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    # --- sensible defaults ------------------------------------------------
+    client_max_body_size 25m;
+    proxy_http_version 1.1;
+    proxy_set_header   Host              $host;
+    proxy_set_header   X-Real-IP         $remote_addr;
+    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header   X-Forwarded-Proto $scheme;
+    proxy_set_header   X-Forwarded-Host  $host;
+    proxy_set_header   Connection        "";
+
+    # --- API: /api/* -> PostgREST ----------------------------------------
+    location /api/ {
+        proxy_pass http://postgrest_upstream;
+        proxy_read_timeout 60s;
+        proxy_send_timeout 60s;
+    }
+
+    # PostgREST exposes its OpenAPI spec at the root of the API; expose it
+    # under a stable URL too.
+    location = /api {
+        proxy_pass http://postgrest_upstream;
+    }
+
+    # --- everything else -> Next.js --------------------------------------
+    location / {
+        proxy_pass http://nextjs_upstream;
+        proxy_read_timeout 120s;
+        proxy_send_timeout 120s;
+    }
+}

docker-compose.yml

@@ -1,83 +0,0 @@
-services:
-  db:
-    image: postgres:16-alpine
-    container_name: route_commerce_db
-    restart: unless-stopped
-    env_file:
-      - .env
-    environment:
-      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
-      POSTGRES_DB: ${POSTGRES_DB}
-    volumes:
-      - db_data:/var/lib/postgresql/data
-    ports:
-      - "127.0.0.1:5432:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-      start_period: 10s
-
-  postgrest:
-    image: postgrest/postgrest:v12.2.3
-    container_name: route_commerce_postgrest
-    restart: unless-stopped
-    depends_on:
-      db:
-        condition: service_healthy
-    environment:
-      PGRST_DB_URI: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
-      PGRST_DB_SCHEMA: public
-      PGRST_DB_ANON_ROLE: ${POSTGRES_USER}
-      PGRST_SERVER_PORT: 3001
-      PGRST_SERVER_HOST: 0.0.0.0
-      PGRST_OPENAPI_MODE: disabled
-      PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
-    ports:
-      - "127.0.0.1:3001:3001"
-
-  minio:
-    image: minio/minio:latest
-    container_name: route_commerce_minio
-    restart: unless-stopped
-    env_file:
-      - .env
-    environment:
-      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
-    command: server /data --console-address ":9001"
-    volumes:
-      - minio_data:/data
-    ports:
-      - "127.0.0.1:9000:9000"
-      - "127.0.0.1:9001:9001"
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
-  minio_init:
-    image: minio/mc:latest
-    depends_on:
-      minio:
-        condition: service_healthy
-    env_file:
-      - .env
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        mc alias set local http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}
-        for b in brand-logos product-images contacts-imports videos water-photos; do
-          mc mb --ignore-existing local/$${b}
-          mc anonymous set download local/$${b}
-        done
-    profiles: ["init"]
-
-volumes:
-  db_data:
-    driver: local
-  minio_data:
-    driver: local

docs/NESTED_LAYOUTS.md

@@ -0,0 +1,255 @@
+# Nested Layout Skeleton
+
+Visual map of how pages nest inside each other in the Next.js App Router.
+Each level persists across navigation — children swap, parents stay.
+
+## Mental model
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│ app/layout.tsx              (root)                              │
+│   html / body / fonts / Providers / Toast / CookieBanner        │
+│   ─────────────────────────────────────────────────────────     │
+│   No global header. Each route group renders its own chrome.    │
+└─────────────────────────────────────────────────────────────────┘
+                                  │
+        ┌─────────────────────────┼─────────────────────────────┐
+        │                         │                             │
+        ▼                         ▼                             ▼
+   Public routes            Storefronts                   Admin
+   (/, /pricing,            (/tuxedo/*,                   (/admin/*)
+    /contact, /login)        /indian-river-direct/*)
+```
+
+## Full tree
+
+```
+src/app/
+├── layout.tsx ────────────────────────────────────────────────── [ROOT]
+│   • <html>, <body>
+│   • next/font: Fraunces (display), Manrope (sans), Fragment_Mono
+│   • <Providers> (theme, posthog, sentry, etc.)
+│   • <ToastNotificationContainer />
+│   • <CookieConsentBanner />
+│   ─── pages render INSIDE ───
+│   │
+│   ├── error.tsx              [ROOT-LEVEL] Atelier error page
+│   ├── loading.tsx            [ROOT-LEVEL] "Preparing your harvest"
+│   ├── not-found.tsx          [ROOT-LEVEL] "Off the beaten path"
+│   │
+│   ├── page.tsx               /                  LandingPageClient
+│   │   └── renders its own SiteHeader + Hero + SiteFooter
+│   │
+│   ├── login/
+│   │   ├── page.tsx           /login             LoginClient (standalone)
+│   │   └── loading.tsx        [isolated]
+│   │
+│   ├── cart/
+│   │   ├── page.tsx           /cart              CartClient (standalone)
+│   │   └── loading.tsx
+│   │
+│   ├── checkout/
+│   │   ├── page.tsx           /checkout          CheckoutClient (standalone)
+│   │   ├── loading.tsx
+│   │   └── success/page.tsx   /checkout/success
+│   │
+│   ├── change-password/page.tsx
+│   ├── pricing/page.tsx       + loading.tsx
+│   ├── contact/page.tsx       + loading.tsx
+│   ├── blog/page.tsx
+│   ├── changelog/page.tsx
+│   ├── roadmap/page.tsx
+│   ├── waitlist/page.tsx
+│   ├── security/page.tsx
+│   ├── privacy-policy/page.tsx
+│   ├── terms-and-conditions/page.tsx
+│   ├── maintenance/page.tsx
+│   │
+│   ├── ─── STOREFRONTS ─────────────────────────────────────────
+│   │
+│   ├── tuxedo/
+│   │   ├── layout.tsx ─────────────────────── [TUXEDO CHROME]
+│   │   │   • Dark emerald gradient backdrop
+│   │   │   • Ambient emerald orb (top-right blur)
+│   │   │   • <StorefrontHeader> + <StorefrontFooter> per page
+│   │   │   • BreadcrumbList + LocalBusiness JSON-LD in metadata
+│   │   │   ─── INSIDE ───
+│   │   │   ├── error.tsx
+│   │   │   ├── loading.tsx
+│   │   │   ├── page.tsx                   /tuxedo
+│   │   │   ├── stops/
+│   │   │   │   ├── page.tsx               /tuxedo/stops
+│   │   │   │   ├── loading.tsx
+│   │   │   │   └── [slug]/
+│   │   │   │       ├── page.tsx           /tuxedo/stops/:slug
+│   │   │   │       ├── error.tsx
+│   │   │   │       └── loading.tsx
+│   │   │   ├── about/
+│   │   │   │   ├── layout.tsx
+│   │   │   │   ├── page.tsx               /tuxedo/about
+│   │   │   │   ├── error.tsx
+│   │   │   │   └── loading.tsx
+│   │   │   ├── faq/
+│   │   │   │   ├── layout.tsx
+│   │   │   │   ├── page.tsx               /tuxedo/faq
+│   │   │   │   ├── error.tsx
+│   │   │   │   └── loading.tsx
+│   │   │   ├── contact/
+│   │   │   │   ├── layout.tsx
+│   │   │   │   ├── page.tsx               /tuxedo/contact
+│   │   │   │   ├── error.tsx
+│   │   │   │   └── loading.tsx
+│   │   │   ├── products/
+│   │   │   │   └── [slug]/page.tsx        /tuxedo/products/:slug
+│   │   │   └── time-clock/page.tsx        /tuxedo/time-clock
+│   │
+│   ├── indian-river-direct/
+│   │   ├── layout.tsx ─────────────────── [IRD CHROME]
+│   │   │   • Light blue/white glass gradient backdrop
+│   │   │   • Three decorative blue orbs
+│   │   │   • <StorefrontHeader> + <StorefrontFooter> per page
+│   │   │   • LocalBusiness (FL, family-owned 1985) JSON-LD
+│   │   │   ─── INSIDE ───
+│   │   │   ├── error.tsx
+│   │   │   ├── loading.tsx
+│   │   │   ├── page.tsx                   /indian-river-direct
+│   │   │   ├── stops/
+│   │   │   │   ├── page.tsx
+│   │   │   │   └── [slug]/
+│   │   │   │       ├── page.tsx
+│   │   │   │       ├── error.tsx
+│   │   │   │       └── loading.tsx
+│   │   │   ├── about/   (layout + page + error + loading)
+│   │   │   ├── faq/     (layout + page + error + loading)
+│   │   │   └── contact/ (layout + page + error + loading)
+│   │
+│   ├── ─── ADMIN ──────────────────────────────────────────────
+│   │
+│   └── admin/
+│       ├── layout.tsx ───────────────────── [ADMIN SHELL]
+│       │   • dynamic = "force-dynamic"  (reads cookies)
+│       │   • getAdminUser() → AdminSidebar + content area
+│       │   • ToastProvider + ToastContainer
+│       │   • Sidebar persists across all /admin/* routes
+│       │   • Parchment background via .admin-section
+│       │   ─── INSIDE ───
+│       │   ├── error.tsx                  Admin error page
+│       │   ├── loading.tsx                Skeleton: header + stats + table
+│       │   ├── page.tsx                   /admin  (Dashboard)
+│       │   │
+│       │   ├── orders/
+│       │   │   ├── page.tsx               /admin/orders
+│       │   │   ├── [id]/page.tsx          /admin/orders/:id
+│       │   │   └── new/page.tsx           /admin/orders/new
+│       │   │
+│       │   ├── products/
+│       │   │   ├── page.tsx               /admin/products
+│       │   │   ├── [id]/page.tsx
+│       │   │   ├── new/page.tsx
+│       │   │   └── import/page.tsx
+│       │   │
+│       │   ├── stops/
+│       │   │   ├── page.tsx               /admin/stops
+│       │   │   ├── [id]/page.tsx
+│       │   │   └── new/page.tsx
+│       │   │
+│       │   ├── communications/
+│       │   │   ├── loading.tsx
+│       │   │   ├── page.tsx               /admin/communications
+│       │   │   ├── compose/page.tsx
+│       │   │   ├── campaigns/[id]/page.tsx
+│       │   │   ├── contacts/page.tsx
+│       │   │   ├── logs/page.tsx
+│       │   │   ├── segments/page.tsx
+│       │   │   ├── settings/page.tsx
+│       │   │   ├── templates/page.tsx
+│       │   │   ├── templates/[id]/page.tsx
+│       │   │   ├── analytics/page.tsx
+│       │   │   ├── abandoned-carts/page.tsx
+│       │   │   └── welcome-sequence/page.tsx
+│       │   │
+│       │   ├── settings/  (sub-tree of 13 pages: billing, brand,
+│       │   │                payments, shipping, ai, apps,
+│       │   │                integrations, square-sync, ...)
+│       │   │
+│       │   ├── route-trace/  (lots, lookup, settings)
+│       │   ├── me/
+│       │   ├── pickup/                  Store-employee landing
+│       │   ├── sales/import/
+│       │   ├── import/
+│       │   ├── analytics/
+│       │   ├── command-center/
+│       │   ├── advanced/
+│       │   ├── reports/
+│       │   ├── shipping/
+│       │   ├── taxes/
+│       │   ├── time-tracking/
+│       │   ├── water-log/  (sub-tree)
+│       │   ├── wholesale/
+│       │   └── launch-checklist/
+│       │
+│       ├── wholesale/         (separate sub-app, not under admin/layout)
+│       │   ├── login/page.tsx
+│       │   ├── portal/page.tsx
+│       │   ├── register/page.tsx
+│       │   ├── employee/page.tsx
+│       │   └── payment/{success,cancel}/page.tsx
+│       │
+│       ├── water/             (separate sub-app, not under admin/layout)
+│       │   ├── page.tsx
+│       │   ├── loading.tsx
+│       │   └── admin/  (login + page)
+│       │
+│       ├── ird/time-clock/    (time-clock for IRD employees)
+│       ├── trace/[lotNumber]/page.tsx     (public route-trace lookup)
+│       └── protected-example/page.tsx     (smoke test for middleware)
+```
+
+## Key nesting rules
+
+1. **The root `app/layout.tsx` is the only one that renders `<html>` and `<body>`**. Every other layout is a child of it.
+2. **A `layout.tsx` in a folder wraps every `page.tsx` in that folder and all subfolders**. Children swap; layout state persists.
+3. **`loading.tsx` and `error.tsx` are per-folder** — Next.js shows them when navigating to a sibling `page.tsx`. They re-render as you move between sections.
+4. **Storefronts are fully isolated**: each `tuxedo/layout.tsx` and `indian-river-direct/layout.tsx` provides its own backdrop and lets individual pages render their own `StorefrontHeader` / `StorefrontFooter`.
+5. **Admin is a single SPA-feeling shell**: navigating between `/admin/orders` and `/admin/products` keeps the `AdminSidebar` mounted, only the content area swaps.
+
+## Things that DO NOT yet nest (gaps)
+
+| Page | Issue | Fix |
+|---|---|---|
+| `/cart` | No shared layout with `/checkout` | Add `app/(shop)/layout.tsx` route group to wrap both |
+| `/wholesale/*` | Wholesale pages have no shared layout | Add `app/wholesale/layout.tsx` with auth gate + nav |
+| `/water/*` | Water pages have no shared layout | Add `app/water/layout.tsx` |
+| `/admin/communications/*` | 13 pages share no sub-layout | Could add `app/admin/communications/layout.tsx` with section tabs |
+| `/admin/settings/*` | 13 settings pages share no sub-layout | Add `app/admin/settings/layout.tsx` with settings sidebar |
+
+## How to add a nested layout
+
+```bash
+# Example: add a settings sub-layout
+mkdir -p src/app/admin/settings
+# Create src/app/admin/settings/layout.tsx
+# It will wrap every page under /admin/settings/* automatically.
+```
+
+```tsx
+// src/app/admin/settings/layout.tsx
+export default function SettingsLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <div className="grid grid-cols-1 lg:grid-cols-[14rem_1fr] gap-6">
+      <SettingsNav />     {/* sticks while content swaps */}
+      <section>{children}</section>
+    </div>
+  );
+}
+```
+
+## How to add parallel routes (modals as overlays)
+
+```bash
+mkdir -p 'src/app/@modal'
+mkdir -p 'src/app/admin/products/(.)new'   # intercepts /admin/products/new
+# Layout returns <>{children}{modal}</>
+```
+
+This makes `/admin/products/new` open as a modal over `/admin/products` instead of a hard navigation.

docs/SUPABASE_DUMP_GUIDE.md

@@ -1,312 +0,0 @@
-# Supabase Dump & Restore Guide
-
-This guide is the runbook for capturing the real Supabase schema and data
-and restoring it to a local Postgres database. It documents the exact
-steps that worked when the spend cap was removed on 2026-06-05.
-
-## Connection (this works from the dev box)
-
-The Supabase project `wnzkhezyhnfzhkhiflrp` (route-commerce) is hosted in
-**East US (North Virginia)**. The dev box has no IPv6, so we must use
-the **Supavisor pooler** (IPv4 only) — and it's on **`aws-1`**, not `aws-0`.
-
-```bash
-# Working pooler URL (from supabase/.temp/pooler-url)
-postgresql://postgres.wnzkhezyhnfzhkhiflrp:YLKzP9jz2yqop7jr@aws-1-us-east-1.pooler.supabase.com:5432/postgres
-```
-
-The `aws-0-us-east-1.pooler.supabase.com` hostname resolves over IPv4
-but Supavisor returns "tenant/user not found" because the project lives
-on `aws-1`. The correct region number is non-obvious — always check
-`supabase/.temp/pooler-url` for the actual endpoint.
-
-The direct hostname `db.wnzkhezyhnfzhkhiflrp.supabase.co` only resolves
-over IPv6, which is unreachable from this dev box.
-
-## pg_dump version
-
-Supabase runs **PostgreSQL 17.6**. Local pg must be ≥ 17 to dump cleanly.
-The dev box had pg 16 by default — install pg 17 client:
-
-```bash
-echo "deb [signed-by=/usr/share/keyrings/pgdg.gpg] http://apt.postgresql.org/pub/repos/apt/ noble-pgdg main" \
-  | sudo tee /etc/apt/sources.list.d/pgdg.list
-sudo apt-get update
-sudo apt-get install -y --allow-unauthenticated postgresql-client-17
-# Use /usr/lib/postgresql/17/bin/pg_dump explicitly (or update PATH)
-```
-
-## Capture Schema
-
-```bash
-export PGPASSWORD="YLKzP9jz2yqop7jr"
-export PATH="/usr/lib/postgresql/17/bin:$PATH"
-
-mkdir -p supabase/captured
-pg_dump \
-  --host=aws-1-us-east-1.pooler.supabase.com \
-  --port=5432 \
-  --username=postgres.wnzkhezyhnfzhkhiflrp \
-  --dbname=postgres \
-  --schema-only \
-  --no-owner \
-  --no-privileges \
-  --no-acl \
-  --exclude-schema=auth \
-  --exclude-schema=storage \
-  --exclude-schema=realtime \
-  --exclude-schema=supabase_functions \
-  --exclude-schema=graphql \
-  --exclude-schema=graphql_public \
-  --exclude-schema=pgsodium \
-  --exclude-schema=pgsodium_masks \
-  --exclude-schema=extensions \
-  --exclude-schema=pgbouncer \
-  --exclude-schema=supabase_migrations \
-  --exclude-schema=net \
-  --exclude-schema=vault \
-  --file=supabase/captured/captured_schema.sql
-```
-
-Captured schema is ~540KB, 65 tables, 252 functions.
-
-## Capture Data
-
-```bash
-pg_dump \
-  --host=aws-1-us-east-1.pooler.supabase.com \
-  --port=5432 \
-  --username=postgres.wnzkhezyhnfzhkhiflrp \
-  --dbname=postgres \
-  --data-only \
-  --no-owner \
-  --no-privileges \
-  --no-acl \
-  --disable-triggers \
-  --exclude-schema=auth \
-  --exclude-schema=storage \
-  --exclude-schema=realtime \
-  --exclude-schema=supabase_functions \
-  --exclude-schema=graphql \
-  --exclude-schema=graphql_public \
-  --exclude-schema=pgsodium \
-  --exclude-schema=pgsodium_masks \
-  --exclude-schema=extensions \
-  --exclude-schema=pgbouncer \
-  --exclude-schema=supabase_migrations \
-  --exclude-schema=net \
-  --exclude-schema=vault \
-  --file=supabase/captured/captured_data.sql
-```
-
-Captured data is ~130KB for this project's current size.
-
-## Restore to Local DB (PostgreSQL 16)
-
-PostgreSQL 16 doesn't support `transaction_timeout` (added in PG 17) and
-doesn't have the `supabase_vault` extension. Pre-create the stub objects:
-
-```bash
-export PGPASSWORD=routecommerce_dev_password
-psql -U routecommerce -h 127.0.0.1 -d route_commerce <<'SQL'
-DROP SCHEMA public CASCADE;
-CREATE SCHEMA public;
-GRANT ALL ON SCHEMA public TO routecommerce;
-
--- extensions schema (referenced by dump as extensions.uuid_generate_v4())
-CREATE SCHEMA extensions;
-CREATE EXTENSION IF NOT EXISTS "uuid-ossp" SCHEMA extensions;
-CREATE EXTENSION IF NOT EXISTS "pgcrypto" SCHEMA extensions;
-CREATE EXTENSION IF NOT EXISTS "pg_stat_statements" SCHEMA extensions;
-
--- Stub functions in extensions schema (real Supabase has pgcrypto.crypt etc.)
-CREATE OR REPLACE FUNCTION extensions.uuid_generate_v4()
-  RETURNS uuid LANGUAGE sql AS $$ SELECT gen_random_uuid(); $$;
-CREATE OR REPLACE FUNCTION extensions.gen_salt(text)
-  RETURNS text LANGUAGE sql AS $$ SELECT '$2a$06$' || repeat('A', 53); $$;
-CREATE OR REPLACE FUNCTION extensions.crypt(text, text)
-  RETURNS text LANGUAGE sql AS $$ SELECT $1; $$;
-
-GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA extensions TO routecommerce;
-
--- auth stub (we excluded auth schema from dump, but RLS policies reference auth.uid())
-CREATE SCHEMA IF NOT EXISTS auth;
-CREATE TABLE IF NOT EXISTS auth.users (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  email TEXT,
-  raw_user_meta_data JSONB,
-  created_at TIMESTAMPTZ DEFAULT now(),
-  updated_at TIMESTAMPTZ DEFAULT now()
-);
-CREATE OR REPLACE FUNCTION auth.uid() RETURNS UUID
-  LANGUAGE sql STABLE AS $$ SELECT NULL::UUID; $$;
-GRANT USAGE ON SCHEMA auth TO routecommerce;
-GRANT ALL ON auth.users TO routecommerce;
-GRANT EXECUTE ON FUNCTION auth.uid() TO routecommerce;
-
--- Drop Supabase-specific publications (we don't have realtime / vault)
-DROP PUBLICATION IF EXISTS supabase_realtime;
-DROP PUBLICATION IF EXISTS supabase_realtime_messages_publication;
-SQL
-```
-
-Strip the PG17-only `SET transaction_timeout` line from the dump:
-
-```bash
-sed -i 's/^SET transaction_timeout = 0;$/-- transaction_timeout requires PG17 (we are on PG16); skipped/' \
-  supabase/captured/captured_schema.sql
-```
-
-Apply schema and data (idempotent — re-runs are safe):
-
-```bash
-psql -U routecommerce -h 127.0.0.1 -d route_commerce -v ON_ERROR_STOP=0 \
-  -f supabase/captured/captured_schema.sql 2>&1 | tail -20
-
-psql -U routecommerce -h 127.0.0.1 -d route_commerce -v ON_ERROR_STOP=0 \
-  -f supabase/captured/captured_data.sql 2>&1 | tail -20
-```
-
-Most errors on re-run are "already exists" — that's expected because the
-dump is idempotent for CREATE statements (we used `IF NOT EXISTS` where
-possible, but pg_dump doesn't add it for everything).
-
-## Verify
-
-```bash
-psql -U routecommerce -h 127.0.0.1 -d route_commerce -c "SELECT count(*) FROM pg_tables WHERE schemaname='public';"
-# Expect: 65
-
-psql -U routecommerce -h 127.0.0.1 -d route_commerce -c "SELECT count(*) FROM pg_proc WHERE pronamespace=(SELECT oid FROM pg_namespace WHERE nspname='public');"
-# Expect: ~250+
-
-psql -U routecommerce -h 127.0.0.1 -d route_commerce -c "SELECT name, slug, created_at FROM brands ORDER BY created_at;"
-# Expect 5 brands: Tuxedo Corn, Indian River Direct, Sunrise Farms, Green Valley Organics, Orchard Fresh
-```
-
-## What Didn't Work (don't try these)
-
-| Approach | Why it failed |
-|---|---|
-| `psql ... db.wnzkhezyhnfzhkhiflrp.supabase.co:5432` | Hostname is IPv6-only, dev box has no IPv6 |
-| `aws-0-us-east-1.pooler.supabase.com` | "tenant/user not found" — wrong region (project is on `aws-1`) |
-| `pg_dump 16.x` against PG 17 server | "server version mismatch" — fatal error |
-| `supabase db dump --linked` | Requires Docker (we don't have it) |
-
-## Notes
-
-- The captured data includes 3 test brands (Sunrise, Green Valley, Orchard)
-  created on 2026-06-03 — these were test data the user added during the
-  migration work, not real customers. They can be deleted safely.
-- Tuxedo Corn and Indian River Direct are the real production brands.
-- The schema dump is committed to git at `supabase/captured/captured_schema.sql.gz`
-  for reproducibility. The data dump is gitignored (regenerate as needed).
-- After dump, the local PostgREST needs a schema cache reload — restart
-  the postgrest process or it'll serve stale metadata for ~30 seconds.
-
-## Post-restore: clean up test brands
-
-The captured production data includes 3 test brands with hardcoded
-sequential UUIDs (`a1b2c3d4-…`, `b2c3d4e5-…`, `c3d4e5f6-…`) created
-during the migration work. They have no related rows in any of the 38
-tables that FK to `brands.id`, so deletion is safe (CASCADE / NO ACTION
-on zero rows is a no-op).
-
-```sql
-BEGIN;
-  DELETE FROM brands
-  WHERE slug IN ('sunrise-farms', 'green-valley', 'orchard-fresh');
-  -- expect DELETE 3
-COMMIT;
-```
-
-Verify the real brands remain:
-
-```sql
-SELECT name, slug, plan_tier FROM brands ORDER BY created_at;
--- Tuxedo Corn         | tuxedo              | starter
--- Indian River Direct | indian-river-direct | starter
-```
-
-## Migrating Brand Assets (Supabase Storage → MinIO)
-
-Brand logos and other Storage files are NOT in the Postgres dump. The
-storage layer is now MinIO (S3-compatible) instead of Supabase Storage.
-
-### Download assets from Supabase
-
-```bash
-# Make sure the target buckets exist in MinIO (one-time)
-mc mb --ignore-existing local/brand-logos local/videos \
-                        local/product-images local/contacts-imports \
-                        local/water-photos
-
-# Pull each asset via the public URL. Path is <bucket>/<key> after the
-# /storage/v1/object/public/ prefix in the Supabase URL.
-mkdir -p .data/assets
-BRAND_ID="<your-brand-uuid>"
-for fname in logo.png olathe-sweet-logo.png olathe-sweet-logo-dark.png; do
-  curl -sf -o ".data/assets/$fname" \
-    "https://<project-ref>.supabase.co/storage/v1/object/public/brand-logos/$BRAND_ID/$fname"
-  mc cp ".data/assets/$fname" "local/brand-logos/$BRAND_ID/$fname"
-done
-```
-
-### Point the DB at MinIO (portable /storage/... paths)
-
-After capture, the `brand_settings.logo_url` etc. values still point at
-the Supabase URL. Replace the base with a relative `/storage/` path so
-the Next.js rewrite in `next.config.ts` can route to whichever MinIO
-endpoint is configured per environment (dev → `localhost:9000`, prod →
-`storage.route.crispygoat.com`).
-
-```sql
-UPDATE brand_settings
-SET
-  logo_url = REPLACE(logo_url, 'https://<project-ref>.supabase.co/storage/v1/object/public', '/storage'),
-  logo_url_dark = REPLACE(logo_url_dark, 'https://<project-ref>.supabase.co/storage/v1/object/public', '/storage'),
-  olathe_sweet_logo_url = REPLACE(olathe_sweet_logo_url, 'https://<project-ref>.supabase.co/storage/v1/object/public', '/storage'),
-  olathe_sweet_logo_url_dark = REPLACE(olathe_sweet_logo_url_dark, 'https://<project-ref>.supabase.co/storage/v1/object/public', '/storage'),
-  hero_image_url = REPLACE(hero_image_url, 'https://<project-ref>.supabase.co/storage/v1/object/public', '/storage');
-```
-
-### Why a rewrite instead of pointing at MinIO directly
-
-Next.js's image optimizer (`/_next/image?url=...`) refuses to fetch
-upstream images whose hostname resolves to a private IP. Local MinIO is
-on `127.0.0.1` / `::1`, so URLs like `http://localhost:9000/...` get
-blocked:
-
-```
-⨯ upstream image http://localhost:9000/... resolved to private ip
-  ["::1","127.0.0.1"]
-```
-
-The rewrite in `next.config.ts` resolves `/storage/*` to the configured
-MinIO base URL server-side, so the browser sees a same-origin URL and
-the optimizer's private-IP check is bypassed:
-
-```ts
-async rewrites() {
-  const storageBase = process.env.STORAGE_PUBLIC_URL || "http://localhost:9000";
-  return [{ source: "/storage/:path*", destination: `${storageBase}/:path*` }];
-}
-```
-
-For production, set `STORAGE_PUBLIC_URL` to the public MinIO endpoint
-(e.g., `https://storage.route.crispygoat.com`) and the same DB values
-work without modification.
-
-### Hardcoded brand asset URLs in client components
-
-A few components used `publicUrl(BUCKETS.BRAND_LOGOS, ...)` to build a
-MinIO URL at module load (used as a fallback before client-side data
-loads). Switch these to `/storage/...` paths so the rewrite covers them:
-
-- `src/components/storefront/TuxedoVideoHero.tsx` — hero video + Olathe Sweet dark logo
-- `src/components/time-tracking/TimeTrackingFieldClient.tsx` — field UI logo
-- `src/app/tuxedo/about/page.tsx` — about page logo
-
-`src/lib/email-service.ts` should keep using `publicUrl(...)` because
-Resend fetches the URL server-side from its own network — relative
-paths won't work for emails.

docs/pricing-assessment.md

@@ -12,7 +12,7 @@ A **multi-tenant B2B produce distribution platform**, not a SaaS starter. Build
 |---|---|
 | Migrations | **135 SQL files** (production schema, RLS, SECURITY DEFINER RPCs, audit logs) |
 | Source | **544 files** (362 .tsx + 179 .ts) |
-| Admin pages | **88 routes** across orders, products, stops, wholesale, communications, time-tracking, water-log, route-trace, reports, advanced, command-center |
+| Admin pages | **87 routes** across orders, products, stops, wholesale, communications, time-tracking, water-log, route-trace, reports, advanced |
 | API routes | **60+ endpoints** (Stripe + Square + FedEx + Resend + Twilio + 8 AI endpoints) |
 | Public surfaces | 2 brand storefronts (Tuxedo, Indian River Direct) with brand theming, hero, color customization |
 | Integrations | Stripe (Connect + subscriptions), Square (POS sync), FedEx (rates + labels), Resend (email), Twilio (SMS), OpenAI (8 AI tools) |

docs/superpowers/plans/2026-06-17-admin-redesign-checklist.md

@@ -0,0 +1,121 @@
+# Admin Redesign — Task Checklist
+
+> Working branch: `design/ui-revamp-2026-06`
+> Spec: `docs/superpowers/specs/2026-06-17-admin-redesign.md`
+> Started: 2026-06-17
+> Deadline: tomorrow
+
+## How to use this file
+
+- `[ ]` unchecked → not done · `[x]` checked → done
+- Tick a box by changing `[ ]` to `[x]`
+- Add free-form notes in the **Notes** column
+- One commit per task (or per cluster of related tasks)
+- Revert a task with `git reset --hard <commit-before-task>`
+- Full revert: `git checkout main && git branch -D design/ui-revamp-2026-06`
+
+## Revert cheatsheet
+
+```bash
+git status                           # what's dirty
+git stash                            # save uncommitted, discard
+git diff                             # see what's staged
+git log --oneline -10                # see recent commits
+git reset --hard <sha>               # nuke back to that commit
+git checkout main                    # abandon branch, keep work
+git branch -D design/ui-revamp-2026-06  # delete the branch
+```
+
+---
+
+## Phase 0 — Setup
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [x] | Create feature branch | — | `design/ui-revamp-2026-06` off `main` | — |
+| [x] | Write design spec | `docs/superpowers/specs/2026-06-17-admin-redesign.md` | aesthetic, color, IA, phases | — |
+| [x] | Write this checklist | `docs/superpowers/plans/2026-06-17-admin-redesign-checklist.md` | — | — |
+| [ ] | Commit baseline | both files above | `chore: design spec + checklist` | (will commit after writing this) |
+
+## Phase 1 — Foundation (color + design tokens)
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [x] | Replace `--admin-*` color tokens in admin-design-system.css | `src/styles/admin-design-system.css` | use spec §3 table. Drop the muddy `aba278` warning, the purple stat icons, the blue stat icons. | `style(admin): unify color tokens` (18fb44e) |
+| [x] | Update `globals.css` if any admin colors live there | `src/app/globals.css` | grep for `admin-accent`, `admin-bg` | (same commit) |
+| [x] | Remove inline `#fef3c7` / `#dbeafe` / `#f3e8ff` from stat cards in DashboardClient | `src/components/admin/DashboardClient.tsx` | semantic colors only | (same commit) |
+
+## Phase 2 — Discoverability (sidebar + command palette)
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [x] | Create `SideNavGroup` component (label + items + active highlight) | `src/components/admin/SideNavGroup.tsx` (new) | matches new IA: Workspace / Operations / Communications / Growth / Tracking / Insights / Settings | (4ded68c) |
+| [x] | Refactor `AdminSidebar` to use grouped nav | `src/components/admin/AdminSidebar.tsx` | replace flat `NAV_ITEMS` with groups; keep role-gating, brand selector, sign-out | `feat(admin): grouped sidebar IA` (4ded68c) |
+| [x] | Create `CommandPalette` (Cmd+K) | `src/components/admin/CommandPalette.tsx` (new) | global search across pages + recent items + quick actions; mounts in admin layout | `feat(admin): command palette` (750efdd) |
+| [x] | Mount `CommandPalette` in admin layout | `src/app/admin/layout.tsx` | wraps children, listens for `Cmd/Ctrl+K` | (442c16d) |
+| [x] | Plumb `enabledAddons` to sidebar (gates Water Log / Route Trace) | `src/app/admin/layout.tsx` | `getEnabledAddons(activeBrandId)` from `actions/billing/stripe-portal` | (442c16d) |
+| [ ] | Settings pages get a top tab bar (no more hidden sub-nav) | `src/app/admin/settings/*/page.tsx` | General / Brand / Billing / Users / Integrations / Payments / Shipping / Add-ons | `feat(admin): settings top tabs` |
+
+## Phase 3 — Component patterns
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [x] | Extract `KPIStat` from DashboardClient | `src/components/admin/KPIStat.tsx` (new) | label + value + optional trend | `feat(admin): KPIStat component` (8e93734) |
+| [x] | Tighten `AdminBadge` variants (status / tier / addon) | `src/components/admin/design-system/AdminBadge.tsx` | semantic: success / warning / danger / info / neutral | (8e93734) |
+| [x] | Add `EmptyState` admin variant | `src/components/admin/EmptyState.tsx` (new) | icon + title + body + CTA; matches color tokens | (8e93734) |
+| [x] | Add `LoadingState` admin variant | `src/components/admin/LoadingState.tsx` (new) | uses `.ha-skeleton` | (8e93734) |
+| [ ] | Audit `PageHeader` usage; fix inconsistencies | `src/components/admin/design-system/PageHeader.tsx` + callers | eyebrow + title + subtitle + actions; consistent across all pages | `chore(admin): PageHeader audit` |
+
+## Phase 4 — Dashboard (unified command center)
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [ ] | Redesign `DashboardClient` as single feed (no 4 tabs) | `src/components/admin/DashboardClient.tsx` | top: KPI strip · middle: "Needs attention" feed · bottom: section grid | `feat(admin): unified dashboard` |
+| [ ] | Add a "What needs attention" feed (orders pending, stops today, low stock, unanswered contacts) | same file | data from existing actions | (same commit) |
+
+## Phase 5 — Apply patterns to top pages
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [x] | `/admin/orders` list + detail | `src/app/admin/orders/page.tsx`, `[id]/page.tsx`, `AdminOrdersPanel.tsx` | new PageHeader, StatusPill, EmptyState | `feat(admin): apply design system to Orders` (467f7e6) |
+| [x] | `/admin/products` list + new + edit | `src/app/admin/products/page.tsx`, `new/page.tsx`, `[id]/page.tsx`, `ProductsClient.tsx` | same | `feat(admin): apply new design system to Products pages` (1e0e278) |
+| [x] | `/admin/stops` calendar | `src/app/admin/stops/page.tsx`, `StopsCalendarClient.tsx` | same | `feat(admin): apply design system to Stops pages` (685a126) |
+| [ ] | `/admin/communications` composer | `src/components/admin/HarvestReach/CampaignComposerPage.tsx` | same | `style(admin): comms composer` |
+| [ ] | `/admin/settings` index + tab bar | `src/app/admin/settings/page.tsx` | overview of all settings w/ quick links | `style(admin): settings index` |
+
+## Phase 6 — Frontend polish (public side)
+
+| Done | Task | Files | Notes | Commit |
+|---|---|---|---|---|
+| [ ] | Tuxedo home polish | `src/app/tuxedo/page.tsx` + `tuxedo/` components | rhythm, spacing, mobile | `style(storefront): tuxedo polish` |
+| [ ] | Indian River Direct home polish | `src/app/indian-river-direct/page.tsx` + components | rhythm, spacing, mobile | `style(storefront): IRD polish` |
+| [ ] | Pricing page polish | `src/app/pricing/page.tsx` | tier card spacing | `style(public): pricing polish` |
+
+## Phase 7 — Verify (gate before merge)
+
+| Done | Task | Command | Notes | Commit |
+|---|---|---|---|---|
+| [ ] | Type-check clean | `npx tsc --noEmit` | 0 errors | (no commit, gate) |
+| [ ] | Build clean | `npm run build` | green | (no commit, gate) |
+| [ ] | Dev server boots | `npm run dev` | `/admin` renders, sidebar works, Cmd+K opens | (no commit, gate) |
+| [ ] | Manual smoke: dashboard | `localhost:4000/admin` | layout intact, no console errors | (no commit, gate) |
+| [ ] | Manual smoke: command palette | `Cmd+K` | opens, type, jump | (no commit, gate) |
+| [ ] | Manual smoke: orders list | `/admin/orders` | loads, page header consistent | (no commit, gate) |
+
+---
+
+## Live notes (free-form)
+
+Add anything you want to remember as we go.
+
+- The existing `.ha-*` (Harvest Almanac) class system is good. Build on it; don't replace it.
+- The sidebar is in `src/components/admin/AdminSidebar.tsx` (~520 lines). Don't rewrite from scratch — refactor the data structure to groups and let the JSX mostly stand.
+- `lucide-react` is already a dependency. New icons should use lucide, not inline SVGs.
+- The `Atelier des Récoltes` CSS classes (`.atelier-*` in `globals.css`) are public-side only. Don't mix them into admin.
+- Per MEMORY.md: spawn sub-agents sequentially if TPM rate limit hits. If parallel works, fine; if not, fall back.
+
+## Decisions log
+
+Record any calls you make mid-flight that change the spec.
+
+- (none yet)

docs/superpowers/plans/2026-06-prod-db-schema-migration-reliability.md

@@ -0,0 +1,147 @@
+# Production DB Schema Migration Reliability Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:systematic-debugging (completed root cause), superpowers:writing-plans (this), superpowers:test-driven-development where code changes have tests, superpowers:verification-before-completion, and superpowers:executing-plans or subagent-driven-development to implement task-by-task. Steps use checkbox syntax.
+
+**Goal:** Ensure that every production deploy (push to main) results in the full schema from `db/migrations/0001_init.sql` (including the `admin_users` and `admin_user_brands` tables required by `getAdminUser()`) being present in the `DATABASE_URL` that the running app connects to via its pool / drizzle client. Eliminate "relation does not exist" errors and the resulting Access Denied screen for properly provisioned Neon Auth users.
+
+**Architecture:** 
+- Make the CI "Run migrations" step a hard gate (fatal on failure, plus explicit post-migrate verification that critical tables exist).
+- Ship the minimal migration runner + SQL files as part of the deploy artifact so the target server has a recovery path.
+- Add a lightweight post-deploy / startup verification in the app or deploy script (fail fast with clear message instead of silent 500s on first admin request).
+- Keep the "migrate from full source locally" path working for initial prod DB bootstrap and emergencies.
+- Do not change the core migration logic or 0001_init.sql in this plan (that would be a separate architectural change if the double-BEGIN wrapping proves fragile).
+
+**Tech Stack:** Gitea Actions (YAML), Node 22 + pg + drizzle on target, Next.js standalone output, pm2 on Ubuntu server, Neon Postgres (with neon_auth schema).
+
+**Root Cause (from systematic-debugging Phase 1):** The prod runtime DB lacked the `admin_users` table because (1) the migration step in `.gitea/workflows/deploy.yml` used `|| echo` making any failure (connection, SQL error in the huge 0001 file, FK to neon_auth.user, tx nesting from the file's BEGIN + script's BEGIN) non-fatal, (2) only `.next/`, `public/`, `package.json` (and optional next.config) are scp'd — `scripts/migrate.js` and `db/migrations/` are never on the server, (3) no verification after "migrate" or at app startup that the tables the admin permission layer depends on actually exist, (4) the `.env.production` written from the same secret as the CI migrate step was used, but the apply didn't happen or was skipped due to _migrations state or partial rollback.
+
+**Evidence Gathered:**
+- deploy.yml: Run migrations step, limited scp, .env.production printf, pm2 "npm start".
+- scripts/migrate.js: dotenv .env.local + env override, _migrations tracking, per-file client.query(sql) inside script tx, re-throw on error.
+- db/migrations/0001_init.sql: explicit CREATE TABLE admin_users (with FK to neon_auth.user), admin_user_brands, brands; file starts with BEGIN;.
+- db/client.ts + src/lib/admin-permissions.ts: withPlatformAdmin → drizzle select on adminUsers from schema (the exact query that 42P01s).
+- next.config.ts: output: 'standalone' (explains pm2 warning).
+- Runtime logs: the repeated "Database query failed" + "relation does not exist", app starts fine.
+- Git history: recent deploy "fixes" focused on SSH/env writing, not migration reliability.
+
+**Files to touch (decomposition by responsibility):**
+- `.gitea/workflows/deploy.yml` (CI pipeline gates + artifact contents)
+- `scripts/migrate.js` (minor hardening if needed for verification hook)
+- `src/app/api/health/route.ts` or similar (new, for startup/schema check — or add to existing)
+- `CLAUDE.md` + `PRODUCTION_DEPLOYMENT_CHECKLIST.md` (docs)
+- Possibly a small `scripts/verify-prod-schema.js` helper
+
+---
+### Task 1: Make CI migration step a hard failure + add explicit verification for admin_users
+
+**Files:**
+- Modify: `.gitea/workflows/deploy.yml:23-27` (the Run migrations step and surrounding)
+
+- [ ] **Step 1.1:** Replace the non-fatal migration line with a strict block that fails the job if migrate fails or the critical table is missing after.
+
+```yaml
+- name: Run migrations
+  env:
+    DATABASE_URL: ${{ secrets.DATABASE_URL }}
+  run: |
+    set -e
+    echo "=== Running migrations against prod DB ==="
+    npm run migrate:one
+    echo "=== Verifying critical schema (admin_users) ==="
+    node -e '
+      const {Client} = require("pg");
+      const c = new Client({connectionString: process.env.DATABASE_URL});
+      c.connect().then(() => c.query("SELECT 1 FROM admin_users LIMIT 1")).then(() => {
+        console.log("✓ admin_users table exists");
+        return c.end();
+      }).then(() => process.exit(0)).catch(e => {
+        console.error("✗ admin_users missing or inaccessible:", e.message);
+        process.exit(1);
+      });
+    '
+```
+
+- [ ] **Step 1.2:** Run a local simulation or note that the Gitea runner will now fail the whole deploy if the secret DB is missing the table (good — forces the bootstrap to happen before code that depends on it ships).
+
+- [ ] **Step 1.3:** Commit the yml change with message referencing the root cause (missing table in prod due to masked migration).
+
+### Task 2: Ship migration capability in the deploy artifact so server has a recovery path
+
+**Files:**
+- Modify: `.gitea/workflows/deploy.yml` in the "Deploy" step (the scp and ssh sections)
+
+- [ ] **Step 2.1:** Add scp for the migration assets (after the existing public/.next scp):
+
+```bash
+echo "Copying migration runner and SQL..."
+scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no -r scripts/migrate.js tyler@...:$APP_DIR/scripts/ || true
+scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no -r db/migrations tyler@...:$APP_DIR/db/ || true
+```
+
+- [ ] **Step 2.2:** Update the server ssh install/restart line to also ensure the scripts dir has the right perms if needed, but mainly document that now `node scripts/migrate.js` will work on the server with the .env.production.
+
+- [ ] **Step 2.3:** In the same Deploy step, after writing .env.production and before or after the pm2 restart, optionally run the migrate on the server as a belt-and-suspenders (using the just-written .env):
+
+```bash
+ssh ... "cd $APP_DIR && source .env.production 2>/dev/null || export \$(grep DATABASE_URL .env.production); node scripts/migrate.js || echo 'migrate on server completed or not needed'"
+```
+
+  (Keep it non-fatal on server for now; the CI gate is the hard one.)
+
+- [ ] **Step 2.4:** Test the scp paths in a dry-run or note the change.
+
+### Task 3: Add a minimal runtime / startup guard (fail fast with clear message)
+
+**Files:**
+- Create: `src/app/api/health/db-schema/route.ts` (or add to an existing health if present)
+- Or simpler: in the admin layout or a top level, but a dedicated health is better for PM2/docker.
+
+- [ ] **Step 3.1:** Create a tiny health endpoint that does the same check the CI verification does (SELECT 1 FROM admin_users) using the existing pool or withDb, returns 200 or 503 with message "Schema not applied - run migrations".
+
+- [ ] **Step 3.2:** Wire it so the deploy can curl it after restart as a final gate (in the workflow ssh step).
+
+- [ ] **Step 3.3:** (Optional but recommended per defense-in-depth) Call a similar check early in getAdminUser or the admin layout and log a very loud message + return a better error than generic "does not have admin access" when the table is literally missing.
+
+### Task 4: Update documentation and bootstrap instructions (so humans know the right sequence)
+
+**Files:**
+- Modify: `CLAUDE.md` (the Commands and Important File Locations + Gotchas sections)
+- Modify or create: `PRODUCTION_DEPLOYMENT_CHECKLIST.md` or a new `docs/PROD_BOOTSTRAP.md`
+
+- [ ] **Step 4.1:** In CLAUDE.md under "Commands" and "Adding a New Brand" / auth section, add a "First production deploy / new prod DB bootstrap" subsection:
+
+  1. Ensure the Neon project has neon_auth enabled and the DATABASE_URL secret in Gitea points to it.
+  2. (Before first code push that depends on admin) Locally or in a throwaway runner: `DATABASE_URL=prod... node scripts/migrate.js`
+  3. Then `DATABASE_URL=prod... npx tsx scripts/provision-admin.ts you@real.com platform_admin` (after signing in on the prod URL).
+  4. Push; the CI gate + shipped runner will keep it healthy on future deploys.
+  5. If you ever see "relation admin_users does not exist" in prod logs, the DB the app is talking to is not the one that had migrate run.
+
+- [ ] **Step 4.2:** Add a note about the `|| echo` anti-pattern that was removed and why the new verification step exists.
+
+- [ ] **Step 4.3:** Mention the standalone vs npm start issue (already in logs) and that the start command on server should eventually be updated to `node .next/standalone/server.js -p 3100` (can be a follow-up task).
+
+### Task 5: Verification before claiming success (use the dedicated skill)
+
+**Files:** (none new, just process)
+
+- [ ] **Step 5.1:** Before merging the plan changes, use `superpowers:verification-before-completion` checklist: the change makes a fresh DB get the table, an "already applied" DB is a no-op, a deploy with missing table now fails the job early with clear output, a manual server migrate works because the files are there, the runtime health returns 200 when table present.
+
+- [ ] **Step 5.2:** After the PR is on a branch, trigger a deploy to a staging or the real prod (with a test DB first if possible), capture the CI log showing the new verification passing, and the app logs showing no more "Database query failed" on /admin.
+
+- [ ] **Step 5.3:** Run the provision script as the final user-visible test; confirm the Access Denied with email message is gone and the platform_admin can see the UI.
+
+- [ ] **Step 5.4:** Document the before/after in the plan or a memory file.
+
+### Task 6: (Stretch / follow-up) Improve the migrate script's resilience for huge init files (if the double tx ever bites again)
+
+**Files:**
+- Modify: `scripts/migrate.js`
+
+- [ ] Only if during verification the 0001 apply is flaky: change the per-file execution to not wrap the file's own BEGIN/COMMIT, or use a separate connection, or exec `psql -f` (but keep node/pg for consistency). Add a comment explaining the previous fragility.
+
+**Rollback / emergency:** If a deploy breaks because of this, the server now has the scripts + db/migrations copied, so SSH + `source .env.production; node scripts/migrate.js` is the recovery (exactly what the user was trying to do manually).
+
+**Success criteria:**
+- A brand new prod DB + push to main results in a green deploy + working /admin after provision.
+- The error "relation \"admin_users\" does not exist" no longer appears in prod pm2 logs for normal admin flows.
+- The pipeline fails loudly (with the table name in the error) instead of shipping a broken app that only shows "Access Denied".

docs/superpowers/specs/2026-06-04-multi-brand-admin-design.md

@@ -0,0 +1,470 @@
+# Multi-Brand Admin Support
+
+**Date:** 2026-06-04
+**Status:** Draft → Approved
+**Author:** Grok (brainstorming session)
+**Migration file:** `supabase/migrations/204_multi_brand_admin.sql`
+**Follow-up migration (out of scope):** `220_drop_legacy_brand_id.sql`
+
+## Problem
+
+`admin_users.brand_id` is a single `UUID | null`. The platform supports a `platform_admin` role (no brand) and a `brand_admin` role (one brand). There is no representation for an admin who legitimately needs access to 2+ specific brands — e.g., a parent company operating multiple storefronts with shared operations staff.
+
+The current `effectiveBrandId = brandId ?? adminUser.brand_id ?? null` pattern silently does the wrong thing for multi-brand use cases:
+
+- Data model can't represent "Jane is admin for Brand A AND Brand B" — would require two `admin_users` rows (and the auth-user→admin-user join gets messy).
+- No central validation that an admin is acting in a brand they actually have access to.
+- No persistent "current brand" context — every page re-derives it from scratch.
+- No per-brand permission overrides possible (locks in flexibility for the future).
+
+This spec addresses multi-brand tenants / franchises: same staff managing multiple brands under a parent org, where brands are separate for storefront/billing but share operations.
+
+## Goals
+
+- An admin can be associated with multiple brands via a junction table.
+- A persistent "active brand" is stored in a cookie, switchable via UI, and used as the default when no explicit brand is requested.
+- A new `multi_brand_admin` role makes the relationship explicit in the data and the UI.
+- `platform_admin` continues to work unchanged (gets all brands implicitly).
+- Existing single-brand `brand_admin`, `store_employee`, and `staff` users continue to work with zero behavior change.
+- Server actions get a single, central place to resolve and validate the active brand.
+
+## Non-Goals (YAGNI)
+
+- Per-(admin, brand) permission overrides. The user explicitly chose "same perms across all brands."
+- Brand-group / parent-org concept. The junction table makes this possible later, but it's not built now.
+- "Last accessed brand" auto-redirect. The cookie is the source of truth; no extra logic.
+- UI for managing `admin_user_brands` rows. Use Supabase Studio or a follow-up admin UI PR.
+- Dropping the legacy `admin_users.brand_id` column. A follow-up migration `220_drop_legacy_brand_id.sql` will do this after we verify nothing reads it. Out of scope for this spec.
+
+## Approach: Junction Table + Backwards-Compat `brand_id`
+
+Selected from among three options:
+
+| Option | Why not |
+|---|---|
+| A. Junction + keep `brand_id` (selected) | — |
+| B. Junction only, drop `brand_id` | High migration risk; every server action reference must change. |
+| C. `brand_ids UUID[]` on `admin_users` | No FK, awkward reverse lookups, locks out per-brand metadata. |
+
+A is the lowest-risk additive path that solves the problem.
+
+## Data Model
+
+### New table: `admin_user_brands`
+
+```sql
+CREATE TABLE admin_user_brands (
+  admin_user_id UUID NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
+  brand_id      UUID NOT NULL REFERENCES brands(id)     ON DELETE CASCADE,
+  added_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  added_by      UUID REFERENCES admin_users(id),
+  PRIMARY KEY (admin_user_id, brand_id)
+);
+CREATE INDEX admin_user_brands_brand_id_idx ON admin_user_brands(brand_id);
+```
+
+- Composite PK enforces uniqueness.
+- Index on `brand_id` makes "which admins are in Brand X?" queries fast.
+- `added_at` / `added_by` for audit trail.
+- `ON DELETE CASCADE` for both FKs — deleting an admin or brand cleans up the junction.
+
+### New role: `multi_brand_admin`
+
+Added to the `role` CHECK constraint. Functionally equivalent to `brand_admin` permission-wise — same `can_manage_*` flags apply. The role label disambiguates intent in the UI ("this person manages 3 brands" vs "this person manages 1 brand") and in audit logs.
+
+### Updated `AdminUser` type
+
+```ts
+// src/lib/admin-permissions-types.ts
+export type AdminUser = {
+  // ... existing fields
+  brand_id: string | null;    // active brand (one of brand_ids, or null for platform_admin)
+  brand_ids: string[];        // all brands this admin can act in
+  role: "platform_admin" | "brand_admin" | "multi_brand_admin" | "store_employee" | "staff";
+};
+```
+
+### Membership rules
+
+| Role | `brand_id` (active) | `brand_ids` (membership) |
+|---|---|---|
+| `platform_admin` | `null` (or cookie-selected brand) | Implicitly all brands; `brand_ids` populated by `listBrandsForAdmin` querying the `brands` table |
+| `multi_brand_admin` | First/selected brand | 2+ brands from `admin_user_brands` |
+| `brand_admin` | Their single brand | `[that one brand]` |
+| `store_employee` | Their single brand | `[that one brand]` |
+| `staff` | Their single brand | `[that one brand]` |
+
+For `platform_admin`, the application layer short-circuits brand-access checks (`if (adminUser.role === "platform_admin") return ...`). The `brand_ids` field is only used by `listBrandsForAdmin` to render the dropdown options; it is not used for permission gating for `platform_admin`.
+
+### `getAdminUser()` resolution order
+
+1. If `dev_session` cookie set → return dev admin. For `platform_admin` dev: `brand_id: null, brand_ids: []` (resolved against `brands` table by `listBrandsForAdmin`). For `store_employee` dev: `brand_id: <first-real-brand-id>, brand_ids: [<that-id>]` — fetched from the `brands` table so dev store_employee can browse a real brand's data. (If no brands exist, dev store_employee sees `<AdminAccessDenied />` — known limitation.)
+2. If `NEXT_PUBLIC_USE_MOCK_DATA=true` → same as `platform_admin` dev.
+3. Real auth → load `admin_users` row, then JOIN `admin_user_brands` to populate `brand_ids`.
+4. Set `brand_id` from (in order): `active_brand_id` cookie (if in `brand_ids` for non-platform-admin, or always for platform-admin) → `admin_users.brand_id` (if in `brand_ids`) → first of `brand_ids`.
+
+## Server Action Patterns
+
+### New file: `src/lib/brand-scope.ts`
+
+```ts
+import { cookies } from "next/headers";
+import type { AdminUser } from "./admin-permissions-types";
+
+const ACTIVE_BRAND_COOKIE = "active_brand_id";
+
+export async function getActiveBrandId(
+  adminUser: AdminUser,
+  requested?: string | null
+): Promise<string | null> {
+  // Cookie is the source of truth for "what brand am I acting in right now"
+  // for everyone — including platform_admin (who can pin a specific brand
+  // or fall back to null = "all brands").
+  const cookieStore = await cookies();
+  const cookieBrand = cookieStore.get(ACTIVE_BRAND_COOKIE)?.value ?? null;
+
+  if (adminUser.role === "platform_admin") {
+    // requested > cookie > null (all brands)
+    return requested ?? cookieBrand ?? null;
+  }
+
+  // Non-platform-admin: requested (if in brand_ids) > cookie (if in brand_ids) > adminUser.brand_id
+  if (requested) {
+    return adminUser.brand_ids.includes(requested) ? requested : null;
+  }
+  if (cookieBrand && adminUser.brand_ids.includes(cookieBrand)) {
+    return cookieBrand;
+  }
+  return adminUser.brand_id;
+}
+
+export async function setActiveBrandCookie(brandId: string): Promise<void> {
+  const cookieStore = await cookies();
+  cookieStore.set(ACTIVE_BRAND_COOKIE, brandId, {
+    httpOnly: true,
+    sameSite: "lax",
+    path: "/",
+    maxAge: 60 * 60 * 24 * 30, // 30 days
+  });
+}
+
+export async function clearActiveBrandCookie(): Promise<void> {
+  const cookieStore = await cookies();
+  cookieStore.delete(ACTIVE_BRAND_COOKIE);
+}
+
+export function assertBrandAccess(adminUser: AdminUser, brandId: string): void {
+  if (adminUser.role === "platform_admin") return;
+  if (!adminUser.brand_ids.includes(brandId)) {
+    throw new Error("Brand access denied");
+  }
+}
+```
+
+### Server action: set active brand
+
+```ts
+// src/actions/admin/set-active-brand.ts
+"use server";
+import { getAdminUser } from "@/lib/admin-permissions";
+import { setActiveBrandCookie, clearActiveBrandCookie } from "@/lib/brand-scope";
+
+export async function setActiveBrand(brandId: string | null): Promise<{ success: boolean; error?: string }> {
+  const adminUser = await getAdminUser();
+  if (!adminUser) return { success: false, error: "Not authenticated" };
+
+  // null = "All brands" (platform_admin only)
+  if (brandId === null) {
+    if (adminUser.role !== "platform_admin") {
+      return { success: false, error: "Only platform admins can select 'All brands'" };
+    }
+    await clearActiveBrandCookie();
+    return { success: true };
+  }
+
+  if (adminUser.role !== "platform_admin" && !adminUser.brand_ids.includes(brandId)) {
+    return { success: false, error: "No access to that brand" };
+  }
+  await setActiveBrandCookie(brandId);
+  return { success: true };
+}
+```
+
+### New server function: list brands for admin
+
+```ts
+// src/actions/brands.ts
+import { getAdminUser } from "@/lib/admin-permissions";
+import { svcHeaders } from "@/lib/svc-headers";
+
+export async function listBrandsForAdmin(): Promise<
+  { id: string; name: string; slug: string; logo_url: string | null }[]
+> {
+  const adminUser = await getAdminUser();
+  if (!adminUser) return [];
+
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+
+  if (adminUser.role === "platform_admin") {
+    const res = await fetch(
+      `${supabaseUrl}/rest/v1/brands?select=id,name,slug,logo_url&order=name`,
+      { headers: svcHeaders(serviceKey) }
+    );
+    return res.ok ? await res.json() : [];
+  }
+
+  if (adminUser.brand_ids.length === 0) return [];
+
+  const filter = `id=in.(${adminUser.brand_ids.map((id) => `"${id}"`).join(",")})`;
+  const res = await fetch(
+    `${supabaseUrl}/rest/v1/brands?${filter}&select=id,name,slug,logo_url&order=name`,
+    { headers: svcHeaders(serviceKey) }
+  );
+  return res.ok ? await res.json() : [];
+}
+```
+
+### Server action migration pattern
+
+```ts
+// Before:
+const effectiveBrandId = brandId ?? adminUser.brand_id ?? null;
+
+// After:
+import { getActiveBrandId } from "@/lib/brand-scope";
+
+const activeBrandId = await getActiveBrandId(adminUser, brandId);
+if (!activeBrandId && adminUser.role !== "platform_admin") {
+  return { success: false, error: "Brand access required" };
+}
+const effectiveBrandId = activeBrandId;
+```
+
+This is a mechanical one-line swap in ~30 server actions identified by the grep:
+
+- `src/actions/wholesale.ts` (multiple)
+- `src/actions/products.ts`
+- `src/actions/communications/templates.ts`
+- `src/actions/communications/campaigns.ts`
+- `src/actions/orders/create-admin-order.ts`
+- `src/actions/stops.ts`
+- `src/actions/analytics.ts`
+- `src/actions/square-sync-ui.ts`
+- `src/actions/shipping.ts`
+- `src/actions/payments.ts`
+- `src/actions/ai-import.ts`
+- `src/actions/wholesale-register.ts`
+
+### Page server component pattern
+
+```ts
+// Before (src/app/admin/orders/page.tsx):
+const effectiveBrandId = brandIdParam ?? adminUser.brand_id ?? "";
+
+// After:
+import { getActiveBrandId } from "@/lib/brand-scope";
+
+export default async function AdminOrdersPage() {
+  const adminUser = await getAdminUser();
+  if (!adminUser) return <AdminAccessDenied />;
+
+  const activeBrandId = await getActiveBrandId(adminUser, brandIdParam);
+
+  if (!activeBrandId && adminUser.role !== "platform_admin") {
+    return <AdminAccessDenied />;
+  }
+
+  // ... rest of the page
+}
+```
+
+This applies to every page under `src/app/admin/` — including the existing `/admin/taxes/[brandId]` and `/admin/settings/billing/[brandId]` which already do brand param resolution.
+
+## UI Components
+
+### Brand selector
+
+**Location:** `src/components/admin/AdminHeader.tsx` (the top bar already rendered on every `/admin/*` page).
+
+**Behavior:** A dropdown showing:
+- Brand logo + name (current active brand)
+- Chevron
+- "All brands" option at the top (only for `platform_admin`)
+- List of accessible brands (`adminUser.brand_ids`)
+- Small badge "Multi-brand manager" next to the user's name when `role === "multi_brand_admin"`
+
+**Visibility matrix:**
+
+| Admin | Show dropdown? | Options |
+|---|---|---|
+| `platform_admin` | Yes | "All brands" + list of all brands |
+| `multi_brand_admin` (2+ brands) | Yes | List of their brands |
+| `brand_admin` / `store_employee` / `staff` (1 brand) | No | — |
+| `platform_admin` (dev_session) | Yes | "All brands" + list of all brands (same UX as production) |
+
+**On select:**
+
+```ts
+// src/components/admin/BrandSelector.tsx (client component)
+"use client";
+async function handleSelect(brandId: string | null) {
+  await setActiveBrand(brandId); // null = "All brands"
+  router.refresh();
+}
+```
+
+`router.refresh()` re-runs server components and re-reads the cookie, so all data on the current page reloads in the new brand context. The URL is **not** changed — the cookie is the source of truth for "what brand am I acting in right now."
+
+### URL-level brand params
+
+Keep URL-level brand as-is — URLs are shareable links. The resolution order for the `brandId` param passed to `getActiveBrandId` is:
+
+1. URL `brandId` param (if present)
+2. `active_brand_id` cookie
+3. `adminUser.brand_id` (legacy single brand)
+4. First of `adminUser.brand_ids`
+5. (platform_admin only) `null` → "all brands"
+
+## Migration: `supabase/migrations/204_multi_brand_admin.sql`
+
+```sql
+-- 1. Add multi_brand_admin to role CHECK constraint
+ALTER TABLE admin_users DROP CONSTRAINT IF EXISTS admin_users_role_check;
+ALTER TABLE admin_users ADD CONSTRAINT admin_users_role_check
+  CHECK (role IN ('platform_admin', 'brand_admin', 'multi_brand_admin', 'store_employee', 'staff'));
+
+-- 2. Create junction table
+CREATE TABLE admin_user_brands (
+  admin_user_id UUID NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
+  brand_id      UUID NOT NULL REFERENCES brands(id)     ON DELETE CASCADE,
+  added_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  added_by      UUID REFERENCES admin_users(id),
+  PRIMARY KEY (admin_user_id, brand_id)
+);
+CREATE INDEX admin_user_brands_brand_id_idx ON admin_user_brands(brand_id);
+
+-- 3. Backfill from existing brand_id (single-brand admins)
+INSERT INTO admin_user_brands (admin_user_id, brand_id)
+SELECT id, brand_id FROM admin_users
+WHERE brand_id IS NOT NULL
+ON CONFLICT DO NOTHING;
+
+-- 4. Promote anyone with > 1 brand to multi_brand_admin
+UPDATE admin_users
+SET role = 'multi_brand_admin'
+WHERE role = 'brand_admin'
+  AND id IN (
+    SELECT admin_user_id FROM admin_user_brands
+    GROUP BY admin_user_id HAVING COUNT(*) > 1
+  );
+
+-- 5. New RPCs for adding/removing brand access
+CREATE OR REPLACE FUNCTION add_admin_user_brand(
+  p_admin_user_id UUID, p_brand_id UUID, p_added_by UUID
+) RETURNS void LANGUAGE sql SECURITY DEFINER AS $$
+  INSERT INTO admin_user_brands (admin_user_id, brand_id, added_by)
+  VALUES (p_admin_user_id, p_brand_id, p_added_by)
+  ON CONFLICT DO NOTHING;
+  UPDATE admin_users SET role = 'multi_brand_admin'
+  WHERE id = p_admin_user_id
+    AND role = 'brand_admin'
+    AND (SELECT COUNT(*) FROM admin_user_brands WHERE admin_user_id = p_admin_user_id) > 1;
+$$;
+
+CREATE OR REPLACE FUNCTION remove_admin_user_brand(
+  p_admin_user_id UUID, p_brand_id UUID
+) RETURNS void LANGUAGE sql SECURITY DEFINER AS $$
+  DELETE FROM admin_user_brands
+  WHERE admin_user_id = p_admin_user_id AND brand_id = p_brand_id;
+  UPDATE admin_users SET role = 'brand_admin'
+  WHERE id = p_admin_user_id
+    AND role = 'multi_brand_admin'
+    AND (SELECT COUNT(*) FROM admin_user_brands WHERE admin_user_id = p_admin_user_id) = 1;
+$$;
+```
+
+The `admin_users.brand_id` column is **kept** for backwards compat. A follow-up migration drops it after we verify nothing reads it.
+
+## Error Handling & Security Boundaries
+
+### Three failure modes
+
+1. **Requested brand not in `brand_ids`** (e.g., URL param has a brand the admin doesn't have):
+   - `getActiveBrandId()` returns `null`
+   - Server action returns `{ success: false, error: "Brand access required" }`
+   - Page renders `<AdminAccessDenied />` with: "You don't have access to that brand. [Switch to a brand you have access to]"
+
+2. **Cookie brand no longer in `brand_ids`** (admin's access was revoked while cookie was still set):
+   - `getActiveBrandId()` falls through to `adminUser.brand_id`, then first of `brand_ids`
+   - Silent recovery — no error, no UI flash
+   - The dropped brand just disappears from the dropdown next page load
+
+3. **Platform admin acting on a brand they don't own:**
+   - Platform admin: `brand_ids = ["*"]` (sentinel) — RPCs treat as "all brands"
+   - Server action: never blocks platform admin from any brand
+   - This is intentional — platform admin = superuser
+
+### Validation placement (defense in depth)
+
+- Server action: `getActiveBrandId(adminUser, requested)` validates.
+- Server action: `assertBrandAccess(adminUser, brandIdFromUrl)` validates (separate, for cases where the brandId comes from URL/form/RPC return rather than `getActiveBrandId`).
+- RPC: still trusts `p_brand_id` (SECURITY DEFINER) — application layer is the gate, matching the existing architecture.
+
+### Audit logging (additive)
+
+- `admin_user_brands.added_by` column tracks who added an admin to a brand.
+- Audit log entry on add/remove: out of scope for v1; documented for follow-up.
+
+## Testing
+
+### Unit tests (`vitest` — new dev dependency)
+
+- `src/lib/brand-scope.test.ts`:
+  - `resolveActiveBrandId(platformAdmin, "X")` → `"X"`
+  - `resolveActiveBrandId(brandAdmin, "X")` where X is their brand → `"X"`
+  - `resolveActiveBrandId(brandAdmin, "Y")` where Y is not their brand → `null`
+  - `getActiveBrandId(multiBrandAdmin)` with cookie set to valid brand → that brand
+  - `getActiveBrandId(multiBrandAdmin)` with cookie set to revoked brand → first of `brand_ids`
+  - `assertBrandAccess(...)` throws for non-platform-admin with invalid brand
+  - `setActiveBrand(null)` rejected for non-platform-admin
+  - `setActiveBrand("X")` rejected for admin without X in `brand_ids`
+
+### Integration tests (Playwright — already in repo)
+
+- `tests/admin/multi-brand.spec.ts`:
+  - As `multi_brand_admin`, dropdown shows 2+ brands
+  - Click brand B → URL stays, cookie updates, page data refreshes to brand B
+  - Direct-navigate to `/admin/orders?brand=<other-brand>` for a brand admin returns access denied
+  - As `platform_admin`, "All brands" option is present and works
+  - As `brand_admin` with 1 brand, no dropdown is shown
+
+### Migration smoke test (manual, documented in MEMORY.md)
+
+- Before migration: 5 brand_admins exist, each with 1 brand
+- After migration: 5 rows in `admin_user_brands`, all `role = 'brand_admin'`
+- Create a 6th admin with 2 brands via `add_admin_user_brand` → `role = 'multi_brand_admin'`, 2 rows in junction
+- Remove one of their brands via `remove_admin_user_brand` → `role` demotes to `brand_admin`, 1 row in junction
+
+## Out of Scope (v1)
+
+- Per-(admin, brand) permission overrides
+- Brand-group / parent-org concept
+- "Last accessed brand" auto-redirect
+- UI for managing `admin_user_brands` rows (Supabase Studio works for now)
+- Dropping the legacy `admin_users.brand_id` column (follow-up `220_*` migration)
+- Audit log entries for add/remove (junction's `added_by` column is the seed)
+
+## Implementation Order
+
+1. Migration `204_multi_brand_admin.sql` applied
+2. `src/lib/brand-scope.ts` + unit tests (TDD)
+3. `AdminUser` type updated; `getAdminUser()` returns `brand_ids`
+4. `setActiveBrand` server action + tests
+5. `listBrandsForAdmin` server function + tests
+6. BrandSelector UI component
+7. Wire BrandSelector into AdminHeader
+8. Server action migration (~30 actions) — mechanical one-line swap each
+9. Page server component migration (~10+ pages) — same pattern
+10. Playwright integration tests
+11. Manual smoke test of the migration on dev DB

docs/superpowers/specs/2026-06-05-selfhost-migration-design.md

@@ -1,325 +0,0 @@
-# Supabase → Self-Hosted Migration — Design Spec
-
-**Date:** 2026-06-05
-**Status:** Approved
-**Author:** Brainstorm session with user
-**Target branch:** `selfhost/migrate` (to be created)
-**Source branches:** `crispygoat/self-hosted-postgres` (6 commits) + `crispygoat/feat/better-auth` (1 commit, contains a detailed `plan.md`)
-
-## Overview
-
-Move Route Commerce off Supabase's hosted platform onto a self-hosted stack while preserving all data and behavior. Replace Supabase Auth with `better-auth`, Supabase Storage with MinIO, and Supabase's hosted Postgres with a plain Postgres instance fronted by PostgREST (the same protocol `supabase-js` and `@supabase/ssr` already speak). Consolidate two diverging branches that have been tackling different layers of this migration independently.
-
-## Goals
-
-1. **No data loss.** Full schema + data dump from the live Supabase project, restored on the new self-hosted Postgres.
-2. **No band-aids.** Real self-hosted replacement, not runtime patches that paper over Supabase.
-3. **App behavior unchanged.** All 137 SECURITY DEFINER RPCs, server actions, and client flows keep working with minimal code change.
-4. **Single coherent path.** Merge the two in-flight branches into one, eliminate the divergence.
-5. **Local + remote parity.** `docker compose up` works on the dev box and on the prod server (route.crispygoat.com).
-
-## Non-Goals
-
-- Replacing `supabase-js` / `@supabase/ssr` libraries. They speak PostgREST; we keep using them.
-- Rewriting the 185 SECURITY DEFINER functions. They stay as-is; brand scoping is already in the function bodies / app layer.
-- Changing the Stripe, Resend, Square, or any other non-Supabase integrations.
-- Performance tuning of the new stack (separate follow-up).
-- Adopting realtime (not used in current code) or Supabase Edge Functions (not used).
-
-## Constraints
-
-- **App must keep building** (`npx tsc --noEmit && npm run build`) without Supabase env vars.
-- **Mock mode still works** for `NEXT_PUBLIC_USE_MOCK_DATA=true` deployments (demos, Netlify previews).
-- **Dev mode bypass** (`dev_session=platform_admin` cookie) must continue to function for local testing.
-- **No new external service dependencies** unless explicitly approved (i.e., we are not introducing Vercel Postgres, Neon, etc. — the stack is self-hosted).
-- **Migration is reversible**: the Supabase project remains live until cutover is verified.
-
-## Architecture
-
-```
-┌──────────────────────────────────────────────────────────────────────┐
-│  Next.js app (Node, port 3100 via PM2)                                │
-│                                                                       │
-│  ┌────────────┐  ┌────────────┐  ┌──────────────┐  ┌──────────────┐  │
-│  │ supabase-js│  │ better-auth│  │ S3 SDK       │  │ middleware   │  │
-│  │ → PostgREST│  │ (in-proc)  │  │ → MinIO      │  │ → /login     │  │
-│  └─────┬──────┘  └──────┬─────┘  └──────┬───────┘  └──────────────┘  │
-│        │ anon key       │ uses pg.Pool   │ MinIO creds                 │
-└────────┼────────────────┼────────────────┼────────────────────────────┘
-         │                │                │
-         ▼                ▼                ▼
-  ┌────────────┐    ┌────────────┐    ┌────────────┐
-  │ PostgREST  │    │  Postgres  │    │   MinIO    │
-  │  (port     │───▶│ (port 5432)│    │ (port 9000)│
-  │   3001)    │    │            │    │  (S3 API)  │
-  └────────────┘    └────────────┘    └────────────┘
-```
-
-Single Docker Compose stack on the prod server: `db` (Postgres 16) + `postgrest` + `minio` + `minio_init` (one-shot) + app under PM2.
-
-## Branch & Merge Strategy
-
-1. Create new branch `selfhost/migrate` from `main` (commit `9374e63`).
-2. Cherry-pick the 7 commits from `crispygoat/self-hosted-postgres` (oldest to newest):
-   - `2de32b0` Add rocket emoji to tagline
-   - `988310f` Add Gitea Actions deploy workflow
-   - `8ad8dbb` Remove npm cache from workflow (local runner)
-   - `fddb917` Use npm install instead of npm ci (no lockfile)
-   - `beac3e4` Load .env.production from server before build
-   - `e8f2d76` Fix workflow: use actual secrets, fix env file writing
-   - `367a562` Add self-hosted Postgres docker-compose
-3. Cherry-pick the 1 commit from `crispygoat/feat/better-auth`:
-   - `456b5b1` Add MinIO storage + replace Supabase Storage with S3 SDK
-4. Resolve conflicts (expected in `.env.example`, `.gitea/workflows/deploy.yml`, `docker-compose.yml`).
-5. Apply the spec's Phase A migration patches on top.
-6. Add the `MinIO` + `minio_init` services to `docker-compose.yml` (the better-auth branch only has app code; it relies on the self-hosted branch's infra setup, but neither has the MinIO service in compose).
-7. Update `src/lib/supabase.ts` line 8: change `!supabaseUrl.includes("supabase.co")` to drop that condition so the real client is used against local PostgREST (currently this triggers mock mode whenever URL is non-Supabase).
-8. Update Gitea deploy workflow to bring up the Docker stack on the prod server before starting the app.
-
-## Env Vars (consolidated)
-
-```bash
-# ── App ──
-NODE_ENV=production
-NEXT_PUBLIC_BASE_URL=https://route.crispygoat.com
-PORT=3100
-
-# ── Postgres (self-hosted) ──
-POSTGRES_USER=routecommerce
-POSTGRES_PASSWORD=<strong-pw>
-POSTGRES_DB=route_commerce
-DATABASE_URL=postgresql://routecommerce:<pw>@db:5432/route_commerce?schema=public
-
-# ── PostgREST ──
-PGRST_SERVER_PORT=3001
-PGRST_DB_URI=postgresql://routecommerce:<pw>@db:5432/route_commerce
-PGRST_DB_ANON_ROLE=anon
-PGRST_JWT_SECRET=<random>          # not used for auth; required by PostgREST
-
-# ── better-auth ──
-BETTER_AUTH_SECRET=<random>
-BETTER_AUTH_URL=https://route.crispygoat.com
-NEXT_PUBLIC_BETTER_AUTH_URL=https://route.crispygoat.com
-
-# ── MinIO ──
-MINIO_ROOT_USER=routecommerce
-MINIO_ROOT_PASSWORD=<strong-pw>
-NEXT_PUBLIC_STORAGE_BASE_URL=https://route.crispygoat.com/storage
-STORAGE_ENDPOINT=http://minio:9000
-STORAGE_REGION=us-east-1
-STORAGE_ACCESS_KEY=routecommerce
-STORAGE_SECRET_KEY=<strong-pw>
-STORAGE_BUCKET_PREFIX=
-
-# ── Supabase env vars (legacy, kept for supabase-js client) ──
-# These now point at the local PostgREST instead of Supabase.
-NEXT_PUBLIC_SUPABASE_URL=http://postgrest:3001   # in Docker network; localhost:3001 from host
-NEXT_PUBLIC_SUPABASE_ANON_KEY=<random>          # PostgREST accepts any string; matches old pattern
-
-# ── Removed ──
-# SUPABASE_SERVICE_ROLE_KEY — no longer needed; better-auth uses pg.Pool directly with the routecommerce role
-
-# ── Unchanged ──
-STRIPE_SECRET_KEY=...
-STRIPE_WEBHOOK_SECRET=...
-STRIPE_PUBLISHABLE_KEY=pk_live_...
-RESEND_API_KEY=...
-RESEND_WEBHOOK_SECRET=...
-OPENAI_API_KEY=...
-MINIMAX_API_KEY=...
-MINIMAX_BASE_URL=...
-FROM_EMAIL=...
-```
-
-## Data Flow
-
-### Auth
-
-1. `/login` posts email + password to `authClient.signIn.email()` (better-auth/react).
-2. better-auth validates against the `user` table in Postgres via `pg.Pool`, sets the `rc_session_token` cookie via `nextCookies()` plugin.
-3. `src/middleware.ts` checks for `rc_session_token` (or `dev_session` for testing); unauthed requests redirect to `/login`.
-4. `getAdminUser()` in `src/lib/admin-permissions.ts` calls `auth.api.getSession({ headers })` then `pg.Pool.query("SELECT * FROM admin_users WHERE user_id = $1")` to resolve the `AdminUser` with role + permission flags.
-5. Server actions check `can_manage_*` flags as today.
-
-### Database (RPC + table access)
-
-1. Server action calls `supabase.rpc('foo', { p_brand_id })` using the supabase-js client from `src/lib/supabase.ts` (base URL = local PostgREST, anon key header).
-2. PostgREST receives `POST /rest/v1/rpc/foo`, looks up the SECURITY DEFINER function in `pg_catalog`, executes it.
-3. The function runs with the function owner's privileges (RLS is disabled, so it returns all rows; brand scoping is in the function body / `p_brand_id` filter).
-4. Result returns as JSON through PostgREST to the app.
-
-### Storage
-
-1. Admin uploads a product image through the admin UI.
-2. Server action `uploadProductImage` reads the file as `Buffer`, calls `uploadFile({ bucket, key, body, contentType })` from `src/lib/storage.ts`.
-3. `uploadFile` sends a `PutObjectCommand` to MinIO via `@aws-sdk/client-s3` (path-style, forcePathStyle for MinIO compatibility).
-4. MinIO stores the object; the action saves the public URL `${NEXT_PUBLIC_STORAGE_BASE_URL}/${bucket}/${key}` to the `products.image_url` column.
-5. MinIO bucket policy is set to `anonymous download` by the `minio_init` one-shot service, so public reads work without presigned URLs.
-
-## File Changes (summary)
-
-### New files
-
-| Path | Source | Purpose |
-|---|---|---|
-| `docker-compose.yml` | `self-hosted-postgres` branch | Postgres + PostgREST + MinIO + minio_init services |
-| `.env.example` | both branches (merged) | Consolidated env vars |
-| `.gitea/workflows/deploy.yml` | `self-hosted-postgres` branch | Updated to bring up Docker stack on prod |
-| `supabase/captured_schema.sql` | NEW | Output of `pg_dump --schema-and-data` from Supabase |
-| `src/lib/auth.ts` | `feat/better-auth` branch | better-auth config (Kysely + pg.Pool) |
-| `src/lib/auth-client.ts` | `feat/better-auth` branch | better-auth/react client |
-| `src/lib/storage.ts` | `feat/better-auth` branch | S3 client + upload/delete/publicUrl helpers + bucket constants |
-| `src/app/api/auth/[...all]/route.ts` | `feat/better-auth` branch | better-auth catch-all route |
-| `supabase/migrations/000_preflight_supabase_compat.sql` | `feat/better-auth` branch | Stub `auth` schema + `anon`/`authenticated`/`service_role` roles |
-| `supabase/migrations/200_better_auth_tables.sql` | `feat/better-auth` branch | better-auth's `user`/`session`/`account`/`verification` tables |
-
-### Deleted files
-
-| Path | Source | Reason |
-|---|---|---|
-| `supabase/migrations/BUNDLE_018_042.sql` | deleted in `feat/better-auth` | Concatenated duplicate of 018-042; explicit migrations apply in order |
-| `supabase/migrations/XXX_*.sql` (4 files) | deleted in `feat/better-auth` | Drafts using XXX convention |
-| `supabase/migrations/087_brand_logos_bucket.sql` | deleted in `feat/better-auth` | Supabase Storage replaced by MinIO |
-| `supabase/migrations/099_contact_imports_bucket.sql` | deleted in `feat/better-auth` | Supabase Storage replaced by MinIO |
-| `supabase/migrations/145_create_product_images_bucket.sql` | deleted in `feat/better-auth` | Supabase Storage replaced by MinIO |
-| `src/lib/supabase/server.ts` | deleted in `feat/better-auth` | Replaced by better-auth catch-all route |
-
-### Modified files
-
-| Path | Change |
-|---|---|
-| `src/lib/supabase.ts` line 8 | Drop `!supabaseUrl.includes("supabase.co")` from `useMockData` check (only `NEXT_PUBLIC_USE_MOCK_DATA === "true"` should trigger mock) |
-| `src/lib/admin-permissions.ts` | Use better-auth session + `pg.Pool` instead of `rc_auth_uid` cookie + Supabase REST |
-| `src/middleware.ts` | Check for `rc_session_token` (better-auth) instead of `rc_auth_uid` |
-| `src/actions/login.ts` | Use `authClient.signIn.email()` instead of `supabase.auth.signInWithPassword` |
-| `src/actions/wholesale-auth.ts` | Use better-auth email sign-in |
-| `src/actions/admin/force-login.ts` | Use `pg.Pool` for upsert (no Supabase) |
-| `src/actions/brand-settings.ts` | Replace 8 Supabase fetch PUTs with `uploadFile()` |
-| `src/actions/products/upload-image.ts` | Replace 3 Supabase calls with `uploadFile()` |
-| `src/actions/communications/import-contacts.ts` | Replace PUT + LIST with S3 SDK |
-| `src/app/api/water-photo-upload/route.ts` | Replace Supabase with `uploadFile()` |
-| `src/lib/email-service.ts` | Use `publicUrl(BUCKETS.X, key)` for 4 hardcoded Supabase URLs |
-| `src/components/admin/AdminHeader.tsx` | Use better-auth session |
-| `src/components/admin/AdminSidebar.tsx` | Use better-auth session |
-| `src/app/admin/me/AdminMeClient.tsx` | Use better-auth `authClient` for password change |
-| `src/app/logout/page.tsx` | Use better-auth `authClient.signOut()` |
-| `src/app/reset-password/page.tsx` | Use better-auth `authClient.changePassword()` |
-| `src/components/storefront/TuxedoVideoHero.tsx` | Use `publicUrl()` for hardcoded Supabase URL |
-| `src/components/time-tracking/TimeTrackingFieldClient.tsx` | Use `publicUrl()` |
-| `src/app/tuxedo/about/page.tsx` | Use `publicUrl()` |
-| `src/app/indian-river-direct/stops/page.tsx` | Use `publicUrl()` |
-| `supabase/migrations/006_water_log_rpcs_fixed.sql` | Patch: `STATIC` → `STABLE` (6 occurrences) |
-| `supabase/migrations/099_harvest_reach_segmentation.sql` | Patch: quote `time` column references |
-| `supabase/migrations/135_email_automation_rpcs.sql` | Patch: reorder `enroll_abandoned_cart` params or add default to `p_next_email_at` |
-| `package.json` | Add `@aws-sdk/client-s3`, `@aws-sdk/s3-request-presigner`, `better-auth`, `kysely`, `pg` |
-
-## Error Handling
-
-| Failure | Behavior |
-|---|---|
-| `pg_dump` from Supabase fails | Retry once, then halt and surface the error. Do not proceed with a partial dump. |
-| Migration apply fails | Continue through all 137, collect failures in a log file, document them as a follow-up commit. |
-| better-auth session invalid / expired | `getAdminUser()` returns `null`; pages redirect to `/login` via middleware. |
-| PostgREST down | supabase-js calls throw; server actions return `{ success: false, error: "Database unavailable" }`. |
-| MinIO down | Upload returns 500; UI shows "Upload failed, please retry." |
-| `auth.uid()` returns NULL inside SECURITY DEFINER function | Per plan.md Phase D Option 1: `ALTER TABLE … DISABLE ROW LEVEL SECURITY` on all `public.*` tables after `pg_dump` apply. Functions still execute with owner privileges; brand scoping happens at the function-body / app layer. |
-| RLS policies left over from `pg_dump` | Same as above: `DISABLE ROW LEVEL SECURITY` removes the block. |
-
-## RLS Strategy (Phase D detail)
-
-The 185 SECURITY DEFINER functions reference `auth.uid()`. The preflight stubs it to read `current_setting('request.jwt.claim.sub')`. In production this would be set by PostgREST from the JWT. Without it, `auth.uid()` returns NULL.
-
-**Decision: Disable RLS on all `public.*` tables.**
-
-```sql
-DO $$ DECLARE r record; BEGIN
-  FOR r IN SELECT tablename FROM pg_tables WHERE schemaname = 'public' LOOP
-    EXECUTE 'ALTER TABLE public.' || quote_ident(r.tablename) || ' DISABLE ROW LEVEL SECURITY';
-  END LOOP;
-END $$;
-```
-
-This is consistent with the existing "brand scoping in server actions" pattern documented in CLAUDE.md. The app already threads `effectiveBrandId = brandId ?? adminUser.brand_id ?? null` to every RPC. SECURITY DEFINER functions still execute with the function owner's privileges; RLS doesn't block them when disabled. The alternative (wiring PostgREST JWT → `request.jwt.claim.sub`) is more complex and not justified by current usage.
-
-## Testing
-
-End-to-end verification sequence (per plan.md Phase E, expanded):
-
-1. **DB schema + data apply cleanly.**
-   - Run `pg_dump --schema-and-data --no-owner --no-privileges --schema=public --exclude-schema=auth --exclude-schema=storage "postgresql://postgres:<pw>@db.wnzkhezyhnfzhkhiflrp.supabase.co:5432/postgres" -f supabase/captured_schema.sql` from the user's Mac (direct PG blocked from this dev box per MEMORY.md).
-   - `docker compose up -d db postgrest minio minio_init`.
-   - Apply preflight, captured schema, then all 137 migrations. Document any remaining failures.
-   - Apply RLS disable block. (The 3 patched migrations 006/099/135 are applied as part of the 137-migration batch — verify each succeeded.)
-2. **PostgREST smoke.**
-   - `curl http://127.0.0.1:3001/brands?limit=1 -H "apikey: <anon>"` → 200.
-   - `curl -X POST http://127.0.0.1:3001/rpc/get_public_stops_for_brand -H "Content-Type: application/json" -d '{"p_slug":"indian-river-direct"}'` → 200 with non-empty array.
-3. **MinIO buckets public.**
-   - `mc alias set local http://127.0.0.1:9000 <user> <pass>`.
-   - `mc ls local/` shows all 5 buckets.
-   - `curl -I http://127.0.0.1:9000/brand-logos/test.png` → 200 or 404, never 403.
-4. **App build.**
-   - `npx tsc --noEmit && npm run build` with the new env vars. Goal: no Supabase URL parse errors, no `auth.uid()` undefined, no missing bucket errors.
-5. **Auth round-trip.**
-   - `POST /api/auth/sign-up/email` with test email/password → 200, user created in `user` table.
-   - `POST /api/auth/sign-in/email` → 200, `rc_session_token` cookie set.
-   - Hit `/admin` with the cookie → 200, not redirect to `/login`.
-6. **Storage round-trip.**
-   - Start dev server (`npm run dev`).
-   - Sign in via better-auth.
-   - Upload a product image via admin UI → verify it lands in MinIO (`mc ls local/product-images/`).
-   - Visit `/indian-river-direct/products/[slug]` → image renders with the MinIO URL.
-7. **Data fidelity spot check.**
-   - Pick 3 known data points (a specific brand, an order, a contact) and verify they match what's in the live Supabase.
-8. **Playwright E2E.**
-   - Update env in `playwright.config.ts` (or `.env.test`).
-   - `npx playwright test` passes.
-
-## Risks
-
-| Risk | Mitigation |
-|---|---|
-| Migration apply order | `pg_dump` puts everything in dependency order; applying it first resolves most cross-references. Apply preflight first to stub `auth`, then captured schema, then migrations in numeric order. |
-| The 3 patched migrations are load-bearing | 006 (water-log RPCs) is critical for `/admin/water-log`; 099 (harvest reach segmentation) is critical for `/admin/communications`; 135 (email automation) is critical for abandoned cart + welcome sequence. If patches don't work, those features break. Document as follow-ups. (087 is in the deleted list since Supabase Storage is replaced by MinIO.) |
-| `pg_dump` includes conflicting `auth.uid()` body | The preflight creates the stub. If `pg_dump` redefines it, apply `pg_dump` first, then re-apply preflight (CREATE OR REPLACE FUNCTION handles re-definition). |
-| Existing user-uploaded images unreachable in new stack | User will re-upload brand logos and product images. The Tuxedo video + Olathe logos (referenced in `email-service.ts` and `tuxedo/about/page.tsx`) need to be copied over manually to MinIO before the cutover. |
-| PostgREST connection pool | PostgREST opens ~10 connections. Default Postgres `max_connections=100` is fine. |
-| `dev_session` cookie and `rc_session_token` cookie coexist | Both checked in middleware. Dev mode bypass stays functional for local testing. |
-| Mock mode regression | The `useMockData` check in `src/lib/supabase.ts` line 8 currently triggers on `!supabaseUrl.includes("supabase.co")` — this would falsely trigger against `http://localhost:3001`. Fix: drop the `.includes("supabase.co")` condition; rely on `NEXT_PUBLIC_USE_MOCK_DATA` flag only. |
-| Two branches had different `.env.example` | Conflict during cherry-pick. Resolution: use the union with comments labeling each section's source. |
-
-## Implementation Phases (overview; full detail in the merged `plan.md` + new task list)
-
-1. **Phase 0 — Merge** — Create `selfhost/migrate`, cherry-pick both branches, resolve conflicts, fix `useMockData` check, update Gitea deploy workflow.
-2. **Phase A — Capture base schema** — `pg_dump` from Supabase (user's Mac), restore to local Postgres, apply preflight + captured schema + 137 migrations + RLS disable.
-3. **Phase B — MinIO** — Add MinIO + minio_init services to docker-compose, install AWS SDK, configure bucket policy.
-4. **Phase C — Verify end-to-end** — Run the test sequence above. Fix any issues.
-5. **Phase D — Cutover** — Update the prod server's env, run the same migration on the prod Postgres, restart services, verify with smoke tests. Supabase project stays live for rollback until prod has been verified for 24h.
-
-## Open Questions
-
-- **Bucket name `videos` for the Tuxedo hero** — currently in `TuxedoVideoHero.tsx` as a hardcoded Supabase URL. The new `src/lib/storage.ts` has `BUCKETS.VIDEOS = "videos"`. Need to manually copy the Tuxedo hero video file to MinIO before cutover.
-- **Storage URL routing** — `NEXT_PUBLIC_STORAGE_BASE_URL` is `https://route.crispygoat.com/storage`. The deploy workflow needs a reverse proxy (Caddy or nginx) in front of MinIO on the prod server, OR MinIO port 9000 must be exposed via the existing domain. Decide: add Caddy to docker-compose, or use path-based routing in the existing reverse proxy.
-- **Better-auth session table cleanup** — better-auth manages its own `session` table. Existing Supabase auth users will need to re-register (no password migration) OR a one-time SQL `INSERT INTO "user" SELECT … FROM auth.users` to seed better-auth users. Decide based on how many active users exist.
-
-## Out of Scope (explicit)
-
-- Migrating user passwords from `auth.users` to `user.password` (better-auth). Will be handled as a one-time "reset your password" email blast in a follow-up.
-- Performance tuning, indexing strategy, or connection pooling beyond defaults.
-- Replacing `@supabase/ssr` (already deleted in better-auth branch) or `supabase-js` (kept for PostgREST compatibility).
-- Migrating Supabase Realtime subscriptions (none in current code).
-- Migrating Supabase Edge Functions (none exist).
-- Changing RLS to be useful instead of disabled (current pattern: brand scoping in app + SECURITY DEFINER).
-
-## Acceptance Criteria
-
-- [ ] `selfhost/migrate` branch builds cleanly (`npx tsc --noEmit && npm run build`).
-- [ ] `docker compose up` on the dev box starts Postgres + PostgREST + MinIO and all 137 migrations apply.
-- [ ] All 3 patched migrations (006, 099, 135) apply without errors.
-- [ ] `supabase-js` calls against `http://localhost:3001` return the same shape as before against Supabase.
-- [ ] better-auth sign-up + sign-in round-trip works in the browser.
-- [ ] Product image upload via admin UI lands in MinIO and renders on the storefront.
-- [ ] Existing data (brands, products, orders, contacts) from the live Supabase dump appears in local Postgres.
-- [ ] Mock mode still works when `NEXT_PUBLIC_USE_MOCK_DATA=true`.
-- [ ] Dev mode bypass (`dev_session=platform_admin` cookie) still works.
-- [ ] Gitea deploy workflow brings up the Docker stack on the prod server, applies migrations, and restarts the app.
-- [ ] Supabase project remains live and unchanged until prod is verified for 24h post-cutover.

docs/superpowers/specs/2026-06-17-admin-mobile-pwa-design.md

@@ -0,0 +1,538 @@
+# Admin Mobile PWA — Design Spec
+
+- **Date:** 2026-06-17
+- **Status:** Draft, awaiting user review
+- **Author:** Grok
+- **Branch:** `main`
+- **Scope:** Admin dashboard only (`/admin/*`), with full PWA + offline support
+
+---
+
+## Context
+
+Route Commerce is used heavily on phones — the team operates out of offices, trucks, warehouses, and outdoor pickup stops. The current admin is mobile-responsive but **not mobile-first**, the PWA is half-built (manifest + service worker exist, but no icons, no install prompt wired up, no offline page, no service worker registration), and Apple HIG accessibility-tier legibility is not the design baseline.
+
+**Symptoms today:**
+
+- `public/icons/` and `public/screenshots/` directories don't exist; manifest references 8 icon files and 2 screenshots that all 404
+- `registerServiceWorker()` is exported but never called
+- `PWAInstallPrompt` is never mounted in the tree
+- `apple-touch-icon.png` and `favicon.ico` are referenced but missing
+- Service worker references `/offline` and `/og-default.jpg` that don't exist
+- `themeColor` in `viewport` (`#0a0a0a`) mismatches manifest (`#1a4d2e`)
+- `AdminSidebar` uses `lg:pl-60` — on phones it becomes an overlay drawer; no bottom nav, no thumb-zone ergonomics
+- Body text is 16pt; tap targets are 40–44pt; status colors don't all clear WCAG AA on the warm cream background
+- No offline mutation queue — losing signal mid-fulfillment is a real operational problem
+
+## Goals
+
+1. **Ship a real, installable PWA** — manifest validates, all icons render, splash + app icon work on iOS Add to Home Screen, themed status bar.
+2. **Mobile-first admin shell** — bottom tab bar (thumb zone) for the 4 most-used surfaces, drag-up "More" sheet for everything else, sticky top bar with brand selector + search + profile.
+3. **HIG Accessibility-tier legibility** — 18pt body, 500 weight, AAA contrast, 56pt+ tap targets, bold weights throughout. Readable in direct sunlight, tappable with gloves.
+4. **Read + queue mutations offline** — operators in dead zones can still see data and queue actions (mark ready, mark picked up, change stop status, adjust stock). Optimistic UI with a visible sync status; replays on reconnect with last-write-wins conflict resolution.
+5. **Production-optimized** — proper cache headers, code-split admin shell, SW cache versioning, no layout shift on font load, Lighthouse PWA + mobile a11y gates in CI.
+
+## Non-Goals
+
+- Redesigning marketing pages (landing, pricing, blog). They stay as-is.
+- Redesigning the public storefronts. They stay as-is.
+- Push notifications / Web Push. The SW has a `push` handler scaffolded but it's not in scope; requires VAPID setup and a separate decision.
+- Wholesale portal mobile redesign. Tabled for a future spec.
+- Real-time collaboration (websockets / live cursors). Out of scope.
+- CRDT-style conflict resolution. We use last-write-wins keyed on `updated_at`.
+
+## Surfaces in scope
+
+- `/admin` (Dashboard)
+- `/admin/orders` + `/admin/orders/[id]`
+- `/admin/stops`
+- `/admin/products`
+- The admin shell that wraps all of the above
+- PWA install, splash, offline page, and SW behavior across the whole app
+
+---
+
+## 1. Aesthetic direction & design system
+
+### Direction: "HIG-First Field Almanac"
+
+Apple HIG Accessibility-tier legibility is the **floor**; the existing editorial identity (Fraunces + Manrope + Fragment Mono, "Field Almanac" palette already hinted at in `globals.css`) pushed harder is the **ceiling**. The result feels like a high-end tool someone made for themselves — confident, large, warm, with serif labels and serious typography weight. Distinctive without being precious.
+
+### Type scale (HIG Accessibility-tier)
+
+| Token            | Size / Weight                       | Use                                    |
+| ---------------- | ----------------------------------- | -------------------------------------- |
+| `text-display`   | 32pt / Fraunces 600                 | Page titles (Dashboard, Orders, etc.)  |
+| `text-h1`        | 24pt / Fraunces 600                 | Section headers                        |
+| `text-h2`        | 19pt / Manrope 700                  | Card titles, list primary              |
+| `text-body`      | 18pt / Manrope 500                  | All body text                          |
+| `text-label`     | 15pt / Manrope 600 / +0.02em        | Button text, field labels, status pills|
+| `text-mono`      | 14pt / Fragment Mono 400            | Order IDs, totals, tracking numbers    |
+| `text-meta`      | 13pt / Manrope 600                  | Timestamps, helper text                |
+
+Body bumped from 16 → 18pt; weight bumped from 400 → 500 for sun legibility.
+
+### Color tokens (AAA contrast where text appears)
+
+| Token         | Value     | Use                                     | Contrast on `bg` / `surface` |
+| ------------- | --------- | --------------------------------------- | ---------------------------- |
+| `bg`          | `#ffffff` | App background                          | —                            |
+| `surface`     | `#faf8f5` | Page background (warm cream)            | —                            |
+| `surface-2`   | `#f5f5f7` | Cards, raised surfaces                  | —                            |
+| `surface-3`   | `#e8e8ed` | Hover / pressed / skeletons             | —                            |
+| `text`        | `#1d1d1f` | Primary text                            | AAA on all 4 surfaces        |
+| `text-muted`  | `#424245` | Secondary text                          | AAA on all 4 surfaces        |
+| `text-faint`  | `#5e5e63` | Tertiary / meta                         | AA on all 4 surfaces (≥ 5.28 : 1) |
+| `accent`      | `#14532d` | Primary actions, brand                  | AAA on `bg` (9.11), `surface` (8.59), `surface-2` (8.37), `surface-3` (7.46) |
+| `accent-2`    | `#166534` | Hover state (button background)         | White text on `accent-2` = 7.13 : 1 (AAA) |
+| `danger`      | `#7f1d1d` | Errors, destructive                     | AAA on `bg` (10.02), `surface` (9.45), `surface-2` (9.20), `surface-3` (8.20) |
+| `warning`     | `#5e2a04` | Warnings, low stock                     | AAA on `bg` (11.61), `surface` (10.95), `surface-2` (10.66), `surface-3` (9.51) |
+| `success`     | `#14532d` | Success, completed                      | Mirrors `accent`             |
+| `info`        | `#1e3a8a` | Informational                           | AAA on all 4 surfaces (8.48–10.36) |
+
+**Status text on its `-soft` pill background** is also AAA — the dark status text (e.g. `#14532d`) sits on a light tinted fill (e.g. `#dcfce7`) with ≥ 7:1 contrast. The full matrix (5 status × 4 surfaces + 5 status-on-soft + 4 body-text × 4 surfaces + 1 meta × 4 surfaces + 1 button-text + 5 soft-distinct = 35 assertions) is enforced by `src/lib/__tests__/design-tokens.test.ts`.
+
+`text-faint` is the only token below AAA — used only for de-emphasized meta text where a stronger color would compete with primary content. All token combinations verified by hand calculation; the test suite in Section 5 enforces this in CI.
+
+### Spacing (8pt grid)
+
+`4 / 8 / 12 / 16 / 24 / 32 / 48 / 64`
+
+### Touch targets (HIG Accessibility + gloves)
+
+- All interactive elements: **56pt min height** (HIG default 44pt → 56pt for gloves)
+- Tab bar items: 60pt tall, icon 28pt + label 12pt
+- List row primary action: full-row 72pt tap zone
+- Bottom sheet drag handle: 56pt wide × 5pt tall
+- FAB: 64pt diameter
+- Minimum spacing between adjacent tap targets: 8pt (HIG recommends 16pt for gloves; we use 12pt to keep density reasonable)
+
+### Motion
+
+- All motion respects `prefers-reduced-motion`
+- Card list items stagger in (16ms delay each, max 240ms total) on first mount
+- Tab bar icon bounce on tap (scale 0.85 → 1.05 → 1, 200ms ease-out)
+- StickyActionBar slides up on mount (translate-y 16 → 0, 200ms ease-out)
+- Pull-to-refresh: custom indicator showing last-synced time in mono
+- Default easing: `cubic-bezier(0.32, 0.72, 0, 1)` (Apple's standard)
+
+---
+
+## 2. Architecture & data flow
+
+### Mobile admin shell
+
+```
+┌─────────────────────────────────┐
+│ TopBar: [brand▼] [🔍] [👤]      │  ← 56pt, sticky
+├─────────────────────────────────┤
+│                                 │
+│  Page content                   │  ← scrollable, max 720pt content width
+│  (card-stacked)                 │
+│                                 │
+├─────────────────────────────────┤
+│ [Home][Orders][Stops][Products] │  ← bottom tab bar, 60pt, fixed
+│                  [More]         │
+└─────────────────────────────────┘
+```
+
+- **Bottom tab bar** (always visible, thumb zone): Dashboard · Orders · Stops · Products · **More**
+- **"More" sheet** (drag-up full screen, 90% max-height): Communications, Pickup, Shipping, Reports, Analytics, Settings, etc. — every other admin link, organized into sections.
+- **TopBar** (sticky): brand selector (left), search button (center, opens full-screen search), profile menu (right).
+- **No desktop sidebar on mobile** — `AdminSidebar` is hidden below `lg`. Above `lg`, sidebar is unchanged.
+- A resize-aware `useMediaQuery('(min-width: 1024px)')` swaps between layouts inside `AdminShell`.
+
+### New shared components
+
+| File                                                    | Purpose                                                            |
+| ------------------------------------------------------- | ------------------------------------------------------------------ |
+| `src/components/admin/AdminShell.tsx`                   | Server-component shell that picks nav based on breakpoint          |
+| `src/components/admin/MobileTabBar.tsx`                 | Client component, fixed bottom, active state from `usePathname()`  |
+| `src/components/admin/MoreSheet.tsx`                    | Drag-up sheet for secondary nav, uses native `<dialog>` + View Transitions |
+| `src/components/admin/PageHeader.tsx`                   | Consistent page title + actions row                                |
+| `src/components/admin/StatusPill.tsx`                   | Color-coded pill (uses new status tokens)                          |
+| `src/components/admin/EmptyState.tsx`                   | Used by all 4 key pages                                            |
+| `src/components/admin/CardList.tsx` + `CardListItem`    | Replaces tables on mobile                                          |
+| `src/components/admin/StickyActionBar.tsx`              | Primary action pinned to bottom of detail screens                  |
+| `src/components/admin/OfflineBanner.tsx`                | Top-of-screen offline indicator with pending sync count            |
+
+### Routing
+
+No URL changes. The same `/admin/orders`, `/admin/stops`, `/admin/products` routes serve both layouts; the shell is purely presentational. Server components stay server components — the mobile shell is a thin client wrapper around them.
+
+### Data flow
+
+| Page             | Server source                                          | Mobile client behavior                                        |
+| ---------------- | ------------------------------------------------------ | ------------------------------------------------------------- |
+| Dashboard        | `get_dashboard_summary(brand_id)` (new RPC)            | Cards, 2-col grid on tablet, 1-col on phone                   |
+| Orders list      | `get_orders_for_brand(brand_id, …)` (existing)         | CardList with status pill, customer, total, time              |
+| Order detail     | `get_order_detail(order_id)` (existing)                | Header card + line items + timeline + StickyActionBar         |
+| Stops            | `get_stops_for_brand(brand_id, …)` (existing)          | CardList with time, address, status, "navigate" action        |
+| Products         | `get_products_for_brand(brand_id, …)` (existing)       | CardList with image, name, price, stock                       |
+
+### Offline mutation queue
+
+- `src/lib/offline/queue.ts` — IndexedDB store keyed by `clientActionId`
+- `src/lib/offline/sync.ts` — replays queued actions on `online` event with exponential backoff
+- Server actions stay the source of truth; the queue records `actionName + payload + clientActionId + createdAt` and posts them when online
+- Each queued action shows in the UI with a "pending / synced / conflict" badge in `StickyActionBar`
+- `OfflineBanner` shows when `navigator.onLine === false` and surfaces pending sync count
+- **Conflict resolution:** last-write-wins keyed on `updated_at` returned by the server. After each sync, the client refetches the affected entity and merges.
+- **Backoff:** 1s, 4s, 16s, 60s, 5min; give up after 5 attempts, surface a "Manual retry" button on the conflicting item.
+- **Idempotency:** every queued action carries a `clientActionId` (uuid v4 generated at enqueue time). The server's RPC layer is updated to accept and dedupe on this id.
+
+### New RPC (for dashboard)
+
+```sql
+CREATE OR REPLACE FUNCTION get_dashboard_summary(p_brand_id UUID)
+RETURNS JSONB
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  result JSONB;
+BEGIN
+  SELECT jsonb_build_object(
+    'orders_today', (SELECT COUNT(*) FROM orders WHERE brand_id = p_brand_id AND created_at::date = CURRENT_DATE),
+    'revenue_today', (SELECT COALESCE(SUM(total), 0) FROM orders WHERE brand_id = p_brand_id AND created_at::date = CURRENT_DATE AND status NOT IN ('cancelled')),
+    'pending_fulfillment', (SELECT COUNT(*) FROM orders WHERE brand_id = p_brand_id AND status IN ('placed', 'ready')),
+    'stops_today', (SELECT COUNT(*) FROM stops WHERE brand_id = p_brand_id AND scheduled_at::date = CURRENT_DATE),
+    'orders_last_7_days', (
+      SELECT jsonb_agg(jsonb_build_object('date', d::date, 'count', COALESCE(o.cnt, 0)))
+      FROM generate_series(CURRENT_DATE - INTERVAL '6 days', CURRENT_DATE, '1 day') d
+      LEFT JOIN (
+        SELECT created_at::date AS day, COUNT(*) AS cnt
+        FROM orders
+        WHERE brand_id = p_brand_id AND created_at >= CURRENT_DATE - INTERVAL '7 days'
+        GROUP BY 1
+      ) o ON o.day = d::date
+    )
+  ) INTO result;
+  RETURN result;
+END;
+$$;
+```
+
+---
+
+## 3. PWA, offline, and production hardening
+
+### PWA — what's broken and what we're fixing
+
+| Issue today                                            | Fix                                                                |
+| ------------------------------------------------------ | ------------------------------------------------------------------ |
+| `public/icons/` doesn't exist                          | Generate all 8 sizes (72–512) PNG + maskable + badge + 3 shortcut icons |
+| `public/screenshots/` doesn't exist                    | Generate `dashboard.png` (1280×720) and `mobile-storefront.png` (390×844) |
+| `apple-touch-icon.png` missing                         | Generate 180×180 + 167×167 + 152×152                               |
+| `favicon.ico` missing                                  | Generate from SVG                                                  |
+| `sw.js` references `/offline` page that doesn't exist  | Create `public/offline.html` (clean cream HIG-style page)          |
+| `sw.js` references `/og-default.jpg` (only .svg exists)| Update ref to `/og-default.svg`                                    |
+| `registerServiceWorker()` exported but never called    | Call it from `src/components/Providers.tsx` (client side)          |
+| `PWAInstallPrompt` never mounted                       | Mount in `src/app/admin/layout.tsx` (admin is the installable surface) |
+| `themeColor` mismatch (`#0a0a0a` vs `#1a4d2e`)         | Standardize on `#166534` (forest-800)                              |
+| Missing PWA meta tags                                  | Add `apple-mobile-web-app-capable`, `application-name`, `mobile-web-app-capable`, `apple-mobile-web-app-status-bar-style` |
+| `viewport.maximumScale = 5` but no `viewportFit: cover`| Add `viewportFit: 'cover'` for notched devices                     |
+
+### Service worker rewrite
+
+Replace `public/sw.js` with a versioned, two-cache SW:
+
+- **App shell cache** (e.g. `rc-shell-v3`): pre-caches `/`, `/admin`, `/manifest.json`, fonts, icons, offline page — install-time `cache.addAll(…)`.
+- **Data cache** (e.g. `rc-data-v3`): stale-while-revalidate for `/api/orders`, `/api/stops`, `/api/products`, `/api/dashboard` — read offline, refetch in background.
+- **Cache strategies:**
+  - Navigations → network-first, fall back to cache, fall back to `/offline.html`
+  - Static assets (`/_next/static/*`, `/icons/*`, `/screenshots/*`) → cache-first
+  - API GETs (`/api/*` non-mutation) → stale-while-revalidate
+  - API mutations (`POST`/`PATCH`/`DELETE`) → never cached, pass-through; offline behavior handled by the client queue
+- **Versioning:** `CACHE_NAME` bumped on each release; activate handler deletes old caches; `skipWaiting()` + `clients.claim()` to roll out updates fast.
+- **Logging:** all `console.log` calls guarded by `process.env.NODE_ENV !== 'production'`.
+
+### Production hardening
+
+- `next.config.ts` — add `headers()` for `Cache-Control: public, max-age=31536000, immutable` on `/_next/static/*` and `/icons/*`
+- Font preloading: `next/font` already inlines the CSS — verify the `display: swap` strategy stays
+- Image optimization: existing `next/image` config; add `priority` to the admin logo in the top bar
+- Code splitting: admin layout stays in its own chunk; mobile shell is a dynamic import gated on viewport
+- No layout shift on font load: `next/font` reserves metric-based space
+
+### Files touched in this section
+
+- `public/manifest.json` (theme_color + new screenshot paths)
+- `public/sw.js` (full rewrite)
+- `public/offline.html` (new)
+- `public/icons/*.png` (8 + maskable + badge + 3 shortcuts = 13 new files)
+- `public/screenshots/*.png` (2 new)
+- `public/apple-touch-icon.png` + variants (3 new)
+- `public/favicon.ico` (1 new)
+- `src/app/layout.tsx` (add PWA meta + register SW via Providers)
+- `src/components/Providers.tsx` (call `registerServiceWorker()` on mount)
+- `src/app/admin/layout.tsx` (mount `PWAInstallPrompt`)
+- `next.config.ts` (cache headers for static assets)
+
+---
+
+## 4. Page-by-page layouts
+
+All pages share: top bar, page header (title + primary action), card-stacked body (no tables on phones), bottom tab bar. The desktop layout is unchanged above `lg`.
+
+### Dashboard (`/admin`)
+
+- **Page header:** "Today" (Fraunces 32pt) + date in mono + brand selector (in top bar)
+- **Stat row** (2×2 grid on phone, 4×1 on tablet+): Orders Today · Revenue · Pending Fulfillment · Stops Today — each card is `surface-2` with a big Fraunces number, Manrope label, and a 7-day sparkline in mono
+- **"Needs you" card** (only if pending actions > 0): top-of-page warning card with count + "View all" CTA
+- **Today's stops timeline:** vertical timeline of upcoming stops, each row tappable
+- **Aesthetic:** calm, editorial, "open the laptop on the couch" feel. Numbers in Fraunces do the talking.
+
+### Orders list (`/admin/orders`)
+
+- **Page header:** "Orders" + filter button (opens bottom sheet) + "+ New order"
+- **Filter sheet:** status, date range, customer, stop — drag-up sheet, sticky apply bar
+- **Card list** (one per order):
+  - Top row: status pill (left) · order # in mono · time-ago (right)
+  - Middle: customer name (Manrope 700 19pt) + item count ("4 items")
+  - Bottom: total (Fraunces 22pt) · arrow chevron
+  - Whole row: 72pt tap zone
+- **Empty state:** "No orders yet" + illustration + "+ New order" CTA
+- **Pull-to-refresh** at the top
+
+### Order detail (`/admin/orders/[id]`)
+
+- **Header card:** customer name (Fraunces 28pt), phone + email (tap-to-call / tap-to-email), order # in mono, status pill
+- **Line items card:** each item is a sub-row — image (56pt square), name, qty × price, fulfillment icon (pickup vs ship)
+- **Fulfillment timeline card:** horizontal stepper (Placed → Ready → Picked up) with timestamps in mono
+- **Customer notes card** (if present): quoted, italic
+- **StickyActionBar** (bottom, above tab bar): primary action changes by status:
+  - Placed → "Mark Ready" (forest-800 fill, full width, 56pt)
+  - Ready → "Mark Picked Up" (forest-800 fill)
+  - Picked up → "View Receipt" (outlined)
+- **Secondary actions** (refund, edit, contact customer) live in a top-right "•••" menu
+- **Offline pending badge:** if the order was just updated offline, the action bar shows "Pending sync" with a tiny spinner until the queue replays
+
+### Stops (`/admin/stops`)
+
+- **Page header:** "Stops" + date picker (large, tappable) + "+ New stop"
+- **Time-grouped sections:** "Morning" / "Afternoon" / "Evening" with sticky section headers (Manrope 700 15pt, surface-50 bg, 8pt vertical padding)
+- **Stop card:**
+  - Time (Fraunces 28pt, left) · address (Manrope 600 17pt) · customer count
+  - Status pill + "Navigate" icon button (opens maps app via `navigator.share` fallback to URL)
+  - Inline status changer: tap status pill → bottom sheet with status options
+  - Whole row: 88pt to accommodate time + address comfortably
+- **Empty state:** "No stops scheduled" + "+ New stop"
+
+### Products (`/admin/products`)
+
+- **Page header:** "Products" + search input (always visible, prominent) + "+ New product"
+- **Card list:**
+  - Image (64pt square, rounded-2xl, object-cover) · name (Manrope 700 17pt) · price (Fraunces 20pt)
+  - Stock row: "142 in stock" or "⚠ 8 left" or "✕ Out of stock" — color + icon, never color alone
+  - "Adjust stock" via long-press → bottom sheet with +/− stepper
+- **Filter chips above list:** All · In stock · Low · Out · Hidden
+- **Empty state:** "No products" + "+ New product"
+
+### Motion (per page)
+
+- Card list items stagger in (16ms delay each, max 240ms total) on first mount
+- Tab bar icon bounce on tap (scale 0.85 → 1.05 → 1, 200ms ease-out)
+- Pull-to-refresh: custom indicator showing last-synced time
+- StickyActionBar slides up on mount (translate-y 16 → 0, 200ms ease-out)
+- All motion respects `prefers-reduced-motion`
+
+### Aesthetic summary
+
+Editorial-meets-field. Fraunces for numbers, prices, and the few serif headlines; Manrope for everything else; Fragment Mono for IDs, totals, timestamps. Warm cream surfaces, deeply saturated status colors, generous breathing room. Reads like a high-end tool someone made for themselves — not a generic admin template.
+
+---
+
+## 5. Testing & verification
+
+### Unit tests (Vitest)
+
+- `src/lib/offline/queue.test.ts` — enqueue, dequeue, persist across page reload, idempotency on `clientActionId`
+- `src/lib/offline/sync.test.ts` — replays on `online` event, exponential backoff (1s, 4s, 16s, 60s, 5min, give up at 5 attempts), conflict surfacing
+- `src/lib/format-date.test.ts` — extend for new relative formats ("just now", "5m ago", "2h ago", "yesterday")
+- `src/lib/__tests__/design-tokens.test.ts` — asserts all token combinations meet WCAG contrast on the surfaces they actually render on (body text on all 4 surfaces at AAA; status text on `bg` + `surface` + their `-soft` pill backgrounds at AAA; `text-faint` on all 4 surfaces at AA; `accent-2` as a button background with white text at AAA); fails CI if a new color regresses
+
+### Component tests (Vitest + Testing Library)
+
+- `MobileTabBar` — active state, more-sheet trigger, keyboard nav
+- `StickyActionBar` — pending badge, conflict state
+- `OfflineBanner` — appears on `offline` event, hidden on `online`
+- `StatusPill` — every status × every color combination renders the right aria-label
+- `MoreSheet` — opens via More button, traps focus, closes on Escape and backdrop click, restores focus on close
+
+**UI primitives:** No dialog/sheet library (vaul, radix, headlessui) is currently in the project. `MoreSheet` and the various bottom sheets (filter, status changer, stock stepper) use the native `<dialog>` element with `showModal()` + the View Transitions API for open/close animation. This is a deliberate choice to keep the bundle small for the PWA. The native `<dialog>` is well-supported in Safari 15.4+, Chrome 37+, and Firefox 98+ — all versions we target.
+
+**Pull-to-refresh:** Custom implementation using pointer events on a sentinel element at the top of each list. We avoid adding a third-party pull-to-refresh library to keep the bundle small. The custom implementation is ~80 lines, respects `overscroll-behavior: contain`, and falls back to no-op if the user has indicated motion sensitivity.
+
+**Tap-to-call / tap-to-email:** Implemented with explicit `tel:` and `mailto:` URL schemes on `<a>` tags (not buttons that call `window.location`). This ensures the OS handles the routing (e.g., FaceTime prompts on iOS, Gmail/Outlook chooser on Android) and is accessible to screen readers out of the box.
+
+**Color contrast test exclusions:** `text-faint` is the only token below WCAG AAA (it passes AA at ≥ 5.28:1). The test in `src/lib/__tests__/design-tokens.test.ts` will assert AAA (7:1) for every token combination *except* `text-faint`, which is tested at AA (4.5:1). This is documented in the test file as an intentional exception.
+
+### E2E (Playwright)
+
+New spec: `tests/mobile-admin/pwa-install.spec.ts`
+- Loads `/admin` on iPhone 13 viewport
+- Asserts manifest link present, manifest is valid JSON, all icons return 200
+- Asserts `apple-touch-icon` link present
+- Asserts service worker registers successfully (via `navigator.serviceWorker.ready`)
+
+New spec: `tests/mobile-admin/orders-list.spec.ts`
+- Loads `/admin/orders` on iPhone 13 viewport
+- Asserts no horizontal scroll (page width ≤ viewport)
+- Asserts every interactive element has touch target ≥ 48pt
+- Asserts all text passes axe-core
+
+New spec: `tests/mobile-admin/offline-queue.spec.ts`
+- Loads `/admin/orders/<id>` on iPhone 13 viewport
+- Goes offline (Playwright `context.setOffline(true)`)
+- Clicks "Mark Ready"
+- Asserts the optimistic UI updates
+- Asserts the action bar shows "Pending sync" badge
+- Goes back online
+- Asserts the badge clears within 5s and the server has the new status
+
+### Visual regression (Playwright `toHaveScreenshot`)
+
+- All 4 key page screens at 390×844 (iPhone 13)
+- All 4 key page screens at 1024×768 (iPad)
+- MobileTabBar — light + dark
+- OfflineBanner — visible, hidden
+
+### Manual QA checklist (added to PR template)
+
+- [ ] Read every new screen in direct sunlight (or under a 5000K desk lamp at full brightness)
+- [ ] Tap every interactive element while wearing work gloves
+- [ ] Verify install-to-home-screen on a real iPhone (Safari → Share → Add to Home Screen) and confirm the splash + app icon are correct
+- [ ] Toggle airplane mode and exercise: orders list, order detail, stops, products, mark-ready, mark-picked-up, stop status change, stock adjust
+- [ ] Run `npx lighthouse http://localhost:3000/admin --preset=mobile --view` and confirm Performance ≥ 90, Accessibility ≥ 95, PWA checks pass
+
+### Lighthouse / PWA gate (CI)
+
+- Add a CI job (`.gitea/workflows/pwa-audit.yml`) that runs `lighthouse-ci` against the preview URL on every PR
+- PWA category must pass (installable, manifest valid, service worker registered, themed)
+- Mobile accessibility score must be ≥ 95
+
+### Documentation
+
+- `docs/pwa-testing.md` — how to manually test PWA + offline on a real device
+- `docs/admin-mobile.md` — design rationale + token reference for the team
+
+### Files touched in this section
+
+~8 new test files, 1 CI workflow, 2 docs, plus assertions added to `playwright.config.ts` to include the `mobile-admin` project at iPhone 13 viewport by default.
+
+---
+
+## File inventory (consolidated)
+
+### New files
+
+- `public/icons/icon-{72,96,128,144,152,192,384,512}x{72,96,128,144,152,192,384,512}.png` (8)
+- `public/icons/icon-maskable-512x512.png` (1)
+- `public/icons/badge-72x72.png` (1)
+- `public/icons/{orders,products,stops}-shortcut.png` (3)
+- `public/screenshots/dashboard.png` (1)
+- `public/screenshots/mobile-storefront.png` (1)
+- `public/apple-touch-icon.png` (180×180), `public/apple-touch-icon-167.png`, `public/apple-touch-icon-152.png` (3)
+- `public/favicon.ico` (1)
+- `public/offline.html` (1)
+- `src/components/admin/AdminShell.tsx`
+- `src/components/admin/MobileTabBar.tsx`
+- `src/components/admin/MoreSheet.tsx`
+- `src/components/admin/PageHeader.tsx`
+- `src/components/admin/StatusPill.tsx`
+- `src/components/admin/EmptyState.tsx`
+- `src/components/admin/CardList.tsx`
+- `src/components/admin/StickyActionBar.tsx`
+- `src/components/admin/OfflineBanner.tsx`
+- `src/lib/offline/queue.ts`
+- `src/lib/offline/sync.ts`
+- `src/lib/offline/db.ts` (IndexedDB wrapper)
+- `src/lib/__tests__/design-tokens.test.ts`
+- `src/lib/offline/queue.test.ts`
+- `src/lib/offline/sync.test.ts`
+- `tests/mobile-admin/pwa-install.spec.ts`
+- `tests/mobile-admin/orders-list.spec.ts`
+- `tests/mobile-admin/offline-queue.spec.ts`
+- `.gitea/workflows/pwa-audit.yml`
+- `docs/pwa-testing.md`
+- `docs/admin-mobile.md`
+- `db/migrations/NNN_dashboard_summary_rpc.sql` (new RPC for dashboard)
+
+### Modified files
+
+- `public/manifest.json` (theme_color, screenshot paths)
+- `public/sw.js` (full rewrite)
+- `src/app/layout.tsx` (PWA meta tags, viewport.fit, themeColor)
+- `src/components/Providers.tsx` (call `registerServiceWorker()`)
+- `src/app/admin/layout.tsx` (mount `PWAInstallPrompt` + `OfflineBanner`, swap sidebar for `AdminShell`)
+- `src/app/admin/v2/page.tsx` (Dashboard card layout — new v2 route)
+- `src/app/admin/v2/orders/page.tsx` (CardList — new v2 route)
+- `src/app/admin/v2/orders/[id]/page.tsx` (card layout + StickyActionBar + offline-queue integration — new v2 route)
+- `src/app/admin/v2/stops/page.tsx` (time-grouped card list — new v2 route)
+- `src/app/admin/v2/products/page.tsx` (image-forward card list — new v2 route)
+- `next.config.ts` (cache headers for static assets; cutover redirects in PRs 6 and 8)
+- `playwright.config.ts` (add `mobile-admin` project at iPhone 13 viewport)
+- `src/lib/pwa.ts` (small fixes: `load` listener guard, dev-only logging)
+- `src/app/page.tsx` (favicon ref fix)
+
+Note: the v1 admin pages (`src/app/admin/page.tsx`, `src/app/admin/orders/page.tsx`, etc.) are **not** modified by PRs 1–5. They continue to serve the existing desktop layout until the cutover PRs redirect their routes to v2. After cutover, the v1 files are deleted in a follow-up commit.
+
+---
+
+## Open questions (deferred)
+
+- **Web Push notifications** — SW has a handler scaffolded, but enabling real pushes requires VAPID keys, a push service, and a UX decision. Tabled for a follow-up spec.
+- **Wholesale portal mobile** — out of scope here; would benefit from the same design system once the admin is shipped.
+- **App Store / Play Store packaging** — Capacitor / TWA is the obvious next step once the PWA is solid. Not in this spec.
+- **Image upload from camera** — products/stops could use this; separate spec.
+
+---
+
+## Risks
+
+1. **The existing admin pages have a lot of bespoke UI** (drag-and-drop, complex tables, modals). Some of it may need to be simplified for the mobile-first treatment, not just wrapped. We'll discover this during implementation; the design language and shared components are designed to absorb it.
+2. **The IndexedDB queue + idempotency requires server-side support** (`clientActionId` parameter on the relevant RPCs). The migration for the new RPCs is in scope; the RPC changes for idempotency are flagged here so they don't surprise us.
+3. **iOS PWA limitations** — no push, no background sync (until iOS 16.4+ and even then limited), no install prompt via API (we use the manual `beforeinstallprompt` only, plus the iOS "Add to Home Screen" instructions in our install prompt copy). We document these limitations in the install prompt UI.
+4. **Outdoor screen testing is subjective.** The 5000K lamp proxy won't catch every case. Real device testing in sunlight is required for sign-off.
+
+---
+
+## Rollout plan
+
+> **Note on feature flags:** The project has a `src/lib/feature-flags.ts` system, but it's for **brand-scoped add-on features** (Harvest Reach, Square Sync, etc.), not for app-wide UI rollouts. There is no general-purpose feature flag system in this codebase. We will use a **route-based dual-deployment** strategy for rollout:
+>
+> - PRs 1–2 (design system + PWA scaffolding) are non-breaking; they add the new infrastructure without changing existing routes.
+> - PRs 3–5 (Orders, Stops, Products) ship the new mobile-first versions at **`/admin/v2/orders`**, **`/admin/v2/stops`**, **`/admin/v2/products`**, and **`/admin/v2/orders/[id]`** initially. The old `/admin/orders` etc. routes continue to work unchanged. Internal team dogfoods at `/admin/v2/*` for 1–2 weeks.
+> - PR 6 cuts over: a redirect in `next.config.ts` sends `/admin/orders*` → `/admin/v2/orders*`, etc. The old routes are removed in a follow-up commit.
+> - PR 7 (Dashboard at `/admin/v2`) follows the same pattern.
+>
+> This avoids the need to introduce a feature flag system, which would be a separate piece of work.
+
+1. **PR 1 — Design system + admin shell** — type scale, color tokens, AdminShell, MobileTabBar, MoreSheet, offline queue + sync. No page changes yet. Lighthouse PWA gate added.
+2. **PR 2 — PWA manifest + SW + icons + offline page** — PWA installable, splash, themed status bar. All tests pass.
+3. **PR 3 — Orders v2 (list + detail)** at `/admin/v2/orders/*` — first page on the new design language. Validates the components in real use.
+4. **PR 4 — Stops v2** at `/admin/v2/stops`
+5. **PR 5 — Products v2** at `/admin/v2/products`
+6. **PR 6 — Cutover Orders + Stops + Products** — redirects in `next.config.ts`; old routes removed in a follow-up commit
+7. **PR 7 — Dashboard v2** at `/admin/v2` (depends on the new `get_dashboard_summary` RPC migration)
+8. **PR 8 — Dashboard cutover** — redirect `/admin` → `/admin/v2`; remove old dashboard
+
+Each PR is independently shippable and reversible. The desktop layout is never affected until cutover PRs land.
+
+---
+
+## Definition of done
+
+- [ ] All 4 key pages ship the mobile-first treatment
+- [ ] PWA installs on iOS Safari and Android Chrome
+- [ ] Service worker pre-caches the app shell, swr-caches the data, falls back to `/offline` on navigation
+- [ ] Offline mutation queue replays actions on reconnect with no data loss
+- [ ] All interactive elements ≥ 48pt (aim 56pt) on mobile
+- [ ] All text passes WCAG AAA (7:1) against its background
+- [ ] Lighthouse mobile audit: Performance ≥ 90, Accessibility ≥ 95, PWA passes
+- [ ] No horizontal scroll on any of the 4 key pages at iPhone 13 viewport
+- [ ] `prefers-reduced-motion` honored
+- [ ] All Playwright specs (PWA install, orders list, offline queue) pass in CI
+- [ ] Visual regression baselines committed for all 4 key pages × 2 viewports
+- [ ] Real-device install + offline testing documented and signed off

docs/superpowers/specs/2026-06-17-admin-redesign.md

@@ -0,0 +1,135 @@
+# Admin Redesign — 2026-06-17
+
+> Branch: `design/ui-revamp-2026-06`
+> Type: Hot take. Tomorrow deadline. Approved yolo.
+> Goal: polish the public side, reimagine the admin, fix the colors, make things findable.
+
+---
+
+## 1. Context
+
+- **Public side (`/`, `/tuxedo`, `/indian-river-direct`, pricing, blog, contact)** — "good, just needs polishing." The "Atelier des Récoltes" / "Field Almanac" editorial language is in place (cream + forest + gold + Fraunces + Manrope + Fragment Mono). Don't break it.
+- **Admin (`/admin/*`)** — the surface that needs the most work.
+  - 15+ admin sections are split across 4 dashboard tabs (Operations / Fulfillment / Management / Tools). **The user can't find things.**
+  - Color palette mixes forest + citrus + sage + gold + warmred + surface greys. **The colors fight each other and feel muddy.**
+  - Sidebar has 6 flat items. "Settings" sub-pages are reachable only by knowing they exist. **Discoverability is bad.**
+  - The "Harvest Almanac" design system (`.ha-*` classes) exists but is underused. Most admin pages fall back to defaults.
+
+## 2. Aesthetic direction (one paragraph, committed)
+
+> **Editorial operations.** The admin should feel like the back office of an almanac press, not a generic SaaS dashboard. Warm cream canvas, deep botanical green for primary action, amber gold for the *one* thing you should do next, ink-black for text, a single soft beige for borders. The same typeface family as the public side (Fraunces / Manrope / Fragment Mono). Generous use of numerals in Fragment Mono so prices and counts read like a ledger. **One primary, one accent, four neutrals. That's it.** No purple, no teal, no citrus orange as a primary.
+
+Commit to this and stop adding new colors.
+
+## 3. Color system (final, do not deviate)
+
+| Token | Hex | Use |
+|---|---|---|
+| `--admin-bg` | `#FAF7F0` | Page background (atelier cream) |
+| `--admin-surface` | `#FFFFFF` | Cards, modals, sheets |
+| `--admin-surface-sunken` | `#F4F1E8` | Inset wells, code blocks |
+| `--admin-ink` | `#1A1814` | Primary text |
+| `--admin-ink-muted` | `#73706B` | Secondary text |
+| `--admin-ink-faint` | `#A8A29E` | Tertiary / placeholders |
+| `--admin-line` | `#E8E4D7` | Borders, dividers |
+| `--admin-line-strong` | `#D4CFBE` | Emphasized borders |
+| `--admin-primary` | `#1F4D2A` | Primary action (deep botanical) |
+| `--admin-primary-hover` | `#163C20` | Primary hover |
+| `--admin-primary-soft` | `#E8F0E5` | Primary at 8% (selected rows, chips) |
+| `--admin-accent` | `#B8761E` | Amber — "the one thing to do" |
+| `--admin-accent-soft` | `#F7EBD5` | Amber at 12% |
+| `--admin-success` | `#1F4D2A` | (same as primary; semantic) |
+| `--admin-warning` | `#B8761E` | (same as accent; semantic) |
+| `--admin-danger` | `#A8321C` | Errors / destructive |
+| `--admin-danger-soft` | `#F7E3DE` | Danger at 12% |
+
+**Drop**: `--admin-warning: #aba278` (looks like dirt), the old `citrus` orange in the active state, the blue/purple stat icons. Replace with semantic use of the new palette.
+
+## 4. IA decision
+
+Sidebar groups, top to bottom, with section dividers:
+
+| Group | Items |
+|---|---|
+| **Workspace** | Dashboard · Command Center (platform_admin only) |
+| **Operations** | Orders · Stops & Routes · Products · Driver Pickup · Shipping |
+| **Communications** | Harvest Reach (campaigns, templates, contacts, segments, logs) |
+| **Growth** | Wholesale · Import Center · AI Intelligence |
+| **Tracking** | Time Tracking · Water Log · Route Trace |
+| **Insights** | Reports · Tax Dashboard |
+| **Settings** | General · Brand · Billing · Users & Permissions · Integrations · Payments · Shipping · Add-ons |
+
+The old "Workers & PINs" sidebar item is a tab on Time Tracking now. Settings is one click → secondary nav inside settings (tabs at the top of the page).
+
+**Cmd+K command palette** for global search across:
+- Pages (jumps to any admin route)
+- Recent orders / products / stops / customers (live search)
+- Quick actions ("Create order", "Add product", "Send blast")
+
+## 5. Component patterns (consistency pass)
+
+| Pattern | Owner | Status |
+|---|---|---|
+| `PageHeader` (eyebrow + title + subtitle + actions) | `src/components/admin/design-system/PageHeader.tsx` | exists, audit usage |
+| `EmptyState` (icon + title + body + CTA) | same dir, currently `EmptyState.tsx` exists for shared, admin needs its own | add `.ha-empty` |
+| `LoadingState` (skeleton + label) | `.ha-skeleton` exists in CSS, no component | wrap |
+| `ConfirmDialog` (destructive action) | `AdminDeleteConfirm.tsx` exists | audit usage |
+| `StatusPill` (success/warn/danger/info/neutral) | `AdminBadge.tsx` exists, variants are off | tighten variants |
+| `KPIStat` (label + value + trend) | inline in `DashboardClient` | extract to component |
+| `CommandPalette` (Cmd+K) | **new** | new component |
+| `SideNavGroup` (label + items) | **new** | replaces flat NAV_ITEMS |
+| `DataTable` (sortable, filterable, paginated) | `shared/DataTable.tsx` exists | tighten + use everywhere |
+
+## 6. Phased execution (yolo, one day)
+
+**Phase 1 — Foundation (commit per file)**
+- Update `src/styles/admin-design-system.css` color tokens
+- New `SideNavGroup` component
+- Replace `AdminSidebar` flat list with grouped nav
+- New `CommandPalette` component (mounted in admin layout)
+- Refactor `DashboardClient` to unified command center (drop 4 tabs, single column feed)
+
+**Phase 2 — Pattern extraction (commit per file)**
+- Extract `KPIStat` from dashboard
+- Refine `EmptyState` admin variant
+- `LoadingState` wrapper
+- `StatusPill` tighten variants
+
+**Phase 3 — Apply to highest-traffic pages**
+- `/admin/orders` + detail
+- `/admin/products` + new + edit
+- `/admin/stops` calendar
+- `/admin/communications` composer
+- `/admin/settings/*` tabs
+
+**Phase 4 — Frontend polish**
+- Public page spot-check: hero spacing, section rhythm
+- Verify TypeScript + build green
+
+## 7. Risk & revert
+
+- Working on branch `design/ui-revamp-2026-06` (already created off `main`).
+- **Every milestone is its own commit.** `git reset --hard <sha>` reverts to that point.
+- **One-click full revert:** `git checkout main && git branch -D design/ui-revamp-2026-06` — but only after a failed `git push`.
+- Type-check (`npx tsc --noEmit`) + `npm run build` are the gate at the end of each phase. Build green = milestone accepted.
+- If something breaks the admin layout at runtime, `git revert HEAD` unwinds the most recent commit without losing history.
+- **Do not delete or rename files in this branch.** Only add, only modify. Easier to revert.
+
+## 8. Out of scope (yolo tomorrow, not now)
+
+- Wholesale portal pages (`/wholesale/*`)
+- Water-log standalone pages
+- Public marketing pages (pricing, blog, changelog) — polish later
+- Wholesale auth migration (separate task per MEMORY.md)
+- Migrating remaining legacy `supabase.from()` calls (separate task per MEMORY.md)
+
+## 9. What "done" looks like
+
+- [ ] Color tokens unified, no muddy mix
+- [ ] Sidebar has 6 visible groups with section labels
+- [ ] Cmd+K opens a command palette that can navigate to any admin page
+- [ ] Dashboard is a single feed, no 4-tab structure
+- [ ] Top 6 admin pages use the new PageHeader / StatusPill / EmptyState consistently
+- [ ] `npx tsc --noEmit` clean
+- [ ] `npm run build` clean
+- [ ] Dev server boots, `/admin` renders, sidebar works, Cmd+K opens

docs/water-log.md

@@ -0,0 +1,337 @@
+# Water Log
+
+A standalone irrigation / water-usage tracker for ditch riders, water
+admins, and farm operators. Tracks flow measurements against physical
+headgates, attributes them to named water users, and rolls them up for
+reporting.
+
+The module is **PIN-based** and lives entirely outside the platform
+admin auth: an irrigator with a 4-digit PIN can submit entries from a
+phone in the field without an account on the platform. Site admins
+manage headgates, users, and settings from `/admin/water-log`.
+
+## When to use this
+
+- You run irrigation ditches / headgates and need to track daily
+  flow with named operators.
+- You need a mobile-friendly entry surface that works in low
+  connectivity (no login, just a PIN).
+- You want a per-brand, brand-scoped record of who recorded what,
+  with audit trail + CSV export for water-rights reporting.
+
+## When NOT to use this
+
+- For sensor/IoT integrations, use the time-series / `Square Sync`
+  flow rather than this module — entries here are hand-typed.
+- For multi-tenant water-rights billing, use the wholesale deposit
+  flow; this module is a measurement ledger, not a billing system.
+
+---
+
+## Architecture at a glance
+
+```
+┌────────────────────────┐  ┌─────────────────────────┐
+│  /water  (PIN form)    │  │  /water/admin/login     │
+│  irrigator → submit    │  │  (water_admin PIN)      │
+│  → wl_session cookie   │  │  → wl_admin_session     │
+└──────────┬─────────────┘  └──────────┬──────────────┘
+           │                            │
+           │  ┌─────────────────────────┘
+           ▼  ▼
+    ┌─────────────────────────────────────┐
+    │   Postgres (RLS) — brand scoped    │
+    │  water_headgates, water_irrigators, │
+    │  water_log_entries, water_sessions, │
+    │  water_admin_sessions, water_       │
+    │  audit_log, water_alert_log,        │
+    │  water_admin_settings               │
+    └─────────────────────────────────────┘
+                  ▲
+                  │
+    ┌─────────────┴──────────────┐
+    │  /admin/water-log          │
+    │  Site-admin CRUD + exports │
+    └────────────────────────────┘
+```
+
+**Two separate PIN surfaces:**
+
+| Surface | Cookie | TTL | Purpose |
+|---|---|---|---|
+| `/water` (irrigator) | `wl_session` | 8 h | Submit flow entries |
+| `/water/admin` (admin) | `wl_admin_session` | configurable (1–168 h) | Manage headgates/users, view all entries |
+
+Both cookies are `httpOnly`, `sameSite=lax`, and `secure` in production.
+
+---
+
+## Data model
+
+### `water_headgates`
+Physical gates a measurement is tied to.
+
+| Column | Type | Notes |
+|---|---|---|
+| `id` | uuid PK | |
+| `brand_id` | uuid FK → brands | brand scope (RLS) |
+| `name` | text | e.g. "Upper Ditch Headgate" |
+| `headgate_token` | text UNIQUE | opaque token used in the QR code |
+| `status` | text | `open` / `closed` / `maintenance` |
+| `unit` | text | default measurement unit (CFS, GPM, AF, …) |
+| `max_flow_gpm` | numeric | optional marker |
+| `high_threshold` | numeric | alert when reading > this |
+| `low_threshold` | numeric | alert when reading < this |
+| `notes` | text | |
+| `active` | bool | soft-delete |
+| `last_used_at` | timestamptz | updated on each entry |
+| `created_at` | timestamptz | |
+
+### `water_irrigators`
+Field workers with PIN access.
+
+| Column | Type | Notes |
+|---|---|---|
+| `id` | uuid PK | |
+| `brand_id` | uuid FK → brands | |
+| `name` | text | |
+| `pin_hash` | text | scrypt `$N$r$p$salt$hash` — never plain |
+| `role` | text | `irrigator` (submit only) or `water_admin` (manage) |
+| `language_preference` | text | `en` / `es` |
+| `phone` | text | optional |
+| `notes` | text | |
+| `active` | bool | soft-delete |
+| `last_used_at` | timestamptz | |
+| `created_at` | timestamptz | |
+
+### `water_log_entries`
+The actual readings.
+
+| Column | Type | Notes |
+|---|---|---|
+| `id` | uuid PK | |
+| `brand_id` | uuid FK → brands | |
+| `headgate_id` | uuid FK | |
+| `irrigator_id` | uuid FK | who submitted |
+| `measurement` | numeric | raw value in `unit` |
+| `unit` | text | CFS, GPM, AF/Day, etc. |
+| `method` | text | `manual` / `meter` / `estimate` / `qr` |
+| `total_gallons` | numeric | auto-computed when CFS × duration is known |
+| `notes` | text | |
+| `submitted_via` | text | `field` / `admin` / `qr` |
+| `photo_url` | text | optional |
+| `latitude` / `longitude` | double precision | optional GPS |
+| `logged_date` | date | date-only mirror for fast grouping |
+| `logged_at` | timestamptz | the actual time |
+| `logged_by` | uuid FK → admin_users | set when a site admin enters data |
+
+### Sessions
+- `water_sessions` — short-lived (8 h) PIN sessions for irrigators.
+- `water_admin_sessions` — admin sign-in sessions, TTL from
+  `water_admin_settings.session_duration_hours`.
+
+### Audit + alerts
+- `water_audit_log` — who changed what, when. Captures every
+  headgate/user/setting mutation with actor + JSON details.
+- `water_alert_log` — high/low threshold breach history.
+- `water_admin_settings` — per-brand admin PIN, permission flags,
+  alert config, session duration.
+
+---
+
+## Security model
+
+### PIN hashing
+PINs are hashed with **scrypt** (Node built-in `crypto.scryptSync`)
+at N=16384, r=8, p=1, 32-byte key, with a per-PIN random salt. The
+hash is self-describing: `scrypt$N$r$p$salt_b64$hash_b64`. We avoid
+adding a `bcrypt` or `argon2` dependency — `scrypt` is in the Node
+core and matches the password module already used elsewhere.
+
+### Brute-force hardening
+- 4–8 digit PINs are low entropy, so we:
+  - Reject "weak" PINs at generation (`generatePin` skips 1111, 1234,
+    palindromes, monotonic sequences).
+  - Add a 200 ms delay on every failed `verifyPin` call to slow
+    online guessing.
+  - Use `timingSafeEqual` for the hash comparison.
+  - Sessions are short-lived (8 h for irrigators, configurable 1–168 h
+    for admins).
+- The admin PIN can be regenerated from `/admin/water-log/settings` —
+  regenerating invalidates all existing admin sessions.
+
+### Auth gates
+Every server action enforces one of:
+- `requireFieldSession()` — reads `wl_session` cookie, looks up
+  `water_sessions` row, verifies `expires_at`. Returns userId +
+  brandId.
+- `requireWaterAdminPermission()` — calls `getAdminUser()` and checks
+  `can_manage_water_log` OR `role === "platform_admin"`.
+- `requireWaterAdminSession()` — reads `wl_admin_session` cookie and
+  verifies the row.
+
+There is **no implicit "logged in"** state. Each action that mutates
+data explicitly checks its gate.
+
+### Data isolation
+- All tables have RLS policies (`withBrand()` helper sets a
+  per-request GUC; the policy reads it).
+- `globalThis.__TUXEDO_BRAND_ID__` is a one-time Tuxedo-brand hint for
+  cold-start paths; the active `getAdminUser().brand_id` always wins
+  on later requests.
+- No Supabase REST, no service-role keys — all access is direct
+  through Drizzle over a single shared `pg` Pool (see `src/lib/db.ts`).
+
+---
+
+## Day-to-day usage
+
+### Add a headgate
+1. `/admin/water-log` → scroll to **Headgates** → **+ Add Headgate**.
+2. Enter a unique name (e.g. "North Field Gate 1"), default unit,
+   optional thresholds.
+3. The new headgate gets a printable QR code. Print it and stick it
+   on the gate.
+
+### Add a water user
+1. **Water Users** → **+ Add User**.
+2. Enter name, choose role (Admin or Irrigator), pick language.
+3. A 4-digit PIN is generated. **Write it down now** — it is shown
+   once and never recoverable.
+4. Hand the PIN to the worker. They sign in at `/water` with just
+   that.
+
+### Submit a flow entry (irrigator)
+1. Open `/water` on a phone → enter 4-digit PIN.
+2. Pick the headgate (or scan the QR code — it deep-links to that
+   gate).
+3. Enter the measurement, duration, method, optional notes/photo.
+4. Tap **Submit**. Total gallons is auto-computed when CFS × duration
+   is known.
+5. If the reading crosses a high/low threshold, an alert row is
+   written to `water_alert_log` and (if enabled) an SMS is dispatched
+   to the configured phone.
+
+### Edit or delete an entry (admin)
+- From the **Recent Entries** table, click any row.
+- Edit form is gated by `canEditEntries` / `canDeleteEntries` in
+  `water_admin_settings`. Defaults: edit ✅, delete ✅.
+
+### Reset a PIN
+- **Water Users** row → **Reset PIN** → new PIN is generated and
+  shown once.
+
+### Export CSV
+- **Recent Entries** → **Export CSV** button. Or hit
+  `GET /api/water-logs/export?format=csv` (auth-gated, requires
+  `can_manage_water_log`).
+
+---
+
+## API surface
+
+| Route | Method | Auth | Purpose |
+|---|---|---|---|
+| `/api/water-admin-auth` | POST | none (PIN-protected) | Exchange admin PIN for `wl_admin_session` cookie |
+| `/api/water-logs/export` | GET | admin | Stream entries as JSON or CSV |
+
+`POST /api/water-admin-auth` body:
+```json
+{ "brandId": "64294306-5f42-463d-a5e8-2ad6c81a96de", "pin": "1234" }
+```
+
+On success, sets the `wl_admin_session` cookie. On failure, returns
+a generic error (we don't leak whether the brand has a PIN configured
+vs. whether the PIN is wrong).
+
+---
+
+## Testing
+
+### Unit (Vitest)
+```bash
+npm test -- tests/unit/water-log
+```
+Covers:
+- PIN format validation + weak-PIN detection
+- scrypt round-trip + tampering
+- Reporting utilities (CSV escaping, date filters, season detection)
+- Display age helpers
+
+### E2E (Playwright)
+```bash
+npx playwright test water-log
+```
+Covers:
+- `/water` and `/water/admin/login` render with PIN form
+- PIN input strips non-digits and caps at 4 chars
+- Wrong PIN does not navigate
+- `/admin/water-log/*` redirects unauthenticated users
+- `/api/water-logs/export` and `/api/water-admin-auth` are auth-gated
+
+For the full DB-backed workflow (add headgate → add user → submit →
+export), set `WATER_LOG_E2E_DB=1` and run the same command against a
+test database.
+
+---
+
+## Environment variables
+
+No Water Log–specific env vars are required. The module uses the
+existing `DATABASE_URL` and (optionally) the MinIO bucket
+`MINIO_BUCKET_WATER_LOGS` for photo uploads.
+
+If you want high/low threshold SMS alerts, configure
+`/admin/water-log/settings` with a phone number — SMS dispatch uses
+the brand's existing Twilio config (same as Harvest Reach).
+
+---
+
+## Migration history
+
+- `0001_init.sql` — initial `water_*` tables + RLS policies.
+- `0090_water_log_completion.sql` — adds `headgate_token`, threshold
+  fields, `role` on irrigators, `method` + `logged_date` on entries,
+  plus the `water_admin_*`, `water_audit_log`, and `water_alert_log`
+  tables.
+
+---
+
+## Admin function checklist
+
+Manual regression pass after changes:
+
+### Field side
+- [ ] `/water` PIN screen loads, accepts 4 digits, rejects letters
+- [ ] Wrong PIN shows an error, does not redirect
+- [ ] Correct PIN shows the entry form with the user's headgates
+- [ ] Submitting an entry creates a row, shows confirmation, returns
+      to the form
+- [ ] QR-code link (`/water?h=TOKEN`) pre-selects the headgate
+- [ ] High/low threshold entries write a `water_alert_log` row
+
+### Admin side
+- [ ] `/admin/water-log` shows headgates, users, recent entries
+- [ ] Add headgate → appears in list + QR can be generated
+- [ ] Edit headgate thresholds → reflected in the field form
+- [ ] Add user → PIN shown once, user appears in list
+- [ ] Reset PIN → new PIN shown, old sessions invalidated
+- [ ] Edit entry → measurement, notes, method all updatable
+- [ ] Delete entry → row removed (or soft-flagged per audit policy)
+- [ ] Filter by date range / headgate / user / method works
+- [ ] CSV export downloads valid CSV
+- [ ] Audit log shows the actor for every change
+
+### Settings + portal
+- [ ] `/admin/water-log/settings` shows current config
+- [ ] Toggling "Enable Admin Portal" blocks `/water/admin/login`
+- [ ] Regenerating admin PIN signs out all current admin sessions
+- [ ] Session duration slider clamps to 1–168 hours
+
+### Edge cases
+- [ ] Zero data: empty states render, no crashes
+- [ ] Invalid PIN: form rejects, error is friendly
+- [ ] Duplicate headgate name: server rejects, UI shows error
+- [ ] Very large measurement (1e9): renders, doesn't blow up float
+- [ ] 1,000+ entries: list paginates, filters stay responsive
+- [ ] Concurrent submissions: both rows present, no lost writes

drizzle.config.ts

@@ -0,0 +1,18 @@
+/**
+ * Drizzle Kit config. Used by `drizzle-kit generate` / `drizzle-kit push`
+ * for future migrations. The schema in `db/migrations/0001_init.sql` is
+ * the source of truth for v1; subsequent migrations can be generated
+ * from changes to `db/schema/*.ts` and committed alongside the SQL.
+ */
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./db/schema/index.ts",
+  out: "./db/migrations",
+  dialect: "postgresql",
+  dbCredentials: {
+    url: process.env.DATABASE_URL ?? "postgres://postgres:postgres@localhost:5432/route_commerce",
+  },
+  strict: true,
+  verbose: true,
+});

eslint.config.mjs

@@ -12,6 +12,9 @@ const eslintConfig = defineConfig([
     "out/**",
     "build/**",
     "next-env.d.ts",
+    // Ignore legacy .js scripts that use CommonJS
+    "scripts/**",
+    "fix-agents.js",
   ]),
   // Allow setState in useEffect for PWA prompts and client-side state initialization
   {
@@ -20,6 +23,14 @@ const eslintConfig = defineConfig([
       "react-hooks/set-state-in-effect": "off",
     },
   },
+  // Relax some rules for legacy code
+  {
+    files: ["db/**", "scripts/**"],
+    rules: {
+      "@typescript-eslint/no-require-imports": "off",
+      "@typescript-eslint/no-explicit-any": "warn",
+    },
+  },
 ]);
 
 export default eslintConfig;

inspect_xlsx.py

@@ -0,0 +1,14 @@
+import openpyxl
+path = "/home/coder/dev/x1/kyle/route_commerce-main/Tuxedo_Corn_2026_Tour_Schedule-3.xlsx"
+wb = openpyxl.load_workbook(path, data_only=True)
+for name in wb.sheetnames:
+    ws = wb[name]
+    print(f"=== SHEET: {name} ({ws.max_row} rows x {ws.max_column} cols) ===")
+    for row in ws.iter_rows(values_only=False):
+        for cell in row:
+            if cell.value is not None:
+                v = str(cell.value)
+                if len(v) > 200:
+                    v = v[:200] + "..."
+                print(f"  {cell.coordinate}: {v!r}")
+    print()

lighthouserc.json

@@ -0,0 +1,26 @@
+{
+  "ci": {
+    "collect": {
+      "url": [
+        "http://localhost:3000/admin/v2/orders",
+        "http://localhost:3000/admin/v2/stops",
+        "http://localhost:3000/admin/v2/products"
+      ],
+      "numberOfRuns": 1,
+      "settings": {
+        "preset": "mobile",
+        "emulatedFormFactor": "mobile"
+      }
+    },
+    "assert": {
+      "assertions": {
+        "categories:performance": ["error", { "minScore": 0.9 }],
+        "categories:accessibility": ["error", { "minScore": 0.95 }],
+        "categories:pwa": "error",
+        "installable-manifest": "error",
+        "service-worker": "error",
+        "themed-omnibox": "warn"
+      }
+    }
+  }
+}

middleware.ts

@@ -1,58 +0,0 @@
-import { NextResponse, type NextRequest } from "next/server";
-import { getSessionCookie } from "better-auth/cookies";
-
-const DEV_UID = "dev-user-00000000-0000-0000-0000-000000000000";
-
-export async function middleware(request: NextRequest) {
-  const response = NextResponse.next({ request });
-
-  // ── Dev session bypass (enabled in all envs for demo) ──────────────
-  // Allow dev cookies via: document.cookie = "dev_session=platform_admin; path=/"
-  const devSession = request.cookies.get("dev_session")?.value;
-  const isDevMode = devSession === "platform_admin" || devSession === "brand_admin" || devSession === "store_employee";
-
-  // Better Auth sets cookie named "rc_session_token" by default (with cookiePrefix: "rc")
-  const sessionCookie = getSessionCookie(request);
-  const hasSession = Boolean(sessionCookie);
-
-  let authed = false;
-  if (isDevMode) {
-    authed = true;
-  } else if (hasSession) {
-    authed = true;
-  }
-
-  const isAdmin = request.nextUrl.pathname.startsWith("/admin");
-  const isLogin = request.nextUrl.pathname === "/login";
-
-  if (isAdmin && !authed) {
-    // Auto-login for demo: no auth cookie present
-    const url = request.nextUrl.clone();
-    url.pathname = "/admin";
-    url.searchParams.set("demo", "1");
-    const response = NextResponse.redirect(url);
-    response.cookies.set("dev_session", "platform_admin", {
-      path: "/",
-      maxAge: 60 * 60 * 24,
-      httpOnly: true,
-      sameSite: "strict",
-    });
-    return response;
-  }
-
-  if (isLogin && authed) {
-    const url = request.nextUrl.clone();
-    url.pathname = "/admin";
-    return NextResponse.redirect(url);
-  }
-
-  return response;
-}
-
-export const config = {
-  matcher: [
-    "/admin/:path*",
-    "/admin",
-    "/login",
-  ],
-};

next.config.ts

@@ -1,16 +1,27 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
+  // Enable standalone output for Docker/PM2 deployment
+  output: "standalone",
+
+  // Lock the file-tracing root to the project directory. Without this,
+  // Next.js 16 walks up from package.json looking for a lockfile, finds
+  // the homelab runner's stale `act` cache at
+  // /home/tyler/.cache/act/.../package-lock.json, and warns:
+  //   "We detected multiple lockfiles and selected the directory of
+  //    /home/tyler/package-lock.json as the root directory."
+  // The deploy runner's APP_DIR is /home/tyler/route-commerce, so
+  // resolving relative to the project root is correct both locally and
+  // in CI. We resolve to an absolute path to avoid the warning in
+  // Next.js 16 which prefers absolute paths here.
+  outputFileTracingRoot: __dirname,
+
   // Enable strict mode
   reactStrictMode: true,
 
   // Optimize images
   images: {
     remotePatterns: [
-      {
-        protocol: "https",
-        hostname: "*.supabase.co",
-      },
       {
         protocol: "https",
         hostname: "images.unsplash.com",
@@ -19,24 +30,6 @@ const nextConfig: NextConfig = {
         protocol: "https",
         hostname: "picsum.photos",
       },
-      // Local self-hosted MinIO (replaces Supabase Storage)
-      {
-        protocol: "http",
-        hostname: "localhost",
-        port: "9000",
-        pathname: "/**",
-      },
-      {
-        protocol: "http",
-        hostname: "127.0.0.1",
-        port: "9000",
-        pathname: "/**",
-      },
-      // Production MinIO behind route.crispygoat.com
-      {
-        protocol: "https",
-        hostname: "storage.route.crispygoat.com",
-      },
     ],
     formats: ["image/avif", "image/webp"],
     deviceSizes: [640, 750, 828, 1080, 1200, 1920, 2048, 3840],
@@ -89,35 +82,63 @@ const nextConfig: NextConfig = {
           },
         ],
       },
+      {
+        source: "/_next/static/:path*",
+        headers: [
+          { key: "Cache-Control", value: "public, max-age=31536000, immutable" },
+        ],
+      },
+      {
+        source: "/icons/:path*",
+        headers: [
+          { key: "Cache-Control", value: "public, max-age=31536000, immutable" },
+        ],
+      },
+      {
+        source: "/screenshots/:path*",
+        headers: [
+          { key: "Cache-Control", value: "public, max-age=604800" },
+        ],
+      },
     ];
   },
 
   // Redirects
   async redirects() {
     return [
-      // Redirect old paths if needed
-      // {
-      //   source: '/old-path',
-      //   destination: '/new-path',
-      //   permanent: true,
-      // },
+      // Cutover (PR 6, Task 6.1): mobile-first admin lives at /admin/v2/*.
+      // Redirect the v1 list/detail paths to their v2 equivalents.
+      // Use `permanent: false` (307) so we can revert easily if a
+      // regression is caught in monitoring before the v1 files are
+      // removed in Task 6.2.
+      // PR 8, Task 8.1: redirect the bare /admin path to the v2 dashboard.
+      // The dashboard itself still lives at /admin (as the v1 page)
+      // until Task 8.2 removes it after a 3-day monitoring window —
+      // this redirect just points the v1 entry point at v2.
+      { source: "/admin", destination: "/admin/v2", permanent: false },
+      { source: "/admin/orders", destination: "/admin/v2/orders", permanent: false },
+      { source: "/admin/orders/:id", destination: "/admin/v2/orders/:id", permanent: false },
+      { source: "/admin/stops", destination: "/admin/v2/stops", permanent: false },
+      { source: "/admin/products", destination: "/admin/v2/products", permanent: false },
+      // v1 admin pages that were removed when the supabase shim was
+      // deleted. There are no v2 equivalents yet (reports / taxes /
+      // settings sub-pages are still TBD on the v2 surface), so they
+      // redirect to the v2 dashboard for now. Once those modules ship
+      // on v2, the redirects can be tightened to point at the new
+      // pages.
+      { source: "/admin/products/:id", destination: "/admin/v2/products", permanent: false },
+      { source: "/admin/reports", destination: "/admin/v2", permanent: false },
+      { source: "/admin/taxes", destination: "/admin/v2", permanent: false },
+      { source: "/admin/settings/shipping", destination: "/admin/settings", permanent: false },
+      { source: "/admin/settings/integrations", destination: "/admin/settings", permanent: false },
+      { source: "/admin/settings/billing", destination: "/admin/settings", permanent: false },
     ];
   },
 
   // Rewrites for API proxy
   async rewrites() {
-    // Storage proxy: /storage/* -> MinIO at the same path
-    // Lets brand assets and product images use portable relative URLs
-    // (e.g. /storage/brand-logos/<id>/logo.png) in the DB, with Next.js
-    // proxying to whichever MinIO endpoint is configured for the environment.
-    // Avoids the next/image "upstream resolved to private ip" block on
-    // localhost MinIO by keeping the upstream fetch on the server side.
-    const storageBase = process.env.STORAGE_PUBLIC_URL || "http://localhost:9000";
     return [
-      {
-        source: "/storage/:path*",
-        destination: `${storageBase}/:path*`,
-      },
+      // Add any necessary rewrites here
     ];
   },
 
@@ -125,6 +146,11 @@ const nextConfig: NextConfig = {
   experimental: {
     // Enable optimizePackageImports for better bundle size
     optimizePackageImports: ["lucide-react", "@radix-ui/react-icons", "framer-motion"],
+    // Enable React's <ViewTransition> and Next.js' automatic route
+    // transitions. Combined with the smooth-transition wrappers around
+    // page content (see src/components/transitions), navigation feels
+    // like a single continuous app rather than a sequence of page loads.
+    viewTransition: true,
   },
 
   // Compiler options

package.json

@@ -1,35 +1,49 @@
 {
   "name": "route-commerce-platform",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "private": true,
   "scripts": {
-    "dev": "node fix-agents.js && next dev --webpack -H 0.0.0.0",
+    "dev": "node fix-agents.js && next dev --webpack -H 0.0.0.0 -p 4000",
     "build": "next build --webpack",
     "start": "next start",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
-    "migrate": "node supabase/push-migrations.js",
-    "migrate:one": "node supabase/push-migrations.js",
+    "migrate": "node scripts/migrate.js",
+    "migrate:one": "node scripts/migrate.js",
+    "db:migrate": "node scripts/migrate.js",
+    "db:seed": "tsx db/seed.ts",
+    "db:seed:tour": "node scripts/seed-tuxedo-2026.js",
+    "db:reset": "node scripts/db-reset.js",
+    "db:studio": "drizzle-kit studio",
     "type-check": "npx tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:ui": "vitest --ui",
+    "test:e2e": "playwright test --project=local",
+    "test:e2e:prod": "PLAYWRIGHT_PROD=1 playwright test",
     "format": "prettier --write \"src/**/*.{ts,tsx}\""
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.96.0",
-    "@aws-sdk/client-s3": "^3.1062.0",
-    "@aws-sdk/s3-request-presigner": "^3.1062.0",
-    "@clerk/nextjs": "^7.4.2",
+    "@aws-sdk/client-s3": "^3.1064.0",
+    "@aws-sdk/s3-request-presigner": "^3.1064.0",
     "@google/generative-ai": "^0.24.1",
     "@gsap/react": "^2.1.2",
+    "@neondatabase/auth": "^0.4.2-beta",
+    "@neondatabase/serverless": "^1.1.0",
     "@sentry/nextjs": "^10.55.0",
+    "@stripe/react-stripe-js": "^6.6.0",
+    "@stripe/stripe-js": "^9.7.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
-    "better-auth": "^1.6.14",
+    "drizzle-orm": "^0.36.4",
     "exceljs": "^4.4.0",
     "framer-motion": "^12.40.0",
     "gsap": "^3.15.0",
-    "kysely": "^0.29.2",
+    "idb": "^8.0.3",
     "lucide-react": "^1.17.0",
     "next": "^16.2.6",
+    "next-auth": "^5.0.0-beta.31",
     "next-themes": "^0.4.6",
     "openai": "^6.37.0",
     "papaparse": "^5.5.3",
@@ -46,6 +60,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@lhci/cli": "^0.15.1",
     "@playwright/test": "^1.60.0",
     "@tailwindcss/postcss": "^4",
     "@types/node": "^20",
@@ -55,13 +70,20 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@types/uuid": "^11.0.0",
+    "@vitejs/plugin-react": "^4.7.0",
     "dotenv": "^17.4.2",
+    "drizzle-kit": "^0.30.6",
     "eslint": "^9",
     "eslint-config-next": "16.2.5",
+    "fake-indexeddb": "^6.2.5",
+    "jsdom": "^25.0.1",
     "pg": "^8.20.0",
     "playwright": "^1.59.1",
     "tailwindcss": "^4",
-    "typescript": "^5"
+    "tsx": "^4.22.4",
+    "typescript": "^5",
+    "vite-tsconfig-paths": "^5.1.4",
+    "vitest": "^2.1.9"
   },
   "overrides": "{}"
 }

playwright.config.ts

@@ -1,24 +1,34 @@
 import { defineConfig, devices } from "@playwright/test";
 import path from "path";
 
+const LOCAL_BASE = process.env.PLAYWRIGHT_URL ?? "http://localhost:3000";
+const PROD_BASE = "https://route-commerce-platform.vercel.app";
+
 export default defineConfig({
   testDir: "./tests",
   fullyParallel: false,
   forbidOnly: !!process.env.CI,
   retries: process.env.CI ? 2 : 0,
   workers: 1,
+  // Playwright should only run E2E specs — vitest owns everything under
+  // tests/unit/. The glob below matches *.spec.ts at the top of tests/ and
+  // tests/e2e/ and tests/login/ but skips the .test.ts files (vitest).
+  testMatch: /(tests\/(smoke|e2e|login)\/.*|\/[^/]+\.spec\.ts$)/,
   reporter: "list",
   use: {
-    baseURL: "https://route-commerce-platform.vercel.app",
+    baseURL: LOCAL_BASE,
     trace: "on-first-retry",
   },
   projects: [
+    {
+      name: "local",
+      use: { ...devices["Desktop Chrome"], baseURL: LOCAL_BASE },
+    },
     {
       name: "production",
-      use: {
-        ...devices["Desktop Chrome"],
-        baseURL: "https://route-commerce-platform.vercel.app",
-      },
+      // `PLAYWRIGHT_PROD=1 npx playwright test` to run against the live site.
+      testMatch: /.*\.prod\.spec\.ts$/,
+      use: { ...devices["Desktop Chrome"], baseURL: PROD_BASE },
     },
   ],
 });

public/manifest.json

@@ -2,101 +2,33 @@
   "name": "Route Commerce",
   "short_name": "Route Commerce",
   "description": "Multi-tenant B2B e-commerce platform for fresh produce wholesale distribution",
-  "start_url": "/",
+  "start_url": "/admin",
+  "scope": "/",
   "display": "standalone",
   "background_color": "#faf8f5",
-  "theme_color": "#1a4d2e",
+  "theme_color": "#166534",
   "orientation": "portrait-primary",
   "icons": [
-    {
-      "src": "/icons/icon-72x72.png",
-      "sizes": "72x72",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-96x96.png",
-      "sizes": "96x96",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-128x128.png",
-      "sizes": "128x128",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-144x144.png",
-      "sizes": "144x144",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-152x152.png",
-      "sizes": "152x152",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-192x192.png",
-      "sizes": "192x192",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-384x384.png",
-      "sizes": "384x384",
-      "type": "image/png",
-      "purpose": "any maskable"
-    },
-    {
-      "src": "/icons/icon-512x512.png",
-      "sizes": "512x512",
-      "type": "image/png",
-      "purpose": "any maskable"
-    }
+    { "src": "/icons/icon-72x72.png",   "sizes": "72x72",   "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-96x96.png",   "sizes": "96x96",   "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-128x128.png", "sizes": "128x128", "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-144x144.png", "sizes": "144x144", "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-152x152.png", "sizes": "152x152", "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-192x192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-384x384.png", "sizes": "384x384", "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-512x512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
+    { "src": "/icons/icon-maskable-512x512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
   ],
   "categories": ["business", "productivity"],
   "shortcuts": [
-    {
-      "name": "View Orders",
-      "short_name": "Orders",
-      "description": "View and manage orders",
-      "url": "/admin/orders",
-      "icons": [{ "src": "/icons/orders-shortcut.png", "sizes": "96x96" }]
-    },
-    {
-      "name": "Add Product",
-      "short_name": "Add Product",
-      "description": "Add a new product",
-      "url": "/admin/products/new",
-      "icons": [{ "src": "/icons/products-shortcut.png", "sizes": "96x96" }]
-    },
-    {
-      "name": "Create Stop",
-      "short_name": "Create Stop",
-      "description": "Schedule a new pickup stop",
-      "url": "/admin/stops/new",
-      "icons": [{ "src": "/icons/stops-shortcut.png", "sizes": "96x96" }]
-    }
+    { "name": "View Orders", "short_name": "Orders", "url": "/admin/v2/orders", "icons": [{ "src": "/icons/orders-shortcut.png", "sizes": "96x96" }] },
+    { "name": "Add Product", "short_name": "Add Product", "url": "/admin/v2/products/new", "icons": [{ "src": "/icons/products-shortcut.png", "sizes": "96x96" }] },
+    { "name": "Create Stop", "short_name": "Create Stop", "url": "/admin/v2/stops/new", "icons": [{ "src": "/icons/stops-shortcut.png", "sizes": "96x96" }] }
   ],
   "screenshots": [
-    {
-      "src": "/screenshots/dashboard.png",
-      "sizes": "1280x720",
-      "type": "image/png",
-      "form_factor": "wide",
-      "label": "Admin Dashboard"
-    },
-    {
-      "src": "/screenshots/mobile-storefront.png",
-      "sizes": "390x844",
-      "type": "image/png",
-      "form_factor": "narrow",
-      "label": "Mobile Storefront"
-    }
+    { "src": "/screenshots/dashboard.png", "sizes": "1280x720", "type": "image/png", "form_factor": "wide", "label": "Admin Dashboard" },
+    { "src": "/screenshots/mobile-storefront.png", "sizes": "390x844", "type": "image/png", "form_factor": "narrow", "label": "Mobile Storefront" }
   ],
   "related_applications": [],
   "prefer_related_applications": false
-}
+}

public/offline.html

@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="theme-color" content="#166534">
+  <title>Offline — Route Commerce</title>
+  <style>
+    :root {
+      --color-bg: #ffffff;
+      --color-surface: #faf8f5;
+      --color-text: #1d1d1f;
+      --color-text-muted: #424245;
+      --color-accent: #166534;
+      --color-warning: #854d0e;
+    }
+    * { box-sizing: border-box; }
+    html, body { margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Manrope, system-ui, sans-serif;
+      background: var(--color-surface);
+      color: var(--color-text);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      -webkit-font-smoothing: antialiased;
+    }
+    .card {
+      max-width: 480px;
+      width: 100%;
+      background: var(--color-bg);
+      border-radius: 24px;
+      padding: 48px 32px;
+      text-align: center;
+      box-shadow: 0 4px 24px rgba(0,0,0,0.06);
+    }
+    .icon {
+      width: 64px;
+      height: 64px;
+      margin: 0 auto 24px;
+      background: var(--color-warning);
+      color: white;
+      border-radius: 16px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 32px;
+    }
+    h1 {
+      font-family: Fraunces, Georgia, serif;
+      font-size: 32px;
+      font-weight: 600;
+      margin: 0 0 12px;
+      letter-spacing: -0.01em;
+    }
+    p {
+      font-size: 18px;
+      line-height: 1.45;
+      color: var(--color-text-muted);
+      margin: 0 0 24px;
+    }
+    button {
+      background: var(--color-accent);
+      color: white;
+      border: 0;
+      border-radius: 12px;
+      padding: 16px 32px;
+      font-size: 15px;
+      font-weight: 600;
+      letter-spacing: 0.02em;
+      cursor: pointer;
+      min-height: 56px;
+    }
+    button:active { opacity: 0.85; }
+  </style>
+</head>
+<body>
+  <div class="card" role="status">
+    <div class="icon" aria-hidden="true">📡</div>
+    <h1>You're offline</h1>
+    <p>This page isn't available without a connection. Cached pages will still work. Your changes will sync when you're back online.</p>
+    <button type="button" onclick="location.reload()">Try again</button>
+  </div>
+</body>
+</html>