chore(release): v2.0.0

fix(deploy): move inline node -e scripts into separate files to fix shell quoting errors
The inline node -e '...' blocks inside the YAML run: block had shell quoting conflicts (nested parens, single-quote escapes) that caused act/local tooling to fail with 'syntax error near unexpected token ('. Split into two dedicated scripts: - scripts/preflight-check.js — neon_auth schema check + 0001_init.sql tracking repair - scripts/postflight-check.js — admin_users table verification after migrations Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 18:14:33 -06:00 · 2026-06-09 18:02:08 -06:00 · 2026-06-09 17:55:42 -06:00 · 2026-06-09 15:50:53 -06:00 · 2026-06-09 15:45:58 -06:00 · 2026-06-09 15:30:23 -06:00
464 changed files with 17280 additions and 13108 deletions
@@ -9,44 +9,18 @@
 NEXT_PUBLIC_BASE_URL=http://localhost:4000
 NEXT_PUBLIC_SITE_URL=http://localhost:4000
-# ── Database (Postgres, direct — Supabase is being removed) ────────────────
+# ── Database (Neon Postgres, direct pg driver) ─────────────────────────────
-# Single connection string used by `pg.Pool` in src/lib/auth.ts and the
+# Single connection string used by the pg Pool in src/lib/auth.ts and the
 # admin-permissions / data-service layer. Format:
 #   postgresql://USER:PASS@HOST:PORT/DBNAME?sslmode=require
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/route_commerce
-# ── Auth.js (NextAuth v5) ───────────────────────────────────────────────────
+# ── Neon Auth (Better Auth) ───────────────────────────────────────────────
-# Generate with: npx auth secret
+# Get these from: neonctl neon-auth status
-# Or: openssl rand -base64 32
+# Base URL: "Auth Base URL" field
-AUTH_SECRET=replace-me-with-a-32-byte-base64-string
+# Cookie secret: openssl rand -base64 32 (min 32 chars)
-
+NEON_AUTH_BASE_URL=https://your-branch.neonauth.region.aws.neon.tech/neondb/auth
-# Base URL used to build OAuth callback URLs. In dev:
+NEON_AUTH_COOKIE_SECRET=replace-me-with-a-32-char-secret
 AUTH_URL=http://localhost:4000
 # In production, set to https://yourdomain.com
 # Google OAuth provider.
 # 1. Go to https://console.cloud.google.com/apis/credentials
 # 2. Create an OAuth 2.0 Client ID (type: Web application)
 # 3. Add Authorized redirect URI: http://localhost:3000/api/auth/callback/google
 # 4. Copy client id + client secret below
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 # Auth.js also reads AUTH_GOOGLE_ID / AUTH_GOOGLE_SECRET if you prefer the
 # default NextAuth variable names. The code in src/auth.config.ts falls
 # back to those names if GOOGLE_CLIENT_ID is unset.
 # Set to "false" to disable the in-app dev credentials provider even in
 # development. Default: enabled in dev only.
 ALLOW_DEV_LOGIN=true
 # ── Supabase (legacy, being removed) ────────────────────────────────────────
 # Still used by the existing admin pages, server actions, and the
 # `getAdminUser` flow. Once the auth migration is complete and the
 # @supabase/* packages are removed, these can go away.
 NEXT_PUBLIC_SUPABASE_URL=
 NEXT_PUBLIC_SUPABASE_ANON_KEY=
 SUPABASE_SERVICE_ROLE_KEY=
 # ── Stripe ─────────────────────────────────────────────────────────────────
 STRIPE_SECRET_KEY=
@@ -66,7 +40,7 @@ STRIPE_PRICE_SMS_CAMPAIGNS=
 RESEND_API_KEY=
 RESEND_WEBHOOK_SECRET=
-# ── AI providers ────────────────────────────────────────────────────────────
+# ── AI providers ──────────────────────────────────────────────────────────
 OPENAI_API_KEY=
 ANTHROPIC_API_KEY=
 GOOGLE_API_KEY=
@@ -74,9 +48,23 @@ XAI_API_KEY=
 MINIMAX_API_KEY=
 MINIMAX_BASE_URL=https://api.minimax.io/v1
-# ── Square (optional) ───────────────────────────────────────────────────────
+# ── Square (optional) ─────────────────────────────────────────────────────
 SQUARE_APP_SECRET=
 SQUARE_ENVIRONMENT=sandbox
 # ── MinIO / S3-compatible object storage ─────────────────────────────────────
 # Endpoint: host:port only (no https://). Use MINIO_PUBLIC_URL for the public base.
 MINIO_ENDPOINT=s3.crispygoat.com
 MINIO_REGION=us-east-1
 MINIO_USE_SSL=true
 MINIO_ACCESS_KEY=routecommerce
 MINIO_SECRET_KEY=miniochangeme123
 # Override public URL if different from endpoint (e.g. Cloudflare CDN in front)
 MINIO_PUBLIC_URL=https://s3.crispygoat.com
 # Bucket names — create these in MinIO first (mc mb myminio/route-products, etc.)
 MINIO_BUCKET_PRODUCTS=route-products
 MINIO_BUCKET_BRAND_LOGOS=route-brand-logos
 MINIO_BUCKET_WATER_LOGS=route-water-logs
 # ── Cron / automation ───────────────────────────────────────────────────────
 CRON_SECRET=replace-me-with-a-random-string
@@ -15,284 +15,187 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
-          node-version: '22'
+          node-version: "22"
      - name: Start Docker stack
        env:
          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
          MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
          MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
          POSTGREST_JWT_SECRET: ${{ secrets.POSTGREST_JWT_SECRET }}
        run: |
          APP_DIR=/home/tyler/route-commerce
          mkdir -p $APP_DIR
          # Free the dev-stack port (3001) and the port the previous deploy used
          # (so a new deploy can pick it back up if it's the lowest free port)
          PREV_PORT=$(cat .postgrest-port 2>/dev/null || echo "")
          for port in 3001 $PREV_PORT; do
            if [ -n "$port" ] && ss -tln 2>/dev/null | grep -qE "[[:space:]]127\.0\.0\.1:${port}[[:space:]]"; then
              echo "Port $port in use, freeing..."
              fuser -k -9 $port/tcp 2>/dev/null || true
              docker ps -aq --filter "publish=$port" 2>/dev/null | xargs -r docker rm -f 2>/dev/null || true
            fi
          done
          # Hard-stop the previous stack. Errors are NOT swallowed: if down
          # fails, picking a port against a half-torn-down stack is exactly
          # what produces the TOCTOU "address already in use" we keep hitting.
          docker compose -f $APP_DIR/docker-compose.yml down --remove-orphans
          # Belt-and-braces: anything with the postgrest name that survived.
          docker ps -aq --filter "name=route_commerce_postgrest" | xargs -r docker rm -f >/dev/null 2>&1 || true
          # docker-proxy sometimes leaves a listener behind for the published port.
          pkill -9 -f 'docker-proxy.*3011' 2>/dev/null || true
          pkill -9 -f 'docker-proxy.*3012' 2>/dev/null || true
          pkill -9 -f 'docker-proxy.*3013' 2>/dev/null || true
          sleep 3
          # Verify the postgrest container is actually gone before we pick a port.
          if docker ps -aq --filter "name=route_commerce_postgrest" | grep -q .; then
            echo "ERROR: route_commerce_postgrest still running after down"
            docker ps --filter "name=route_commerce_postgrest"
            exit 1
          fi
          # Find the first free host port starting from 3011. Persist the choice
          # so the Build and Deploy steps below can use the same URL.
          POSTGREST_HOST_PORT=3011
          for attempt in 1 2 3 4 5 6 7 8 9 10; do
            if ! ss -tln 2>/dev/null | grep -qE "[[:space:]]127\.0\.0\.1:${POSTGREST_HOST_PORT}[[:space:]]"; then
              break
            fi
            echo "Port $POSTGREST_HOST_PORT in use, trying next... (attempt $attempt)"
            POSTGREST_HOST_PORT=$((POSTGREST_HOST_PORT + 1))
            if [ $POSTGREST_HOST_PORT -gt 30200 ]; then
              echo "ERROR: no free port in 3011-30200 range"
              exit 1
            fi
            sleep 1
          done
          echo "Using PostgREST host port: $POSTGREST_HOST_PORT"
          echo "$POSTGREST_HOST_PORT" > .postgrest-port
          export NEXT_PUBLIC_API_URL="http://localhost:$POSTGREST_HOST_PORT"
          export POSTGREST_HOST_PORT
          # Seed config files into APP_DIR if missing (they live in the repo, not in APP_DIR)
          [ -f $APP_DIR/.env.example ] || cp .env.example $APP_DIR/.env.example
          [ -f $APP_DIR/docker-compose.yml ] || cp deploy/docker-compose.yml $APP_DIR/docker-compose.yml
          cd $APP_DIR
          [ -f .env ] || cp .env.example .env
          # Append production secrets to .env (overriding .env.example defaults)
          {
            echo "POSTGRES_USER=${POSTGRES_USER}"
            echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
            echo "POSTGRES_DB=${POSTGRES_DB}"
            echo "MINIO_ROOT_USER=${MINIO_ROOT_USER}"
            echo "MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}"
            echo "POSTGREST_JWT_SECRET=${POSTGREST_JWT_SECRET}"
            echo "POSTGREST_HOST_PORT=$POSTGREST_HOST_PORT"
            echo "NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL"
          } >> .env
          # Bring the stack up fresh — --force-recreate ensures no stale
          # network/container references from prior failed attempts
          docker compose up -d --force-recreate db postgrest minio minio_init
          # Wait for Postgres healthcheck
          for i in $(seq 1 30); do
            if docker compose exec -T db pg_isready -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" > /dev/null 2>&1; then
              echo "Postgres is ready"
              break
            fi
            sleep 2
          done
      - name: Apply migrations
        env:
          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
        run: |
          APP_DIR=/home/tyler/route-commerce
          # Seed supabase/ into APP_DIR if missing (the deploy step copies it after, but
          # we need it here for migrations)
          [ -d $APP_DIR/supabase ] || cp -r supabase $APP_DIR/supabase
          cd $APP_DIR
          # PAGER= prevents psql from launching less/more in a non-interactive shell,
          # which hangs indefinitely waiting for keypress. Batch all files into one
          # connection for speed instead of one psql invocation per file.
          export PAGER=
          export PGPASSWORD="${POSTGRES_PASSWORD}"
          PG="psql -h 127.0.0.1 -U ${POSTGRES_USER} -d ${POSTGRES_DB} --no-psqlrc -v ON_ERROR_STOP=0 -q"
          $PG -f supabase/migrations/000_preflight_supabase_compat.sql || true
          [ -f supabase/captured_schema.sql ] && $PG -f supabase/captured_schema.sql || true
          # Concatenate all numbered migrations and run in one session
          cat supabase/migrations/[0-9]*.sql | $PG
      - name: Install dependencies
        run: npm install
      - name: Run migrations
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
        run: |
          set -e
          node scripts/preflight-check.js
          npm run migrate:one
          node scripts/postflight-check.js
      - name: Build
        env:
          NODE_ENV: production
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-
+          NEXT_PUBLIC_SITE_URL: ${{ secrets.NEXT_PUBLIC_SITE_URL }}
-          # Auth.js v5 (NextAuth). Fall back to Better Auth names if the
+          NEON_AUTH_BASE_URL: ${{ secrets.NEON_AUTH_BASE_URL }}
-          # Gitea secret hasn't been renamed yet.
+          NEON_AUTH_COOKIE_SECRET: ${{ secrets.NEON_AUTH_COOKIE_SECRET }}
-          AUTH_SECRET: ${{ secrets.AUTH_SECRET || secrets.BETTER_AUTH_SECRET }}
+          AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
-          AUTH_URL: ${{ secrets.AUTH_URL || secrets.BETTER_AUTH_URL }}
+          AUTH_URL: ${{ secrets.AUTH_URL }}
-          NEXT_PUBLIC_AUTH_URL: ${{ secrets.NEXT_PUBLIC_AUTH_URL || secrets.NEXT_PUBLIC_BETTER_AUTH_URL }}
+          NEXT_PUBLIC_AUTH_URL: ${{ secrets.NEXT_PUBLIC_AUTH_URL }}
-          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID || secrets.AUTH_GOOGLE_ID }}
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
-          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET || secrets.AUTH_GOOGLE_SECRET }}
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
          ALLOW_DEV_LOGIN: ${{ secrets.ALLOW_DEV_LOGIN }}
-
+          ADMIN_ALLOWED_EMAILS: ${{ secrets.ADMIN_ALLOWED_EMAILS }}
-          # Supabase (legacy, still used by admin pages/server actions until
+          NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY }}
          # the Auth.js migration is finished)
          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
          # Storage (MinIO / S3)
          NEXT_PUBLIC_STORAGE_BASE_URL: ${{ secrets.NEXT_PUBLIC_STORAGE_BASE_URL }}
          STORAGE_ENDPOINT: ${{ secrets.STORAGE_ENDPOINT }}
          STORAGE_REGION: ${{ secrets.STORAGE_REGION }}
          STORAGE_ACCESS_KEY: ${{ secrets.STORAGE_ACCESS_KEY }}
          STORAGE_SECRET_KEY: ${{ secrets.STORAGE_SECRET_KEY }}
          STORAGE_BUCKET_PREFIX: ${{ secrets.STORAGE_BUCKET_PREFIX }}
          # Stripe
          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-          STRIPE_PUBLISHABLE_KEY: ${{ secrets.STRIPE_PUBLISHABLE_KEY }}
+          STRIPE_PRICE_STARTER: ${{ secrets.STRIPE_PRICE_STARTER }}
-
+          STRIPE_PRICE_FARM: ${{ secrets.STRIPE_PRICE_FARM }}
-          # Resend
+          STRIPE_PRICE_ENTERPRISE: ${{ secrets.STRIPE_PRICE_ENTERPRISE }}
          STRIPE_PRICE_HARVEST_REACH: ${{ secrets.STRIPE_PRICE_HARVEST_REACH }}
          STRIPE_PRICE_WHOLESALE_PORTAL: ${{ secrets.STRIPE_PRICE_WHOLESALE_PORTAL }}
          STRIPE_PRICE_WATER_LOG: ${{ secrets.STRIPE_PRICE_WATER_LOG }}
          STRIPE_PRICE_AI_TOOLS: ${{ secrets.STRIPE_PRICE_AI_TOOLS }}
          STRIPE_PRICE_SQUARE_SYNC: ${{ secrets.STRIPE_PRICE_SQUARE_SYNC }}
          STRIPE_PRICE_SMS_CAMPAIGNS: ${{ secrets.STRIPE_PRICE_SMS_CAMPAIGNS }}
          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
-          RESEND_WEBHOOK_SECRET: ${{ secrets.RESEND_WEBHOOK_SECRET }}
+          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
-
+          MINIO_ENDPOINT: ${{ secrets.MINIO_ENDPOINT }}
-          # AI providers
+          MINIO_REGION: ${{ secrets.MINIO_REGION }}
          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
          MINIO_PUBLIC_URL: ${{ secrets.MINIO_PUBLIC_URL }}
          MINIO_BUCKET_PRODUCTS: ${{ secrets.MINIO_BUCKET_PRODUCTS }}
          MINIO_BUCKET_BRAND_LOGOS: ${{ secrets.MINIO_BUCKET_BRAND_LOGOS }}
          MINIO_BUCKET_WATER_LOGS: ${{ secrets.MINIO_BUCKET_WATER_LOGS }}
          MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
          MINIMAX_BASE_URL: ${{ secrets.MINIMAX_BASE_URL }}
-
+        run: npm run build
          # Email sender
          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
        run: |
          POSTGREST_HOST_PORT=$(cat .postgrest-port)
          export NEXT_PUBLIC_API_URL="http://localhost:$POSTGREST_HOST_PORT"
          npm run build
      - name: Deploy
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+          NEXT_PUBLIC_SITE_URL: ${{ secrets.NEXT_PUBLIC_SITE_URL }}
-          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+          NEON_AUTH_BASE_URL: ${{ secrets.NEON_AUTH_BASE_URL }}
-          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
+          NEON_AUTH_COOKIE_SECRET: ${{ secrets.NEON_AUTH_COOKIE_SECRET }}
-          MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
+          AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
-          MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
+          AUTH_URL: ${{ secrets.AUTH_URL }}
-          POSTGREST_JWT_SECRET: ${{ secrets.POSTGREST_JWT_SECRET }}
+          NEXT_PUBLIC_AUTH_URL: ${{ secrets.NEXT_PUBLIC_AUTH_URL }}
-
+          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
-          # Auth.js v5 (with Better Auth fallback for the secret name)
+          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
          AUTH_SECRET: ${{ secrets.AUTH_SECRET || secrets.BETTER_AUTH_SECRET }}
          AUTH_URL: ${{ secrets.AUTH_URL || secrets.BETTER_AUTH_URL }}
          NEXT_PUBLIC_AUTH_URL: ${{ secrets.NEXT_PUBLIC_AUTH_URL || secrets.NEXT_PUBLIC_BETTER_AUTH_URL }}
          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID || secrets.AUTH_GOOGLE_ID }}
          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET || secrets.AUTH_GOOGLE_SECRET }}
          ALLOW_DEV_LOGIN: ${{ secrets.ALLOW_DEV_LOGIN }}
-
+          ADMIN_ALLOWED_EMAILS: ${{ secrets.ADMIN_ALLOWED_EMAILS }}
-          # Storage
+          NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY }}
          STORAGE_ENDPOINT: ${{ secrets.STORAGE_ENDPOINT }}
          STORAGE_REGION: ${{ secrets.STORAGE_REGION }}
          STORAGE_ACCESS_KEY: ${{ secrets.STORAGE_ACCESS_KEY }}
          STORAGE_SECRET_KEY: ${{ secrets.STORAGE_SECRET_KEY }}
          STORAGE_BUCKET_PREFIX: ${{ secrets.STORAGE_BUCKET_PREFIX }}
          NEXT_PUBLIC_STORAGE_BASE_URL: ${{ secrets.NEXT_PUBLIC_STORAGE_BASE_URL }}
          # PostgREST
          PGRST_SERVER_PORT: ${{ secrets.PGRST_SERVER_PORT }}
          PGRST_DB_URI: ${{ secrets.PGRST_DB_URI }}
          PGRST_DB_ANON_ROLE: ${{ secrets.PGRST_DB_ANON_ROLE }}
          PGRST_JWT_SECRET: ${{ secrets.POSTGREST_JWT_SECRET }}
          # Supabase (legacy)
          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
          # Stripe
          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
-          STRIPE_PUBLISHABLE_KEY: ${{ secrets.STRIPE_PUBLISHABLE_KEY }}
+          STRIPE_PRICE_STARTER: ${{ secrets.STRIPE_PRICE_STARTER }}
-
+          STRIPE_PRICE_FARM: ${{ secrets.STRIPE_PRICE_FARM }}
-          # Resend
+          STRIPE_PRICE_ENTERPRISE: ${{ secrets.STRIPE_PRICE_ENTERPRISE }}
          STRIPE_PRICE_HARVEST_REACH: ${{ secrets.STRIPE_PRICE_HARVEST_REACH }}
          STRIPE_PRICE_WHOLESALE_PORTAL: ${{ secrets.STRIPE_PRICE_WHOLESALE_PORTAL }}
          STRIPE_PRICE_WATER_LOG: ${{ secrets.STRIPE_PRICE_WATER_LOG }}
          STRIPE_PRICE_AI_TOOLS: ${{ secrets.STRIPE_PRICE_AI_TOOLS }}
          STRIPE_PRICE_SQUARE_SYNC: ${{ secrets.STRIPE_PRICE_SQUARE_SYNC }}
          STRIPE_PRICE_SMS_CAMPAIGNS: ${{ secrets.STRIPE_PRICE_SMS_CAMPAIGNS }}
          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
-          RESEND_WEBHOOK_SECRET: ${{ secrets.RESEND_WEBHOOK_SECRET }}
+          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
-
+          MINIO_ENDPOINT: ${{ secrets.MINIO_ENDPOINT }}
-          # AI
+          MINIO_REGION: ${{ secrets.MINIO_REGION }}
          MINIO_ACCESS_KEY: ${{ secrets.MINIO_ACCESS_KEY }}
          MINIO_SECRET_KEY: ${{ secrets.MINIO_SECRET_KEY }}
          MINIO_PUBLIC_URL: ${{ secrets.MINIO_PUBLIC_URL }}
          MINIO_BUCKET_PRODUCTS: ${{ secrets.MINIO_BUCKET_PRODUCTS }}
          MINIO_BUCKET_BRAND_LOGOS: ${{ secrets.MINIO_BUCKET_BRAND_LOGOS }}
          MINIO_BUCKET_WATER_LOGS: ${{ secrets.MINIO_BUCKET_WATER_LOGS }}
          MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
          MINIMAX_BASE_URL: ${{ secrets.MINIMAX_BASE_URL }}
-
+          CRON_SECRET: ${{ secrets.CRON_SECRET }}
-          FROM_EMAIL: ${{ secrets.FROM_EMAIL }}
+          SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
        run: |
          set -e
          APP_DIR=/home/tyler/route-commerce
          mkdir -p $APP_DIR
          # Use the port chosen by Start Docker stack (persisted to .postgrest-port)
          POSTGREST_HOST_PORT=$(cat .postgrest-port)
          export NEXT_PUBLIC_API_URL="http://localhost:$POSTGREST_HOST_PORT"
-          # Write env file from secrets (preserves existing .env for docker compose)
+          # Setup SSH key - write raw (no printf which can corrupt multi-line keys)
-          {
+          mkdir -p ~/.ssh
-            printf "DATABASE_URL=%s\n" "$DATABASE_URL"
+          echo "$SERVER_SSH_KEY" > ~/.ssh/id_ed25519
-            printf "NEXT_PUBLIC_API_URL=%s\n" "$NEXT_PUBLIC_API_URL"
+          chmod 600 ~/.ssh/id_ed25519
            printf "POSTGRES_USER=%s\n" "$POSTGRES_USER"
            printf "POSTGRES_PASSWORD=%s\n" "$POSTGRES_PASSWORD"
            printf "POSTGRES_DB=%s\n" "$POSTGRES_DB"
            printf "MINIO_ROOT_USER=%s\n" "$MINIO_ROOT_USER"
            printf "MINIO_ROOT_PASSWORD=%s\n" "$MINIO_ROOT_PASSWORD"
            printf "POSTGREST_JWT_SECRET=%s\n" "$POSTGREST_JWT_SECRET"
            printf "AUTH_SECRET=%s\n" "$AUTH_SECRET"
            printf "AUTH_URL=%s\n" "$AUTH_URL"
            printf "NEXT_PUBLIC_AUTH_URL=%s\n" "$NEXT_PUBLIC_AUTH_URL"
            printf "GOOGLE_CLIENT_ID=%s\n" "$GOOGLE_CLIENT_ID"
            printf "GOOGLE_CLIENT_SECRET=%s\n" "$GOOGLE_CLIENT_SECRET"
            printf "ALLOW_DEV_LOGIN=%s\n" "$ALLOW_DEV_LOGIN"
            printf "STORAGE_ENDPOINT=%s\n" "$STORAGE_ENDPOINT"
            printf "STORAGE_REGION=%s\n" "$STORAGE_REGION"
            printf "STORAGE_ACCESS_KEY=%s\n" "$STORAGE_ACCESS_KEY"
            printf "STORAGE_SECRET_KEY=%s\n" "$STORAGE_SECRET_KEY"
            printf "STORAGE_BUCKET_PREFIX=%s\n" "$STORAGE_BUCKET_PREFIX"
            printf "NEXT_PUBLIC_STORAGE_BASE_URL=%s\n" "$NEXT_PUBLIC_STORAGE_BASE_URL"
            printf "PGRST_SERVER_PORT=%s\n" "$PGRST_SERVER_PORT"
            printf "PGRST_DB_URI=%s\n" "$PGRST_DB_URI"
            printf "PGRST_DB_ANON_ROLE=%s\n" "$PGRST_DB_ANON_ROLE"
            printf "PGRST_JWT_SECRET=%s\n" "$POSTGREST_JWT_SECRET"
            printf "NEXT_PUBLIC_SUPABASE_URL=%s\n" "$NEXT_PUBLIC_SUPABASE_URL"
            printf "NEXT_PUBLIC_SUPABASE_ANON_KEY=%s\n" "$NEXT_PUBLIC_SUPABASE_ANON_KEY"
            printf "STRIPE_SECRET_KEY=%s\n" "$STRIPE_SECRET_KEY"
            printf "STRIPE_WEBHOOK_SECRET=%s\n" "$STRIPE_WEBHOOK_SECRET"
            printf "STRIPE_PUBLISHABLE_KEY=%s\n" "$STRIPE_PUBLISHABLE_KEY"
            printf "RESEND_API_KEY=%s\n" "$RESEND_API_KEY"
            printf "RESEND_WEBHOOK_SECRET=%s\n" "$RESEND_WEBHOOK_SECRET"
            printf "MINIMAX_API_KEY=%s\n" "$MINIMAX_API_KEY"
            printf "MINIMAX_BASE_URL=%s\n" "$MINIMAX_BASE_URL"
            printf "FROM_EMAIL=%s\n" "$FROM_EMAIL"
          } > $APP_DIR/.env.production
-          # Copy build output and required files
+          # Verify key was written correctly
-          rsync -a --delete .next/ $APP_DIR/.next/
+          if ! grep -q "PRIVATE KEY" ~/.ssh/id_ed25519; then
-          rsync -a --delete public/ $APP_DIR/public/
+            echo "ERROR: SSH key not found or malformed. Check SERVER_SSH_KEY secret."
-          cp package.json $APP_DIR/
+            cat ~/.ssh/id_ed25519 || echo "File is empty"
-          cp deploy/docker-compose.yml $APP_DIR/
+            exit 1
          cp -r supabase/ $APP_DIR/
          cp next.config.ts $APP_DIR/ 2>/dev/null || cp next.config.js $APP_DIR/ 2>/dev/null || true
          # Install production deps only
          cd $APP_DIR
          npm install --omit=dev
          # Start or restart PM2 process
          if pm2 describe route-commerce > /dev/null 2>&1; then
            pm2 restart route-commerce
          else
            pm2 start npm --name route-commerce -- start -- -p 3100
            pm2 save
          fi
          ssh-keyscan -H route.crispygoat.com >> ~/.ssh/known_hosts 2>/dev/null || true
          # Test SSH connection with verbose output for debugging
          echo "Testing SSH connection..."
          ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=no -o LogLevel=VERBOSE tyler@route.crispygoat.com "echo 'SSH OK' && hostname" 2>&1 || { echo "SSH FAILED"; exit 1; }
          # Create app dir on server
          ssh tyler@route.crispygoat.com "mkdir -p $APP_DIR/.next $APP_DIR/public"
          # Write production env file
          ENV_FILE=$(mktemp)
          {
            printf 'DATABASE_URL=%s\n' "$DATABASE_URL"
            printf 'NEXT_PUBLIC_SITE_URL=%s\n' "$NEXT_PUBLIC_SITE_URL"
            printf 'NEON_AUTH_BASE_URL=%s\n' "$NEON_AUTH_BASE_URL"
            printf 'NEON_AUTH_COOKIE_SECRET=%s\n' "$NEON_AUTH_COOKIE_SECRET"
            printf 'AUTH_SECRET=%s\n' "$AUTH_SECRET"
            printf 'AUTH_URL=%s\n' "$AUTH_URL"
            printf 'NEXT_PUBLIC_AUTH_URL=%s\n' "$NEXT_PUBLIC_AUTH_URL"
            printf 'GOOGLE_CLIENT_ID=%s\n' "$GOOGLE_CLIENT_ID"
            printf 'GOOGLE_CLIENT_SECRET=%s\n' "$GOOGLE_CLIENT_SECRET"
            printf 'ALLOW_DEV_LOGIN=%s\n' "$ALLOW_DEV_LOGIN"
            printf 'ADMIN_ALLOWED_EMAILS=%s\n' "$ADMIN_ALLOWED_EMAILS"
            printf 'NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=%s\n' "$NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY"
            printf 'STRIPE_SECRET_KEY=%s\n' "$STRIPE_SECRET_KEY"
            printf 'STRIPE_WEBHOOK_SECRET=%s\n' "$STRIPE_WEBHOOK_SECRET"
            printf 'STRIPE_PRICE_STARTER=%s\n' "$STRIPE_PRICE_STARTER"
            printf 'STRIPE_PRICE_FARM=%s\n' "$STRIPE_PRICE_FARM"
            printf 'STRIPE_PRICE_ENTERPRISE=%s\n' "$STRIPE_PRICE_ENTERPRISE"
            printf 'STRIPE_PRICE_HARVEST_REACH=%s\n' "$STRIPE_PRICE_HARVEST_REACH"
            printf 'STRIPE_PRICE_WHOLESALE_PORTAL=%s\n' "$STRIPE_PRICE_WHOLESALE_PORTAL"
            printf 'STRIPE_PRICE_WATER_LOG=%s\n' "$STRIPE_PRICE_WATER_LOG"
            printf 'STRIPE_PRICE_AI_TOOLS=%s\n' "$STRIPE_PRICE_AI_TOOLS"
            printf 'STRIPE_PRICE_SQUARE_SYNC=%s\n' "$STRIPE_PRICE_SQUARE_SYNC"
            printf 'STRIPE_PRICE_SMS_CAMPAIGNS=%s\n' "$STRIPE_PRICE_SMS_CAMPAIGNS"
            printf 'RESEND_API_KEY=%s\n' "$RESEND_API_KEY"
            printf 'FROM_EMAIL=%s\n' "$FROM_EMAIL"
            printf 'MINIO_ENDPOINT=%s\n' "$MINIO_ENDPOINT"
            printf 'MINIO_REGION=%s\n' "$MINIO_REGION"
            printf 'MINIO_ACCESS_KEY=%s\n' "$MINIO_ACCESS_KEY"
            printf 'MINIO_SECRET_KEY=%s\n' "$MINIO_SECRET_KEY"
            printf 'MINIO_PUBLIC_URL=%s\n' "$MINIO_PUBLIC_URL"
            printf 'MINIO_BUCKET_PRODUCTS=%s\n' "$MINIO_BUCKET_PRODUCTS"
            printf 'MINIO_BUCKET_BRAND_LOGOS=%s\n' "$MINIO_BUCKET_BRAND_LOGOS"
            printf 'MINIO_BUCKET_WATER_LOGS=%s\n' "$MINIO_BUCKET_WATER_LOGS"
            printf 'MINIMAX_API_KEY=%s\n' "$MINIMAX_API_KEY"
            printf 'MINIMAX_BASE_URL=%s\n' "$MINIMAX_BASE_URL"
            printf 'CRON_SECRET=%s\n' "$CRON_SECRET"
          } > "$ENV_FILE"
          # Upload env file and sync build output
          echo "Uploading env file..."
          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no "$ENV_FILE" tyler@route.crispygoat.com:$APP_DIR/.env.production
          echo "Copying .next/..."
          scp -o ConnectTimeout=30 -o StrictHostKeyChecking=no -r .next tyler@route.crispygoat.com:$APP_DIR/
          echo "Copying public/..."
          scp -o ConnectTimeout=30 -o StrictHostKeyChecking=no -r public tyler@route.crispygoat.com:$APP_DIR/
          echo "Copying package.json..."
          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no package.json tyler@route.crispygoat.com:$APP_DIR/
          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no next.config.ts tyler@route.crispygoat.com:$APP_DIR/ 2>/dev/null || true
          # Ship the migration runner + SQL so the server has a recovery path (scripts/ and db/migrations/ were previously omitted from the artifact).
          # This allows `node scripts/migrate.js` (after sourcing .env.production) to work directly on the target if needed for bootstrap or emergencies.
          # See docs/superpowers/plans/2026-06-prod-db-schema-migration-reliability.md
          echo "Ensuring migration directories on server and copying runner + SQL..."
          ssh -o ConnectTimeout=15 -o StrictHostKeyChecking=no tyler@route.crispygoat.com "mkdir -p $APP_DIR/scripts $APP_DIR/db"
          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no scripts/migrate.js tyler@route.crispygoat.com:$APP_DIR/scripts/migrate.js 2>/dev/null || true
          scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no -r db/migrations tyler@route.crispygoat.com:$APP_DIR/db/ 2>/dev/null || true
          # Install deps and restart on server
          echo "Installing deps and restarting PM2..."
          ssh -o ConnectTimeout=60 -o StrictHostKeyChecking=no tyler@route.crispygoat.com "cd $APP_DIR && npm install --omit=dev 2>&1 | tail -5 && pm2 restart route-commerce || pm2 start npm --name route-commerce -- start -- -p 3100 && pm2 save && sleep 4 && curl -f -s http://localhost:3100/api/health/db-schema || { echo 'Health check failed after start - schema not applied (see plan)'; exit 1; }"
          echo "Deployed successfully"
@@ -39,6 +39,11 @@ next-env.d.ts
 # Supabase
 supabase/.temp/
 # Playwright test results (generated, not source)
 test-results/
 playwright-report/
 # IDE / local config
 .mcp.json
 .env*
 public/videos/tuxedo-hero.mp4
@@ -16,9 +16,9 @@ Do **not** add GitHub remotes. There is no `origin` on github.com and no separat
 Route Commerce is a multi-tenant B2B e-commerce platform for fresh produce wholesale distribution. Brands sell to customers who pick up at scheduled stops or receive shipments. The platform includes admin dashboards for order management, stop/route scheduling, product catalogs, payment processing (Stripe + Square), and a communications module ("Harvest Reach") for email/SMS campaigns.
-Tech stack: Next.js 16 (App Router) · **Postgres** (direct — Supabase is being removed) · Auth.js (NextAuth v5, in-progress migration from bespoke cookie auth) · Stripe · Square · Resend (email) · Tailwind CSS v4
+Tech stack: Next.js 16 (App Router) · **Postgres** (direct) · **Neon Auth** (Better Auth) · Stripe · Square · Resend (email) · Tailwind CSS v4
-> **Direction:** Supabase is being removed in favor of a direct Postgres connection. The `supabase/` directory is kept as a path for migrations tooling only (no Supabase platform/CLI/auth). Until the Auth.js migration ships, auth still flows through the `dev_session` / `rc_auth_uid` cookies — see the Authentication section. New DB code should connect to Postgres directly (via `pg` or the chosen driver — see Database section) and **must not** import from `@supabase/*` or call Supabase REST.
+> **Direction:** Auth is handled by Neon Auth (Better Auth). The `admin_users` table links to Neon Auth users by email. New DB code should connect to Postgres directly (via `pg` or the chosen driver — see Database section) and **must not** import from `@supabase/*` or call Supabase REST.
 ---
@@ -46,35 +46,47 @@ E2E tests live in `tests/` and run via Playwright. Specs include `tests/smoke.sp
 ### Authentication & Authorization
-**Dev mode** bypasses Supabase auth entirely via `dev_session` cookie set by `/login`:
+**Neon Auth (Better Auth)** is the active auth system. Config lives in `src/lib/auth.ts`, with the route handler at `src/app/api/auth/[...nextauth]/route.ts`. Neon Auth manages users in the `neon_auth.user` table; our `admin_users` table links to Neon Auth users by email.
 - `dev_session=platform_admin` — full access, all brands
 - `dev_session=brand_admin` — full access to assigned brand only
 - `dev_session=store_employee` — limited access (orders, pickup, wholesale only)
-`src/lib/admin-permissions.ts` is the single source of truth for the current admin user. It uses a `dev_session` cookie in development and the legacy `rc_auth_uid` cookie in production (set by the pre-Auth.js `/api/login`) — never import this file directly into Client Components. Use the `getCurrentAdminUser` server action from `@/actions/admin-user` instead.
+**Auth flow:**
 1. User signs in via `/api/auth/sign-in` → Neon Auth validates credentials → session cookie set
 2. `getAdminUser()` in `src/lib/admin-permissions.ts` reads the Neon Auth session and looks up `admin_users` by email
 3. Middleware (`src/middleware.ts`) guards `/admin/*` routes at the edge level
-The middleware (`src/middleware.ts`) guards `/admin/:path*` and `/login`. It auto-issues a `dev_session=platform_admin` cookie for the demo flow when no auth is present. A `clerk-auth.ts` helper exists in `src/lib/` but is currently a stub — do not depend on it.
+**Key files:**
 - `src/lib/auth.ts` — Neon Auth configuration (getSession, signIn, signOut, resetPassword, requestPasswordReset)
 - `src/auth.config.ts` — Edge-safe config (baseUrl, cookieSecret)
 - `src/middleware.ts` — Edge-level route protection
 - `src/app/api/auth/sign-in/route.ts` — Email/password sign-in API
 - `src/app/api/auth/forgot-password/route.ts` — Password reset request API
 - `src/app/api/auth/reset-password/route.ts` — Password reset confirmation API
 - `src/actions/auth-actions.ts` — Server actions (signOutAction)
 - `src/actions/admin/password.ts` — Admin password update (setUserPassword)
 **Environment variables:**
 - `NEON_AUTH_BASE_URL` — from `neonctl neon-auth status`
 - `NEON_AUTH_COOKIE_SECRET` — min 32-char secret: `openssl rand -base64 32`
 - `NEXT_PUBLIC_SITE_URL` — site URL for redirects and Origin header
 **Single source of truth for the current admin user:** `getAdminUser()` in `src/lib/admin-permissions.ts`. It reads the Neon Auth session via `getSession()` from `@/lib/auth`, then looks up `admin_users` by email. **Never import `admin-permissions.ts` into Client Components** — use server actions instead.
 The `AdminUser` type lives in `src/lib/admin-permissions-types.ts` and is shared across server/client boundary.
-#### Auth.js (NextAuth v5) migration — in progress
+#### Auth API routes
-The platform is migrating from the bespoke `dev_session` + `rc_auth_uid` cookie flow to **Auth.js (NextAuth v5)**, with Supabase as the database adapter and email/OAuth providers. While the migration is in flight:
+| Route | Method | Purpose |
-
+|-------|--------|---------|
- Do **not** add new code that depends on the `dev_session` or `rc_auth_uid` cookies — write against the Auth.js API (`auth()`, `signIn`, `signOut`, `getSession`) instead.
+| `/api/auth/sign-in` | POST | Email/password sign-in |
- New env vars: `AUTH_SECRET`, `AUTH_URL`, and provider-specific keys (`AUTH_GITHUB_ID`/`SECRET`, `AUTH_GOOGLE_ID`/`SECRET`, etc.). See `.env.example` for the full list.
+| `/api/auth/forgot-password` | POST | Request password reset email |
- A new route handler at `src/app/api/auth/[...nextauth]/route.ts` will replace the ad-hoc `/api/login`, `/api/auth/uid`, and `/api/logout` endpoints.
+| `/api/auth/reset-password` | POST | Set new password (after reset link clicked) |
- The middleware (`src/middleware.ts`) will eventually use `auth()` from NextAuth to populate the session; the existing `dev_session` auto-login branch is a temporary fallback for demos.
+| `/api/auth/[...nextauth]` | GET/POST | Neon Auth handler (sign-out, OAuth callbacks, etc.) |
 - `src/lib/admin-permissions.ts` will keep its public surface (`getAdminUser`, `getCurrentAdminUser`) but read the session from NextAuth internally — the `AdminUser` type does not need to change.
 - `clerk-auth.ts` is being removed in favor of Auth.js; do not extend it.
 - Until the migration ships, the `dev_session` and `rc_auth_uid` paths remain the source of truth — see the section above for current behavior.
 ### Server Actions Pattern
 All database writes go through server actions in `src/actions/`. These:
 1. Call `getAdminUser()` to verify auth
 2. Check role/permission flags (`can_manage_orders`, etc.)
-3. Call Supabase REST APIs (not the Supabase client directly in server actions) to trigger SECURITY DEFINER RPCs
+3. Call Postgres RPCs via the `pg` driver
 4. Return typed results (`{ success: true, ... } | { success: false, error: string }`)
 Server actions are "use server" files that export async functions. Client components import and call them directly.
@@ -89,6 +101,33 @@ The app connects to **Postgres directly** — no Supabase platform, JS client, o
 - A single shared `pg` `Pool` is exported from `src/lib/db.ts` (TBD — to be created/confirmed during the migration). Server actions and API routes import it and call `pool.query(...)` against RPC names.
 - No `NEXT_PUBLIC_SUPABASE_URL` / `SUPABASE_SERVICE_ROLE_KEY` / `@supabase/*` imports — these are being purged from the codebase.
 #### First production deploy / new prod DB bootstrap (critical for admin access)
 The `admin_users` + `admin_user_brands` tables (and the rest of the schema) come **only** from `db/migrations/0001_init.sql`.
 If the prod `DATABASE_URL` has never had the migrations applied, `getAdminUser()` will fail with "relation \"admin_users\" does not exist", the layout will show "Access Denied", and even a signed-in Neon Auth user will be blocked.
 **Correct bootstrap sequence (do this from a machine with the full source tree before the first push that exercises /admin):**
 1. Ensure the Gitea secret `DATABASE_URL` points at the real prod Neon Postgres (the one with `neon_auth.user` already present).
 2. Sign in once at the live prod URL (`/login`) with the email you want as the first `platform_admin`. This creates the row in `neon_auth.user`.
 3. From your laptop (or any box with the checkout):
   ```bash
   # Paste the real prod connection string (get it from Gitea secrets or the target's .env.production)
   DATABASE_URL="postgresql://...prod-full-string..." node scripts/migrate.js
   # Then provision (the script will link to the first brand it finds)
   DATABASE_URL="postgresql://...prod-full-string..." \
     npx tsx scripts/provision-admin.ts you@real.com platform_admin
   ```
 4. Push to main. The deploy workflow now has a hard gate (see `.gitea/workflows/deploy.yml` "Run migrations" + verification query for `admin_users`) and ships the migrate runner + SQL files, so future deploys and server-side recovery are protected.
 See the full root-cause + plan: `docs/superpowers/plans/2026-06-prod-db-schema-migration-reliability.md`
 The old `|| echo` masking around `npm run migrate:one` has been removed; a missing critical table will now fail the CI job with a clear message.
 #### SECURITY DEFINER RPCs + Brand Scoping
 The app uses **PostgreSQL SECURITY DEFINER functions** for all data access. These run with the function owner's privileges and bypass any future RLS. This means:
@@ -258,13 +297,15 @@ Separate from orders/stops — tracks irrigation/water usage per brand. `src/act
 | Concern | Location |
 |---|---|
 | Neon Auth configuration | `src/lib/auth.ts`, `src/auth.config.ts` |
 | Auth API routes | `src/app/api/auth/sign-in/route.ts`, `src/app/api/auth/forgot-password/route.ts`, `src/app/api/auth/reset-password/route.ts`, `src/app/api/auth/[...nextauth]/route.ts` |
 | Admin auth + permissions | `src/lib/admin-permissions.ts`, `src/lib/admin-permissions-types.ts` |
 | Middleware (route protection) | `src/middleware.ts` |
 | Server actions | `src/actions/*.ts` (one file per domain; also grouped into `src/actions/{admin,ai,billing,communications,harvest-reach,integrations,orders,products,settings,shipping,stops,water-log,platform,route-trace,time-tracking,email-automation}/`) |
 | Admin pages | `src/app/admin/[module]/page.tsx` |
 | Admin client components | `src/components/admin/*.tsx` |
-| Migrations | `supabase/migrations/` (kept for now; will likely move to `db/migrations/` in a later pass) |
+| Migrations | `db/migrations/` |
-| Postgres pool / driver | `src/lib/db.ts` (TBD — create during the Supabase removal pass) |
+| Postgres pool / driver | `src/lib/db.ts` (TBD) |
 | Email templates | `src/lib/email-templates.ts` |
 | Date formatting | `src/lib/format-date.ts` |
 | Feature flags | `src/lib/feature-flags.ts` |
@@ -282,7 +323,8 @@ Separate from orders/stops — tracks irrigation/water usage per brand. `src/act
 - **Dev mode `brand_id: null`**: `getAdminUser()` returns `brand_id: null` for platform_admin dev sessions. Always pass explicit `brandId` to server action functions that accept it — don't rely on `adminUser.brand_id` alone.
 - **Communications = no RLS**: The communications tables (campaigns, templates, contacts, message_logs) have no row-level policies. All brand scoping must be enforced in server actions.
 - **Supabase residue in the wild**: `grep -r "@supabase" src/` will still find imports during the transition. Do not add new ones; if you're touching a file that imports from Supabase, replace the call with the equivalent `pg`-pool call before merging.
 - **Webhook event_id**: `log_communication_messages` never populates `event_id`, so the Resend webhook uses `customer_email + subject` lookup instead.
 - **Mixed fulfillment orders**: An order can have both pickup and ship items. `get_shipping_orders` RPC returns orders with at least one `fulfillment = 'ship'` item.
 - **SMS opt-in defaults**: `communication_contacts.sms_opt_in` defaults to `FALSE` (opt-out by default). `email_opt_in` defaults to `TRUE`. Always check `sms_opt_in` specifically for SMS sends, not `email_opt_in`.
 - **Neon Auth session cookie**: The session cookie is managed by Neon Auth. Do not manually set or clear it — use `signOut()` from `@/lib/auth` instead.
 - **Password reset**: The forgot-password API returns success even if the email doesn't exist (to prevent email enumeration). Check server logs to verify reset emails were sent.
@@ -0,0 +1,125 @@
 # Database Reference — Neon Postgres (Route Commerce)
 ## Core Auth
 | Table | Key Columns |
 |---|---|
 | `users` | id, name, email, email_verified, image, created_at |
 | `sessions` | id, user_id, token, expires_at, ip_address, user_agent |
 | `accounts` | id, user_id, provider_id, access_token, refresh_token |
 | `verifications` | id, identifier, value, expires_at |
 | `admin_users` | id, user_id, email, name, **role**, can_manage_* (15 flags), created_at |
 | `admin_user_brands` | admin_user_id, brand_id, added_at, added_by |
 > `role` values: `platform_admin`, `brand_admin`, `store_employee`
 > Link a user to a brand via `admin_user_brands`, NOT a column on `admin_users`.
 ## Brands & Plans
 | Table | Key Columns |
 |---|---|
 | `brands` | id, name, slug, **plan_tier**, max_users, max_products, max_stops_monthly, stripe_* |
 | `plans` | id, code, name, monthly_price_cents, max_users, max_products, max_stops_monthly, features |
 | `add_ons` | id, code, name, monthly_price_cents, description |
 | `brand_add_ons` | brand_id, add_on_id, stripe_subscription_id, status |
 | `brand_features` | id, brand_id, feature_key, enabled, enabled_at |
 | `brand_settings` | id, brand_id, legal_business_name, phone, email, logo_url, tagline, from_email, primary_color, custom_footer_text, etc. |
 | `wholesale_settings` | id, brand_id, require_approval, min_order_amount, pickup_location, fob_location, from_email, invoice_business_name, last_invoice_number |
 ## Products & Media
 | Table | Key Columns |
 |---|---|
 | `products` | id, brand_id, name, description, sku, type, price_cents, inventory, unit, active, is_taxable, pickup_type, image_url |
 | `product_images` | id, product_id, storage_key, position, alt_text |
 | `wholesale_products` | id, brand_id, rc_product_id, name, unit_type, availability, qty_available, price_tiers (JSON) |
 ## Orders
 | Table | Key Columns |
 |---|---|
 | `orders` | id, brand_id, customer_id, stop_id, total_cents, status, fulfillment, customer_address, placed_at |
 | `order_items` | id, order_id, product_id, quantity, price_cents, fulfillment |
 | `stops` | id, brand_id, name, location, address, city, state, zip, date, time, cutoff_date, status, is_public |
 | `shipments` | id, order_id, carrier, tracking_number, label_url, status, fedex_shipment_id |
 | `shipping_settings` | id, brand_id, carrier, fedex_account_number, fedex_api_key, fedex_use_production |
 | `user_carts` | id, brand_id, customer_id, items (JSON) |
 | `abandoned_cart_recovery` | id, brand_id, customer_id, contact_email, sequence_step, status, next_email_at |
 ## Wholesale
 | Table | Key Columns |
 |---|---|
 | `wholesale_customers` | id, user_id, brand_id, company_name, contact_name, email, account_status, credit_limit, deposits_enabled |
 | `wholesale_orders` | id, brand_id, customer_id, status, fulfillment_status, payment_status, subtotal, deposit_paid, balance_due, invoice_number |
 | `wholesale_order_items` | id, wholesale_order_id, product_id, quantity, unit_price, line_total |
 | `wholesale_deposits` | id, wholesale_order_id, amount, payment_method, reference |
 | `wholesale_customer_product_pricing` | id, customer_id, product_id, custom_price_cents |
 | `wholesale_notifications` | id, brand_id, customer_id, notification_type, channel, status, sent_at |
 | `wholesale_webhook_settings` | id, brand_id, url, secret, enabled |
 | `wholesale_sync_log` | id, brand_id, event_type, order_id, status |
 ## Communications (Harvest Reach)
 | Table | Key Columns |
 |---|---|
 | `communication_campaigns` | id, brand_id, name, subject, body_text, body_html, campaign_type, status, audience_rules (JSON), scheduled_at, sent_at |
 | `communication_contacts` | id, brand_id, email, phone, first_name, last_name, email_opt_in, sms_opt_in, unsubscribed_at, tags |
 | `communication_message_logs` | id, brand_id, campaign_id, contact_id, customer_email, delivery_method, subject, status |
 | `communication_segments` | id, brand_id, name, rules (JSON) |
 | `communication_templates` | id, brand_id, name, subject, body_text, body_html, template_type |
 | `communication_settings` | id, brand_id, default_sender_email, email_provider |
 | `welcome_email_sequence` | id, brand_id, contact_id, sequence_step, status, next_email_at |
 ## Customers
 | Table | Key Columns |
 |---|---|
 | `customers` | id, brand_id, primary_email, primary_phone, first_name, last_name, source |
 | `customer_communication_preferences` | id, customer_id, email_opt_in, sms_opt_in |
 ## Time Tracking
 | Table | Key Columns |
 |---|---|
 | `time_tracking_workers` | id, brand_id, name, role, pin, active |
 | `time_tracking_tasks` | id, brand_id, name, unit, sort_order, active |
 | `time_tracking_logs` | id, brand_id, worker_id, task_id, clock_in, clock_out, lunch_break_minutes |
 | `time_tracking_settings` | id, brand_id, pay_period_start_day, daily_overtime_threshold, weekly_overtime_threshold, overtime_multiplier |
 | `time_tracking_notification_log` | id, brand_id, worker_id, notification_type, status, sent_at |
 ## Water Log
 | Table | Key Columns |
 |---|---|
 | `water_headgates` | id, brand_id, name, active |
 | `water_irrigators` | id, brand_id, name, pin_hash, active |
 | `water_sessions` | id, irrigator_id, expires_at |
 | `water_log_entries` | id, brand_id, headgate_id, irrigator_id, measurement, unit, notes, logged_at |
 | `water_alert_log` | id, brand_id, alert_type, headgate_id, message, sent_to |
 ## Integrations
 | Table | Key Columns |
 |---|---|
 | `square_sync_log` | id, brand_id, sync_type, direction, item_id, status |
 | `square_sync_queue` | id, brand_id, sync_type, status, retry_count |
 | `api_keys` | id, brand_id, name, key_hash, permissions (JSON), is_active |
 | `payment_settings` | id, brand_id, provider, stripe_publishable_key, stripe_secret_key, square_access_token |
 ## Locations
 | Table | Key Columns |
 |---|---|
 | `locations` | id, brand_id, name, address, city, state, zip, active |
 ## Misc
 | Table | Key Columns |
 |---|---|
 | `audit_logs` | id, user_id, brand_id, action, entity_type, entity_id, details (JSON) |
 | `admin_action_logs` | id, admin_user_id, brand_id, action, target_type, target_id, metadata (JSON) |
 | `operational_events` | id, brand_id, event_type, entity_type, actor_type, payload (JSON) |
 | `referral_codes` | id, brand_id, referral_code, referrer_email, reward_type, reward_value |
 | `referral_redemptions` | id, referral_code_id, brand_id, referred_user_id |
 | `onboarding_progress` | id, brand_id, user_id, current_step, completed_steps (JSON) |
 | `notification_preferences` | id, user_id, email_orders, email_marketing, sms_orders, etc. |
 | `changelogs` | — |
 | `changelog_reads` | id, user_id, changelog_id |
 | `_migrations` | filename, applied_at |
 ## Schema Notes
 - All timestamps use `TIMESTAMP WITH TIME ZONE` — timezone-aware
 - No PostgreSQL ENUM types — statuses are plain TEXT
 - Brand scoping enforced at application layer (SECURITY DEFINER RPCs), NOT via RLS
 - `brands.slug` is the public storefront URL slug (e.g. `tuxedo`, `indian-river-direct`)
 - `admin_users.user_id` links to `neon_auth.user` (managed by Neon Auth), NOT to `users` table
 - The `users` table above is Neon Auth's internal table — do NOT write to it directly
@@ -170,3 +170,49 @@ Controls whether to use Square sandbox or production.
 - **SQUARE_ENVIRONMENT mismatch:** Production Square credentials won't work with `sandbox`. Match it to your app secret type.
 - **SUPABASE_SERVICE_ROLE_KEY in client:** If you ever see `SUPABASE_SERVICE_ROLE_KEY` in a browser bundle, it's a critical security incident. The key was exposed server-side. Rotate it immediately in Supabase Dashboard.
 - **OPENAI_API_KEY for AI features:** AI features won't work without this. The AI Intelligence Pack add-on requires a valid OpenAI key.
 ---
 ## Authentication
 ### Production (HTTPS Required)
 Neon Auth session cookies use the `__Secure-` prefix, which requires HTTPS. In production, the auth flow works as follows:
 1. User submits credentials to `/api/auth/sign-in`
 2. Neon Auth server sets session cookie with `secure: true`
 3. Browser stores the cookie and sends it with subsequent requests
 4. Middleware validates the session cookie
 ### Local Development (HTTP)
 For local development over HTTP (e.g., `http://localhost:4000`), the platform provides a dev_session bypass:
 1. **Via Login Page:** Visit `/login` - you'll see "Dev Mode — Quick Access" buttons for Platform Admin, Brand Admin, and Store Employee roles.
 2. **Via Browser Console:** `document.cookie = 'dev_session=platform_admin; path=/; max-age=86400'`
 3. **Via curl:** `curl -b "dev_session=platform_admin" http://localhost:4000/admin`
 The dev_session cookie is automatically recognized by:
 - The middleware (`src/proxy.ts`)
 - The `getAdminUser()` function (`src/lib/admin-permissions.ts`)
 **Note:** The dev_session bypass only works when `NODE_ENV !== "production"`. In production, only Neon Auth session cookies are accepted.
 ### HTTPS for Local Development
 If you prefer to test with real auth over HTTPS locally, you can use a tool like [mkcert](https://github.com/FiloSottile/mkcert):
 ```bash
 # Install mkcert
 brew install mkcert
 # Create local CA and install it
 mkcert -install
 # Generate certificate for localhost
 mkcert localhost 127.0.0.1 ::1
 # Update next.config.ts to use HTTPS
 ```
 For most development work, the dev_session bypass is sufficient.
@@ -2,7 +2,35 @@
 This file captures key context, decisions, fixes, and state from recent work so it survives across conversations.
-**Last updated:** 2026-06-06 (Supabase → Postgres pivot)
+**Last updated:** 2026-06 (migration reliability + Google sign-in work)
 ## 2026-06: CI migration failures on re-deploy (0001_init.sql "already exists")
 Prod DATABASE_URL already had the schema from the first successful bootstrap.
 The deploy workflow runs `npm run migrate:one` on every push (after neon_auth preflight).
 `scripts/migrate.js` has `_migrations` tracking + skip, but the row for `0001_init.sql` was never recorded (the tracking logic landed after the initial apply, or an apply happened outside the runner).
 `db/migrations/0001_init.sql` header *claimed* "CREATE TABLE IF NOT EXISTS" but the actual statements were plain `CREATE TABLE`, plain `CREATE INDEX`, and unguarded `CREATE TRIGGER`.
 Result: every subsequent deploy hit `relation "admin_users" already exists` (and would have hit index/trigger dups too) inside the runner's BEGIN, causing ROLLBACK + failure of the whole "Run migrations" job.
 ### Fixes applied
 - Made `0001_init.sql` truly re-runnable:
  - All `CREATE TABLE` → `CREATE TABLE IF NOT EXISTS`
  - All `CREATE INDEX` / `CREATE UNIQUE INDEX` → `... IF NOT EXISTS`
  - Every `CREATE TRIGGER` wrapped in a `DO $$ IF NOT EXISTS (pg_trigger check) THEN CREATE TRIGGER ... END IF; $$` guard
  - Removed the file-level `BEGIN; ... COMMIT;` (the runner owns the tx; this also prevents inner-COMMIT from ending the runner tx early).
 - `0002_admin_password.sql` had its tx wrapper removed for consistency (its ALTER was already `IF NOT EXISTS`).
 - Hardened `scripts/migrate.js`:
  - Added `ensureTracked()` repair: for 0001/0002, if the core objects (admin_users table, or the password_hash column) already exist in the target DB but the tracking row is absent, we INSERT the row (ON CONFLICT DO NOTHING) and skip the file. Logs "repaired tracking".
 - Hardened `.gitea/workflows/deploy.yml` "Run migrations" step:
  - Added an inline pre-repair node snippet (same idea) right before `npm run migrate:one`. This protects even if an older runner is checked out.
  - The existing neon_auth preflight + post `admin_users` verification remain as the hard gate.
 - Updated header comments and docs in the files.
 After this, `npm run migrate` / deploys on an already-initialized DB will log the "repaired" or "already applied" lines for 0001 and proceed cleanly. The shipped `scripts/migrate.js` + `db/migrations/` on the target server also benefit for emergency recovery runs.
 See also the plan doc referenced in deploy.yml for the broader reliability work.
 ---
@@ -308,3 +336,252 @@ The earlier commit `2f3be54 fix(actions): skip Supabase fetch at build time when
 - The crispygoat repo (`git@git.crispygoat.com:tyler/route-commerce.git`) and the GitHub `origin` repo are separate forks — `tyler/main` is the self-hosted Auth.js + Postgres branch, `origin/main` is the Supabase branch. Don't merge them; they share no deploy workflow.
 - Push targets `tyler/main` to trigger the Gitea build.
 ## Build green — 2026-06-06
 Push `32396af` to `origin/main` triggered a successful Gitea deploy. Fixes that landed:
 - `force-dynamic` on `src/app/admin/layout.tsx` + `src/app/admin/settings/square-sync/page.tsx`
 - try/catch around Supabase REST fetches in `src/actions/stops.ts` and `src/actions/brand-settings.ts`
 - `.gitea/workflows/deploy.yml` paths updated to `deploy/docker-compose.yml`
 ## Production prep — next steps
 1. **Verify the stack is actually running.** SSH to the deploy host, `docker compose -p prod-app ps` in `$APP_DIR` (`/home/tyler/route-commerce`). All services should be `healthy`.
 2. **Test Postgres connectivity.** `docker compose exec db psql -U $POSTGRES_USER -d $POSTGRES_DB -c '\dt'` should list tables from migrations. `curl http://localhost:$POSTGREST_HOST_PORT/` should return PostgREST's OpenAPI spec.
 3. **Test app → PostgREST.** Hit any public page that reads from PostgREST (e.g. `/indian-river-direct/stops` after the revalidate window). If it returns stops, the chain works.
 4. **Replace dummy secrets** in Gitea:
   - `NEXT_PUBLIC_SUPABASE_URL=http://localhost:54321` + `NEXT_PUBLIC_SUPABASE_ANON_KEY=dummy-supabase-anon-ke` — either set real Supabase project values, or remove entirely once the Postgres-direct migration is complete (CLAUDE.md direction).
   - `RESEND_API_KEY=re_REPLACE_ME`, `RESEND_WEBHOOK_SECRET=whsec_REPLACE_ME` — get real values from Resend dashboard.
   - `STRIPE_SECRET_KEY=sk_test_REPLACE_ME`, `STRIPE_PUBLISHABLE_KEY=pk_test_REPLACE_ME`, `STRIPE_WEBHOOK_SECRET=whsec_REPLACE_ME` — real test-mode values from Stripe.
 5. **Supabase → direct Postgres migration.** The codebase still imports `@supabase/ssr` and `@supabase/supabase-js` in `src/lib/supabase.ts`, `src/lib/supabase/server.ts`, `src/actions/login.ts`, `src/actions/admin/users.ts`, `src/actions/admin/force-login.ts`, `src/actions/wholesale-auth.ts`. CLAUDE.md says these should be purged. The deploy stack already has PostgREST, so the path is: replace `supabase.from(...)` calls with `fetch` to `NEXT_PUBLIC_API_URL/rest/v1/...` or direct `pg` queries, then drop the `@supabase/*` deps.
 6. **Auth.js hardening.** `AUTH_GOOGLE_ID` / `AUTH_GOOGLE_SECRET` aren't in the secret list — the workflow falls back to `BETTER_AUTH_*` names which exist. Set the canonical `AUTH_*` names too so the fallback isn't load-bearing.
 ## Login flow consolidated — 2026-06-06
 Push `e499139` fixes the "dev login redirects back to /login" bug and
 removes the three-mode login page.
 **Root cause:** `src/middleware.ts` didn't exist, so the `authorized`
 callback in `auth.config.ts` never ran at the edge. The demo buttons at
 `/login?demo=1` set `dev_session` via `document.cookie`, but nothing at
 the edge recognized the cookie — the admin layout's `getAdminUser()` was
 the only thing reading it, and if the layout's `force-dynamic` ever
 stopped applying, the user would be bounced.
 **Fix:**
 - **New `src/middleware.ts`** — plain middleware (NOT the `auth()`
  wrapper). Gates `/admin/*` and `/login`:
  - If `dev_session`, `rc_auth_uid`, or `rc_uid` cookie is present →
    `NextResponse.next()`.
  - If no auth cookie, on `/admin/*`, and `ALLOW_DEV_LOGIN !== "false"`
    (on by default) → set `dev_session=platform_admin` cookie and
    `NextResponse.next()`. Invisible auto-login.
  - If no auth and dev disabled → redirect to `/login`.
  - If authenticated and on `/login` → redirect to `/admin`.
 - **`src/app/login/LoginClient.tsx`** — stripped to a single Google
  OAuth button. Removed:
  - Email/password form (was hitting dummy Supabase and 500'ing).
  - Dev credentials form (`signInWithDev`).
  - `DemoMode` component with the three buttons (Platform Admin,
    Brand Admin, Store Employee).
  - `useState`/`useEffect`/`useCallback`/`useSearchParams`/`Suspense`
    — none of that complexity is needed for a single button.
 - **`src/actions/auth-signin.ts`** — removed `signInWithDev`. Kept
  `signInWithGoogle` and `signOutAction`.
 - **Deleted `src/app/dev-login/page.tsx`** and
  **`src/app/api/dev-login/route.ts`** — dead routes, middleware
  handles it.
 **What "one way to log in" looks like now:**
 - Dev/demo: visit `/admin` → middleware sets `dev_session` cookie →
  `getAdminUser()` returns platform_admin → you're in.
 - Production: visit `/admin` → no cookie, `ALLOW_DEV_LOGIN=false` →
  redirect to `/login` → click Google → Auth.js OAuth flow.
 **Note for Auth.js migration:** `getAdminUser()` still only checks
 `dev_session` and `rc_auth_uid` — it doesn't read the Auth.js JWT.
 After Google sign-in succeeds, the user has a valid Auth.js session
 but `getAdminUser()` returns null. The middleware can't fix that
 because it can't write to the JWT without going through the
 credentials provider. This is the next piece of the Auth.js migration
 (see CLAUDE.md "Auth.js migration — in progress"). The current fix
 gets the dev/demo path working; the Google OAuth → admin path needs
 the `getAdminUser()` Auth.js check wired up.
 ## Auth.js v5 wiring complete — 2026-06-06
 Push `1e9f9c0` completes the Auth.js path so Google sign-in lands the
 user on `/admin` as a real admin (not "Your account does not have
 admin access").
 **What landed:**
 - **`src/lib/db.ts` (NEW)** — shared `pg.Pool` singleton. The single
  connection pool for the whole app. Extracted from `src/lib/auth.ts`
  (which had its own private pool). Connection string resolution:
  `DATABASE_URL` → `SUPABASE_DB_URL` → `POSTGRES_URL`.
 - **`src/lib/auth.ts`** — imports the shared pool. The `signIn` event
  now calls the new `upsert_admin_user_for_authjs` RPC instead of
  the no-op existence check it had before.
 - **`supabase/migrations/209_authjs_auto_create_admin.sql` (NEW)** —
  pushed automatically by the deploy workflow (line 130 of
  `.gitea/workflows/deploy.yml` does `cat supabase/migrations/[0-9]*.sql
  | $PG`). Contains:
  - `ALTER TABLE admin_users ADD COLUMN IF NOT EXISTS
    can_manage_settings BOOLEAN NOT NULL DEFAULT false` — defensive,
    since this column is in the TypeScript `AdminUser` type but not
    in any tracked migration (was likely dashboard-added).
  - SECURITY DEFINER RPC `upsert_admin_user_for_authjs(p_user_id UUID)`
    that inserts a `platform_admin` row with all `can_manage_*` flags
    true, `ON CONFLICT (user_id) DO NOTHING`.
  - `NOTIFY pgrst, 'reload schema'` so PostgREST picks up the new RPC.
 - **`src/lib/admin-permissions.ts`** — new Auth.js session check
  between `dev_session` and `rc_auth_uid`. Uses `auth()` from
  `@/lib/auth` to decrypt the JWT cookie server-side, then
  `getAdminUserFromPool()` queries `admin_users` + `admin_user_brands`
  via the shared pool. The legacy `rc_auth_uid` path is unchanged
  (deferred — it still hits the dummy Supabase URL in prod).
 - **`src/middleware.ts`** — recognizes `authjs.session-token` and
  `__Secure-authjs.session-token` cookies at the edge so signed-in
  users aren't bounced to `/login`.
 **Key insight: same ID space.** Both `admin_users.user_id` (UUID, per
 `028_fix_caller_uid_type.sql`) and Auth.js `users.id` (UUID, per
 `204_authjs_tables.sql:18`) are in the same UUID space. The
 `@auth/pg-adapter` auto-generates a fresh UUID per new user on first
 sign-in; the Google `sub` claim is stored separately in
 `accounts."providerAccountId"`. So no schema change was needed —
 just a `user_id` lookup in `getAdminUserFromPool()`.
 **Full sign-in flow now:**
 1. Dev/demo: visit `/admin` → middleware auto-issues `dev_session`
   cookie → `getAdminUser()` returns platform_admin. (No DB call.)
 2. Production: click "Sign in with Google" → Auth.js OAuth →
   `signIn` event fires → `upsert_admin_user_for_authjs` creates
   the `admin_users` row → redirect to `/admin` → `getAdminUser()`
   reads JWT, queries pool via `auth.js.user.id`, returns
   platform_admin.
 **What's still broken (out of scope for this push):**
 - Legacy `rc_auth_uid` path in `getAdminUser()` still fetches from
  `${NEXT_PUBLIC_SUPABASE_URL}/rest/v1/...` which is a dummy
  `http://localhost:54321` in prod. Any pre-existing user with a
  `rc_auth_uid` cookie will get null. Defer until the Supabase →
  direct Postgres migration of the REST calls.
 - `getCurrentAdminUser` (client-side variant) still reads from
  server-passed props — no change needed.
 - The `signIn` event RPC call will fail silently if `DATABASE_URL`
  is not set. The user would see "Your account does not have admin
  access" and need to sign out and back in once the env is fixed.
 ## Deploy fix — PostgREST env + dead nextjs service — 2026-06-06
 Push `2d55791` fixes two issues that broke the "Start Docker stack" step:
 1. **`PGRST_DB_URI` not set** — the env var was only in the "Deploy"
   step's env, which runs after PostgREST has already started.
   PostgREST booted with a blank DB URI. Now set in the "Start
   Docker stack" step's env and written to `$APP_DIR/.env` (the
   file docker compose auto-loads).
 2. **`docker-compose.yml` had a dead `nextjs` service** with
   `env_file: ../.env.production`. That file is written by the
   "Deploy" step (later in the workflow), so at "Start Docker stack"
   time the path doesn't exist. `docker compose up` validates the
   whole compose file and bailed.
   The `nextjs` service is dead code anyway — PM2 runs Next.js
   directly from `$APP_DIR`, never through docker. Removed it.
 **Other fixes in the same push:**
 - `docker compose up -d db postgrest minio minio_init` referenced
  services that don't exist in the compose file. Postgres runs on
  the host (the migrations step uses `psql -h 127.0.0.1`), not in
  docker. Changed to just `postgrest`.
 - The `pg_isready` check was `docker compose exec -T db pg_isready`.
  Since `db` is a host service, changed to
  `PGPASSWORD=... psql -h 127.0.0.1 -U ... -d ... -c "SELECT 1"`.
 **Architecture (now consistent):**
 - Postgres: host (127.0.0.1:5432), migrations via `psql -h 127.0.0.1`
 - PostgREST: docker, connects to host Postgres via `PGRST_DB_URI`
 - Next.js: host, PM2 process, reads `DATABASE_URL` from `.env.production`
 - MinIO: not yet wired up (the `MINIO_ROOT_USER`/`PASSWORD` env vars
  are written to `.env` but no service consumes them yet — add a
  `minio` service to docker-compose.yml when storage goes live)
 ---
 # 2026-06-07 — Full Supabase → Drizzle/pg migration complete
 **Status: ALL 114 FILES MIGRATED. ZERO @supabase IMPORTS. ZERO rest/v1 CALLS.**
 ## Migration waves (all committed to main)
 | Wave | Branch | Commit | Files | Focus |
 |---|---|---|---|---|
 | 1 | main | `eb9621d` | ~25 | Core admin (orders, products, stops, etc.) |
 | 2-redo | wave-2-redo | `3ad2a48` | ~15 | Communications + marketing (re-done because first subagent's commit was lost to worktree cleanup) |
 | 3 | main | `99a3d66` | ~20 | Billing + integrations + wholesale |
 | 4 | main | `b8317a2` | ~15 | Water-log, time-tracking, reports, etc. |
 | 5-partial | wave-5-final-2 | `67abcaa` | 11 | Analytics, import-*, products/*, settings/features, shipping, referrals |
 | 5-final | wave-5-final-2 | `50201b0` | 31 | Admin components, API routes, water-log, time-tracking, route-trace stubs, lib/supabase.ts (rewritten as pure mock), lib/supabase/server.ts (deleted), api/supabase/route.ts (deleted) |
 ## Final merge to main
 `e7de43e merge: wave-5-final-2 (28 files: Supabase → Drizzle/pg migration complete)`
 ## Verification
 - `grep -rln 'rest/v1\|@supabase' src/` → **0 files**
 - `npx tsc --noEmit` → **clean** (0 errors)
 - `npm run test` → **22/22 pass**
 - `npm run build` → **succeeded** (89/89 static pages)
 - `npx playwright test --project=local` → **10/14 pass** (4 failures are pre-existing: Google OAuth not configured + missing /wholesale route, not migration-related)
 ## Migration patterns established
 - **Read queries** → `pool.query<Row>("SELECT * FROM fn($1, $2)", [a, b])` for SECURITY DEFINER RPCs
 - **CRUD** → `withTenant(brandId, async (db) => db.select().from(table).where(eq(table.tenantId, brandId)))` for tenant-scoped reads
 - **Writes** → `withTx(async (tx) => { ... })` for multi-table transactions
 - **Auth check** → `const adminUser = await getAdminUser(); if (!adminUser) return ...`
 - **Brand scoping** → `effectiveBrandId = brandId ?? adminUser.brand_id ?? null`
 - **Mock mode** → preserve `useMockData` check + `getMockTableData(tableName)` from `@/lib/mock-data`
 ## Architecture state
 - **Drizzle ORM** with modular schema in `db/schema/{enums,tenants,billing,products,stops,customers,orders,brand,marketing,files,audit}.ts`
 - **Postgres + RLS** with `withTenant()` setting `app.current_tenant_id` GUC
 - **Auth.js v5** (next-auth@5.0.0-beta.31) with Google OAuth + Credentials providers
 - **`src/lib/db.ts`** — shared `pg.Pool` (server-only, lazy)
 - **`db/client.ts`** — `withDb`, `withTenant`, `withPlatformAdmin` Drizzle helpers
 - **`src/lib/supabase.ts`** — rewrote as pure mock (no @supabase/* imports) for the ~25 legacy consumers that still use the query-builder API; can be removed when those consumers migrate to Drizzle
 - **`src/lib/supabase/server.ts`** — DELETED
 - **`src/app/api/supabase/route.ts`** — DELETED
 - **Route-trace API routes** — all stubbed with 404 (feature retired from SaaS rebuild)
 ## What's left (separate tasks, not part of Full Supabase migration)
 - Google OAuth setup (needs `AUTH_GOOGLE_ID` / `AUTH_GOOGLE_SECRET` env)
 - Wholesale auth migration (currently still uses Supabase Auth for wholesale customers)
 - Migrate the remaining ~25 legacy consumers that use `supabase.from('table').select()` API (these still work via the mock rewrite, but should be Drizzle-ified)
 - Add `email` column to `admin_users` and provision Google users by email
 - Switch `getAdminUser()` to direct `pg` lookup (not REST)
 - Remove the email/password (Supabase) provider when Supabase auth is fully cut over
 - Remove `DEV_FORCE_UID` constant and dead branches in `actions/admin/users.ts`
 ## Pushed to remotes
 - `crispygoat/main` (the SSH remote at git.crispygoat.com) — primary target
 - `origin/main` (GitHub) — for backup visibility
 - 36 commits ahead of `origin/main` as of this entry
@@ -0,0 +1,204 @@
 # YOLO Auth Migration — Final Report
 **Date:** 2026-06-06 → 2026-06-07
 **Mission:** Stand up a working Auth.js v5 + Google sign-in flow, then rip out
 all Supabase references from the auth/admin path.
 ---
 ## What was built
 ### 1. Auth.js v5 (NextAuth) integration — DONE
 - **`src/lib/auth.ts`** — Auth.js v5 config. Google is the only provider
  (no Supabase-backed Credentials provider). Sessions are JWTs; no DB
  adapter. Exports `handlers`, `auth`, `signIn`, `signOut`.
 - **`src/lib/admin-permissions.ts`** — `getAdminUser()` resolves the
  current admin. Three branches in precedence order:
  1. `NEXT_PUBLIC_USE_MOCK_DATA=true` → platform_admin dev shim
  2. `dev_session` cookie → matching dev shim (platform/brand/store)
  3. Auth.js session → `null` (no DB lookup yet — see Follow-ups)
 - **`src/actions/auth-actions.ts`** — `signInWithGoogle()` and
  `signOutAction()`. `signInWithPassword` was removed.
 - **`src/app/login/LoginClient.tsx`** + **`page.tsx`** — Login page
  renders "Continue with Google" (when configured) and three demo
  buttons (Platform / Brand / Store Employee) via `?demo=1`. Email /
  password form and "Forgot password" are gone.
 - **`src/app/api/auth/[...nextauth]/route.ts`** — Auth.js route handler.
 ### 2. Direct Postgres connection (`src/lib/db.ts`) — DONE
 - Single shared `pg.Pool` with lazy initialization. Throws a clear
  error if `DATABASE_URL` is not set.
 - Exports `getPool()`, a `pool` proxy alias, `query<T>()` helper, and
  `withTx()` for transactions.
 - Tuned for Vercel/serverless: 10 max conns, 30s idle, 10s connect
  timeout. All overridable via `PG_POOL_*` env vars.
 ### 3. Server actions → `pg` (no Supabase) — DONE
 - **`src/actions/admin/users.ts`** — Full rewrite. `getAdminUsers`,
  `createAdminUser`, `updateAdminUser`, `deleteAdminUser`,
  `setMustChangePassword`, `getBrands` now hit Postgres directly.
  `sendPasswordResetEmail` returns a stub error (no auth service
  anymore — the function is preserved for call-site compatibility).
 - The `dev_session` cookie continues to be the demo-flow bypass.
 ### 4. Cleanup — DONE
 - **`src/actions/admin/force-login.ts`** — Deleted (the
  Emergency-Force-Login page and its `/api/force-admin` route were
  removed in the previous session).
 - **`src/actions/admin/users.ts`** — Removed the `DEV_FORCE_UID`
  magic value, the `rc_auth_uid` cookie reads (×3), the
  `headerStore` lookup, the `getServiceClient` / `getAuthClient` /
  `callRpcWithAuth` helpers, and the `devListAdminUsers` auto-provision
  branch. All Supabase imports gone.
 - **`src/app/admin/me/AdminMeClient.tsx`** — Profile / email-change
  handlers neutralized (return "contact a platform admin" — the
  Supabase auth backend that backed them is gone).
 - **`src/middleware.ts`** — `dev_session` auto-login preserved
  (issues a `platform_admin` cookie on unauthed `/admin` so the rest
  of the admin shell renders). `auth()` wrapper in place.
 ### 5. Test infrastructure — DONE
 - **Vitest 2.1.9** with `@vitejs/plugin-react`, jsdom, manual
  `@/* → src/*` alias. No `vite-tsconfig-paths` (ESM/require
  incompatibility).
 - **`tests/setup.ts`** — Mocks `next/navigation` (not in jsdom).
 - **`tests/unit/getAdminUser.test.ts`** — 12 tests covering
  dev_session, mock-data, Auth.js session, defensive error handling.
 - **`tests/unit/auth-actions.test.ts`** — 2 tests for
  `signInWithGoogle` + `signOutAction`.
 - Both test files stub `server-only` with `vi.mock("server-only", () => ({}))`.
 - **Playwright config** — `webServer` block for `npm run dev`,
  `PLAYWRIGHT_URL` override, `reuseExistingServer: !process.env.CI`.
 - **`tests/login/login-flow.spec.ts`** — Login form rendering +
  demo mode (3 roles) tests.
 - **`tests/e2e/auth.spec.ts`** — Auth.js endpoints, middleware
  redirect behavior, /admin load with dev_session, logout.
 ### 6. `import "server-only"` markers — DONE
 - Added to `src/lib/auth.ts`, `src/lib/admin-permissions.ts`,
  `src/lib/db.ts`, `src/actions/auth-actions.ts`,
  `src/actions/admin/users.ts`.
 - ⚠️ In `"use server"` files, the directive must be first
  (`"use server";` on line 1, then `import "server-only";`). The dev
  build surfaced this; fixed in `auth-actions.ts` and `users.ts`.
 ---
 ## Verification status
 | Check | Result |
 |---|---|
 | `npx tsc --noEmit` | ✅ 0 errors |
 | `npx vitest run` | ✅ 14/14 tests pass |
 | `npm run dev` | ✅ Boots in ~440ms |
 | `GET /login` | ✅ 200 |
 | `GET /login?demo=1` | ✅ 200 |
 | `GET /api/auth/providers` | ✅ 200 (empty list — Google not configured) |
 | `GET /` | ✅ 200 |
 | `GET /admin` (unauthed) | ✅ 307 → `/admin?demo=1` + `dev_session` cookie |
 | `GET /admin?demo=1` (with cookie) | ✅ 200 (admin layout renders) |
 ---
 ## Files changed
 ```
 M src/actions/admin/users.ts            # full rewrite, pg-only
 M src/actions/auth-actions.ts           # signInWithPassword removed
 M src/app/admin/me/AdminMeClient.tsx    # handlers stubbed
 M src/app/login/LoginClient.tsx         # email/password form removed
 M src/app/login/page.tsx                # passes hasGoogle prop
 M src/lib/admin-permissions.ts          # Supabase REST calls removed
 M src/lib/auth.ts                       # Credentials provider removed
 M tests/unit/auth-actions.test.ts       # signInWithPassword tests removed
 M tests/unit/getAdminUser.test.ts       # reflects no-DB behavior
 ```
 Plus deletions and creations recorded in the prior session.
 ---
 ## Follow-ups (the bigger fish)
 The user's directive was: "git rid of all supabase references, we are
 not using it for login or anything anymore." The auth/admin path is
 now Supabase-free. **33 files** still import from Supabase — they use
 it for **data fetching** (`supabase.from(...).select(...)`), not auth.
 **Migrating those to `pg` is a follow-up.** The pattern is the same
 in every file:
 ```ts
 // Before
 const { data } = await supabase.from("products").select("*").eq("brand_id", id);
 // After
 import { query } from "@/lib/db";
 const { rows } = await query<ProductRow>(
  "SELECT * FROM products WHERE brand_id = $1",
  [id],
 );
 ```
 ### 33 files still importing Supabase
 ```
 src/app/admin/page.tsx, products/[id]/page.tsx, products/page.tsx,
     orders/page.tsx, stops/[id]/page.tsx, stops/new/page.tsx,
     stops/page.tsx, reports/page.tsx, taxes/page.tsx,
     settings/billing/page.tsx, settings/integrations/page.tsx,
     settings/shipping/page.tsx
 src/app/tuxedo/page.tsx, about/page.tsx, contact/ContactClientPage.tsx,
     stops/[slug]/page.tsx
 src/app/indian-river-direct/page.tsx, faq/FAQClientPage.tsx,
     contact/ContactClientPage.tsx, stops/[slug]/page.tsx
 src/app/api/tuxedo/schedule-pdf/route.ts,
     src/app/api/indian-river-direct/schedule-pdf/route.ts
 src/app/reset-password/page.tsx, src/app/test/page.tsx
 src/components/admin/AdminHeader.tsx, AdminSidebar.tsx
 src/lib/supabase.ts, src/lib/supabase/server.ts  # the client modules
 src/actions/wholesale-auth.ts, reset-admin.ts, audit.ts
 src/actions/ai/preferences.ts
 ```
 ### Additional follow-ups
 1. **Provision a `pg` pool in production.** `DATABASE_URL` must be
   set in the hosting dashboard (same env var as
   `supabase/push-migrations.js` uses).
 2. **Apply migration 204** if not already applied — adds
   `email`, `auth_provider`, `auth_subject` columns to `admin_users`
   and the `get_admin_user_for_session` RPC.
 3. **Wire `getAdminUser()`'s Auth.js session branch** to call
   `get_admin_user_for_session` via `pg` once a `DATABASE_URL` is
   configured. Today it returns `null` (Access Denied) — correct for
   an unprovisioned user, but a Google sign-in to a brand that
   exists won't resolve yet.
 4. **Drop the `next-auth` Credentials provider module path** in
   `auth.ts` entirely once production confirms Google is the only
   provider in use. Currently it's gated on env var presence.
 5. **Re-implement `sendPasswordResetEmail`** if/when Auth.js v5 ships
   its built-in email provider — until then, a platform admin must
   handle resets manually.
 6. **Decommission `src/lib/supabase.ts` and `src/lib/supabase/server.ts`**
   once all 33 remaining files have been ported to `pg`. They are
   the only remaining `@supabase/*` import surface.
 7. **Delete `@supabase/ssr` and `@supabase/supabase-js` from
   `package.json`** (last step once no file imports them).
 ---
 ## Commands
 ```bash
 npm run dev          # Dev server (boots in ~440ms)
 npm test             # Vitest: 14/14 pass
 npx tsc --noEmit     # Typecheck: 0 errors
 npx playwright test  # E2E (skips credentials tests if env unset)
 ```
@@ -0,0 +1,135 @@
 /**
 * Drizzle client + brand-scoped query helper.
 *
 * The app connects to Postgres directly via the `pg` driver. Drizzle sits
 * on top, providing typed queries. The `withBrand` wrapper is the only
 * sanctioned way to run a brand-scoped query — it sets the
 * `app.current_brand_id` GUC transaction-locally, and the database's
 * RLS policies enforce brand isolation even if application code forgets
 * a `WHERE brand_id = $1`.
 *
 * Usage (read):
 *   const products = await withBrand(brandId, (db) =>
 *     db.select().from(productsTable).where(eq(productsTable.active, true)),
 *   );
 *
 * Usage (platform admin — sees all brands):
 *   const allBrands = await withPlatformAdmin((db) =>
 *     db.select().from(brandsTable),
 *   );
 *
 * Usage (no brand — for the rare case the query isn't brand-scoped):
 *   const plans = await withDb((db) => db.select().from(plansTable));
 */
 import "server-only";
 import { Pool, type PoolClient } from "pg";
 import { drizzle, type NodePgDatabase } from "drizzle-orm/node-postgres";
 import * as schema from "./schema";
 type Schema = typeof schema;
 export type Db = NodePgDatabase<Schema>;
 let _pool: Pool | null = null;
 function getPool(): Pool {
  if (_pool) return _pool;
  const connectionString = process.env.DATABASE_URL;
  if (!connectionString) {
    throw new Error(
      "DATABASE_URL is not set. Add it to .env.local (see .env.example).",
    );
  }
  _pool = new Pool({
    connectionString,
    max: parseInt(process.env.PG_POOL_MAX ?? "10", 10),
    idleTimeoutMillis: parseInt(process.env.PG_POOL_IDLE_MS ?? "30000", 10),
    connectionTimeoutMillis: parseInt(
      process.env.PG_POOL_CONN_TIMEOUT_MS ?? "10000",
      10,
    ),
    allowExitOnIdle: false,
  });
  _pool.on("error", (err) => {
    console.error("[db] idle client error", err);
  });
  return _pool;
 }
 /**
 * Run `fn` with a Drizzle client. No brand context is set — the caller
 * is responsible for RLS bypass (e.g. for the `plans` and `add_ons` tables,
 * which are not brand-scoped). For brand-scoped reads, prefer
 * `withBrand` or `withPlatformAdmin`.
 */
 export async function withDb<T>(fn: (db: Db) => Promise<T>): Promise<T> {
  const client = await getPool().connect();
  try {
    const db = drizzle(client, { schema });
    return await fn(db);
  } finally {
    client.release();
  }
 }
 /**
 * Run `fn` inside a transaction with the current brand id set as a
 * transaction-local GUC. RLS policies on brand-scoped tables will allow
 * reads/writes only for rows where `brand_id` matches. Pass `null` to
 * fail open (don't set the GUC) — only useful for the migrations
 * themselves, never for app code.
 */
 export async function withBrand<T>(
  brandId: string,
  fn: (db: Db) => Promise<T>,
 ): Promise<T> {
  return runInTransaction(async (client) => {
    // set_config(setting, value, is_local) — is_local=true makes it
    // transaction-local so it auto-resets at COMMIT/ROLLBACK and never
    // leaks across pooled connections.
    await client.query("SELECT set_config('app.current_brand_id', $1, true)", [
      brandId,
    ]);
    await client.query("SELECT set_config('app.platform_admin', 'false', true)");
    const db = drizzle(client, { schema });
    return fn(db);
  });
 }
 /**
 * Run `fn` as platform admin. RLS policies permit access to all brands.
 * Use sparingly — typically only in the /admin/platform routes.
 */
 export async function withPlatformAdmin<T>(
  fn: (db: Db) => Promise<T>,
 ): Promise<T> {
  return runInTransaction(async (client) => {
    await client.query("SELECT set_config('app.current_brand_id', '', true)");
    await client.query("SELECT set_config('app.platform_admin', 'true', true)");
    const db = drizzle(client, { schema });
    return fn(db);
  });
 }
 async function runInTransaction<T>(
  fn: (client: PoolClient) => Promise<T>,
 ): Promise<T> {
  const client = await getPool().connect();
  try {
    await client.query("BEGIN");
    const result = await fn(client);
    await client.query("COMMIT");
    return result;
  } catch (err) {
    try {
      await client.query("ROLLBACK");
    } catch {
      // ignore secondary rollback failure
    }
    throw err;
  } finally {
    client.release();
  }
 }
 export { schema };
@@ -0,0 +1,20 @@
 -- 0002_admin_password.sql
 --
 -- Adds a `password_hash` column to `users` so the Auth.js Credentials
 -- provider can verify email + password against the database.
 --
 -- Idempotent: uses `ADD COLUMN IF NOT EXISTS`. The column is nullable
 -- because OAuth-only users (Google) never set a password.
 --
 -- The Credentials provider's `authorize` function is documented in
 -- `src/lib/auth.ts` — it queries this column and runs `verifyPassword`
 -- (see `src/lib/passwords.ts`) before returning the user.
 -- Transaction is managed by the migrate runner (scripts/migrate.js).
 -- File kept small and re-runnable via IF NOT EXISTS on the ALTER.
 ALTER TABLE users
  ADD COLUMN IF NOT EXISTS password_hash TEXT;
 -- Update the updated_at trigger tracking — no new triggers needed since
 -- `users` already has `set_updated_at` from migration 0001.
@@ -0,0 +1,36 @@
 /**
 * Audit log. Source of truth: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  jsonb,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const auditLog = pgTable(
  "audit_log",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    userId: uuid("user_id"), // FK to neon_auth.user(id) — plain UUID, enforced at DB level
    action: text("action").notNull(),
    targetType: text("target_type"),
    targetId: uuid("target_id"),
    payload: jsonb("payload"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("audit_log_brand_idx").on(t.brandId, t.createdAt),
  }),
 );
 export type AuditLog = typeof auditLog.$inferSelect;
 export type NewAuditLog = typeof auditLog.$inferInsert;
@@ -0,0 +1,72 @@
 /**
 * Billing: plans, add_ons, brand_add_ons.
 * Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  timestamp,
  jsonb,
  primaryKey,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const plans = pgTable("plans", {
  id: uuid("id").primaryKey().defaultRandom(),
  code: text("code", {
    enum: ["starter", "farm", "enterprise"],
  }).notNull().unique(),
  name: text("name").notNull(),
  monthlyPriceCents: integer("monthly_price_cents").notNull(),
  maxUsers: integer("max_users").notNull(),
  maxProducts: integer("max_products").notNull(),
  maxStopsMonthly: integer("max_stops_monthly").notNull(),
  features: jsonb("features").notNull().default([]),
  createdAt: timestamp("created_at", { withTimezone: true })
    .notNull()
    .defaultNow(),
 });
 export const addOns = pgTable("add_ons", {
  id: uuid("id").primaryKey().defaultRandom(),
  code: text("code", {
    enum: [
      "wholesale_portal", "harvest_reach", "ai_tools",
      "water_log", "square_sync", "sms_campaigns",
    ],
  }).notNull().unique(),
  name: text("name").notNull(),
  monthlyPriceCents: integer("monthly_price_cents").notNull(),
  description: text("description"),
  createdAt: timestamp("created_at", { withTimezone: true })
    .notNull()
    .defaultNow(),
 });
 export const brandAddOns = pgTable(
  "brand_add_ons",
  {
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    addOnId: uuid("add_on_id")
      .notNull()
      .references(() => addOns.id, { onDelete: "cascade" }),
    stripeSubscriptionId: text("stripe_subscription_id"),
    status: text("status", { enum: ["active", "canceled"] })
      .notNull()
      .default("active"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    pk: primaryKey({ columns: [t.brandId, t.addOnId] }),
  }),
 );
 export type Plan = typeof plans.$inferSelect;
 export type AddOn = typeof addOns.$inferSelect;
 export type BrandAddOn = typeof brandAddOns.$inferSelect;
@@ -0,0 +1,76 @@
 /**
 * Brand settings + brand features. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  jsonb,
  boolean,
  timestamp,
  uniqueIndex,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const brandSettings = pgTable(
  "brand_settings",
  {
    brandId: uuid("brand_id")
      .primaryKey()
      .references(() => brands.id, { onDelete: "cascade" }),
    legalBusinessName: text("legal_business_name"),
    phone: text("phone"),
    email: text("email"),
    websiteUrl: text("website_url"),
    streetAddress: text("street_address"),
    city: text("city"),
    state: text("state"),
    postalCode: text("postal_code"),
    country: text("country").default("US"),
    logoUrl: text("logo_url"),
    logoUrlDark: text("logo_url_dark"),
    heroImageUrl: text("hero_image_url"),
    tagline: text("tagline"),
    aboutHtml: text("about_html"),
    primaryColor: text("primary_color").default("#0F766E"),
    defaultEmailSignature: text("default_email_signature"),
    invoiceFooterNotes: text("invoice_footer_notes"),
    fromEmail: text("from_email"),
    fromName: text("from_name"),
    replyToEmail: text("reply_to_email"),
    customFooterText: text("custom_footer_text"),
    featureFlags: jsonb("feature_flags").notNull().default({}),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const brandFeatures = pgTable(
  "brand_features",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    featureKey: text("feature_key").notNull(),
    enabled: boolean("enabled").notNull().default(false),
    enabledAt: timestamp("enabled_at", { withTimezone: true }),
    disabledAt: timestamp("disabled_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandFeatureIdx: uniqueIndex("brand_features_brand_key_idx").on(
      t.brandId,
      t.featureKey,
    ),
  }),
 );
 export type BrandSettings = typeof brandSettings.$inferSelect;
 export type BrandFeature = typeof brandFeatures.$inferSelect;
@@ -0,0 +1,129 @@
 /**
 * Brands (Tenants). Source of truth: `db/migrations/0001_init.sql`.
 * Multi-brand isolation: every business table has `brand_id` FK → brands.id.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  boolean,
  timestamp,
  index,
  uniqueIndex,
  primaryKey,
 } from "drizzle-orm/pg-core";
 export const brands = pgTable(
  "brands",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    name: text("name").notNull(),
    slug: text("slug").notNull().unique(),
    planTier: text("plan_tier", {
      enum: ["starter", "farm", "enterprise"],
    }).notNull().default("starter"),
    maxUsers: integer("max_users").notNull().default(2),
    maxProducts: integer("max_products").notNull().default(25),
    maxStopsMonthly: integer("max_stops_monthly").notNull().default(10),
    stripeCustomerId: text("stripe_customer_id"),
    stripeSubscriptionId: text("stripe_subscription_id"),
    stripeSubscriptionStatus: text("stripe_subscription_status", {
      enum: [
        "trialing", "active", "past_due", "canceled",
        "incomplete", "incomplete_expired",
      ],
    }),
    stripeCurrentPeriodEnd: timestamp("stripe_current_period_end", {
      withTimezone: true,
    }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    slugIdx: uniqueIndex("brands_slug_idx").on(t.slug),
  }),
 );
 // ── Admin Users ──────────────────────────────────────────────────────────────
 export const adminUsers = pgTable(
  "admin_users",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    // FK to neon_auth.user(id) is enforced at DB level by the migration SQL.
    // Drizzle can't reference tables in other schemas, so no .references() here.
    userId: uuid("user_id"),
    email: text("email").notNull().unique(),
    name: text("name"),
    role: text("role", {
      enum: ["platform_admin", "brand_admin", "store_employee"],
    }).notNull().default("brand_admin"),
    canManageOrders: boolean("can_manage_orders").notNull().default(true),
    canManageProducts: boolean("can_manage_products").notNull().default(true),
    canManageStops: boolean("can_manage_stops").notNull().default(true),
    canManageCustomers: boolean("can_manage_customers").notNull().default(true),
    canManageWholesale: boolean("can_manage_wholesale").notNull().default(false),
    canManageBilling: boolean("can_manage_billing").notNull().default(false),
    canManageSettings: boolean("can_manage_settings").notNull().default(false),
    canManageWaterLog: boolean("can_manage_water_log").notNull().default(false),
    canManageTimeTracking: boolean("can_manage_time_tracking").notNull().default(false),
    canManageRouteTrace: boolean("can_manage_route_trace").notNull().default(false),
    canManageReports: boolean("can_manage_reports").notNull().default(true),
    canManageCommunications: boolean("can_manage_communications").notNull().default(false),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    userIdIdx: uniqueIndex("admin_users_user_id_idx").on(t.userId),
    emailIdx: uniqueIndex("admin_users_email_idx").on(t.email),
  }),
 );
 export const adminUserBrands = pgTable(
  "admin_user_brands",
  {
    adminUserId: uuid("admin_user_id")
      .notNull()
      .references(() => adminUsers.id, { onDelete: "cascade" }),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    addedAt: timestamp("added_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    addedBy: uuid("added_by").references(() => adminUsers.id),
  },
  (t) => ({
    pk: primaryKey({ columns: [t.adminUserId, t.brandId] }),
  }),
 );
 // ── Neon Auth stub (for Drizzle typing only — table is managed by Neon Auth) ──
 // The actual table is neon_auth.user (singular). We can't FK-reference a table
 // in another schema via Drizzle, so we store userId as a plain UUID and rely on
 // the DB-level FK constraint (enforced by the migration SQL).
 export const authUsers = pgTable("user", {
  id: uuid("id").primaryKey(),
  name: text("name"),
  email: text("email"),
  emailVerified: boolean("email_verified"),
  image: text("image"),
  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow(),
 });
 export type Brand = typeof brands.$inferSelect;
 export type NewBrand = typeof brands.$inferInsert;
 export type AdminUser = typeof adminUsers.$inferSelect;
 export type NewAdminUser = typeof adminUsers.$inferInsert;
 export type AdminUserBrand = typeof adminUserBrands.$inferSelect;
 export type NewAdminUserBrand = typeof adminUserBrands.$inferInsert;
@@ -0,0 +1,315 @@
 /**
 * Communications (Harvest Reach).
 * Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  boolean,
  timestamp,
  jsonb,
  index,
  uniqueIndex,
 } from "drizzle-orm/pg-core";
 import { brands, adminUsers } from "./brands";
 export const communicationSettings = pgTable(
  "communication_settings",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .unique()
      .references(() => brands.id, { onDelete: "cascade" }),
    defaultSenderEmail: text("default_sender_email"),
    defaultSenderName: text("default_sender_name"),
    replyToEmail: text("reply_to_email"),
    emailProvider: text("email_provider").notNull().default("resend"),
    emailFooterHtml: text("email_footer_html"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const communicationTemplates = pgTable(
  "communication_templates",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    subject: text("subject").notNull(),
    bodyText: text("body_text").notNull().default(""),
    bodyHtml: text("body_html"),
    templateType: text("template_type").notNull(),
    campaignType: text("campaign_type"),
    createdBy: uuid("created_by"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("communication_templates_brand_idx").on(t.brandId),
  }),
 );
 export const communicationSegments = pgTable(
  "communication_segments",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    description: text("description"),
    rules: jsonb("rules").notNull().default({}),
    createdBy: uuid("created_by"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("communication_segments_brand_idx").on(t.brandId),
  }),
 );
 export const communicationCampaigns = pgTable(
  "communication_campaigns",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    subject: text("subject"),
    bodyText: text("body_text"),
    bodyHtml: text("body_html"),
    templateId: uuid("template_id").references(
      () => communicationTemplates.id,
      { onDelete: "set null" },
    ),
    campaignType: text("campaign_type").notNull(),
    status: text("status", {
      enum: ["draft", "scheduled", "sending", "sent", "canceled"],
    }).notNull().default("draft"),
    audienceRules: jsonb("audience_rules").notNull().default({}),
    brandName: text("brand_name"),
    scheduledAt: timestamp("scheduled_at", { withTimezone: true }),
    sentAt: timestamp("sent_at", { withTimezone: true }),
    recipientCount: integer("recipient_count").notNull().default(0),
    createdBy: uuid("created_by"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("communication_campaigns_brand_idx").on(t.brandId),
    statusIdx: index("communication_campaigns_status_idx").on(
      t.brandId,
      t.status,
    ),
  }),
 );
 export const communicationContacts = pgTable(
  "communication_contacts",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    email: text("email"),
    phone: text("phone"),
    firstName: text("first_name"),
    lastName: text("last_name"),
    fullName: text("full_name"),
    source: text("source").notNull(),
    externalId: text("external_id"),
    customerId: uuid("customer_id"),
    emailOptIn: boolean("email_opt_in").notNull().default(true),
    smsOptIn: boolean("sms_opt_in").notNull().default(false),
    emailOptInAt: timestamp("email_opt_in_at", { withTimezone: true }),
    smsOptInAt: timestamp("sms_opt_in_at", { withTimezone: true }),
    unsubscribedAt: timestamp("unsubscribed_at", { withTimezone: true }),
    tags: text("tags").array().default([]),
    metadata: jsonb("metadata").default({}),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("communication_contacts_brand_idx").on(t.brandId),
    emailIdx: index("communication_contacts_email_idx").on(
      t.brandId,
      t.email,
    ),
  }),
 );
 export const communicationMessageLogs = pgTable(
  "communication_message_logs",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    campaignId: uuid("campaign_id").references(
      () => communicationCampaigns.id,
      { onDelete: "set null" },
    ),
    contactId: uuid("contact_id").references(
      () => communicationContacts.id,
      { onDelete: "set null" },
    ),
    customerEmail: text("customer_email"),
    deliveryMethod: text("delivery_method").notNull(),
    subject: text("subject"),
    bodyPreview: text("body_preview"),
    status: text("status").notNull(),
    sentAt: timestamp("sent_at", { withTimezone: true }),
    errorMessage: text("error_message"),
    eventType: text("event_type"),
    eventId: uuid("event_id"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("communication_message_logs_brand_idx").on(t.brandId),
    campaignIdx: index(
      "communication_message_logs_campaign_idx",
    ).on(t.campaignId),
  }),
 );
 export const customerCommunicationPreferences = pgTable(
  "customer_communication_preferences",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    customerId: uuid("customer_id").notNull(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    emailOptIn: boolean("email_opt_in").notNull().default(true),
    smsOptIn: boolean("sms_opt_in").notNull().default(false),
    emailOptInAt: timestamp("email_opt_in_at", { withTimezone: true }),
    smsOptInAt: timestamp("sms_opt_in_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    customerBrandIdx: uniqueIndex(
      "customer_communication_prefs_customer_brand_idx",
    ).on(t.customerId, t.brandId),
  }),
 );
 // Email automation sequences
 export const abandonedCartRecovery = pgTable(
  "abandoned_cart_recovery",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    customerId: uuid("customer_id"),
    contactEmail: text("contact_email").notNull(),
    contactName: text("contact_name"),
    cartSnapshot: jsonb("cart_snapshot").notNull(),
    brandName: text("brand_name"),
    locale: text("locale").default("en"),
    sequenceStep: integer("sequence_step").default(0),
    lastEmailSentAt: timestamp("last_email_sent_at", {
      withTimezone: true,
    }),
    nextEmailAt: timestamp("next_email_at", { withTimezone: true }),
    status: text("status", {
      enum: ["active", "recovered", "expired", "manually_closed"],
    }).default("active"),
    recoveredOrderId: uuid("recovered_order_id"),
    recoveredAt: timestamp("recovered_at", { withTimezone: true }),
    expiredAt: timestamp("expired_at", { withTimezone: true }),
    manuallyClosedAt: timestamp("manually_closed_at", {
      withTimezone: true,
    }),
    manuallyClosedBy: uuid("manually_closed_by").references(
      () => adminUsers.id,
    ),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const welcomeEmailSequence = pgTable(
  "welcome_email_sequence",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    contactId: uuid("contact_id").references(
      () => communicationContacts.id,
      { onDelete: "cascade" },
    ),
    contactEmail: text("contact_email").notNull(),
    contactName: text("contact_name"),
    brandName: text("brand_name"),
    locale: text("locale").default("en"),
    sequenceStep: integer("sequence_step").default(0),
    lastEmailSentAt: timestamp("last_email_sent_at", {
      withTimezone: true,
    }),
    nextEmailAt: timestamp("next_email_at", { withTimezone: true }),
    status: text("status", {
      enum: ["active", "completed", "unsubscribed", "bounced"],
    }).default("active"),
    completedAt: timestamp("completed_at", { withTimezone: true }),
    unsubscribedAt: timestamp("unsubscribed_at", { withTimezone: true }),
    bouncedAt: timestamp("bounced_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export type CommunicationSettings =
  typeof communicationSettings.$inferSelect;
 export type CommunicationTemplate = typeof communicationTemplates.$inferSelect;
 export type CommunicationSegment = typeof communicationSegments.$inferSelect;
 export type CommunicationCampaign = typeof communicationCampaigns.$inferSelect;
 export type CommunicationContact = typeof communicationContacts.$inferSelect;
 export type CommunicationMessageLog = typeof communicationMessageLogs.$inferSelect;
 export type CustomerCommunicationPreference =
  typeof customerCommunicationPreferences.$inferSelect;
 export type AbandonedCartRecovery = typeof abandonedCartRecovery.$inferSelect;
 export type WelcomeEmailSequence = typeof welcomeEmailSequence.$inferSelect;
@@ -0,0 +1,52 @@
 /**
 * Customers. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  boolean,
  timestamp,
  varchar,
  bigint,
  jsonb,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const customers = pgTable(
  "customers",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    email: text("email"),
    phone: text("phone"),
    firstName: text("first_name"),
    lastName: text("last_name"),
    fullName: text("full_name"),
    source: text("source").notNull().default("system"),
    externalId: text("external_id"),
    customerId: uuid("customer_id"),
    emailOptIn: boolean("email_opt_in").notNull().default(true),
    smsOptIn: boolean("sms_opt_in").notNull().default(false),
    emailOptInAt: timestamp("email_opt_in_at", { withTimezone: true }),
    smsOptInAt: timestamp("sms_opt_in_at", { withTimezone: true }),
    unsubscribedAt: timestamp("unsubscribed_at", { withTimezone: true }),
    tags: text("tags").array().notNull().default([]),
    metadata: jsonb("metadata").notNull().default({}),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("customers_brand_idx").on(t.brandId),
  }),
 );
 export type Customer = typeof customers.$inferSelect;
 export type NewCustomer = typeof customers.$inferInsert;
@@ -0,0 +1,75 @@
 /**
 * Shared enums for the SaaS schema. Mirrored in SQL as TEXT + CHECK.
 *
 * Usage:
 *   import { tenantStatusEnum, type TenantStatus } from "@/db/schema/enums";
 *   import { pgEnum } from "drizzle-orm/pg-core";
 *
 *   export const tenantStatus = pgEnum("tenant_status", tenantStatusEnum);
 */
 export const tenantStatusEnum = [
  "trial",
  "active",
  "past_due",
  "suspended",
  "churned",
 ] as const;
 export type TenantStatus = (typeof tenantStatusEnum)[number];
 export const authProviderEnum = ["dev", "google", "email"] as const;
 export type AuthProvider = (typeof authProviderEnum)[number];
 export const roleEnum = ["platform_admin", "brand_admin", "store_employee"] as const;
 export type Role = (typeof roleEnum)[number];
 export const planCodeEnum = ["starter", "farm", "enterprise"] as const;
 export type PlanCode = (typeof planCodeEnum)[number];
 export const addOnCodeEnum = [
  "wholesale_portal",
  "harvest_reach",
  "ai_tools",
  "water_log",
  "square_sync",
  "sms_campaigns",
 ] as const;
 export type AddOnCode = (typeof addOnCodeEnum)[number];
 export const subscriptionStatusEnum = [
  "trialing",
  "active",
  "past_due",
  "canceled",
  "incomplete",
 ] as const;
 export type SubscriptionStatus = (typeof subscriptionStatusEnum)[number];
 export const addOnStatusEnum = ["active", "canceled"] as const;
 export type AddOnStatus = (typeof addOnStatusEnum)[number];
 export const stopStatusEnum = ["active", "paused", "closed"] as const;
 export type StopStatus = (typeof stopStatusEnum)[number];
 export const orderStatusEnum = [
  "pending",
  "confirmed",
  "fulfilled",
  "canceled",
 ] as const;
 export type OrderStatus = (typeof orderStatusEnum)[number];
 export const fulfillmentEnum = ["pickup", "ship", "mixed"] as const;
 export type Fulfillment = (typeof fulfillmentEnum)[number];
 export const itemFulfillmentEnum = ["pickup", "ship"] as const;
 export type ItemFulfillment = (typeof itemFulfillmentEnum)[number];
 export const campaignStatusEnum = [
  "draft",
  "scheduled",
  "sending",
  "sent",
  "canceled",
 ] as const;
 export type CampaignStatus = (typeof campaignStatusEnum)[number];
@@ -0,0 +1,36 @@
 /**
 * Files. Source of truth: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const files = pgTable(
  "files",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    storageKey: text("storage_key").notNull().unique(),
    mimeType: text("mime_type").notNull(),
    sizeBytes: integer("size_bytes").notNull(),
    purpose: text("purpose"),
    uploadedBy: uuid("uploaded_by"), // FK to neon_auth.user(id) — plain UUID, enforced at DB level
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("files_brand_idx").on(t.brandId),
  }),
 );
 export type File = typeof files.$inferSelect;
 export type NewFile = typeof files.$inferInsert;
@@ -0,0 +1,19 @@
 /**
 * Schema barrel. Re-exports every Drizzle table + inferred row type.
 * Source of truth: `db/migrations/0001_init.sql`.
 */
 export * from "./brands";
 export * from "./billing";
 export * from "./products";
 export * from "./stops";
 export * from "./customers";
 export * from "./orders";
 export * from "./brand";
 export * from "./wholesale";
 export * from "./water-log";
 export * from "./communications";
 export * from "./marketing";
 export * from "./time-tracking";
 export * from "./shipping";
 export * from "./support";
 export * from "./files";
@@ -0,0 +1,71 @@
 /**
 * Marketing: email templates + campaigns.
 * Source of truth: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { campaignStatusEnum } from "./enums";
 import { brands } from "./brands";
 export const emailTemplates = pgTable(
  "email_templates",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    subject: text("subject").notNull(),
    bodyHtml: text("body_html").notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("email_templates_brand_idx").on(t.brandId),
  }),
 );
 export const campaigns = pgTable(
  "campaigns",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    templateId: uuid("template_id").references((): any => emailTemplates.id, {
      onDelete: "set null",
    }),
    name: text("name").notNull(),
    status: text("status", { enum: campaignStatusEnum })
      .notNull()
      .default("draft"),
    scheduledFor: timestamp("scheduled_for", { withTimezone: true }),
    sentAt: timestamp("sent_at", { withTimezone: true }),
    recipientCount: integer("recipient_count").notNull().default(0),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("campaigns_brand_idx").on(t.brandId),
    statusIdx: index("campaigns_status_idx").on(t.brandId, t.status),
  }),
 );
 export type EmailTemplate = typeof emailTemplates.$inferSelect;
 export type NewEmailTemplate = typeof emailTemplates.$inferInsert;
 export type Campaign = typeof campaigns.$inferSelect;
 export type NewCampaign = typeof campaigns.$inferInsert;
@@ -0,0 +1,85 @@
 /**
 * Orders + order_items. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 import { customers } from "./customers";
 import { stops } from "./stops";
 import { products } from "./products";
 export const orders = pgTable(
  "orders",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    customerId: uuid("customer_id").references(() => customers.id, {
      onDelete: "set null",
    }),
    stopId: uuid("stop_id").references(() => stops.id, {
      onDelete: "set null",
    }),
    totalCents: integer("total_cents").notNull().default(0),
    status: text("status", {
      enum: ["pending", "confirmed", "fulfilled", "canceled"],
    }).notNull().default("pending"),
    fulfillment: text("fulfillment", {
      enum: ["pickup", "ship", "mixed"],
    }).notNull(),
    customerAddress: text("customer_address"),
    customerCity: text("customer_city"),
    customerState: text("customer_state"),
    customerZip: text("customer_zip"),
    idempotencyKey: text("idempotency_key"),
    notes: text("notes"),
    placedAt: timestamp("placed_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("orders_brand_idx").on(t.brandId),
    statusIdx: index("orders_status_idx").on(t.brandId, t.status),
    stopIdx: index("orders_stop_idx").on(t.stopId),
    customerIdx: index("orders_customer_idx").on(t.customerId),
  }),
 );
 export const orderItems = pgTable(
  "order_items",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    orderId: uuid("order_id")
      .notNull()
      .references(() => orders.id, { onDelete: "cascade" }),
    productId: uuid("product_id").references(() => products.id, {
      onDelete: "set null",
    }),
    quantity: integer("quantity").notNull(),
    priceCents: integer("price_cents").notNull(),
    fulfillment: text("fulfillment", {
      enum: ["pickup", "ship"],
    }).notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    orderIdx: index("order_items_order_idx").on(t.orderId),
  }),
 );
 export type Order = typeof orders.$inferSelect;
 export type NewOrder = typeof orders.$inferInsert;
 export type OrderItem = typeof orderItems.$inferSelect;
 export type NewOrderItem = typeof orderItems.$inferInsert;
@@ -0,0 +1,75 @@
 /**
 * Products. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  integer,
  boolean,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const products = pgTable(
  "products",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    description: text("description"),
    sku: text("sku"),
    type: text("type", { enum: ["standard", "wholesale", "both"] })
      .notNull()
      .default("standard"),
    priceCents: integer("price_cents").notNull(),
    inventory: integer("inventory").notNull().default(0),
    unit: text("unit"),
    active: boolean("active").notNull().default(true),
    isTaxable: boolean("is_taxable").notNull().default(false),
    pickupType: text("pickup_type", { enum: ["pickup", "ship", "all"] })
      .notNull()
      .default("all"),
    imageUrl: text("image_url"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("products_brand_idx").on(t.brandId),
    activeIdx: index("products_active_idx").on(t.brandId, t.active),
  }),
 );
 export type Product = typeof products.$inferSelect;
 export type NewProduct = typeof products.$inferInsert;
 // ── Product Images ─────────────────────────────────────────────────────────────
 export const productImages = pgTable(
  "product_images",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    productId: uuid("product_id")
      .notNull()
      .references(() => products.id, { onDelete: "cascade" }),
    storageKey: text("storage_key").notNull(),
    position: integer("position").notNull().default(0),
    altText: text("alt_text"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    productIdx: index("product_images_product_idx").on(t.productId),
  }),
 );
 export type ProductImage = typeof productImages.$inferSelect;
 export type NewProductImage = typeof productImages.$inferInsert;
@@ -0,0 +1,106 @@
 /**
 * Shipping + Payments. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  numeric,
  boolean,
  date,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 import { orders } from "./orders";
 export const shippingSettings = pgTable(
  "shipping_settings",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .unique()
      .references(() => brands.id, { onDelete: "cascade" }),
    carrier: text("carrier").notNull().default("fedex"),
    fedexAccountNumber: text("fedex_account_number"),
    fedexApiKey: text("fedex_api_key"),
    fedexApiSecret: text("fedex_api_secret"),
    fedexUseProduction: boolean("fedex_use_production")
      .notNull()
      .default(false),
    defaultServiceType: text("default_service_type")
      .notNull()
      .default("FEDEX_GROUND"),
    refrigeratedHandlingNotes: text("refrigerated_handling_notes"),
    fragileHandlingNotes: text("fragile_handling_notes"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const shipments = pgTable(
  "shipments",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    orderId: uuid("order_id")
      .notNull()
      .references(() => orders.id, { onDelete: "cascade" }),
    carrier: text("carrier").notNull().default("fedex"),
    serviceType: text("service_type").notNull(),
    trackingNumber: text("tracking_number"),
    labelUrl: text("label_url"),
    rateCharged: numeric("rate_charged", { precision: 10, scale: 2 }),
    estimatedDeliveryDate: date("estimated_delivery_date"),
    isRefrigerated: boolean("is_refrigerated").notNull().default(false),
    isFragile: boolean("is_fragile").notNull().default(false),
    handlingNotes: text("handling_notes"),
    status: text("status", {
      enum: [
        "created", "label_printed", "picked_up",
        "in_transit", "delivered", "exception",
      ],
    }).notNull().default("created"),
    fedexShipmentId: text("fedex_shipment_id"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    createdBy: uuid("created_by"),
  },
  (t) => ({
    orderIdx: index("shipments_order_idx").on(t.orderId),
  }),
 );
 export const paymentSettings = pgTable(
  "payment_settings",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .unique()
      .references(() => brands.id, { onDelete: "cascade" }),
    provider: text("provider"),
    stripePublishableKey: text("stripe_publishable_key"),
    stripeSecretKey: text("stripe_secret_key"),
    squareAccessToken: text("square_access_token"),
    squareLocationId: text("square_location_id"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export type ShippingSettings = typeof shippingSettings.$inferSelect;
 export type Shipment = typeof shipments.$inferSelect;
 export type PaymentSettings = typeof paymentSettings.$inferSelect;
@@ -0,0 +1,85 @@
 /**
 * Stops + Locations. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  date,
  boolean,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const stops = pgTable(
  "stops",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    location: text("location").notNull(),
    address: text("address"),
    city: text("city"),
    state: text("state"),
    zip: text("zip"),
    date: date("date").notNull(),
    // "time" is a reserved word — quoted in SQL, unquoted in JS
    time: text("time"),
    cutoffDate: date("cutoff_date"),
    status: text("status", { enum: ["active", "paused", "closed"] })
      .notNull()
      .default("active"),
    isPublic: boolean("is_public").notNull().default(true),
    notes: text("notes"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("stops_brand_idx").on(t.brandId),
    statusIdx: index("stops_status_idx").on(t.brandId, t.status),
    dateIdx: index("stops_date_idx").on(t.brandId, t.date),
  }),
 );
 export const locations = pgTable(
  "locations",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    address: text("address"),
    city: text("city"),
    state: text("state"),
    zip: text("zip"),
    phone: text("phone"),
    contactName: text("contact_name"),
    contactEmail: text("contact_email"),
    notes: text("notes"),
    active: boolean("active").notNull().default(true),
    deletedAt: timestamp("deleted_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("locations_brand_idx").on(t.brandId),
  }),
 );
 export type Stop = typeof stops.$inferSelect;
 export type NewStop = typeof stops.$inferInsert;
 export type Location = typeof locations.$inferSelect;
 export type NewLocation = typeof locations.$inferInsert;
@@ -0,0 +1,297 @@
 /**
 * Support tables: referrals, changelogs, onboarding, api_keys,
 * notifications, operational events, audit logs.
 * Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  varchar,
  boolean,
  timestamp,
  jsonb,
  integer,
  numeric,
  time,
  index,
  uniqueIndex,
 } from "drizzle-orm/pg-core";
 import { brands, adminUsers } from "./brands";
 // ── Referrals ──────────────────────────────────────────────────────────────
 export const referralCodes = pgTable(
  "referral_codes",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    referrerUserId: uuid("referrer_user_id").notNull(),
    referralCode: varchar("referral_code", { length: 50 }).notNull().unique(),
    referrerEmail: varchar("referrer_email", { length: 255 }).notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    expiresAt: timestamp("expires_at", { withTimezone: true }),
    maxUses: integer("max_uses").default(1),
    currentUses: integer("current_uses").default(0),
    isActive: boolean("is_active").default(true),
    rewardType: varchar("reward_type", { length: 50 }).default("percentage"),
    rewardValue: numeric("reward_value", { precision: 10, scale: 2 }).default("20.00"),
    metadata: jsonb("metadata").default({}),
  },
 );
 export const referralRedemptions = pgTable(
  "referral_redemptions",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    referralCodeId: uuid("referral_code_id").references(
      () => referralCodes.id,
      { onDelete: "cascade" },
    ),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    referredUserId: uuid("referred_user_id").notNull(),
    referredEmail: varchar("referred_email", { length: 255 }).notNull(),
    redeemedAt: timestamp("redeemed_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    rewardType: varchar("reward_type", { length: 50 }),
    rewardValue: numeric("reward_value", { precision: 10, scale: 2 }),
    isCreditApplied: boolean("is_credit_applied").default(false),
    signupPlan: varchar("signup_plan", { length: 50 }),
    signupValue: numeric("signup_value", { precision: 10, scale: 2 }),
    metadata: jsonb("metadata").default({}),
  },
 );
 // ── Changelogs ─────────────────────────────────────────────────────────────
 export const changelogs = pgTable(
  "changelogs",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    version: varchar("version", { length: 50 }).notNull(),
    title: varchar("title", { length: 255 }).notNull(),
    description: text("description"),
    content: jsonb("content").notNull().default([]),
    releasedAt: timestamp("released_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    isPublished: boolean("is_published").default(false),
    featureType: varchar("feature_type", { length: 50 }).default("general"),
    metadata: jsonb("metadata").default({}),
  },
  (t) => ({
    brandVersionIdx: uniqueIndex("changelogs_brand_version_idx").on(
      t.brandId,
      t.version,
    ),
  }),
 );
 export const changelogReads = pgTable(
  "changelog_reads",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    userId: uuid("user_id").notNull(),
    changelogId: uuid("changelog_id").references(() => changelogs.id, {
      onDelete: "cascade",
    }),
    readAt: timestamp("read_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    dismissed: boolean("dismissed").default(false),
  },
  (t) => ({
    userChangelogIdx: uniqueIndex("changelog_reads_user_changelog_idx").on(
      t.userId,
      t.changelogId,
    ),
  }),
 );
 // ── Onboarding ─────────────────────────────────────────────────────────────
 export const onboardingProgress = pgTable(
  "onboarding_progress",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    userId: uuid("user_id").notNull(),
    currentStep: varchar("current_step", { length: 50 }).notNull(),
    completedSteps: jsonb("completed_steps").default([]),
    skippedSteps: jsonb("skipped_steps").default([]),
    data: jsonb("data").default({}),
    startedAt: timestamp("started_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    completedAt: timestamp("completed_at", { withTimezone: true }),
    isCompleted: boolean("is_completed").default(false),
    metadata: jsonb("metadata").default({}),
  },
  (t) => ({
    brandUserIdx: uniqueIndex("onboarding_progress_brand_user_idx").on(
      t.brandId,
      t.userId,
    ),
  }),
 );
 // ── API Keys ────────────────────────────────────────────────────────────────
 export const apiKeys = pgTable(
  "api_keys",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    name: varchar("name", { length: 255 }).notNull(),
    keyHash: varchar("key_hash", { length: 255 }).notNull(),
    keyPrefix: varchar("key_prefix", { length: 20 }),
    permissions: jsonb("permissions").default(["read"]),
    rateLimit: integer("rate_limit").default(1000),
    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
    expiresAt: timestamp("expires_at", { withTimezone: true }),
    isActive: boolean("is_active").default(true),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    createdBy: uuid("created_by").notNull(),
  },
  (t) => ({
    brandIdx: index("api_keys_brand_idx").on(t.brandId),
  }),
 );
 // ── Notification Preferences ───────────────────────────────────────────────
 export const notificationPreferences = pgTable(
  "notification_preferences",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    userId: uuid("user_id").notNull(),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "cascade",
    }),
    emailOrders: boolean("email_orders").default(true),
    emailMarketing: boolean("email_marketing").default(false),
    emailReports: boolean("email_reports").default(true),
    emailBilling: boolean("email_billing").default(true),
    smsOrders: boolean("sms_orders").default(false),
    smsMarketing: boolean("sms_marketing").default(false),
    pushOrders: boolean("push_orders").default(true),
    pushMarketing: boolean("push_marketing").default(false),
    quietHoursStart: time("quiet_hours_start"),
    quietHoursEnd: time("quiet_hours_end"),
    timezone: varchar("timezone", { length: 50 }).default("America/New_York"),
    metadata: jsonb("metadata").default({}),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    userBrandIdx: uniqueIndex("notification_preferences_user_brand_idx").on(
      t.userId,
      t.brandId,
    ),
  }),
 );
 // ── Operational Events ─────────────────────────────────────────────────────
 export const operationalEvents = pgTable(
  "operational_events",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    eventType: text("event_type").notNull(),
    entityType: text("entity_type"),
    entityId: uuid("entity_id"),
    actorType: text("actor_type"),
    actorId: uuid("actor_id"),
    source: text("source").notNull().default("system"),
    payload: jsonb("payload").notNull().default({}),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("operational_events_brand_idx").on(t.brandId),
    typeIdx: index("operational_events_type_idx").on(t.brandId, t.eventType),
  }),
 );
 // ── Audit Logs ─────────────────────────────────────────────────────────────
 export const auditLogs = pgTable(
  "audit_logs",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    userId: uuid("user_id"),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "set null",
    }),
    action: text("action").notNull(),
    entityType: text("entity_type"),
    entityId: uuid("entity_id"),
    details: jsonb("details"),
    ipAddress: text("ip_address"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("audit_logs_brand_idx").on(t.brandId),
    userIdx: index("audit_logs_user_idx").on(t.userId),
    createdIdx: index("audit_logs_created_idx").on(t.createdAt),
  }),
 );
 export const adminActionLogs = pgTable(
  "admin_action_logs",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    adminUserId: uuid("admin_user_id")
      .notNull()
      .references(() => adminUsers.id),
    brandId: uuid("brand_id").references(() => brands.id, {
      onDelete: "set null",
    }),
    action: text("action").notNull(),
    targetType: text("target_type"),
    targetId: uuid("target_id"),
    metadata: jsonb("metadata"),
    ipAddress: text("ip_address"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    adminIdx: index("admin_action_logs_admin_idx").on(t.adminUserId),
    createdIdx: index("admin_action_logs_created_idx").on(t.createdAt),
  }),
 );
 export type ReferralCode = typeof referralCodes.$inferSelect;
 export type ReferralRedemption = typeof referralRedemptions.$inferSelect;
 export type Changelog = typeof changelogs.$inferSelect;
 export type ChangelogRead = typeof changelogReads.$inferSelect;
 export type OnboardingProgress = typeof onboardingProgress.$inferSelect;
 export type ApiKey = typeof apiKeys.$inferSelect;
 export type NotificationPreference = typeof notificationPreferences.$inferSelect;
 export type OperationalEvent = typeof operationalEvents.$inferSelect;
 export type AuditLog = typeof auditLogs.$inferSelect;
 export type AdminActionLog = typeof adminActionLogs.$inferSelect;
@@ -0,0 +1,161 @@
 /**
 * Time Tracking. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  numeric,
  integer,
  boolean,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 export const timeTrackingSettings = pgTable(
  "time_tracking_settings",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .unique()
      .references(() => brands.id, { onDelete: "cascade" }),
    payPeriodStartDay: integer("pay_period_start_day").notNull().default(0),
    payPeriodLengthDays: integer("pay_period_length_days")
      .notNull()
      .default(7),
    dailyOvertimeThreshold: numeric("daily_overtime_threshold", {
      precision: 5,
      scale: 2,
    }).notNull().default("8.0"),
    weeklyOvertimeThreshold: numeric("weekly_overtime_threshold", {
      precision: 5,
      scale: 2,
    }).notNull().default("40.0"),
    overtimeMultiplier: numeric("overtime_multiplier", {
      precision: 3,
      scale: 2,
    }).notNull().default("1.50"),
    overtimeNotifications: boolean("overtime_notifications")
      .notNull()
      .default(true),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const timeTrackingWorkers = pgTable(
  "time_tracking_workers",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    role: text("role", { enum: ["worker", "time_admin"] })
      .notNull()
      .default("worker"),
    lang: text("lang").notNull().default("en"),
    pin: text("pin").notNull(),
    active: boolean("active").notNull().default(true),
    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("time_tracking_workers_brand_idx").on(t.brandId),
  }),
 );
 export const timeTrackingTasks = pgTable(
  "time_tracking_tasks",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    nameEs: text("name_es"),
    unit: text("unit", { enum: ["hours", "pieces", "units"] })
      .notNull()
      .default("hours"),
    sortOrder: integer("sort_order").notNull().default(0),
    active: boolean("active").notNull().default(true),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("time_tracking_tasks_brand_idx").on(t.brandId),
  }),
 );
 export const timeTrackingLogs = pgTable(
  "time_tracking_logs",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    workerId: uuid("worker_id")
      .notNull()
      .references(() => timeTrackingWorkers.id, { onDelete: "cascade" }),
    taskId: uuid("task_id").references(() => timeTrackingTasks.id, {
      onDelete: "set null",
    }),
    taskName: text("task_name").notNull(),
    clockIn: timestamp("clock_in", { withTimezone: true }).notNull(),
    clockOut: timestamp("clock_out", { withTimezone: true }),
    lunchBreakMinutes: integer("lunch_break_minutes").notNull().default(0),
    notes: text("notes"),
    submittedVia: text("submitted_via", {
      enum: ["manual", "field", "import"],
    }).notNull().default("manual"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("time_tracking_logs_brand_idx").on(t.brandId),
    workerIdx: index("time_tracking_logs_worker_idx").on(t.workerId),
    clockInIdx: index("time_tracking_logs_clock_in_idx").on(t.clockIn),
  }),
 );
 export const timeTrackingNotificationLog = pgTable(
  "time_tracking_notification_log",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    workerId: uuid("worker_id").references(
      () => timeTrackingWorkers.id,
      { onDelete: "set null" },
    ),
    notificationType: text("notification_type").notNull(),
    recipient: text("recipient").notNull(),
    subject: text("subject"),
    body: text("body").notNull(),
    status: text("status", {
      enum: ["pending", "sent", "failed"],
    }).notNull().default("pending"),
    sentAt: timestamp("sent_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export type TimeTrackingSettings = typeof timeTrackingSettings.$inferSelect;
 export type TimeTrackingWorker = typeof timeTrackingWorkers.$inferSelect;
 export type TimeTrackingTask = typeof timeTrackingTasks.$inferSelect;
 export type TimeTrackingLog = typeof timeTrackingLogs.$inferSelect;
 export type TimeTrackingNotificationLog =
  typeof timeTrackingNotificationLog.$inferSelect;
@@ -0,0 +1,115 @@
 /**
 * Water Log. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  numeric,
  boolean,
  timestamp,
  index,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 import { adminUsers } from "./brands";
 export const waterHeadgates = pgTable(
  "water_headgates",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    active: boolean("active").notNull().default(true),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const waterIrrigators = pgTable(
  "water_irrigators",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    name: text("name").notNull(),
    pinHash: text("pin_hash").notNull(),
    languagePreference: text("language_preference")
      .notNull()
      .default("en"),
    active: boolean("active").notNull().default(true),
    lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const waterSessions = pgTable(
  "water_sessions",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    irrigatorId: uuid("irrigator_id")
      .notNull()
      .references(() => waterIrrigators.id, { onDelete: "cascade" }),
    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const waterLogEntries = pgTable(
  "water_log_entries",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    headgateId: uuid("headgate_id")
      .notNull()
      .references(() => waterHeadgates.id, { onDelete: "cascade" }),
    irrigatorId: uuid("irrigator_id")
      .notNull()
      .references(() => waterIrrigators.id, { onDelete: "cascade" }),
    measurement: numeric("measurement").notNull(),
    unit: text("unit").notNull(),
    notes: text("notes"),
    submittedVia: text("submitted_via").notNull().default("app"),
    loggedAt: timestamp("logged_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    loggedBy: uuid("logged_by").references(() => adminUsers.id),
  },
  (t) => ({
    brandIdx: index("water_log_entries_brand_idx").on(t.brandId),
    headgateIdx: index("water_log_entries_headgate_idx").on(t.headgateId),
  }),
 );
 export const waterAlertLog = pgTable(
  "water_alert_log",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    alertType: text("alert_type").notNull(),
    headgateId: uuid("headgate_id").references(() => waterHeadgates.id),
    message: text("message").notNull(),
    sentTo: text("sent_to"),
    sentAt: timestamp("sent_at", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export type WaterHeadgate = typeof waterHeadgates.$inferSelect;
 export type WaterIrrigator = typeof waterIrrigators.$inferSelect;
 export type WaterSession = typeof waterSessions.$inferSelect;
 export type WaterLogEntry = typeof waterLogEntries.$inferSelect;
 export type WaterAlertLog = typeof waterAlertLog.$inferSelect;
@@ -0,0 +1,373 @@
 /**
 * Wholesale portal. Source: `db/migrations/0001_init.sql`.
 */
 import {
  pgTable,
  uuid,
  text,
  numeric,
  integer,
  boolean,
  timestamp,
  date,
  index,
  uniqueIndex,
  jsonb,
 } from "drizzle-orm/pg-core";
 import { brands } from "./brands";
 import { authUsers } from "./brands";
 export const wholesaleSettings = pgTable(
  "wholesale_settings",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .unique()
      .references(() => brands.id, { onDelete: "cascade" }),
    requireApproval: boolean("require_approval").notNull().default(true),
    minOrderAmount: numeric("min_order_amount", { precision: 10, scale: 2 }),
    onlinePaymentEnabled: boolean("online_payment_enabled")
      .notNull()
      .default(false),
    pickupLocation: text("pickup_location"),
    fobLocation: text("fob_location"),
    fromEmail: text("from_email"),
    invoiceBusinessName: text("invoice_business_name"),
    lastInvoiceNumber: integer("last_invoice_number").notNull().default(0),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const wholesaleCustomers = pgTable(
  "wholesale_customers",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    userId: uuid("user_id").references(() => authUsers.id, {
      onDelete: "set null",
    }),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    companyName: text("company_name"),
    contactName: text("contact_name"),
    email: text("email"),
    phone: text("phone"),
    billingAddress: text("billing_address"),
    shippingAddress: text("shipping_address"),
    accountStatus: text("account_status", {
      enum: ["active", "suspended", "inactive"],
    }).notNull().default("active"),
    creditLimit: numeric("credit_limit", { precision: 10, scale: 2 })
      .notNull()
      .default("0"),
    depositsEnabled: boolean("deposits_enabled").notNull().default(false),
    depositThreshold: numeric("deposit_threshold", { precision: 10, scale: 2 }),
    depositPercentage: integer("deposit_percentage"),
    orderEmail: text("order_email"),
    invoiceEmail: text("invoice_email"),
    adminNotes: text("admin_notes"),
    role: text("role", { enum: ["buyer", "admin"] })
      .notNull()
      .default("buyer"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("wholesale_customers_brand_idx").on(t.brandId),
  }),
 );
 export const wholesaleProducts = pgTable(
  "wholesale_products",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    rcProductId: uuid("rc_product_id"),
    name: text("name").notNull(),
    description: text("description"),
    unitType: text("unit_type").notNull().default("each"),
    availability: text("availability", {
      enum: ["available", "unavailable", "limited", "seasonal"],
    }).notNull().default("unavailable"),
    qtyAvailable: numeric("qty_available", { precision: 10, scale: 2 })
      .default("0"),
    priceTiers: jsonb("price_tiers").notNull().default([]),
    hpSku: text("hp_sku"),
    hpItemId: text("hp_item_id"),
    internalNotes: text("internal_notes"),
    handlingInstructions: text("handling_instructions"),
    transportTemp: text("transport_temp"),
    storageWarning: text("storage_warning"),
    loadingNotes: text("loading_notes"),
    productLabel: text("product_label"),
    packStyle: text("pack_style"),
    containerType: text("container_type"),
    containerSizeCode: text("container_size_code"),
    unitsPerContainer: integer("units_per_container"),
    containerNotes: text("container_notes"),
    defaultPickupLocation: text("default_pickup_location"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("wholesale_products_brand_idx").on(t.brandId),
  }),
 );
 export const wholesaleOrders = pgTable(
  "wholesale_orders",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    customerId: uuid("customer_id")
      .notNull()
      .references(() => wholesaleCustomers.id),
    wcOrderId: numeric("wc_order_id"),
    status: text("status", {
      enum: [
        "pending", "confirmed", "in_production", "ready",
        "fulfilled", "canceled",
      ],
    }).notNull().default("pending"),
    fulfillmentStatus: text("fulfillment_status", {
      enum: ["unfulfilled", "partial", "fulfilled"],
    }).notNull().default("unfulfilled"),
    paymentStatus: text("payment_status", {
      enum: ["unpaid", "deposit_paid", "paid", "refunded"],
    }).notNull().default("unpaid"),
    anticipatedPickupDate: date("anticipated_pickup_date"),
    subtotal: numeric("subtotal", { precision: 10, scale: 2 })
      .notNull()
      .default("0"),
    depositRequired: numeric("deposit_required", { precision: 10, scale: 2 })
      .default("0"),
    depositPaid: numeric("deposit_paid", { precision: 10, scale: 2 })
      .notNull()
      .default("0"),
    balanceDue: numeric("balance_due", { precision: 10, scale: 2 })
      .notNull()
      .default("0"),
    assignedEmployeeId: uuid("assigned_employee_id"),
    fulfillmentNotes: text("fulfillment_notes"),
    internalNotes: text("internal_notes"),
    invoiceNumber: text("invoice_number"),
    invoicePdfPath: text("invoice_pdf_path"),
    invoiceToken: text("invoice_token"),
    invoiceType: text("invoice_type"),
    depositPercentage: integer("deposit_percentage"),
    fulfilledAt: timestamp("fulfilled_at", { withTimezone: true }),
    fulfilledBy: uuid("fulfilled_by"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("wholesale_orders_brand_idx").on(t.brandId),
    customerIdx: index("wholesale_orders_customer_idx").on(t.customerId),
    statusIdx: index("wholesale_orders_status_idx").on(t.brandId, t.status),
  }),
 );
 export const wholesaleOrderItems = pgTable(
  "wholesale_order_items",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    wholesaleOrderId: uuid("wholesale_order_id")
      .notNull()
      .references(() => wholesaleOrders.id, { onDelete: "cascade" }),
    productId: uuid("product_id")
      .notNull()
      .references(() => wholesaleProducts.id),
    quantity: numeric("quantity", { precision: 10, scale: 2 }).notNull(),
    unitPrice: numeric("unit_price", { precision: 10, scale: 2 }).notNull(),
    lineTotal: numeric("line_total", { precision: 10, scale: 2 }).notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    orderIdx: index("wholesale_order_items_order_idx").on(
      t.wholesaleOrderId,
    ),
  }),
 );
 export const wholesaleDeposits = pgTable(
  "wholesale_deposits",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    wholesaleOrderId: uuid("wholesale_order_id")
      .notNull()
      .references(() => wholesaleOrders.id, { onDelete: "cascade" }),
    amount: numeric("amount", { precision: 10, scale: 2 }).notNull(),
    paymentMethod: text("payment_method"),
    reference: text("reference"),
    recordedBy: uuid("recorded_by").notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const wholesaleNotifications = pgTable(
  "wholesale_notifications",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    customerId: uuid("customer_id")
      .notNull()
      .references(() => wholesaleCustomers.id, { onDelete: "cascade" }),
    notificationType: text("notification_type", {
      enum: [
        "order_confirmed", "order_ready", "pickup_reminder",
        "payment_reminder", "invoice",
      ],
    }).notNull(),
    channel: text("channel", { enum: ["email", "sms"] }).notNull(),
    recipient: text("recipient").notNull(),
    subject: text("subject"),
    body: text("body").notNull(),
    status: text("status", {
      enum: ["pending", "sent", "failed"],
    }).notNull().default("pending"),
    sentAt: timestamp("sent_at", { withTimezone: true }),
    errorMessage: text("error_message"),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("wholesale_notifications_brand_idx").on(t.brandId),
  }),
 );
 export const wholesaleCustomerProductPricing = pgTable(
  "wholesale_customer_product_pricing",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    customerId: uuid("customer_id")
      .notNull()
      .references(() => wholesaleCustomers.id, { onDelete: "cascade" }),
    productId: uuid("product_id")
      .notNull()
      .references(() => wholesaleProducts.id, { onDelete: "cascade" }),
    customPriceCents: integer("custom_price_cents").notNull(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    customerProductIdx: uniqueIndex(
      "wholesale_customer_product_pricing_cust_prod_idx",
    ).on(t.customerId, t.productId),
  }),
 );
 export const wholesaleWebhookSettings = pgTable(
  "wholesale_webhook_settings",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .unique()
      .references(() => brands.id, { onDelete: "cascade" }),
    url: text("url").notNull(),
    secret: text("secret").notNull(),
    enabled: boolean("enabled").notNull().default(false),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
 );
 export const wholesaleSyncLog = pgTable(
  "wholesale_sync_log",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    eventType: text("event_type").notNull(),
    orderId: uuid("order_id"),
    payload: jsonb("payload"),
    status: text("status", {
      enum: ["pending", "sent", "failed"],
    }).notNull().default("pending"),
    response: text("response"),
    attempts: integer("attempts").notNull().default(0),
    nextRetry: timestamp("next_retry", { withTimezone: true }),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    brandIdx: index("wholesale_sync_log_brand_idx").on(t.brandId),
  }),
 );
 export const userCarts = pgTable(
  "user_carts",
  {
    id: uuid("id").primaryKey().defaultRandom(),
    brandId: uuid("brand_id")
      .notNull()
      .references(() => brands.id, { onDelete: "cascade" }),
    customerId: uuid("customer_id")
      .notNull()
      .references(() => wholesaleCustomers.id, { onDelete: "cascade" }),
    items: jsonb("items").notNull().default([]),
    updatedAt: timestamp("updated_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
    createdAt: timestamp("created_at", { withTimezone: true })
      .notNull()
      .defaultNow(),
  },
  (t) => ({
    customerIdx: uniqueIndex("user_carts_customer_idx").on(
      t.brandId,
      t.customerId,
    ),
  }),
 );
 export type WholesaleSettings = typeof wholesaleSettings.$inferSelect;
 export type WholesaleCustomer = typeof wholesaleCustomers.$inferSelect;
 export type WholesaleProduct = typeof wholesaleProducts.$inferSelect;
 export type WholesaleOrder = typeof wholesaleOrders.$inferSelect;
 export type WholesaleOrderItem = typeof wholesaleOrderItems.$inferSelect;
 export type WholesaleDeposit = typeof wholesaleDeposits.$inferSelect;
 export type WholesaleNotification = typeof wholesaleNotifications.$inferSelect;
 export type WholesaleWebhookSettings =
  typeof wholesaleWebhookSettings.$inferSelect;
 export type WholesaleSyncLog = typeof wholesaleSyncLog.$inferSelect;
 export type UserCart = typeof userCarts.$inferSelect;
@@ -0,0 +1,177 @@
 /**
 * Seed script. Idempotent — safe to re-run. Uses `ON CONFLICT (col) DO UPDATE`
 * (with a target) for tables that have a unique constraint; uses
 * `WHERE NOT EXISTS` for tables that don't.
 *
 *   npm run db:seed
 *
 * Populates:
 *   - 2 brands (Tuxedo, Indian River Direct)
 *   - brand_settings per brand
 *   - sample products, stops, customers per brand
 *   - sample communication templates + a draft campaign
 *
 * NOTE: Admin users are managed by Neon Auth. To create an admin user:
 *   1. Sign up / sign in via the app (creates a neon_auth.user row)
 *   2. Manually insert into admin_users + admin_user_brands:
 *      INSERT INTO admin_users (email, name, role) VALUES ('you@example.com', 'Your Name', 'brand_admin');
 *      INSERT INTO admin_user_brands (admin_user_id, brand_id, role) VALUES (<admin_user_id>, <brand_id>, 'brand_admin');
 */
 import "dotenv/config";
 import { Pool } from "pg";
 const pool = new Pool({
  connectionString:
    process.env.DATABASE_ADMIN_URL ??
    process.env.DATABASE_URL ??
    "postgres://postgres:postgres@localhost:5432/route_commerce",
 });
 async function main() {
  const client = await pool.connect();
  try {
    await client.query("BEGIN");
    // ── Brands ──────────────────────────────────────────────────────────────
    const brandsData = [
      {
        slug: "tuxedo",
        name: "Tuxedo Citrus",
        brandName: "Tuxedo Citrus Co.",
        tagline: "Sun-ripened citrus, delivered.",
        aboutHtml:
          "<p>Family-run citrus grove in the Indian River region. We grow, pack, and ship premium grapefruit, oranges, and specialty varieties to wholesale buyers across the country.</p>",
        primaryColor: "#F59E0B",
        contactEmail: "hello@tuxedocitrus.example",
        contactPhone: "(555) 010-2200",
      },
      {
        slug: "indian-river-direct",
        name: "Indian River Direct",
        brandName: "Indian River Direct",
        tagline: "From our groves to your store.",
        aboutHtml:
          "<p>Direct-from-grove wholesale produce. Family farms, fair pricing, fast delivery.</p>",
        primaryColor: "#0F766E",
        contactEmail: "orders@indianriverdirect.example",
        contactPhone: "(555) 010-3300",
      },
    ];
    for (const b of brandsData) {
      // Upsert brand
      const brandRes = await client.query<{ id: string }>(
        `INSERT INTO brands (name, slug, plan_tier)
         VALUES ($1, $2, 'starter')
         ON CONFLICT (slug) DO UPDATE SET name = EXCLUDED.name
         RETURNING id`,
        [b.name, b.slug],
      );
      const brandId = brandRes.rows[0].id;
      // Brand settings (PK is brand_id)
      await client.query(
        `INSERT INTO brand_settings
           (brand_id, brand_name, tagline, about_html, primary_color, contact_email, contact_phone)
         VALUES ($1, $2, $3, $4, $5, $6, $7)
         ON CONFLICT (brand_id) DO UPDATE SET
           brand_name = EXCLUDED.brand_name,
           tagline = EXCLUDED.tagline,
           about_html = EXCLUDED.about_html,
           primary_color = EXCLUDED.primary_color,
           contact_email = EXCLUDED.contact_email,
           contact_phone = EXCLUDED.contact_phone`,
        [brandId, b.brandName, b.tagline, b.aboutHtml, b.primaryColor, b.contactEmail, b.contactPhone],
      );
      // Sample products
      const products = [
        { name: "Ruby Red Grapefruit", price: 2400, unit: "40 lb case", desc: "Sweet, juicy, seedless." },
        { name: "Navel Oranges", price: 2200, unit: "40 lb case", desc: "Classic eating orange, easy-peel." },
        { name: "Honeybells", price: 3200, unit: "20 lb case", desc: "Limited season — bell-shaped, super sweet." },
        { name: "Tangelos", price: 2800, unit: "40 lb case", desc: "Tangerine-grapefruit hybrid." },
      ];
      for (const p of products) {
        await client.query(
          `INSERT INTO products (brand_id, name, description, price_cents, inventory, unit, active)
           SELECT $1, $2, $3, $4, 100, $5, true
           WHERE NOT EXISTS (
             SELECT 1 FROM products WHERE brand_id = $1 AND name = $2
           )`,
          [brandId, p.name, p.desc, p.price, p.unit],
        );
      }
      // Sample stops
      const stops = [
        { name: "Downtown Farmers Market", address: "100 Main St", schedule: [{ day: "Saturday", time: "08:00" }] },
        { name: "Eastside Pickup Hub", address: "555 Oak Ave", schedule: [{ day: "Wednesday", time: "16:00" }] },
      ];
      for (const s of stops) {
        await client.query(
          `INSERT INTO stops (brand_id, name, address, schedule, status)
           SELECT $1, $2, $3, $4::jsonb, 'active'
           WHERE NOT EXISTS (
             SELECT 1 FROM stops WHERE brand_id = $1 AND name = $2
           )`,
          [brandId, s.name, s.address, JSON.stringify(s.schedule)],
        );
      }
      // Sample customers
      const customers = [
        { name: "Green Grocer Co.", email: "buyer@greengrocer.example", phone: "555-010-0010" },
        { name: "Sunset Cafe", email: "orders@sunsetcafe.example", phone: "555-010-0020" },
        { name: "Northside Co-op", email: "produce@northsidecoop.example", phone: "555-010-0030" },
      ];
      for (const c of customers) {
        await client.query(
          `INSERT INTO customers (brand_id, name, email, phone, sms_opt_in, email_opt_in)
           SELECT $1, $2, $3, $4, true, true
           WHERE NOT EXISTS (
             SELECT 1 FROM customers WHERE brand_id = $1 AND email = $3
           )`,
          [brandId, c.name, c.email, c.phone],
        );
      }
      // Sample communication template
      const tmplRes = await client.query<{ id: string }>(
        `INSERT INTO communication_templates (brand_id, name, subject, body_html)
         SELECT $1, 'Weekly Availability', 'This week at the grove', '<h1>Fresh this week</h1><p>Hi {{name}}, our harvest is in. Reply to reserve.</p>'
         WHERE NOT EXISTS (
           SELECT 1 FROM communication_templates WHERE brand_id = $1 AND name = 'Weekly Availability'
         )
         RETURNING id`,
        [brandId],
      );
      if (tmplRes.rows[0]) {
        await client.query(
          `INSERT INTO communication_campaigns (brand_id, template_id, name, status)
           SELECT $1, $2, 'Welcome series — week 1', 'draft'
           WHERE NOT EXISTS (
             SELECT 1 FROM communication_campaigns WHERE brand_id = $1 AND name = 'Welcome series — week 1'
           )`,
          [brandId, tmplRes.rows[0].id],
        );
      }
    }
    console.log(`Seeded ${brandsData.length} brands with sample data`);
    await client.query("COMMIT");
    console.log("✅ Seed complete");
  } catch (err) {
    await client.query("ROLLBACK");
    throw err;
  } finally {
    client.release();
  }
 }
 main()
  .then(() => pool.end())
  .catch((err) => {
    console.error("❌ Seed failed:", err);
    pool.end();
    process.exit(1);
  });
@@ -1,53 +0,0 @@
 import { chromium } from 'playwright';
 async function debugAuth() {
  console.log('Launching browser...');
  const browser = await chromium.launch({ headless: true });
  const context = await browser.newContext();
  const page = await context.newPage();
  // First, login
  console.log('Navigating to login page...');
  await page.goto('https://route-commerce-platform.vercel.app/login');
  console.log('Filling login form...');
  await page.fill('#email', 'kylemart@gmail.com');
  await page.fill('#password', 'Test123456!');
  console.log('Clicking sign in...');
  const response = await page.click('button[type="submit"]');
  // Wait for network to settle
  await page.waitForLoadState('networkidle').catch(() => {});
  console.log('Current URL after wait:', page.url());
  // Get any error messages
  const errorText = await page.$eval('[role="alert"]', el => el.textContent).catch(() => null);
  if (errorText) console.log('Error message:', errorText);
  const pageContent = await page.content();
  if (pageContent.includes('Access Denied')) {
    console.log('*** ACCESS DENIED PAGE DETECTED ***');
  }
  // Check cookies
  const cookies = await context.cookies();
  console.log('Cookies:', cookies.map(c => `${c.name}=${c.value.slice(0, 30)}...`));
  // Try to visit debug-auth page
  console.log('Navigating to /admin/debug-auth...');
  try {
    const response = await page.goto('https://route-commerce-platform.vercel.app/admin/debug-auth', { timeout: 10000 });
    console.log('Response status:', response?.status());
    console.log('Response URL:', page.url());
    const content = await page.content();
    console.log('Page content (first 2000 chars):', content.slice(0, 2000));
  } catch (e) {
    console.log('Error:', e);
  }
  await browser.close();
 }
 debugAuth().catch(console.error);
@@ -1,57 +1,79 @@
 # =============================================================================
 # Dockerfile.nextjs — multi-stage build for the Next.js frontend
 # =============================================================================
 # Used by docker-compose.yml's `nextjs` service.
 #
-# Why this looks the way it does:
+# Production-ready Docker image for Next.js with:
-#   - `NEXT_PUBLIC_API_URL` must be present at BUILD time (Next.js inlines
+#   - Multi-stage build for minimal image size
-#     it into the client JS). We pass it through as an ARGs so the build
+#   - Standalone server output for containerized deployment
-#     context is reproducible (`docker build --build-arg` or via deploy.sh's
+#   - Non-root user for security
-#     `docker compose --env-file` flow).
+#   - Health check support
-#   - We copy the host's pre-built `.next/` (produced by `npm run build` in
+#
-#     deploy.sh) rather than running `next build` inside the image. This
+# Build args (set via --build-arg or docker-compose args):
-#     keeps the image lean and avoids double-building.
+#   - NEXT_PUBLIC_API_URL: Public URL for the frontend (inlined at build time)
 #   - NODE_ENV: Environment (defaults to production)
 #
 # Required: next.config.ts must have `output: "standalone"` enabled.
 # =============================================================================
-# ---- builder: produce node_modules with dev deps for the build step --------
+# ── Stage 1: Dependencies ────────────────────────────────────────────────────
 FROM node:20-alpine AS deps
 WORKDIR /app
 COPY package.json package-lock.json* ./
 RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
-# ---- builder: produce the standalone .next/ output ------------------------
+# Copy package files
 COPY package.json package-lock.json* ./
 # Install dependencies
 RUN if [ -f package-lock.json ]; then \
      npm ci --no-audit --no-fund; \
    else \
      npm install --no-audit --no-fund; \
    fi
 # ── Stage 2: Build ───────────────────────────────────────────────────────────
 FROM node:20-alpine AS builder
 WORKDIR /app
 # Copy node_modules from deps stage
 COPY --from=deps /app/node_modules ./node_modules
 # Copy source files
 COPY . .
-# These ARGs are wired through docker-compose's `args:` block (or the CLI).
+# Set build arguments (inlined into client bundle)
-# deploy.sh exports them in the build environment.
+ARG NEXT_PUBLIC_API_URL=http://localhost:3000
 ARG NEXT_PUBLIC_API_URL
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
-ARG NEXTJS_HOST_PORT
+ARG NODE_ENV=production
-ENV NEXTJS_HOST_PORT=${NEXTJS_HOST_PORT}
+ENV NODE_ENV=${NODE_ENV}
 # Build the Next.js application
 RUN npm run build
-# ---- runner: minimal image, standalone server -----------------------------
+# ── Stage 3: Runtime ─────────────────────────────────────────────────────────
 FROM node:20-alpine AS runner
 WORKDIR /app
 # Set production environment
 ENV NODE_ENV=production
 ENV PORT=3000
-# Run as non-root.
+# Create non-root user for security
 RUN addgroup --system --gid 1001 nodejs \
- && adduser  --system --uid 1001 nextjs
+ && adduser --system --uid 1001 nextjs
-# Copy only what the standalone server needs.
+# Copy standalone server and static assets from builder
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
-USER nextjs
+# Expose the port
 EXPOSE 3000
-# Adjust this CMD to match the actual server file your build emits.
+# Switch to non-root user
-# For `output: "standalone"` in next.config.js the file is server.js.
+USER nextjs
 # Health check
 HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=6 \
  CMD wget -qO- http://localhost:3000/ || exit 1
 # Start the standalone server
 CMD ["node", "server.js"]
@@ -2,22 +2,50 @@
 # docker-compose.yml — production stack consumed by deploy.sh
 # =============================================================================
 #
-# The host-side ports (POSTGREST_HOST_PORT, NEXTJS_HOST_PORT) are written by
+# Complete Docker stack for production deployment:
-# deploy.sh into .env.production. We interpolate from there with ${VAR:-3011}
+#   - Next.js frontend (Node.js standalone server)
-# so a manual `docker compose up` without the deploy script still works.
+#   - PostgREST API (optional, for direct PostgreSQL access)
 #
-# Note on networking: the Next.js container calls PostgREST on
+# Postgres itself runs on the host (the deploy workflow applies migrations
-# `host.docker.internal:POSTGREST_HOST_PORT` so the inlined
+# via `psql -h 127.0.0.1`). Next.js can also run under PM2 on the host —
-# NEXT_PUBLIC_API_URL (a localhost URL, per the deploy contract) resolves
+# this compose file provides a Docker alternative for the frontend.
-# correctly. On Linux you may need to add
+#
-#   extra_hosts:
+# The host-side ports are written by the deploy workflow into $APP_DIR/.env.
-#     - "host.docker.internal:host-gateway"
+# We interpolate from there with ${VAR:-default} so a manual
-# which is included below for that reason.
+# `docker compose up` without the deploy script still works.
 # =============================================================================
 name: prod-app  # default project name; deploy.sh overrides with -p
 services:
  # ── Next.js Frontend ──────────────────────────────────────────────────────────
  nextjs:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.nextjs
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
        NODE_ENV: production
    container_name: prod-app-nextjs
    restart: unless-stopped
    ports:
      - "${NEXTJS_HOST_PORT:-3000}:3000"
    environment:
      NODE_ENV: production
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
      DATABASE_URL: ${DATABASE_URL}
      # Pass other env vars as needed
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 30s
    # Volume mount for hot-reload in development (comment out for production)
    # volumes:
    #   - ../src:/app/src:ro
  # ── PostgREST (optional direct PostgreSQL access) ────────────────────────────
  postgrest:
    image: postgrest/postgrest:latest
    container_name: prod-app-postgrest
@@ -32,6 +60,9 @@ services:
      PGRST_SERVER_PORT: 3000
      # Optional: tighten CORS for your real domain
      PGRST_DB_TXN_END: "commit-allow-overwrite"
    depends_on:
      nextjs:
        condition: service_healthy
    # Healthcheck lets `docker compose ps` show healthy state.
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
@@ -39,32 +70,3 @@ services:
      timeout: 3s
      retries: 6
  nextjs:
    # Build context is the workspace root (one level up from this file).
    build:
      context: ..
      dockerfile: deploy/Dockerfile.nextjs
    container_name: prod-app-nextjs
    restart: unless-stopped
    ports:
      - "${NEXTJS_HOST_PORT:-3012}:3000"
    environment:
      # Runtime vars — these can change without rebuilding. NEXT_PUBLIC_*
      # is also exported here for completeness, but the BROWSER's view of
      # NEXT_PUBLIC_API_URL is baked in at build time (see Dockerfile).
      NODE_ENV: production
      PORT: 3000
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
    env_file:
      - ../.env.production   # server-side secrets read at runtime
    extra_hosts:
      # Lets the container reach the host on the dynamically allocated port.
      - "host.docker.internal:host-gateway"
    depends_on:
      postgrest:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/api/health"]
      interval: 10s
      timeout: 3s
      retries: 6
@@ -0,0 +1,147 @@
 # Production DB Schema Migration Reliability Implementation Plan
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:systematic-debugging (completed root cause), superpowers:writing-plans (this), superpowers:test-driven-development where code changes have tests, superpowers:verification-before-completion, and superpowers:executing-plans or subagent-driven-development to implement task-by-task. Steps use checkbox syntax.
 **Goal:** Ensure that every production deploy (push to main) results in the full schema from `db/migrations/0001_init.sql` (including the `admin_users` and `admin_user_brands` tables required by `getAdminUser()`) being present in the `DATABASE_URL` that the running app connects to via its pool / drizzle client. Eliminate "relation does not exist" errors and the resulting Access Denied screen for properly provisioned Neon Auth users.
 **Architecture:** 
 - Make the CI "Run migrations" step a hard gate (fatal on failure, plus explicit post-migrate verification that critical tables exist).
 - Ship the minimal migration runner + SQL files as part of the deploy artifact so the target server has a recovery path.
 - Add a lightweight post-deploy / startup verification in the app or deploy script (fail fast with clear message instead of silent 500s on first admin request).
 - Keep the "migrate from full source locally" path working for initial prod DB bootstrap and emergencies.
 - Do not change the core migration logic or 0001_init.sql in this plan (that would be a separate architectural change if the double-BEGIN wrapping proves fragile).
 **Tech Stack:** Gitea Actions (YAML), Node 22 + pg + drizzle on target, Next.js standalone output, pm2 on Ubuntu server, Neon Postgres (with neon_auth schema).
 **Root Cause (from systematic-debugging Phase 1):** The prod runtime DB lacked the `admin_users` table because (1) the migration step in `.gitea/workflows/deploy.yml` used `|| echo` making any failure (connection, SQL error in the huge 0001 file, FK to neon_auth.user, tx nesting from the file's BEGIN + script's BEGIN) non-fatal, (2) only `.next/`, `public/`, `package.json` (and optional next.config) are scp'd — `scripts/migrate.js` and `db/migrations/` are never on the server, (3) no verification after "migrate" or at app startup that the tables the admin permission layer depends on actually exist, (4) the `.env.production` written from the same secret as the CI migrate step was used, but the apply didn't happen or was skipped due to _migrations state or partial rollback.
 **Evidence Gathered:**
 - deploy.yml: Run migrations step, limited scp, .env.production printf, pm2 "npm start".
 - scripts/migrate.js: dotenv .env.local + env override, _migrations tracking, per-file client.query(sql) inside script tx, re-throw on error.
 - db/migrations/0001_init.sql: explicit CREATE TABLE admin_users (with FK to neon_auth.user), admin_user_brands, brands; file starts with BEGIN;.
 - db/client.ts + src/lib/admin-permissions.ts: withPlatformAdmin → drizzle select on adminUsers from schema (the exact query that 42P01s).
 - next.config.ts: output: 'standalone' (explains pm2 warning).
 - Runtime logs: the repeated "Database query failed" + "relation does not exist", app starts fine.
 - Git history: recent deploy "fixes" focused on SSH/env writing, not migration reliability.
 **Files to touch (decomposition by responsibility):**
 - `.gitea/workflows/deploy.yml` (CI pipeline gates + artifact contents)
 - `scripts/migrate.js` (minor hardening if needed for verification hook)
 - `src/app/api/health/route.ts` or similar (new, for startup/schema check — or add to existing)
 - `CLAUDE.md` + `PRODUCTION_DEPLOYMENT_CHECKLIST.md` (docs)
 - Possibly a small `scripts/verify-prod-schema.js` helper
 ---
 ### Task 1: Make CI migration step a hard failure + add explicit verification for admin_users
 **Files:**
 - Modify: `.gitea/workflows/deploy.yml:23-27` (the Run migrations step and surrounding)
 - [ ] **Step 1.1:** Replace the non-fatal migration line with a strict block that fails the job if migrate fails or the critical table is missing after.
 ```yaml
 - name: Run migrations
  env:
    DATABASE_URL: ${{ secrets.DATABASE_URL }}
  run: |
    set -e
    echo "=== Running migrations against prod DB ==="
    npm run migrate:one
    echo "=== Verifying critical schema (admin_users) ==="
    node -e '
      const {Client} = require("pg");
      const c = new Client({connectionString: process.env.DATABASE_URL});
      c.connect().then(() => c.query("SELECT 1 FROM admin_users LIMIT 1")).then(() => {
        console.log("✓ admin_users table exists");
        return c.end();
      }).then(() => process.exit(0)).catch(e => {
        console.error("✗ admin_users missing or inaccessible:", e.message);
        process.exit(1);
      });
    '
 ```
 - [ ] **Step 1.2:** Run a local simulation or note that the Gitea runner will now fail the whole deploy if the secret DB is missing the table (good — forces the bootstrap to happen before code that depends on it ships).
 - [ ] **Step 1.3:** Commit the yml change with message referencing the root cause (missing table in prod due to masked migration).
 ### Task 2: Ship migration capability in the deploy artifact so server has a recovery path
 **Files:**
 - Modify: `.gitea/workflows/deploy.yml` in the "Deploy" step (the scp and ssh sections)
 - [ ] **Step 2.1:** Add scp for the migration assets (after the existing public/.next scp):
 ```bash
 echo "Copying migration runner and SQL..."
 scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no -r scripts/migrate.js tyler@...:$APP_DIR/scripts/ || true
 scp -o ConnectTimeout=15 -o StrictHostKeyChecking=no -r db/migrations tyler@...:$APP_DIR/db/ || true
 ```
 - [ ] **Step 2.2:** Update the server ssh install/restart line to also ensure the scripts dir has the right perms if needed, but mainly document that now `node scripts/migrate.js` will work on the server with the .env.production.
 - [ ] **Step 2.3:** In the same Deploy step, after writing .env.production and before or after the pm2 restart, optionally run the migrate on the server as a belt-and-suspenders (using the just-written .env):
 ```bash
 ssh ... "cd $APP_DIR && source .env.production 2>/dev/null || export \$(grep DATABASE_URL .env.production); node scripts/migrate.js || echo 'migrate on server completed or not needed'"
 ```
  (Keep it non-fatal on server for now; the CI gate is the hard one.)
 - [ ] **Step 2.4:** Test the scp paths in a dry-run or note the change.
 ### Task 3: Add a minimal runtime / startup guard (fail fast with clear message)
 **Files:**
 - Create: `src/app/api/health/db-schema/route.ts` (or add to an existing health if present)
 - Or simpler: in the admin layout or a top level, but a dedicated health is better for PM2/docker.
 - [ ] **Step 3.1:** Create a tiny health endpoint that does the same check the CI verification does (SELECT 1 FROM admin_users) using the existing pool or withDb, returns 200 or 503 with message "Schema not applied - run migrations".
 - [ ] **Step 3.2:** Wire it so the deploy can curl it after restart as a final gate (in the workflow ssh step).
 - [ ] **Step 3.3:** (Optional but recommended per defense-in-depth) Call a similar check early in getAdminUser or the admin layout and log a very loud message + return a better error than generic "does not have admin access" when the table is literally missing.
 ### Task 4: Update documentation and bootstrap instructions (so humans know the right sequence)
 **Files:**
 - Modify: `CLAUDE.md` (the Commands and Important File Locations + Gotchas sections)
 - Modify or create: `PRODUCTION_DEPLOYMENT_CHECKLIST.md` or a new `docs/PROD_BOOTSTRAP.md`
 - [ ] **Step 4.1:** In CLAUDE.md under "Commands" and "Adding a New Brand" / auth section, add a "First production deploy / new prod DB bootstrap" subsection:
  1. Ensure the Neon project has neon_auth enabled and the DATABASE_URL secret in Gitea points to it.
  2. (Before first code push that depends on admin) Locally or in a throwaway runner: `DATABASE_URL=prod... node scripts/migrate.js`
  3. Then `DATABASE_URL=prod... npx tsx scripts/provision-admin.ts you@real.com platform_admin` (after signing in on the prod URL).
  4. Push; the CI gate + shipped runner will keep it healthy on future deploys.
  5. If you ever see "relation admin_users does not exist" in prod logs, the DB the app is talking to is not the one that had migrate run.
 - [ ] **Step 4.2:** Add a note about the `|| echo` anti-pattern that was removed and why the new verification step exists.
 - [ ] **Step 4.3:** Mention the standalone vs npm start issue (already in logs) and that the start command on server should eventually be updated to `node .next/standalone/server.js -p 3100` (can be a follow-up task).
 ### Task 5: Verification before claiming success (use the dedicated skill)
 **Files:** (none new, just process)
 - [ ] **Step 5.1:** Before merging the plan changes, use `superpowers:verification-before-completion` checklist: the change makes a fresh DB get the table, an "already applied" DB is a no-op, a deploy with missing table now fails the job early with clear output, a manual server migrate works because the files are there, the runtime health returns 200 when table present.
 - [ ] **Step 5.2:** After the PR is on a branch, trigger a deploy to a staging or the real prod (with a test DB first if possible), capture the CI log showing the new verification passing, and the app logs showing no more "Database query failed" on /admin.
 - [ ] **Step 5.3:** Run the provision script as the final user-visible test; confirm the Access Denied with email message is gone and the platform_admin can see the UI.
 - [ ] **Step 5.4:** Document the before/after in the plan or a memory file.
 ### Task 6: (Stretch / follow-up) Improve the migrate script's resilience for huge init files (if the double tx ever bites again)
 **Files:**
 - Modify: `scripts/migrate.js`
 - [ ] Only if during verification the 0001 apply is flaky: change the per-file execution to not wrap the file's own BEGIN/COMMIT, or use a separate connection, or exec `psql -f` (but keep node/pg for consistency). Add a comment explaining the previous fragility.
 **Rollback / emergency:** If a deploy breaks because of this, the server now has the scripts + db/migrations copied, so SSH + `source .env.production; node scripts/migrate.js` is the recovery (exactly what the user was trying to do manually).
 **Success criteria:**
 - A brand new prod DB + push to main results in a green deploy + working /admin after provision.
 - The error "relation \"admin_users\" does not exist" no longer appears in prod pm2 logs for normal admin flows.
 - The pipeline fails loudly (with the table name in the error) instead of shipping a broken app that only shows "Access Denied".
@@ -0,0 +1,18 @@
 /**
 * Drizzle Kit config. Used by `drizzle-kit generate` / `drizzle-kit push`
 * for future migrations. The schema in `db/migrations/0001_init.sql` is
 * the source of truth for v1; subsequent migrations can be generated
 * from changes to `db/schema/*.ts` and committed alongside the SQL.
 */
 import { defineConfig } from "drizzle-kit";
 export default defineConfig({
  schema: "./db/schema/index.ts",
  out: "./db/migrations",
  dialect: "postgresql",
  dbCredentials: {
    url: process.env.DATABASE_URL ?? "postgres://postgres:postgres@localhost:5432/route_commerce",
  },
  strict: true,
  verbose: true,
 });
@@ -12,6 +12,10 @@ const eslintConfig = defineConfig([
    "out/**",
    "build/**",
    "next-env.d.ts",
    // Ignore legacy .js scripts that use CommonJS
    "scripts/**",
    "supabase/**",
    "fix-agents.js",
  ]),
  // Allow setState in useEffect for PWA prompts and client-side state initialization
  {
@@ -20,6 +24,14 @@ const eslintConfig = defineConfig([
      "react-hooks/set-state-in-effect": "off",
    },
  },
  // Relax some rules for legacy code
  {
    files: ["db/**", "scripts/**", "supabase/**"],
    rules: {
      "@typescript-eslint/no-require-imports": "off",
      "@typescript-eslint/no-explicit-any": "warn",
    },
  },
 ]);
 export default eslintConfig;
@@ -1,6 +1,20 @@
 import type { NextConfig } from "next";
 const nextConfig: NextConfig = {
  // Enable standalone output for Docker/PM2 deployment
  output: "standalone",
  // Lock the file-tracing root to the project directory. Without this,
  // Next.js 16 walks up from package.json looking for a lockfile, finds
  // the homelab runner's stale `act` cache at
  // /home/tyler/.cache/act/.../package-lock.json, and warns:
  //   "We detected multiple lockfiles and selected the directory of
  //    /home/tyler/package-lock.json as the root directory."
  // The deploy runner's APP_DIR is /home/tyler/route-commerce, so
  // resolving relative to the project root is correct both locally and
  // in CI.
  outputFileTracingRoot: ".",
  // Enable strict mode
  reactStrictMode: true,
@@ -1,6 +1,6 @@
 {
  "name": "route-commerce-platform",
-  "version": "1.0.0",
+  "version": "2.0.0",
  "private": true,
  "scripts": {
    "dev": "node fix-agents.js && next dev --webpack -H 0.0.0.0 -p 4000",
@@ -8,24 +8,35 @@
    "start": "next start",
    "lint": "eslint",
    "lint:fix": "eslint --fix",
-    "migrate": "node supabase/push-migrations.js",
+    "migrate": "node scripts/migrate.js",
-    "migrate:one": "node supabase/push-migrations.js",
+    "migrate:one": "node scripts/migrate.js",
    "db:migrate": "node scripts/migrate.js",
    "db:seed": "tsx db/seed.ts",
    "db:reset": "node scripts/db-reset.js",
    "db:studio": "drizzle-kit studio",
    "type-check": "npx tsc --noEmit",
    "test": "vitest run",
    "test:watch": "vitest",
    "test:ui": "vitest --ui",
    "test:e2e": "playwright test --project=local",
    "test:e2e:prod": "PLAYWRIGHT_PROD=1 playwright test",
    "format": "prettier --write \"src/**/*.{ts,tsx}\""
  },
  "dependencies": {
    "@anthropic-ai/sdk": "^0.96.0",
-    "@auth/pg-adapter": "^1.11.2",
+    "@aws-sdk/client-s3": "^3.1064.0",
-    "@clerk/nextjs": "^7.4.2",
+    "@aws-sdk/s3-request-presigner": "^3.1064.0",
    "@google/generative-ai": "^0.24.1",
    "@gsap/react": "^2.1.2",
    "@neondatabase/auth": "^0.4.2-beta",
    "@sentry/nextjs": "^10.55.0",
-    "@stripe/react-stripe-js": "^3.10.0",
+    "@stripe/react-stripe-js": "^6.6.0",
-    "@stripe/stripe-js": "^5.10.0",
+    "@stripe/stripe-js": "^9.7.0",
    "@supabase/ssr": "^0.10.2",
    "@supabase/supabase-js": "^2.105.3",
    "@upstash/ratelimit": "^2.0.8",
    "@upstash/redis": "^1.38.0",
    "drizzle-orm": "^0.36.4",
    "exceljs": "^4.4.0",
    "framer-motion": "^12.40.0",
    "gsap": "^3.15.0",
@@ -57,13 +68,19 @@
    "@types/react": "^19",
    "@types/react-dom": "^19",
    "@types/uuid": "^11.0.0",
    "@vitejs/plugin-react": "^4.7.0",
    "dotenv": "^17.4.2",
    "drizzle-kit": "^0.30.6",
    "eslint": "^9",
    "eslint-config-next": "16.2.5",
    "jsdom": "^25.0.1",
    "pg": "^8.20.0",
    "playwright": "^1.59.1",
    "tailwindcss": "^4",
-    "typescript": "^5.9.3"
+    "tsx": "^4.22.4",
    "typescript": "^5",
    "vite-tsconfig-paths": "^5.1.4",
    "vitest": "^2.1.9"
  },
  "overrides": "{}"
 }
@@ -1,24 +1,34 @@
 import { defineConfig, devices } from "@playwright/test";
 import path from "path";
 const LOCAL_BASE = process.env.PLAYWRIGHT_URL ?? "http://localhost:3000";
 const PROD_BASE = "https://route-commerce-platform.vercel.app";
 export default defineConfig({
  testDir: "./tests",
  fullyParallel: false,
  forbidOnly: !!process.env.CI,
  retries: process.env.CI ? 2 : 0,
  workers: 1,
  // Playwright should only run E2E specs — vitest owns everything under
  // tests/unit/. The glob below matches *.spec.ts at the top of tests/ and
  // tests/e2e/ and tests/login/ but skips the .test.ts files (vitest).
  testMatch: /(tests\/(smoke|e2e|login)\/.*|\/[^/]+\.spec\.ts$)/,
  reporter: "list",
  use: {
-    baseURL: "https://route-commerce-platform.vercel.app",
+    baseURL: LOCAL_BASE,
    trace: "on-first-retry",
  },
  projects: [
    {
      name: "local",
      use: { ...devices["Desktop Chrome"], baseURL: LOCAL_BASE },
    },
    {
      name: "production",
-      use: {
+      // `PLAYWRIGHT_PROD=1 npx playwright test` to run against the live site.
-        ...devices["Desktop Chrome"],
+      testMatch: /.*\.prod\.spec\.ts$/,
-        baseURL: "https://route-commerce-platform.vercel.app",
+      use: { ...devices["Desktop Chrome"], baseURL: PROD_BASE },
      },
    },
  ],
 });
@@ -0,0 +1,61 @@
 /**
 * Create an admin user in Neon Auth via direct HTTP call.
 * Run: npx tsx scripts/create-admin-user.ts [email] [password] [name]
 *
 * Makes a direct HTTP request to the Neon Auth API so we don't need
 * a Next.js request context, then updates email_verified in the DB.
 */
 import { config } from "dotenv";
 config({ path: ".env.local" });
 import pg from "pg";
 const { Pool } = pg;
 async function main() {
  const email = process.argv[2] ?? "admin@example.com";
  const password = process.argv[3] ?? "Admin1234!";
  const name = process.argv[4] ?? "Admin";
  const baseUrl = process.env.NEON_AUTH_BASE_URL!;
  console.log(`Creating user: ${email}`);
  const res = await fetch(`${baseUrl}/sign-up/email`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Origin": "http://localhost:4000",
      "x-neon-auth-proxy": "node",
    },
    body: JSON.stringify({ email, password, name, callbackURL: "/admin" }),
  });
  const data = await res.json().catch(() => ({}));
  console.log(`Sign-up status: ${res.status}`);
  if (!res.ok) {
    console.error("Failed to create user:", JSON.stringify(data));
    process.exit(1);
  }
  const userId = data.user?.id;
  console.log("User created:", data.user?.email, "| ID:", userId);
  // Mark email verified in DB so they can log in immediately
  if (userId) {
    const pool = new Pool({ connectionString: process.env.DATABASE_URL });
    try {
      await pool.query(
        "UPDATE neon_auth.user SET email_verified = true WHERE id = $1",
        [userId]
      );
      console.log("Email verified in DB.");
    } finally {
      await pool.end();
    }
  }
  console.log(`\nLog in at http://localhost:4000/login with ${email} / ${password}`);
 }
 main();
@@ -0,0 +1,44 @@
 #!/usr/bin/env node
 /**
 * DESTRUCTIVE: drops and recreates the `route_commerce` database, then
 * applies all migrations and seeds.
 *
 * Usage:
 *   npm run db:reset
 *
 * Use only in dev. Requires sudo-less access to a postgres superuser.
 */
 require("dotenv").config({ path: ".env.local" });
 const { execSync } = require("node:child_process");
 const url = process.env.DATABASE_URL;
 if (!url) {
  console.error("❌ DATABASE_URL is not set");
  process.exit(1);
 }
 const m = url.match(/postgres(?:ql)?:\/\/([^:]+):[^@]+@([^:]+):(\d+)\/(.+)/);
 if (!m) {
  console.error("❌ Could not parse DATABASE_URL");
  process.exit(1);
 }
 const [, user, host, port, db] = m;
 const adminUrl = url.replace(/\/[^/]+$/, "/postgres");
 console.log(`⚠️  DROPPING and recreating ${db} on ${host}:${port} as ${user}`);
 try {
  execSync(
    `psql "${adminUrl}" -c "DROP DATABASE IF EXISTS ${db};" -c "CREATE DATABASE ${db} OWNER ${user};"`,
    { stdio: "inherit" },
  );
  console.log("✓ Database recreated");
 } catch (err) {
  console.error("❌ Failed to drop/create database. Try with sudo:");
  console.error(
    `   sudo -u postgres psql -c "DROP DATABASE IF EXISTS ${db};" -c "CREATE DATABASE ${db} OWNER ${user};"`,
  );
  process.exit(1);
 }
 execSync("npm run db:migrate", { stdio: "inherit" });
 execSync("npm run db:seed", { stdio: "inherit" });
 console.log("✅ Database reset, migrated, and seeded");
@@ -0,0 +1,124 @@
 #!/usr/bin/env node
 /**
 * Apply Postgres migrations from `db/migrations/*.sql` in lexical order.
 * Wraps each new file in a transaction; tracks applied files in
 * `_migrations` so re-runs are safe and idempotent.
 *
 * The 0001_init.sql (and 0002) are now fully re-runnable (IF NOT EXISTS +
 * trigger guards) + this script has repair logic for DBs that were
 * initialized before tracking was introduced.
 *
 * Usage:
 *   npm run migrate
 *   npm run migrate:one     # same as above (applies all pending)
 */
 require("dotenv").config({ path: ".env.local" });
 const fs = require("node:fs");
 const path = require("node:path");
 const { Client } = require("pg");
 const MIGRATIONS_DIR = path.join(__dirname, "..", "db", "migrations");
 async function main() {
  const url = process.env.DATABASE_ADMIN_URL ?? process.env.DATABASE_URL;
  if (!url) {
    console.error("❌ DATABASE_URL (or DATABASE_ADMIN_URL) is not set in .env.local");
    process.exit(1);
  }
  const client = new Client({ connectionString: url });
  await client.connect();
  try {
    await client.query(`
      CREATE TABLE IF NOT EXISTS _migrations (
        filename TEXT PRIMARY KEY,
        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
      )
    `);
    const files = fs
      .readdirSync(MIGRATIONS_DIR)
      .filter((f) => f.endsWith(".sql"))
      .sort();
    if (files.length === 0) {
      console.log("No migration files found in db/migrations/");
      return;
    }
    const { rows: applied } = await client.query(
      `SELECT filename FROM _migrations`,
    );
    const appliedSet = new Set(applied.map((r) => r.filename));
    // Repair for historical DBs (applied before _migrations tracking existed,
    // or via direct psql / earlier tooling). If the core objects are present
    // we record the filename so future deploys (and server-side recovery runs)
    // treat 0001/0002 as done without re-executing the large init script.
    async function ensureTracked(filename, existenceCheckSql) {
      if (appliedSet.has(filename)) return;
      try {
        const { rows } = await client.query(existenceCheckSql);
        if (rows.length > 0) {
          await client.query(
            `INSERT INTO _migrations (filename) VALUES ($1) ON CONFLICT (filename) DO NOTHING`,
            [filename]
          );
          console.log(`✓ ${filename} (objects present in DB; repaired tracking)`);
          appliedSet.add(filename);
        }
      } catch (e) {
        // Non-fatal: the check may fail on a brand-new DB or with limited perms.
        // We'll let the normal apply path handle it.
      }
    }
    await ensureTracked(
      "0001_init.sql",
      "SELECT 1 FROM information_schema.tables WHERE table_name = 'admin_users' LIMIT 1"
    );
    await ensureTracked(
      "0002_admin_password.sql",
      "SELECT 1 FROM information_schema.columns WHERE table_name = 'users' AND column_name = 'password_hash' LIMIT 1"
    );
    let appliedNow = 0;
    for (const file of files) {
      if (appliedSet.has(file)) {
        console.log(`✓ ${file} (already applied)`);
        continue;
      }
      const sql = fs.readFileSync(path.join(MIGRATIONS_DIR, file), "utf8");
      console.log(`→ Applying ${file}...`);
      try {
        await client.query("BEGIN");
        await client.query(sql);
        await client.query(`INSERT INTO _migrations (filename) VALUES ($1)`, [
          file,
        ]);
        await client.query("COMMIT");
        appliedNow += 1;
        console.log(`✓ ${file}`);
      } catch (err) {
        await client.query("ROLLBACK");
        console.error(`✗ ${file} failed:`, err.message);
        throw err;
      }
    }
    console.log(
      `\n✅ Done. ${appliedNow} new migration(s) applied. ${
        files.length - appliedNow
      } already current.`,
    );
  } finally {
    await client.end();
  }
 }
 main().catch((err) => {
  console.error(err);
  process.exit(1);
 });
@@ -0,0 +1,33 @@
 #!/usr/bin/env node
 /**
 * Post-migration verification.
 * Called by .gitea/workflows/deploy.yml after npm run migrate:one.
 * Confirms critical table admin_users is queryable.
 */
 const { Client } = require("pg");
 async function main() {
  const url = process.env.DATABASE_URL;
  if (!url) {
    console.error("No DATABASE_URL");
    process.exit(1);
  }
  const c = new Client({ connectionString: url });
  await c.connect();
  try {
    console.log("=== Post-migration verification: critical table admin_users must exist ===");
    await c.query("SELECT 1 FROM admin_users LIMIT 1");
    console.log("✓ admin_users table exists and is queryable");
    process.exit(0);
  } catch (e) {
    console.error("✗ FATAL: admin_users relation missing after migrate:", e.message);
    console.error("The deploy cannot continue. The secret DATABASE_URL must have had db/migrations/0001_init.sql applied successfully.");
    process.exit(1);
  } finally {
    await c.end();
  }
 }
 main();
@@ -0,0 +1,71 @@
 #!/usr/bin/env node
 /**
 * Preflight check + migration repair runner.
 * Called by .gitea/workflows/deploy.yml before running migrations.
 *
 * 1. Verify neon_auth schema exists (prerequisite for 0001_init.sql FKs)
 * 2. Ensure 0001_init.sql is tracked in _migrations if admin_users already exists
 *    (repair for DBs that had 0001_init.sql applied before _migrations was added)
 */
 const { Client } = require("pg");
 async function main() {
  const url = process.env.DATABASE_URL;
  if (!url) {
    console.error("No DATABASE_URL");
    process.exit(1);
  }
  const c = new Client({ connectionString: url });
  await c.connect();
  try {
    // 1. Pre-flight: check neon_auth schema
    console.log("=== Pre-flight: checking for neon_auth schema (required by 0001_init.sql for FKs to neon_auth.user and related RPCs) ===");
    const schemaRes = await c.query(
      "SELECT 1 FROM information_schema.schemata WHERE schema_name = 'neon_auth'"
    );
    if (schemaRes.rows.length === 0) {
      console.error("✗ FATAL: neon_auth schema does not exist in the target database.");
      console.error("Enable Neon Auth on the Neon project/branch that this DATABASE_URL points to first.");
      console.error("Run: neonctl neon-auth  (or equivalent) against the correct Neon branch.");
      console.error("The neon_auth schema is created by Neon Auth and is a prerequisite for 0001_init.sql.");
      process.exit(1);
    }
    console.log("✓ neon_auth schema exists");
    // 2. Pre-repair: ensure 0001_init.sql is tracked if admin_users already exists
    // This handles DBs where 0001_init.sql was applied before _migrations tracking existed.
    console.log("=== Pre-repair: checking _migrations tracking (best-effort) ===");
    try {
      const tableRes = await c.query(
        "SELECT 1 FROM information_schema.tables WHERE table_name = 'admin_users' LIMIT 1"
      );
      if (tableRes.rows.length > 0) {
        await c.query(`
          CREATE TABLE IF NOT EXISTS _migrations (
            filename TEXT PRIMARY KEY,
            applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
          );
          INSERT INTO _migrations (filename)
          VALUES ('0001_init.sql')
          ON CONFLICT (filename) DO NOTHING;
        `);
        console.log("✓ 0001_init.sql tracking repaired (admin_users already present)");
      }
    } catch (e) {
      // best-effort
      console.log("(pre-repair skipped: " + e.message + ")");
    }
    console.log("Preflight complete. Proceeding to migrations...");
    process.exit(0);
  } catch (e) {
    console.error("Preflight failed:", e.message);
    process.exit(1);
  } finally {
    await c.end();
  }
 }
 main();
@@ -0,0 +1,123 @@
 /**
 * Provision an admin user by email.
 * Run: npx tsx scripts/provision-admin.ts [email] [role]
 * 
 * Role options: platform_admin, brand_admin, store_employee
 */
 import pg from "pg";
 import * as fs from "fs";
 import * as path from "path";
 // Load .env.local (or .env.production) manually so the script works in prod bootstrap
 const envFiles = [".env.local", ".env.production"];
 for (const f of envFiles) {
  const envPath = path.join(process.cwd(), f);
  if (fs.existsSync(envPath)) {
    const envContent = fs.readFileSync(envPath, "utf-8");
    for (const line of envContent.split("\n")) {
      const trimmed = line.trim();
      if (trimmed && !trimmed.startsWith("#")) {
        const [key, ...valueParts] = trimmed.split("=");
        const k = key.trim();
        if (!process.env[k]) {
          process.env[k] = valueParts.join("=").trim();
        }
      }
    }
    console.log(`[provision] loaded ${f}`);
  }
 }
 const { Pool } = pg;
 async function main() {
  const email = process.argv[2] ?? "admin@example.com";
  const role = process.argv[3] ?? "platform_admin";
  console.log("DATABASE_URL:", process.env.DATABASE_URL ? "set" : "NOT SET");
  const pool = new Pool({ connectionString: process.env.DATABASE_URL });
  try {
    // Find the Neon Auth user by email
    const userResult = await pool.query(
      "SELECT id FROM neon_auth.user WHERE email = $1",
      [email]
    );
    if (userResult.rows.length === 0) {
      console.error(`User ${email} not found in neon_auth.user`);
      console.error("Please sign up first at /login");
      process.exit(1);
    }
    const userId = userResult.rows[0].id;
    console.log(`Found Neon Auth user: ${userId} (${email})`);
    // Check if already in admin_users
    const existingAdmin = await pool.query(
      "SELECT id FROM admin_users WHERE user_id = $1",
      [userId]
    );
    let adminUserId: string;
    if (existingAdmin.rows.length > 0) {
      adminUserId = existingAdmin.rows[0].id;
      console.log(`User already in admin_users: ${adminUserId}`);
    } else {
      // Insert into admin_users
      const insertResult = await pool.query(
        `INSERT INTO admin_users (user_id, email, name, role, 
          can_manage_orders, can_manage_products, can_manage_stops,
          can_manage_customers, can_manage_wholesale, can_manage_billing,
          can_manage_settings, can_manage_water_log, can_manage_time_tracking,
          can_manage_route_trace, can_manage_reports, can_manage_communications)
         VALUES ($1, $2, $3, $4, true, true, true, true, true, true, true, true, true, true, true, true)
         RETURNING id`,
        [userId, email, email.split("@")[0], role]
      );
      adminUserId = insertResult.rows[0].id;
      console.log(`Created admin_users record: ${adminUserId}`);
    }
    // Get brands
    const brandsResult = await pool.query("SELECT id, name, slug FROM brands LIMIT 10");
    if (brandsResult.rows.length === 0) {
      console.error("No brands found. Please create a brand first.");
      process.exit(1);
    }
    console.log("\nAvailable brands:");
    brandsResult.rows.forEach((b, i) => {
      console.log(`  ${i + 1}. ${b.name} (${b.slug}) - ${b.id}`);
    });
    // Link to first brand (or create a default one)
    const brand = brandsResult.rows[0];
    // Check if already linked
    const existingLink = await pool.query(
      "SELECT 1 FROM admin_user_brands WHERE admin_user_id = $1 AND brand_id = $2",
      [adminUserId, brand.id]
    );
    if (existingLink.rows.length > 0) {
      console.log(`Already linked to brand: ${brand.name}`);
    } else {
      await pool.query(
        "INSERT INTO admin_user_brands (admin_user_id, brand_id) VALUES ($1, $2)",
        [adminUserId, brand.id]
      );
      console.log(`Linked to brand: ${brand.name} (${brand.slug})`);
    }
    console.log(`\n✅ ${email} is now provisioned as ${role}!`);
    console.log(`   They can access the admin at your production URL /admin (sign in first if needed).`);
  } finally {
    await pool.end();
  }
 }
 main().catch(console.error);
@@ -0,0 +1,96 @@
 /**
 * Seed an admin user for development.
 * Run: npx tsx scripts/seed-admin.ts [email] [password] [name]
 */
 import { config } from "dotenv";
 config({ path: ".env.local" });
 import pg from "pg";
 const { Pool } = pg;
 async function main() {
  const email = process.argv[2] ?? "admin@test.com";
  const password = process.argv[3] ?? "Admin1234!";
  const name = process.argv[4] ?? "Admin";
  const baseUrl = process.env.NEON_AUTH_BASE_URL!;
  const pool = new Pool({ connectionString: process.env.DATABASE_URL });
  try {
    // 1. Create or get brand
    const brandResult = await pool.query(`
      INSERT INTO brands (name, slug, plan_tier)
      VALUES ('Demo Brand', 'demo', 'enterprise')
      ON CONFLICT (slug) DO UPDATE SET name = EXCLUDED.name
      RETURNING id, name, slug
    `);
    const brand = brandResult.rows[0];
    console.log("✓ Brand:", brand.name, `(${brand.id})`);
    // 2. Create user in Neon Auth via direct API
    const res = await fetch(`${baseUrl}/sign-up/email`, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "Origin": "http://localhost:4000",
        "x-neon-auth-proxy": "node",
      },
      body: JSON.stringify({ email, password, name, callbackURL: "/admin" }),
    });
    const data = await res.json();
    if (!res.ok && data.code !== "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL") {
      console.error("✗ Failed to create user:", data);
      process.exit(1);
    }
    const userId = data.user?.id;
    console.log("✓ Neon Auth user:", email, userId ? `(${userId})` : "(already existed)");
    // 3. Verify email in Neon Auth DB
    if (userId) {
      await pool.query(
        `UPDATE neon_auth.user SET "emailVerified" = true WHERE id = $1`,
        [userId]
      );
      console.log("✓ Email verified in DB");
    }
    // 4. Get user ID from neon_auth.user by email
    const neonUser = await pool.query(
      `SELECT id FROM neon_auth.user WHERE email = $1`,
      [email]
    );
    const neonUserId = neonUser.rows[0]?.id;
    if (!neonUserId) {
      console.error("✗ Could not find user in neon_auth.user");
      process.exit(1);
    }
    // 5. Insert into admin_users (upsert)
    const adminResult = await pool.query(`
      INSERT INTO admin_users (user_id, email, name, role)
      VALUES ($1, $2, $3, 'brand_admin')
      ON CONFLICT (email) DO UPDATE SET user_id = EXCLUDED.user_id, name = EXCLUDED.name, role = EXCLUDED.role
      RETURNING id
    `, [neonUserId, email, name]);
    const adminUser = adminResult.rows[0];
    console.log("✓ Admin user:", email, `(${adminUser.id})`);
    // 6. Link to brand
    await pool.query(`
      INSERT INTO admin_user_brands (admin_user_id, brand_id)
      VALUES ($1, $2)
      ON CONFLICT DO NOTHING
    `, [adminUser.id, brand.id]);
    console.log("✓ Linked to brand:", brand.name);
    console.log(`\n🎉 All set! Log in at http://localhost:4000/login`);
    console.log(`   Email: ${email}`);
    console.log(`   Password: ${password}`);
  } finally {
    await pool.end();
  }
 }
 main();
@@ -0,0 +1,41 @@
 import { config } from "dotenv";
 config({ path: ".env.local" });
 import pg from "pg";
 const { Pool } = pg;
 const TUXEDO = "64294306-5f42-463d-a5e8-2ad6c81a96de";
 async function main() {
  const pool = new Pool({ connectionString: process.env.DATABASE_URL });
  try {
    // brand_settings
    const bs = await pool.query(
      `INSERT INTO brand_settings (brand_id, legal_business_name, phone, email, logo_url, tagline, from_email)
       VALUES ($1, $2, $3, $4, $5, $6, $7)
       ON CONFLICT (brand_id) DO UPDATE SET legal_business_name = EXCLUDED.legal_business_name
       RETURNING brand_id, legal_business_name`,
      [TUXEDO, "Tuxedo Corn LLC", "970-555-0100", "info@tuxedocorn.com",
       "/brand-logos/64294306-5f42-463d-a5e8-2ad6c81a96de/logo.png",
       "Farm-Fresh Sweet Corn, Delivered", "orders@tuxedocorn.com"]
    );
    console.log("brand_settings:", bs.rows[0]);
    // wholesale_settings
    const ws = await pool.query(
      `INSERT INTO wholesale_settings (brand_id, require_approval, pickup_location, fob_location, from_email)
       VALUES ($1, true, $2, $3, $4)
       ON CONFLICT (brand_id) DO UPDATE SET pickup_location = EXCLUDED.pickup_location
       RETURNING brand_id, pickup_location`,
      [TUXEDO, "59751 David Road, Olathe, CO 81425", "FOB Olathe, CO", "orders@tuxedocorn.com"]
    );
    console.log("wholesale_settings:", ws.rows[0]);
    console.log("\nDone!");
  } finally {
    await pool.end();
  }
 }
 main().catch((e) => { console.error(e.message); process.exit(1); });
@@ -0,0 +1,11 @@
 import { config } from "dotenv";
 config({ path: ".env.local" });
 import pg from "pg";
 const { Pool } = pg;
 async function main() {
  const pool = new Pool({ connectionString: process.env.DATABASE_URL });
  const r = await pool.query(`SELECT id, email, "emailVerified" FROM neon_auth.user WHERE email = 'admin@test.com'`);
  console.log(JSON.stringify(r.rows, null, 2));
  await pool.end();
 }
 main();
@@ -1,15 +1,6 @@
 "use server";
-import { createClient as createServiceClient } from "@supabase/supabase-js";
+import { pool } from "@/lib/db";
 function getServiceClient() {
  const roleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  if (!roleKey) throw new Error("SUPABASE_SERVICE_ROLE_KEY is not set");
  return createServiceClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    roleKey,
  );
 }
 type AdminActionPayload = {
  action_type: "create" | "update" | "delete";
@@ -30,35 +21,33 @@ type UserActivityPayload = {
 export async function logAdminAction(payload: AdminActionPayload): Promise<void> {
  try {
-    const service = getServiceClient();
+    await pool.query("SELECT log_admin_action($1::jsonb)", [
-    await service.rpc("log_admin_action", {
+      JSON.stringify({
      p_payload: {
        action_type: payload.action_type,
        admin_id: payload.admin_id ?? null,
        admin_email: payload.admin_email ?? null,
        affected_user_id: payload.affected_user_id ?? null,
        brand_id: payload.brand_id ?? null,
        details: payload.details ?? {},
-      },
+      }),
-    });
+    ]);
-  } catch (e) {
+  } catch {
    // logging failed silently
  }
 }
 export async function logUserActivity(payload: UserActivityPayload): Promise<void> {
  try {
-    const service = getServiceClient();
+    await pool.query("SELECT log_user_activity($1::jsonb)", [
-    await service.rpc("log_user_activity", {
+      JSON.stringify({
      p_payload: {
        user_id: payload.user_id,
        activity_type: payload.activity_type,
        details: payload.details ?? {},
        ip_address: payload.ip_address ?? null,
        user_agent: payload.user_agent ?? null,
-      },
+      }),
-    });
+    ]);
-  } catch (e) {
+  } catch {
    // logging failed silently
  }
 }
@@ -1,63 +0,0 @@
 "use server";
 import { createServerClient } from "@supabase/ssr";
 import { cookies } from "next/headers";
 import { NextResponse } from "next/server";
 const DEV_ADMIN_UID = "dev-user-00000000-0000-0000-0000-000000000001";
 export async function forceAdminLogin(): Promise<{ success: boolean; uid?: string; error?: string }> {
  const cookieStore = await cookies();
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  const response = NextResponse.next();
  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
    cookies: {
      getAll() { return cookieStore.getAll(); },
      setAll(cookiesToSet, headers) {
        cookiesToSet.forEach(({ name, value, options }) => {
          response.cookies.set(name, value, options);
        });
        Object.entries(headers).forEach(([key, value]) => {
          response.headers.set(key, value);
        });
      },
    },
  });
  // Upsert dev platform_admin record
  const { data: existing } = await supabase
    .from("admin_users")
    .select("id, role")
    .eq("user_id", DEV_ADMIN_UID)
    .single();
  if (!existing) {
    const { error: insertError } = await supabase
      .from("admin_users")
      .insert({
        user_id: DEV_ADMIN_UID,
        brand_id: null,
        role: "platform_admin",
        active: true,
        can_manage_products: true,
        can_manage_stops: true,
        can_manage_orders: true,
        can_manage_pickup: true,
        can_manage_messages: true,
        can_manage_refunds: true,
        can_manage_users: true,
        can_manage_water_log: true,
        can_manage_reports: true,
        can_manage_settings: true,
        must_change_password: false,
      });
    if (insertError) {
      return { success: false, error: insertError.message };
    }
  }
  return { success: true, uid: DEV_ADMIN_UID };
 }
@@ -1,30 +1,60 @@
 "use server";
-import { cookies } from "next/headers";
+import "server-only";
-import { createClient as createServiceClient } from "@supabase/supabase-js";
+import { getSession } from "@/lib/auth";
 import { setUserPassword } from "@/lib/auth";
 import { getAdminUser } from "@/lib/admin-permissions";
 const MIN_PASSWORD_LENGTH = 8;
 /**
 * Change a user's password. Requires admin privileges.
 * 
 * Use this for admin-initiated password resets. For self-service
 * password changes, users should use the forgot password flow.
 */
 export async function updatePasswordAction(
  userId: string,
  newPassword: string
-): Promise<{ error?: string }> {
+): Promise<{ success: boolean; error?: string }> {
-  const cookieStore = await cookies();
+  // Verify the caller is an admin
-  const uid =
+  const adminUser = await getAdminUser();
-    cookieStore.get("rc_auth_uid")?.value ??
+  if (!adminUser) {
-    cookieStore.get("rc_uid")?.value;
+    return { success: false, error: "Not authenticated. Please log in again." };
  if (!uid) {
    return { error: "Not authenticated. Please log in again." };
  }
-  const service = createServiceClient(
+  if (adminUser.role !== "platform_admin") {
-    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    return { success: false, error: "Only platform admins can change passwords." };
-    process.env.SUPABASE_SERVICE_ROLE_KEY!
+  }
  );
-  const { error } = await service.rpc("update_user_password", {
+  // Validate password
-    p_user_id: uid,
+  if (!newPassword || newPassword.length < MIN_PASSWORD_LENGTH) {
-    p_password: newPassword,
+    return { success: false, error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.` };
-  });
+  }
-  if (error) return { error: error.message };
+  try {
-  return {};
+    const result = await setUserPassword({
      userId,
      newPassword,
    });
    if (result.error) {
      console.error("[updatePassword] Failed:", result.error);
      return { success: false, error: result.error.message ?? "Failed to update password." };
    }
    console.log("[updatePassword] Password updated for user:", userId);
    return { success: true };
  } catch (err) {
    console.error("[updatePassword] Unexpected error:", err);
    return { success: false, error: "An unexpected error occurred." };
  }
 }
 /**
 * Get the current session user ID. Used by the change-password UI.
 */
 export async function getCurrentUserId(): Promise<string | null> {
  const { data: session } = await getSession();
  return session?.user?.id ?? null;
 }
@@ -1,15 +1,6 @@
 "use server";
-import { createClient as createServiceClient } from "@supabase/supabase-js";
+import { query } from "@/lib/db";
 function getServiceClient() {
  const roleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  if (!roleKey) throw new Error("SUPABASE_SERVICE_ROLE_KEY not set");
  return createServiceClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    roleKey,
  );
 }
 export type ResetAdminPasswordResult =
  | { success: true; tempPassword: string }
@@ -17,35 +8,35 @@ export type ResetAdminPasswordResult =
 /**
 * Emergency recovery action — only usable in development or when the caller
- * already has service role access. Resets the password for the specified email
+ * already has direct DB access. Resets the password for the specified email
 * and returns the temp password so it can be displayed to the user.
 *
 * Now that Supabase auth is gone, this hits the `users` table directly and
 * calls the same `update_user_password` SECURITY DEFINER RPC used by the
 * self-service password change action.
 */
 export async function resetAdminPassword(
  email: string,
  newPassword: string
 ): Promise<ResetAdminPasswordResult> {
-  const service = getServiceClient();
+  // Look up the user by email
-
+  const { rows } = await query<{ id: string }>(
-  // Look up auth user by email
+    "SELECT id FROM users WHERE email = $1 LIMIT 1",
-  const { data: authUsers, error: listError } = await service.auth.admin.listUsers();
+    [email.toLowerCase()],
-  if (listError || !authUsers?.users) {
+  );
-    return { success: false, error: "Could not list users: " + listError?.message };
+  const user = rows[0];
-  }
+  if (!user) {
  const authUser = authUsers.users.find((u) => u.email?.toLowerCase() === email.toLowerCase());
  if (!authUser) {
    return { success: false, error: "No auth user found for that email address." };
  }
-  // Update password via service role
+  // Update password via SECURITY DEFINER RPC
-  const { error: updateError } = await service.auth.admin.updateUserById(
+  try {
-    authUser.id,
+    await query("SELECT update_user_password($1, $2)", [user.id, newPassword]);
-    { password: newPassword, email_confirm: true }
+    return { success: true, tempPassword: newPassword };
-  );
+  } catch (err) {
-
+    return {
-  if (updateError) {
+      success: false,
-    return { success: false, error: updateError.message };
+      error: err instanceof Error ? err.message : "Failed to update password",
    };
  }
  return { success: true, tempPassword: newPassword };
 }
@@ -1,18 +1,12 @@
 "use server";
-import { cookies, headers } from "next/headers";
+import "server-only";
-import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
-import { NextRequest } from "next/server";
+import { pool, query } from "@/lib/db";
 import { NextResponse } from "next/server";
 import { createClient as createServiceClient } from "@supabase/supabase-js";
 import { supabase as publicSupabase } from "@/lib/supabase";
 import { getMockTableData, mockBrands } from "@/lib/mock-data";
 const useMockData = process.env.NEXT_PUBLIC_USE_MOCK_DATA === "true";
 export type AdminUserRow = {
  id: string;
-  user_id: string;
+  user_id: string | null;
  display_name: string | null;
  email: string;
  phone_number: string | null;
@@ -75,169 +69,17 @@ export type UpdateAdminUserInput = {
  phone_number?: string | null;
 };
-// ─── SSR client for authenticated requests ─────────────────────────────────
+// ─── Row mapping ────────────────────────────────────────────────────────────
-
+//
-async function getAuthClient() {
+// `admin_users` schema (after migration 204 + 034 + 037):
-  const cookieStore = await cookies();
+//   id, user_id, display_name, email, phone_number, role, brand_id,
-  const headerStore = await headers();
+//   can_manage_<X> (BOOLEAN each), active, must_change_password,
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+//   created_at, last_login, raw_user_meta_data, auth_provider, auth_subject
  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  const request = new NextRequest("http://localhost/admin", { headers: new Headers() });
  const response = NextResponse.next({ request });
  // Read rc_auth_uid from the raw HTTP Cookie header (document.cookie sets
  // cookies that arrive in the header but NOT in next/headers cookies()).
  const cookieHeader = headerStore.get("cookie") || "";
  const allCookies = cookieHeader.split(";").map(c => c.trim());
  const rcUidCookie = allCookies.find(c => c.startsWith("rc_auth_uid="));
  const rcAuthUid = rcUidCookie ? rcUidCookie.split("=")[1] : null;
  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
    cookies: {
      getAll() { return cookieStore.getAll(); },
      setAll(cookiesToSet, headers) {
        cookiesToSet.forEach(({ name, value, options }) => response.cookies.set(name, value, options));
        Object.entries(headers).forEach(([key, value]) => response.headers.set(key, value));
      },
    },
  });
  return { supabase, response, rcAuthUid };
 }
 async function callRpcWithAuth<T>(fn: string, params: Record<string, unknown>): Promise<{ data: T | null; error: string | null }> {
  const { supabase, rcAuthUid } = await getAuthClient();
  // Dev force-login UID bypasses Supabase auth entirely
  const DEV_FORCE_UID = "dev-user-00000000-0000-0000-0000-000000000001";
  if (rcAuthUid === DEV_FORCE_UID) {
    return { data: null, error: null }; // let the action proceed without auth check
  }
  const { data: userData, error: userError } = await supabase.auth.getUser();
  if (userError || !userData.user) {
    return { data: null, error: "Not authenticated" };
  }
  const { data, error } = await supabase.rpc(fn, params as Record<string, unknown>);
  if (error) { /* RPC error handled silently */ }
  return { data: data as T, error: error ? error.message : null };
 }
 // ─── Service role client (server-only, never exposed to browser) ───────────
 function getServiceClient() {
  const roleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  if (!roleKey) {
    throw new Error("SUPABASE_SERVICE_ROLE_KEY is not set. Cannot use service role in dev path.");
  }
  return createServiceClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    roleKey,
  );
 }
 // ─── Dev-only path — uses service role to create auth user + admin_users ──
 async function devCreateAdminUser(input: CreateAdminUserInput): Promise<{ user: AdminUserRow | null; error: string | null }> {
  if (process.env.NODE_ENV === "production") {
    return { user: null, error: "Dev path not available in production" };
  }
  const cookieStore = await cookies();
  const devSession = cookieStore.get("dev_session")?.value;
  if (!devSession || devSession !== "platform_admin") {
    return { user: null, error: "Not authenticated" };
  }
  const service = getServiceClient();
  // Create auth user with the provided password
  const { data: authUser, error: authError } = await service.auth.admin.createUser({
    email: input.email,
    password: input.password,
    email_confirm: true,
    user_metadata: {
      display_name: input.display_name || input.email.split("@")[0],
      phone_number: input.phone_number ?? null,
    },
  });
  if (authError || !authUser.user) {
    return { user: null, error: authError?.message ?? "Failed to create auth user" };
  }
  // Insert into admin_users
  const { data: inserted, error: insertError } = await service
    .from("admin_users")
    .insert({
      user_id: authUser.user.id,
      role: input.role,
      brand_id: input.brand_id,
      display_name: input.display_name || input.email.split("@")[0],
      phone_number: input.phone_number ?? null,
      can_manage_products: input.flags.can_manage_products ?? false,
      can_manage_stops: input.flags.can_manage_stops ?? false,
      can_manage_orders: input.flags.can_manage_orders ?? false,
      can_manage_pickup: input.flags.can_manage_pickup ?? false,
      can_manage_messages: input.flags.can_manage_messages ?? false,
      can_manage_refunds: input.flags.can_manage_refunds ?? false,
      can_manage_users: input.flags.can_manage_users ?? false,
      can_manage_water_log: input.flags.can_manage_water_log ?? false,
      can_manage_reports: input.flags.can_manage_reports ?? false,
      active: true,
      must_change_password: input.mustChangePassword ?? true,
    })
    .select()
    .single();
  if (insertError) {
    return { user: null, error: insertError.message };
  }
  // Send welcome email
  try {
    const { sendWelcomeEmail } = await import("@/lib/email-service");
    const emailRole = input.role === "platform_admin" ? "brand_admin" : input.role;
    await sendWelcomeEmail({
      to: input.email,
      name: input.display_name || input.email.split("@")[0],
      role: emailRole as "brand_admin" | "wholesale_buyer" | "store_employee",
      brandName: "Tuxedo Corn",
      tempPassword: input.password,
    });
  } catch (e) {
    // welcome email failed silently
  }
  return {
    user: {
      id: inserted.id,
      user_id: inserted.user_id,
      display_name: inserted.display_name ?? input.display_name ?? input.email.split("@")[0],
      email: input.email,
      phone_number: inserted.phone_number ?? input.phone_number ?? null,
      role: inserted.role,
      brand_id: inserted.brand_id,
      brand_name: null,
      can_manage_products: inserted.can_manage_products,
      can_manage_stops: inserted.can_manage_stops,
      can_manage_orders: inserted.can_manage_orders,
      can_manage_pickup: inserted.can_manage_pickup,
      can_manage_messages: inserted.can_manage_messages,
      can_manage_refunds: inserted.can_manage_refunds,
      can_manage_users: inserted.can_manage_users,
      can_manage_water_log: inserted.can_manage_water_log,
      can_manage_reports: inserted.can_manage_reports,
      active: inserted.active,
      must_change_password: inserted.must_change_password ?? true,
      created_at: inserted.created_at,
      last_login: null,
    },
    error: null,
  };
 }
 function mapUserRow(row: Record<string, unknown>): AdminUserRow {
  return {
    id: String(row.id ?? ""),
-    user_id: String(row.user_id ?? ""),
+    user_id: (row.user_id as string | null) ?? null,
    display_name: (row.display_name as string | null) ?? null,
    email: String(row.email ?? ""),
    phone_number: (row.phone_number as string | null) ?? null,
@@ -260,413 +102,232 @@ function mapUserRow(row: Record<string, unknown>): AdminUserRow {
  };
 }
-// ─── Dev path helpers (service role, local only) ───────────────────────────
+// ─── Welcome email (best-effort) ────────────────────────────────────────────
-async function devListAdminUsers(callerUid?: string): Promise<{ users: AdminUserRow[]; error: string | null }> {
+async function sendWelcomeEmailSafe(input: {
-  const service = getServiceClient();
+  to: string;
  name: string;
  role: "platform_admin" | "brand_admin" | "store_employee";
  password: string;
  brandId?: string;
 }): Promise<void> {
  try {
    const { sendWelcomeEmail } = await import("@/lib/email-service");
    const { getBrandSettings } = await import("@/actions/brand-settings");
    const emailRole = input.role === "platform_admin" ? "brand_admin" : input.role;
-  // Ensure caller has an admin_users record
+    let logoUrl: string | null = null;
-  if (callerUid) {
+    let brandName = "Route Commerce";
-    const { data: existing } = await service
+    if (input.brandId) {
-      .from("admin_users")
+      const settings = await getBrandSettings(input.brandId);
-      .select("id")
+      if (settings.success && settings.settings) {
-      .eq("user_id", callerUid)
+        logoUrl = settings.settings.logo_url ?? null;
-      .maybeSingle();
+        brandName = settings.settings.brand_name ?? brandName;
-
+      }
    if (!existing) {
      // auto-creating admin_users for uid
      const { data: authData } = await service.auth.admin.listUsers();
      const authUser = authData?.users?.find((u) => u.id === callerUid);
      const meta = (authUser as { user_metadata?: Record<string, unknown> })?.user_metadata;
      await service.from("admin_users").insert({
        user_id: callerUid,
        role: "platform_admin",
        brand_id: null,
        display_name: (meta?.display_name as string | null) ?? authUser?.email?.split("@")[0] ?? "Admin",
        phone_number: (meta?.phone_number as string | null) ?? null,
        can_manage_products: true,
        can_manage_stops: true,
        can_manage_orders: true,
        can_manage_pickup: true,
        can_manage_messages: true,
        can_manage_refunds: true,
        can_manage_users: true,
        can_manage_water_log: true,
        can_manage_reports: true,
        active: true,
        must_change_password: false,
      });
    }
    await sendWelcomeEmail({
      to: input.to,
      name: input.name,
      role: emailRole as "brand_admin" | "wholesale_buyer" | "store_employee",
      brandName,
      tempPassword: input.password,
      logoUrl: logoUrl ?? undefined,
    });
  } catch {
    // welcome email is best-effort; never block user creation
  }
  // Fetch all admin_users rows (no RLS for service role)
  const { data: adminRows, error: adminError } = await service
    .from("admin_users")
    .select(`
      id, user_id, role, brand_id, active, must_change_password, created_at, last_login,
      can_manage_products, can_manage_stops, can_manage_orders, can_manage_pickup,
      can_manage_messages, can_manage_refunds, can_manage_users, can_manage_water_log, can_manage_reports,
      brands (name)
    `)
    .order("created_at", { ascending: false });
  if (adminError) return { users: [], error: adminError.message };
  // Fetch auth user details via service role admin API
  const { data: authData, error: authError } = await service.auth.admin.listUsers();
  if (authError) return { users: [], error: authError.message };
  const authMap: Record<string, { email: string; display_name: string | null; phone_number: string | null }> = {};
  (authData?.users ?? []).forEach((u) => {
    const user = u as { id: string; email?: string; user_metadata?: Record<string, unknown> };
    authMap[user.id] = {
      email: user.email ?? "",
      display_name: (user.user_metadata?.display_name as string | null) ?? (user.user_metadata?.full_name as string | null) ?? null,
      phone_number: (user.user_metadata?.phone_number as string | null) ?? null,
    };
  });
  const users: AdminUserRow[] = (adminRows ?? []).map((row) => {
    const r = row as Record<string, unknown> & { brands?: { name?: string } };
    const authInfo = authMap[String(r.user_id ?? "")] ?? { email: "", display_name: null, phone_number: null };
    return {
      ...mapUserRow(r),
      email: authInfo.email || "No Email",
      display_name: authInfo.display_name ?? null,
      phone_number: authInfo.phone_number ?? (r.phone_number as string | null) ?? null,
      brand_name: r.brands?.name ?? null,
    };
  });
  return { users, error: null };
 }
-function buildUsersFromRows(adminRows: Record<string, unknown>[], authUsers: { id: string; email?: string; user_metadata?: Record<string, unknown> }[]): { users: AdminUserRow[]; error: string | null } {
+// ─── Public actions ─────────────────────────────────────────────────────────
  const authMap: Record<string, { email: string; display_name: string | null; phone_number: string | null }> = {};
  (authUsers ?? []).forEach((u) => {
    authMap[u.id] = {
      email: u.email ?? "",
      display_name: (u.user_metadata?.display_name as string | null) ?? (u.user_metadata?.full_name as string | null) ?? null,
      phone_number: (u.user_metadata?.phone_number as string | null) ?? null,
    };
  });
  const users: AdminUserRow[] = adminRows.map((row) => {
    const r = row as Record<string, unknown> & { brands?: { name?: string } };
    const authInfo = authMap[String(r.user_id ?? "")] ?? { email: "", display_name: null, phone_number: null };
    return {
      ...mapUserRow(r),
      email: authInfo.email || "No Email",
      display_name: authInfo.display_name ?? null,
      phone_number: authInfo.phone_number ?? (r.phone_number as string | null) ?? null,
      brand_name: r.brands?.name ?? null,
    };
  });
  return { users, error: null };
 }
 // ─── Production admin actions (require real Supabase auth) ─────────────────
 const DEV_FORCE_UID = "dev-user-00000000-0000-0000-0000-000000000001";
 export async function getAdminUsers(brandId?: string): Promise<{ users: AdminUserRow[]; error: string | null }> {
-  if (useMockData) {
+  try {
-    const mockUsers = getMockTableData("users") as AdminUserRow[];
+    const sql = brandId
-    let filteredUsers = mockUsers;
+      ? `SELECT au.id, au.user_id, au.display_name, au.email, au.phone_number,
-    if (brandId) {
+               au.role, au.brand_id, b.name AS brand_name,
-      filteredUsers = mockUsers.filter(u => u.brand_id === brandId);
+               au.can_manage_products, au.can_manage_stops, au.can_manage_orders,
-    }
+               au.can_manage_pickup, au.can_manage_messages, au.can_manage_refunds,
-    return { users: filteredUsers, error: null };
+               au.can_manage_users, au.can_manage_water_log, au.can_manage_reports,
               au.active, au.must_change_password, au.created_at, au.last_login
           FROM admin_users au
           LEFT JOIN brands b ON b.id = au.brand_id
           WHERE au.brand_id = $1
           ORDER BY au.created_at DESC`
      : `SELECT au.id, au.user_id, au.display_name, au.email, au.phone_number,
               au.role, au.brand_id, b.name AS brand_name,
               au.can_manage_products, au.can_manage_stops, au.can_manage_orders,
               au.can_manage_pickup, au.can_manage_messages, au.can_manage_refunds,
               au.can_manage_users, au.can_manage_water_log, au.can_manage_reports,
               au.active, au.must_change_password, au.created_at, au.last_login
           FROM admin_users au
           LEFT JOIN brands b ON b.id = au.brand_id
           ORDER BY au.created_at DESC`;
    const { rows } = await query<Record<string, unknown>>(sql, brandId ? [brandId] : []);
    return { users: rows.map(mapUserRow), error: null };
  } catch (err) {
    return { users: [], error: err instanceof Error ? err.message : String(err) };
  }
  const cookieStore = await cookies();
  const headerStore = await headers();
  const devSession = cookieStore.get("dev_session")?.value;
  // Read rc_auth_uid for force-login check
  const cookieHeader = headerStore.get("cookie") || "";
  const rcAuthUid = cookieHeader.split(";").map(c => c.trim())
    .find(c => c.startsWith("rc_auth_uid="))?.split("=")[1] ?? null;
  // In development mode: ALL requests with a valid rc_auth_uid use the dev/service path.
  // This includes real Supabase auth users — bypassing supabase.auth.getUser JWT validation.
  if (process.env.NODE_ENV !== "production" && rcAuthUid && rcAuthUid !== DEV_FORCE_UID) {
    return devListAdminUsers(rcAuthUid);
  }
  // Dev session cookie (platform_admin/brand_admin) — always use service role path
  const isDevAdmin = process.env.NODE_ENV !== "production" && (
    devSession === "platform_admin" || devSession === "brand_admin" || rcAuthUid === DEV_FORCE_UID
  );
  if (isDevAdmin) {
    return devListAdminUsers(rcAuthUid ?? undefined);
  }
  // Production path: try authenticated RPC first, fall back to service role if not authenticated
  const result = await callRpcWithAuth<AdminUserRow[]>("get_admin_users", { p_brand_id: brandId ?? null });
  if (result.error === "Not authenticated" && rcAuthUid) {
    // No Supabase session token in browser — use service role with rc_auth_uid
    const service = getServiceClient();
    const { data: adminRows, error: adminError } = await service
      .from("admin_users")
      .select(`id, user_id, role, brand_id, active, must_change_password, created_at, last_login,
        can_manage_products, can_manage_stops, can_manage_orders, can_manage_pickup,
        can_manage_messages, can_manage_refunds, can_manage_users, can_manage_water_log, can_manage_reports,
        brands (name)`)
      .order("created_at", { ascending: false });
    if (adminError) return { users: [], error: adminError.message };
    const { data: authData } = await service.auth.admin.listUsers();
    const authMap: Record<string, { email: string; display_name: string | null; phone_number: string | null }> = {};
    (authData?.users ?? []).forEach((u) => {
      const user = u as { id: string; email?: string; user_metadata?: Record<string, unknown> };
      authMap[user.id] = {
        email: user.email ?? "",
        display_name: (user.user_metadata?.display_name as string | null) ?? null,
        phone_number: (user.user_metadata?.phone_number as string | null) ?? null,
      };
    });
    const users: AdminUserRow[] = (adminRows ?? []).map((row) => {
      const r = row as Record<string, unknown> & { brands?: { name?: string } };
      const authInfo = authMap[String(r.user_id ?? "")] ?? { email: "", display_name: null, phone_number: null };
      return {
        ...mapUserRow(r),
        email: authInfo.email || "No Email",
        display_name: authInfo.display_name ?? null,
        phone_number: authInfo.phone_number ?? (r.phone_number as string | null) ?? null,
        brand_name: r.brands?.name ?? null,
      };
    });
    return { users, error: null };
  }
  return { users: result.data ?? [], error: result.error };
 }
 export async function createAdminUser(input: CreateAdminUserInput): Promise<{ user: AdminUserRow | null; error: string | null }> {
-  // Read auth context
+  try {
-  const cookieStore = await cookies();
+    // No Supabase Auth — `user_id` stays NULL until the user signs in
-  const headerStore = await headers();
+    // via Auth.js and `get_admin_user_for_session` matches them by
-  const devSession = cookieStore.get("dev_session")?.value;
+    // `auth_subject` / `email`. We just insert the row.
-  const cookieHeader = headerStore.get("cookie") || "";
+    const f = input.flags;
-  const rcAuthUid = cookieHeader.split(";").map(c => c.trim())
+    const { rows } = await query<Record<string, unknown>>(
-    .find(c => c.startsWith("rc_auth_uid="))?.split("=")[1] ?? null;
+      `INSERT INTO admin_users
         (user_id, display_name, email, phone_number, role, brand_id,
          can_manage_products, can_manage_stops, can_manage_orders,
          can_manage_pickup, can_manage_messages, can_manage_refunds,
          can_manage_users, can_manage_water_log, can_manage_reports,
          active, must_change_password, auth_provider, auth_subject)
       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,true,$16,'pending',$17)
       RETURNING id, user_id, display_name, email, phone_number, role, brand_id,
                 can_manage_products, can_manage_stops, can_manage_orders,
                 can_manage_pickup, can_manage_messages, can_manage_refunds,
                 can_manage_users, can_manage_water_log, can_manage_reports,
                 active, must_change_password, created_at, last_login`,
      [
        null,
        input.display_name ?? input.email.split("@")[0],
        input.email.toLowerCase(),
        input.phone_number ?? null,
        input.role,
        input.brand_id,
        f.can_manage_products ?? false,
        f.can_manage_stops ?? false,
        f.can_manage_orders ?? false,
        f.can_manage_pickup ?? false,
        f.can_manage_messages ?? false,
        f.can_manage_refunds ?? false,
        f.can_manage_users ?? false,
        f.can_manage_water_log ?? false,
        f.can_manage_reports ?? false,
        input.mustChangePassword ?? true,
        input.email.toLowerCase(),
      ],
    );
    if (!rows[0]) return { user: null, error: "Insert returned no row" };
-  // DEV_FORCE_UID bypass — set by Emergency Force Login or /api/force-admin
+    const newAdminId = String(rows[0].id);
  if (rcAuthUid === DEV_FORCE_UID) {
    return devCreateAdminUser(input);
  }
-  const isDevAdmin = process.env.NODE_ENV !== "production" && devSession === "platform_admin";
+    // Ensure the admin_user_brands link exists for brand-scoped roles.
    // (Platform admins created without a chosen brand may have 0 links and still
    // get access via role; getAdminUser allows this.)
    if (input.brand_id) {
      try {
        await query(
          `INSERT INTO admin_user_brands (admin_user_id, brand_id)
           VALUES ($1, $2)
           ON CONFLICT (admin_user_id, brand_id) DO NOTHING`,
          [newAdminId, input.brand_id],
        );
      } catch (linkErr) {
        console.error("[createAdminUser] Failed to create admin_user_brands link:", linkErr);
        // Non-fatal — the user row exists; a platform admin can link manually.
      }
    }
-  // Dev path: use service role to create user without Supabase auth session
+    await sendWelcomeEmailSafe({
-  if (isDevAdmin) {
+      to: input.email,
-    return devCreateAdminUser(input);
+      name: input.display_name ?? input.email.split("@")[0],
-  }
+      role: input.role,
  // Production path — use service role directly (bypasses Supabase JWT auth)
  // rc_auth_uid cookie proves the admin is logged in; service role creates the account
  if (rcAuthUid) {
    const service = getServiceClient();
    // Create auth user
    const { data: authUser, error: authError } = await service.auth.admin.createUser({
      email: input.email,
      password: input.password,
-      email_confirm: true,
+      brandId: input.brand_id ?? undefined,
      user_metadata: {
        display_name: input.display_name || input.email.split("@")[0],
        phone_number: input.phone_number ?? null,
      },
    });
    if (authError || !authUser.user) {
      return { user: null, error: authError?.message ?? "Failed to create auth user" };
    }
-    // Insert into admin_users
+    return { user: mapUserRow(rows[0]), error: null };
-    const { data: inserted, error: insertError } = await service
+  } catch (err) {
-      .from("admin_users")
+    return { user: null, error: err instanceof Error ? err.message : String(err) };
      .insert({
        user_id: authUser.user.id,
        role: input.role,
        brand_id: input.brand_id,
        display_name: input.display_name || input.email.split("@")[0],
        phone_number: input.phone_number ?? null,
        can_manage_products: input.flags.can_manage_products ?? false,
        can_manage_stops: input.flags.can_manage_stops ?? false,
        can_manage_orders: input.flags.can_manage_orders ?? false,
        can_manage_pickup: input.flags.can_manage_pickup ?? false,
        can_manage_messages: input.flags.can_manage_messages ?? false,
        can_manage_refunds: input.flags.can_manage_refunds ?? false,
        can_manage_users: input.flags.can_manage_users ?? false,
        can_manage_water_log: input.flags.can_manage_water_log ?? false,
        can_manage_reports: input.flags.can_manage_reports ?? false,
        active: true,
        must_change_password: input.mustChangePassword ?? true,
      })
      .select()
      .single();
    if (insertError) return { user: null, error: insertError.message };
    // Send welcome email
    try {
      const { sendWelcomeEmail } = await import("@/lib/email-service");
      const emailRole = input.role === "platform_admin" ? "brand_admin" : input.role;
      await sendWelcomeEmail({
        to: input.email,
        name: input.display_name || input.email.split("@")[0],
        role: emailRole as "brand_admin" | "wholesale_buyer" | "store_employee",
        brandName: "Tuxedo Corn",
        tempPassword: input.password,
      });
    } catch (e) {
      // welcome email failed silently
    }
    return {
      user: {
        id: inserted.id,
        user_id: inserted.user_id,
        display_name: inserted.display_name ?? input.display_name ?? input.email.split("@")[0],
        email: input.email,
        phone_number: inserted.phone_number ?? input.phone_number ?? null,
        role: inserted.role,
        brand_id: inserted.brand_id,
        brand_name: null,
        can_manage_products: inserted.can_manage_products,
        can_manage_stops: inserted.can_manage_stops,
        can_manage_orders: inserted.can_manage_orders,
        can_manage_pickup: inserted.can_manage_pickup,
        can_manage_messages: inserted.can_manage_messages,
        can_manage_refunds: inserted.can_manage_refunds,
        can_manage_users: inserted.can_manage_users,
        can_manage_water_log: inserted.can_manage_water_log,
        can_manage_reports: inserted.can_manage_reports,
        active: inserted.active,
        must_change_password: inserted.must_change_password ?? true,
        created_at: inserted.created_at,
        last_login: null,
      },
      error: null,
    };
  }
  return { user: null, error: "Not authenticated" };
 }
 export async function updateAdminUser(input: UpdateAdminUserInput): Promise<{ user: AdminUserRow | null; error: string | null }> {
-  // Dev bypass check
+  try {
-  const cookieStore = await cookies();
+    // Build a partial SET clause. Each `can_manage_*` column is set
-  const headerStore = await headers();
+    // individually — the input's `flags` partial is spread across them.
-  const devSession = cookieStore.get("dev_session")?.value;
+    const sets: string[] = [];
-  const cookieHeader = headerStore.get("cookie") || "";
+    const params: unknown[] = [];
-  const rcAuthUid = cookieHeader.split(";").map(c => c.trim())
+    const push = (col: string, val: unknown) => { params.push(val); sets.push(`${col} = $${params.length}`); };
    .find(c => c.startsWith("rc_auth_uid="))?.split("=")[1] ?? null;
  // DEV_FORCE_UID bypass — Emergency Force Login sets this cookie directly
  if (rcAuthUid === DEV_FORCE_UID) {
    const service = getServiceClient();
    const { data, error } = await service
      .from("admin_users")
      .update({
        role: input.role ?? undefined,
        brand_id: input.brand_id ?? undefined,
        can_manage_products: input.flags?.can_manage_products ?? undefined,
        can_manage_stops: input.flags?.can_manage_stops ?? undefined,
        can_manage_orders: input.flags?.can_manage_orders ?? undefined,
        can_manage_pickup: input.flags?.can_manage_pickup ?? undefined,
        can_manage_messages: input.flags?.can_manage_messages ?? undefined,
        can_manage_refunds: input.flags?.can_manage_refunds ?? undefined,
        can_manage_users: input.flags?.can_manage_users ?? undefined,
        can_manage_water_log: input.flags?.can_manage_water_log ?? undefined,
        can_manage_reports: input.flags?.can_manage_reports ?? undefined,
        active: input.active ?? undefined,
        display_name: input.display_name ?? null,
        phone_number: input.phone_number ?? null,
      })
      .eq("id", input.id)
      .select()
      .single();
    if (error) return { user: null, error: error.message };
    return { user: mapUserRow(data), error: null };
  }
-  const result = await callRpcWithAuth<AdminUserRow[]>("update_admin_user", {
+    if (input.role !== undefined) push("role", input.role);
-    p_id: input.id,
+    if (input.brand_id !== undefined) push("brand_id", input.brand_id);
-    p_role: input.role ?? null,
+    if (input.active !== undefined) push("active", input.active);
-    p_brand_id: input.brand_id ?? null,
+    if (input.display_name !== undefined) push("display_name", input.display_name);
-    p_flags: input.flags ?? null,
+    if (input.phone_number !== undefined) push("phone_number", input.phone_number);
-    p_active: input.active ?? null,
+    if (input.flags) {
-    p_display_name: input.display_name ?? null,
+      for (const [key, val] of Object.entries(input.flags)) {
-    p_phone_number: input.phone_number ?? null,
+        if (val !== undefined) push(key, val);
-  });
+      }
-  const rows = result.data as AdminUserRow[] | null;
+    }
-  return { user: rows?.[0] ?? null, error: result.error };
+    if (sets.length === 0) return { user: null, error: "Nothing to update" };
    params.push(input.id);
    const sql = `UPDATE admin_users SET ${sets.join(", ")}
                 WHERE id = $${params.length}
                 RETURNING id, user_id, display_name, email, phone_number, role, brand_id,
                           can_manage_products, can_manage_stops, can_manage_orders,
                           can_manage_pickup, can_manage_messages, can_manage_refunds,
                           can_manage_users, can_manage_water_log, can_manage_reports,
                           active, must_change_password, created_at, last_login`;
    const { rows } = await query<Record<string, unknown>>(sql, params);
    if (!rows[0]) return { user: null, error: "User not found" };
    return { user: mapUserRow(rows[0]), error: null };
  } catch (err) {
    return { user: null, error: err instanceof Error ? err.message : String(err) };
  }
 }
 export async function deleteAdminUser(id: string): Promise<{ success: boolean; error: string | null }> {
-  // Dev bypass check
+  try {
-  const cookieStore = await cookies();
+    // No Supabase Auth — nothing to delete from the auth service.
-  const headerStore = await headers();
+    const { rowCount } = await query(`DELETE FROM admin_users WHERE id = $1`, [id]);
-  const devSession = cookieStore.get("dev_session")?.value;
+    return { success: (rowCount ?? 0) > 0, error: null };
-  const cookieHeader = headerStore.get("cookie") || "";
+  } catch (err) {
-  const rcAuthUid = cookieHeader.split(";").map(c => c.trim())
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
    .find(c => c.startsWith("rc_auth_uid="))?.split("=")[1] ?? null;
  // DEV_FORCE_UID bypass — Emergency Force Login sets this cookie directly
  if (rcAuthUid === DEV_FORCE_UID) {
    const service = getServiceClient();
    // Get user_id first
    const { data: adminRow, error: fetchError } = await service
      .from("admin_users")
      .select("user_id")
      .eq("id", id)
      .single();
    if (fetchError) return { success: false, error: fetchError.message };
    // Delete from admin_users
    const { error: deleteError } = await service.from("admin_users").delete().eq("id", id);
    if (deleteError) return { success: false, error: deleteError.message };
    // Delete auth user
    if (adminRow?.user_id) {
      await service.auth.admin.deleteUser(adminRow.user_id);
    }
    return { success: true, error: null };
  }
  const result = await callRpcWithAuth<boolean>("delete_admin_user", { p_id: id });
  return { success: result.data ?? false, error: result.error };
 }
 export async function setMustChangePassword(userId: string): Promise<{ success: boolean; error: string | null }> {
-  const cookieStore = await cookies();
+  try {
-  const headerStore = await headers();
+    const { rowCount } = await query(
-  const cookieHeader = headerStore.get("cookie") || "";
+      `UPDATE admin_users SET must_change_password = true WHERE id = $1`,
-  const rcAuthUid = cookieHeader.split(";").map(c => c.trim())
+      [userId],
-    .find(c => c.startsWith("rc_auth_uid="))?.split("=")[1] ?? null;
+    );
-
+    return { success: (rowCount ?? 0) > 0, error: null };
-  if (rcAuthUid === DEV_FORCE_UID || process.env.NODE_ENV !== "production") {
+  } catch (err) {
-    const service = getServiceClient();
+    return { success: false, error: err instanceof Error ? err.message : String(err) };
    const { error } = await service.from("admin_users").update({ must_change_password: true }).eq("id", userId);
    return { success: !error, error: error?.message ?? null };
  }
  // Production path — use service role via direct update
  const service = getServiceClient();
  const { error } = await service.from("admin_users").update({ must_change_password: true }).eq("id", userId);
  return { success: !error, error: error?.message ?? null };
 }
-export async function sendPasswordResetEmail(email: string): Promise<{ success: boolean; error: string | null }> {
+/**
-  const { error } = await publicSupabase.auth.resetPasswordForEmail(email, {
+ * No auth service anymore (no Supabase, no Auth.js password-reset
-    redirectTo: `${process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"}/change-password`,
+ * endpoint). A platform admin can reset access by deleting +
-  });
+ * re-creating the user, or by toggling `must_change_password` via the
-  return { success: !error, error: error?.message ?? null };
+ * UI — the function is preserved as a no-op so call sites keep
 * compiling.
 */
 export async function sendPasswordResetEmail(_email: string): Promise<{ success: boolean; error: string | null }> {
  return {
    success: false,
    error: "Password reset is handled by a platform admin. Contact them to reset your access.",
  };
 }
 export async function getBrands(): Promise<{ brands: { id: string; name: string }[]; error: string | null }> {
-  if (useMockData) {
+  try {
-    const brands = mockBrands.map(b => ({ id: b.id, name: b.name }));
+    // Sort by name so the platform admin's brand picker stays stable.
-    return { brands, error: null };
+    const { rows } = await query<{ id: string; name: string }>(
      `SELECT id, name FROM brands ORDER BY name`,
    );
    return { brands: rows, error: null };
  } catch (err) {
    return { brands: [], error: err instanceof Error ? err.message : String(err) };
  }
  const { data, error } = await publicSupabase.from("brands").select("id, name").order("name");
  return { brands: data ?? [], error: error?.message ?? null };
 }
 // Keep `pool` reachable so bundlers don't tree-shake the import — the
 // import is for the `server-only` side effect.
 void pool;
@@ -32,7 +32,7 @@ export async function saveAIPreferences(
  brandId: string,
  config: AIAuthConfig
 ): Promise<{ success: boolean; error?: string }> {
-  const { error } = await supabase
+  const result = await supabase
    .from("brand_ai_settings")
    .upsert({
      brand_id: brandId,
@@ -43,9 +43,9 @@ export async function saveAIPreferences(
      model: config.model || "gpt-4o-mini",
      max_tokens: config.max_tokens || 4000,
      updated_at: new Date().toISOString(),
-    });
+    }) as { data: unknown; error: { message: string } | null };
-  if (error) return { success: false, error: error.message };
+  if (result.error) return { success: false, error: result.error.message };
  return { success: true };
 }
@@ -2,10 +2,7 @@
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
 const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
 // ── Types ────────────────────────────────────────────────────────────────────
@@ -56,67 +53,66 @@ export type ConversionFunnel = {
  rate: number;
 };
-// ── Helper ────────────────────────────────────────────────────────────────────
+// ── Helpers ──────────────────────────────────────────────────────────────────
 //
 // The original Supabase REST endpoints (get_reports_summary, get_revenue_chart,
 // get_sales_by_product_report, get_contact_growth_report) backed tables that
 // have been retired from the SaaS rebuild (`orders` in the old schema had
 // `subtotal` / `brand_id` / `pickup_complete` / `created_at` columns that the
 // new `orders` table does not have). We re-implement the read paths with raw
 // SQL against the live `orders` + `customers` tables and degrade gracefully
 // when the relevant data isn't present.
 //
 // `recent_orders` / `conversion_funnel` use the new `orders` schema directly
 // (total_cents, placed_at, fulfillment, status, customer_id, brand_id).
-async function brandScopedFetch<T>(
+/**
-  endpoint: string,
+ * Aggregate KPIs over a date window. Replaces the
-  options?: RequestInit & { params?: Record<string, string> }
+ * `get_reports_summary` SECURITY DEFINER RPC from
-): Promise<T> {
+ * `supabase/migrations/031_reports_v1_rpcs.sql`. Returns zeroed metrics
-  const adminUser = await getAdminUser();
+ * if the caller is unauthenticated or no orders exist in the window.
-  if (!adminUser) throw new Error("Not authenticated");
+ */
-
+async function getReportsSummary(
-  // brandId is available for future use in filtering
+  brandId: string | null,
-  void adminUser.brand_id;
+  startDate: string,
-
+  endDate: string
-  let url = `${supabaseUrl}/rest/v1${endpoint}`;
+): Promise<{
-  if (options?.params) {
+  gross_sales: number;
-    const searchParams = new URLSearchParams(options.params);
+  total_orders: number;
-    url += `?${searchParams.toString()}`;
+  avg_order_value: number;
 }> {
  const params: unknown[] = [startDate, endDate];
  let brandFilter = "";
  if (brandId) {
    brandFilter = `AND brand_id = $3::uuid`;
    params.push(brandId);
  }
-
+  const { rows } = await pool.query<{
-  const response = await fetch(url, {
+    gross_sales: number;
-    ...options,
+    total_orders: number;
-    headers: {
+    avg_order_value: number;
-      ...svcHeaders(supabaseKey),
+  }>(
-      ...options?.headers,
+    `SELECT
-    },
+       COALESCE(SUM(total_cents), 0)::float / 100.0 AS gross_sales,
-  });
+       COUNT(*)::int AS total_orders,
-
+       COALESCE(ROUND(AVG(total_cents)::numeric, 2), 0)::float AS avg_order_value
-  if (!response.ok) {
+     FROM orders
-    const err = await response.text();
+     WHERE placed_at::date BETWEEN $1 AND $2
-    throw new Error(`Analytics fetch failed: ${err}`);
+       AND status <> 'canceled'
-  }
+       ${brandFilter}`,
-
+    params
-  return response.json() as Promise<T>;
+  );
-}
+  return rows[0] ?? { gross_sales: 0, total_orders: 0, avg_order_value: 0 };
 async function brandScopedRPC<T>(
  rpcName: string,
  params: Record<string, unknown>
 ): Promise<T> {
  const adminUser = await getAdminUser();
  if (!adminUser) throw new Error("Not authenticated");
  const brandId = await getActiveBrandId(adminUser);
  const response = await fetch(`${supabaseUrl}/rest/v1/rpc/${rpcName}`, {
    method: "POST",
    headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
    body: JSON.stringify({ p_brand_id: brandId, ...params }),
  });
  if (!response.ok) {
    const err = await response.text();
    throw new Error(`RPC ${rpcName} failed: ${err}`);
  }
  return response.json() as Promise<T>;
 }
 // ── Analytics Actions ─────────────────────────────────────────────────────────
 export async function getAnalyticsMetrics(periodDays: number = 30): Promise<AnalyticsMetrics> {
  try {
    const adminUser = await getAdminUser();
    if (!adminUser) throw new Error("Not authenticated");
    const brandId = await getActiveBrandId(adminUser);
    const endDate = new Date();
    const startDate = new Date();
    startDate.setDate(startDate.getDate() - periodDays);
@@ -126,51 +122,42 @@ export async function getAnalyticsMetrics(periodDays: number = 30): Promise<Anal
    const prevStartDate = new Date(prevEndDate);
    prevStartDate.setDate(prevStartDate.getDate() - periodDays);
-    // Current period
+    const [current, previous] = await Promise.all([
-    const current = await brandScopedRPC<{
+      getReportsSummary(brandId, startDate.toISOString().split("T")[0], endDate.toISOString().split("T")[0]),
-      gross_sales: number;
+      getReportsSummary(brandId, prevStartDate.toISOString().split("T")[0], prevEndDate.toISOString().split("T")[0]),
-      total_orders: number;
+    ]);
      avg_order_value: number;
    }>("get_reports_summary", {
      p_start_date: startDate.toISOString().split("T")[0],
      p_end_date: endDate.toISOString().split("T")[0],
    });
    // Previous period
    const previous = await brandScopedRPC<{
      gross_sales: number;
      total_orders: number;
      avg_order_value: number;
    }>("get_reports_summary", {
      p_start_date: prevStartDate.toISOString().split("T")[0],
      p_end_date: prevEndDate.toISOString().split("T")[0],
    });
    // Calculate changes
-    const calcChange = (current: number, previous: number) => {
+    const calcChange = (cur: number, prev: number) => {
-      if (previous === 0) return current > 0 ? 100 : 0;
+      if (prev === 0) return cur > 0 ? 100 : 0;
-      return Math.round(((current - previous) / previous) * 100 * 10) / 10;
+      return Math.round(((cur - prev) / prev) * 100 * 10) / 10;
    };
-    // Get customer count
+    // Active customers (count of `customers` rows scoped to the brand).
-    const customers = await brandScopedFetch<{ count: number }[]>(
+    const customerParams: unknown[] = [];
-      "/communication_contacts",
+    let customerFilter = "";
-      { params: { select: "count", limit: "1" } }
+    if (brandId) {
      customerFilter = "WHERE brand_id = $1::uuid";
      customerParams.push(brandId);
    }
    const customerCountRes = await pool.query<{ count: string }>(
      `SELECT COUNT(*)::text AS count FROM customers ${customerFilter}`,
      customerParams
    );
    const active_customers = parseInt(customerCountRes.rows[0]?.count ?? "0", 10);
    return {
-      total_revenue: current?.gross_sales ?? 0,
+      total_revenue: current.gross_sales,
-      revenue_change: calcChange(current?.gross_sales ?? 0, previous?.gross_sales ?? 0),
+      revenue_change: calcChange(current.gross_sales, previous.gross_sales),
-      total_orders: current?.total_orders ?? 0,
+      total_orders: current.total_orders,
-      orders_change: calcChange(current?.total_orders ?? 0, previous?.total_orders ?? 0),
+      orders_change: calcChange(current.total_orders, previous.total_orders),
-      active_customers: Array.isArray(customers) ? customers[0]?.count ?? 0 : 0,
+      active_customers,
      customers_change: 0,
-      avg_order_value: current?.avg_order_value ?? 0,
+      avg_order_value: current.avg_order_value,
-      aov_change: calcChange(current?.avg_order_value ?? 0, previous?.avg_order_value ?? 0),
+      aov_change: calcChange(current.avg_order_value, previous.avg_order_value),
    };
  } catch (error) {
    console.error("Failed to fetch analytics metrics:", error);
    // Return zeros on error
    return {
      total_revenue: 0,
      revenue_change: 0,
@@ -186,16 +173,35 @@ export async function getAnalyticsMetrics(periodDays: number = 30): Promise<Anal
 export async function getRevenueChart(periodDays: number = 30): Promise<RevenueDataPoint[]> {
  try {
    const adminUser = await getAdminUser();
    if (!adminUser) throw new Error("Not authenticated");
    const brandId = await getActiveBrandId(adminUser);
    const endDate = new Date();
    const startDate = new Date();
    startDate.setDate(startDate.getDate() - periodDays);
-    const data = await brandScopedRPC<RevenueDataPoint[]>("get_revenue_chart", {
+    const params: unknown[] = [startDate.toISOString().split("T")[0], endDate.toISOString().split("T")[0]];
-      p_start_date: startDate.toISOString().split("T")[0],
+    let brandFilter = "";
-      p_end_date: endDate.toISOString().split("T")[0],
+    if (brandId) {
-    });
+      brandFilter = "AND brand_id = $3::uuid";
-
+      params.push(brandId);
-    return data ?? [];
+    }
    const { rows } = await pool.query<{ date: string; revenue: number; orders: number }>(
      `SELECT
         d::date::text AS date,
         COALESCE(SUM(o.total_cents), 0)::float / 100.0 AS revenue,
         COUNT(o.id)::int AS orders
       FROM generate_series($1::date, $2::date, '1 day'::interval) d
       LEFT JOIN orders o
         ON o.placed_at::date = d::date
         AND o.status <> 'canceled'
         ${brandFilter.replace("AND", "AND o.")}
       GROUP BY d::date
       ORDER BY d::date`,
      params
    );
    return rows;
  } catch (error) {
    console.error("Failed to fetch revenue chart:", error);
    return [];
@@ -204,23 +210,50 @@ export async function getRevenueChart(periodDays: number = 30): Promise<RevenueD
 export async function getTopProducts(limit: number = 5): Promise<ProductPerformance[]> {
  try {
-    const result = await brandScopedRPC<Array<{
+    const adminUser = await getAdminUser();
    if (!adminUser) throw new Error("Not authenticated");
    const brandId = await getActiveBrandId(adminUser);
    const startDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString().split("T")[0];
    const endDate = new Date().toISOString().split("T")[0];
    const params: unknown[] = [startDate, endDate];
    let brandFilter = "";
    if (brandId) {
      brandFilter = "AND o.brand_id = $3::uuid";
      params.push(brandId);
    }
    const { rows } = await pool.query<{
      product_id: string;
      product_name: string;
      units_sold: number;
      gross_revenue: number;
      avg_price: number;
-      product_id: string;
+    }>(
-    }>>("get_sales_by_product_report", {
+      `SELECT
-      p_start_date: new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString().split("T")[0],
+         p.id AS product_id,
-      p_end_date: new Date().toISOString().split("T")[0],
+         p.name AS product_name,
-    });
+         COALESCE(SUM(oi.quantity), 0)::int AS units_sold,
         COALESCE(SUM(oi.price_cents * oi.quantity), 0)::float / 100.0 AS gross_revenue,
         COALESCE(ROUND(AVG(oi.price_cents)::numeric, 2), 0)::float / 100.0 AS avg_price
       FROM order_items oi
       JOIN orders o ON o.id = oi.order_id
       JOIN products p ON p.id = oi.product_id
       WHERE o.placed_at::date BETWEEN $1 AND $2
         AND o.status <> 'canceled'
         ${brandFilter}
       GROUP BY p.id, p.name
       ORDER BY gross_revenue DESC
       LIMIT ${Math.max(1, limit)}`,
      params
    );
-    return (result ?? []).slice(0, limit).map(item => ({
+    return rows.map((r) => ({
-      product_id: item.product_id ?? "",
+      product_id: r.product_id ?? "",
-      product_name: item.product_name ?? "Unknown Product",
+      product_name: r.product_name ?? "Unknown Product",
-      units_sold: item.units_sold ?? 0,
+      units_sold: r.units_sold ?? 0,
-      revenue: item.gross_revenue ?? 0,
+      revenue: r.gross_revenue ?? 0,
-      avg_price: item.avg_price ?? 0,
+      avg_price: r.avg_price ?? 0,
    }));
  } catch (error) {
    console.error("Failed to fetch top products:", error);
@@ -232,22 +265,46 @@ export async function getRecentOrders(limit: number = 10): Promise<RecentOrder[]
  try {
    const adminUser = await getAdminUser();
    if (!adminUser) throw new Error("Not authenticated");
    const brandId = await getActiveBrandId(adminUser);
-    const params = new URLSearchParams({
+    const params: unknown[] = [];
-      select: "id,customer_name,subtotal,status,created_at,fulfillment",
+    let brandFilter = "";
      order: "created_at.desc",
      limit: limit.toString(),
    });
    if (brandId) {
-      params.append("brand_id", "eq." + brandId);
+      brandFilter = "WHERE brand_id = $1::uuid";
      params.push(brandId);
    }
    const cappedLimit = Math.max(1, Math.min(limit, 100));
    const { rows } = await pool.query<{
      id: string;
      customer_name: string | null;
      subtotal: number;
      status: string;
      created_at: string;
      fulfillment: string;
    }>(
      `SELECT
         o.id::text AS id,
         c.name AS customer_name,
         o.total_cents::float / 100.0 AS subtotal,
         o.status,
         o.placed_at::text AS created_at,
         o.fulfillment
       FROM orders o
       LEFT JOIN customers c ON c.id = o.customer_id
       ${brandFilter}
       ORDER BY o.placed_at DESC
       LIMIT ${cappedLimit}`,
      params
    );
-    const data = await brandScopedFetch<RecentOrder[]>(`/orders?${params.toString()}`);
+    return rows.map((r) => ({
-
+      id: r.id,
-    return data ?? [];
+      customer_name: r.customer_name ?? "Unknown",
      subtotal: r.subtotal,
      status: r.status,
      created_at: r.created_at,
      fulfillment: r.fulfillment,
    }));
  } catch (error) {
    console.error("Failed to fetch recent orders:", error);
    return [];
@@ -256,26 +313,37 @@ export async function getRecentOrders(limit: number = 10): Promise<RecentOrder[]
 export async function getCustomerGrowth(): Promise<CustomerGrowth> {
  try {
-    const result = await brandScopedRPC<{
+    const adminUser = await getAdminUser();
-      total: number;
+    if (!adminUser) throw new Error("Not authenticated");
-      new_contacts: number;
+    const brandId = await getActiveBrandId(adminUser);
      growth_rate: number;
    }>("get_contact_growth_report", {
      p_start_date: new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString().split("T")[0],
      p_end_date: new Date().toISOString().split("T")[0],
    });
-    // Get total customers
+    const startDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString().split("T")[0];
-    const totalCustomers = await brandScopedFetch<{ count: number }[]>(
+    const endDate = new Date().toISOString().split("T")[0];
-      "/communication_contacts",
+    const params: unknown[] = [startDate, endDate];
-      { params: { select: "count", limit: "1" } }
+    let brandFilter = "";
    if (brandId) {
      brandFilter = "AND brand_id = $3::uuid";
      params.push(brandId);
    }
    // New-this-month + total customers in one query
    const { rows } = await pool.query<{ total: number; new_count: number }>(
      `SELECT
         COUNT(*)::int AS total,
         COUNT(*) FILTER (WHERE created_at::date BETWEEN $1 AND $2)::int AS new_count
       FROM customers
       WHERE 1=1 ${brandFilter}`,
      params
    );
    const total = rows[0]?.total ?? 0;
    const newThisMonth = rows[0]?.new_count ?? 0;
    const growthRate = total > 0 ? (newThisMonth / total) * 100 : 0;
    return {
-      total_customers: Array.isArray(totalCustomers) ? totalCustomers[0]?.count ?? 0 : 0,
+      total_customers: total,
-      new_this_month: result?.new_contacts ?? 0,
+      new_this_month: newThisMonth,
      retention_rate: 85,
-      growth_rate: result?.growth_rate ?? 0,
+      growth_rate: Math.round(growthRate * 10) / 10,
    };
  } catch (error) {
    console.error("Failed to fetch customer growth:", error);
@@ -289,25 +357,23 @@ export async function getCustomerGrowth(): Promise<CustomerGrowth> {
 }
 export async function getConversionFunnel(): Promise<ConversionFunnel[]> {
  // Return a standardized funnel based on order data
  try {
    const adminUser = await getAdminUser();
    if (!adminUser) throw new Error("Not authenticated");
    const brandId = await getActiveBrandId(adminUser);
-    const params = new URLSearchParams({
+    const params: unknown[] = [];
-      select: "id,status",
+    let brandFilter = "";
      limit: "1000",
    });
    if (brandId) {
-      params.append("brand_id", "eq." + brandId);
+      brandFilter = "WHERE brand_id = $1::uuid";
      params.push(brandId);
    }
    const { rows } = await pool.query<{ status: string }>(
      `SELECT status FROM orders ${brandFilter} LIMIT 1000`,
      params
    );
-    const orders = await brandScopedFetch<Array<{ status: string }>>(`/orders?${params.toString()}`);
+    const total = rows.length;
    const total = orders?.length ?? 0;
    if (total === 0) {
      return [
        { stage: "Visitors", count: 0, rate: 0 },
@@ -318,7 +384,7 @@ export async function getConversionFunnel(): Promise<ConversionFunnel[]> {
      ];
    }
-    const purchased = orders?.filter(o => o.status !== "cancelled").length ?? 0;
+    const purchased = rows.filter((o) => o.status !== "canceled").length;
    const checkout = Math.round(purchased * 1.5);
    const addToCart = Math.round(checkout * 2.6);
    const productViews = Math.round(addToCart * 2.7);
@@ -1,7 +1,7 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 export type AuditAction = "INSERT" | "UPDATE" | "DELETE";
@@ -21,15 +21,11 @@ type AuditResult =
 /**
 * Logs an audit event to the audit_logs table.
 *
- * In dev mode (dev_session cookie), uses the dev user identity.
+ * Resolves the admin user from the Auth.js session via getAdminUser().
- * In production (Supabase auth), resolves the admin user from admin_users.
+ * Audit writes go through the `log_audit_event` SECURITY DEFINER
- *
+ * PL/pgSQL function via the shared pg pool — no Supabase REST hop.
 * Audit writes bypass RLS via the SECURITY DEFINER log_audit_event RPC function.
 */
 export async function logAuditEvent(payload: AuditPayload): Promise<AuditResult> {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  const adminUser = await getAdminUser();
  const performed_by = adminUser?.user_id ?? null;
@@ -51,26 +47,22 @@ export async function logAuditEvent(payload: AuditPayload): Promise<AuditResult>
    brand_id: payload.brand_id ?? null,
  };
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/log_audit_event`,
+    const { rows } = await pool.query<{ id?: string }>(
-    {
+      "SELECT * FROM log_audit_event($1::jsonb)",
-      method: "POST",
+      [JSON.stringify(rpcPayload)],
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json", Prefer: "return=representation" },
+    );
-      body: JSON.stringify({ p_payload: rpcPayload }),
+    const auditId = typeof rows[0] === "string"
      ? rows[0]
      : rows[0]?.id;
    if (!auditId) {
      return { success: false, error: "Audit log written but ID not returned" };
    }
-  );
+    return { success: true, audit_id: auditId };
-
+  } catch (err) {
-  if (!response.ok) {
+    return {
-    const err = await response.json().catch(() => ({ message: "Unknown error" }));
+      success: false,
-    return { success: false, error: err.message ?? "Failed to write audit log" };
+      error: err instanceof Error ? err.message : "Failed to write audit log",
    };
  }
  const data = await response.json();
  const auditId = typeof data === "string" ? data : data?.[0]?.id ?? data?.id;
  if (!auditId) {
    return { success: false, error: "Audit log written but ID not returned" };
  }
  return { success: true, audit_id: auditId };
 }
@@ -0,0 +1,14 @@
 "use server";
 import "server-only";
 import { signOut } from "@/lib/auth";
 import { redirect } from "next/navigation";
 /**
 * Sign out and clear the Neon Auth session cookie.
 */
 export async function signOutAction(): Promise<void> {
  console.log("[auth/sign-out] Signing out");
  await signOut();
  redirect("/login");
 }
@@ -1,56 +0,0 @@
 "use server";
 import { signIn, signOut } from "@/lib/auth";
 import { AuthError } from "next-auth";
 /**
 * Server actions that wrap the Auth.js v5 `signIn` / `signOut` API for
 * use from client components.
 *
 * Why server actions?
 *   • The Auth.js v5 `signIn` function has to run on the server (it
 *     needs to set the session cookie, talk to the database adapter,
 *     and redirect the user to the OAuth provider).
 *   • Calling it from a client component via a server action keeps the
 *     client bundle small and avoids exposing the OAuth client secret.
 *
 * Usage from a client component:
 *   <form action={signInWithGoogle}>
 *     <button type="submit">Sign in with Google</button>
 *   </form>
 *
 * Usage for the dev credentials provider (dev only):
 *   <form action={signInWithDev}>
 *     <input name="username" />
 *     <input name="password" type="password" />
 *     <button type="submit">Dev login</button>
 *   </form>
 */
 export async function signInWithGoogle(): Promise<void> {
  await signIn("google", { redirectTo: "/admin" });
 }
 export async function signInWithDev(formData: FormData): Promise<void> {
  const username = String(formData.get("username") ?? "admin");
  const password = String(formData.get("password") ?? "dev");
  try {
    await signIn("dev-login", {
      username,
      password,
      redirectTo: "/admin",
    });
  } catch (e) {
    // signIn() throws a `NEXT_REDIRECT` to navigate — let that through
    // so the redirect actually happens. Re-throw any other error so the
    // caller can render a meaningful message.
    if (e instanceof AuthError) {
      throw new Error(`Dev sign-in failed: ${e.type}`);
    }
    throw e;
  }
 }
 export async function signOutAction(): Promise<void> {
  await signOut({ redirectTo: "/login" });
 }
@@ -36,12 +36,12 @@
 */
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { withBrand } from "@/db/client";
 import { products } from "@/db/schema";
 import { and, eq, count } from "drizzle-orm";
 import { ADDONS, PLAN_TIERS, type AddonKey, type PlanTierKey } from "@/lib/pricing";
 const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
 const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
 export type BillingSubscriptionStatus =
  | "active"
  | "trialing"
@@ -97,48 +97,76 @@ export async function getBillingOverview(
    if (!brandId) return { success: false, error: "brandId required" };
    // 1) Plan info (plan_tier + limits + usage via get_brand_plan_info)
-    const planRes = await fetch(
+    //    Replicate the RPC inline via raw SQL on tenants + plans.
-      `${supabaseUrl}/rest/v1/rpc/get_brand_plan_info`,
+    const planRes = await pool.query<{
-      {
+      plan_tier: string;
-        method: "POST",
+      plan_name: string | null;
-        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      max_users: number;
-        body: JSON.stringify({ p_brand_id: brandId }),
+      max_stops_monthly: number;
-      }
+      max_products: number;
      usage: { users: number; stops_this_month: number; products: number } | null;
    }>(
      `SELECT
         t.plan_tier,
         t.name AS plan_name,
         COALESCE(t.max_users, 1) AS max_users,
         COALESCE(t.max_stops_monthly, 10) AS max_stops_monthly,
         COALESCE(t.max_products, 25) AS max_products,
         jsonb_build_object(
           'users', (SELECT count(*)::int FROM admin_user_brands tu WHERE tu.brand_id = t.id),
           'stops_this_month', (SELECT count(*)::int FROM stops s
                                WHERE s.brand_id = t.id
                                  AND s.created_at >= date_trunc('month', now())),
           'products', (SELECT count(*)::int FROM products p
                        WHERE p.brand_id = t.id AND p.active = true AND p.deleted_at IS NULL)
         ) AS usage
       FROM brands t
       WHERE t.id = $1`,
      [brandId]
    );
-    const planData = planRes.ok ? await planRes.json() : null;
+    const planData = planRes.rows[0] ?? null;
    // 2) Brand row: subscription state, name, stripe_customer_id
-    const brandRes = await fetch(
+    const brandRes = await pool.query<{
-      `${supabaseUrl}/rest/v1/brands?id=eq.${brandId}&select=name,stripe_customer_id,stripe_subscription_id,stripe_subscription_status,stripe_current_period_end`,
+      name: string;
-      { headers: svcHeaders(supabaseKey) }
+      stripe_customer_id: string | null;
      stripe_subscription_id: string | null;
      stripe_subscription_status: string | null;
      stripe_current_period_end: string | null;
    }>(
      `SELECT name, stripe_customer_id, NULL::text AS stripe_subscription_id,
              NULL::text AS stripe_subscription_status, NULL::text AS stripe_current_period_end
       FROM brands WHERE id = $1`,
      [brandId]
    );
-    const brandRows = brandRes.ok ? await brandRes.json() : [];
+    const brand = brandRes.rows[0] ?? null;
    const brand = Array.isArray(brandRows) ? brandRows[0] : null;
-    // 3) Enabled add-ons (feature flags)
+    // 3) Enabled add-ons (feature flags from brand_settings)
-    const addonsRes = await fetch(
+    const addonsRes = await pool.query<{ feature_flags: Record<string, unknown> | null }>(
-      `${supabaseUrl}/rest/v1/rpc/get_brand_features`,
+      `SELECT feature_flags FROM brand_settings WHERE brand_id = $1`,
-      {
+      [brandId]
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({ p_brand_id: brandId }),
      }
    );
-    const enabledAddons = addonsRes.ok ? await addonsRes.json() : {};
+    const flags = addonsRes.rows[0]?.feature_flags ?? {};
    const enabledAddons: Record<string, boolean> = {};
    for (const [k, v] of Object.entries(flags ?? {})) {
      enabledAddons[k] = v === true || v === "true" || v === 1 || v === "1";
    }
    // 4) Active product count — same semantics as the dashboard
-    //    (active=true AND deleted_at IS NULL). Keeps the billing page in
+    //    (active=true). Keeps the billing page in sync with /admin
-    //    sync with /admin "Active Products" stat.
+    //    "Active Products" stat.
-    const productRes = await fetch(
+    const productCountRows = await withBrand(brandId, (db) =>
-      `${supabaseUrl}/rest/v1/products?select=id&brand_id=eq.${brandId}&active=eq.true&deleted_at=is.null&limit=1000`,
+      db
-      { headers: { ...svcHeaders(supabaseKey), Prefer: "count=exact" } }
+        .select({ value: count() })
        .from(products)
        .where(
          and(
            eq(products.brandId, brandId),
            eq(products.active, true)
          )
        )
    );
-    const productCountHeader = productRes.headers.get("Content-Range");
+    const activeProductCount = Number(productCountRows[0]?.value ?? 0);
    let activeProductCount = 0;
    if (productCountHeader && productCountHeader.includes("/")) {
      const total = productCountHeader.split("/").pop();
      activeProductCount = parseInt(total ?? "0", 10) || 0;
    }
    // 5) Admin context (so we know if the user can manage / is platform)
    const adminUser = await getAdminUser();
@@ -146,7 +174,7 @@ export async function getBillingOverview(
    const canManageBilling = isPlatformAdmin || !!adminUser?.can_manage_settings;
    // ── Normalize plan data ──────────────────────────────────────────────────
-    const planTier = (planData?.plan_tier ?? "starter") as PlanTierKey;
+    const planTier = ((planData?.plan_tier as PlanTierKey | undefined) ?? "starter");
    const limits = {
      max_users: planData?.max_users ?? 1,
      max_stops_monthly: planData?.max_stops_monthly ?? 10,
@@ -209,7 +237,7 @@ export async function getBillingOverview(
      success: true,
      data: {
        brandId,
-        brandName: brand?.name ?? planData?.brand_name ?? null,
+        brandName: brand?.name ?? planData?.plan_name ?? null,
        planTier,
        planCycle,
        planMonthlyPrice,
@@ -220,7 +248,7 @@ export async function getBillingOverview(
        currentPeriodEnd: brand?.stripe_current_period_end ?? null,
        limits,
        usage,
-        enabledAddons: (enabledAddons ?? {}) as Record<string, boolean>,
+        enabledAddons,
        addons,
        displayedInvoiceAmount,
        monthlyTotal,
@@ -1,6 +1,6 @@
 "use server";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 type LineItem = {
  id: string;
@@ -9,6 +9,9 @@ type LineItem = {
  quantity: number;
 };
 // Stripe API version type - using const assertion for type safety
 type StripeApiVersion = "2026-05-27.dahlia";
 export async function createRetailStripeCheckoutSession(
  items: LineItem[],
  orderId: string,
@@ -20,7 +23,7 @@ export async function createRetailStripeCheckoutSession(
  if (!stripeKey) return { success: false, error: "Stripe not configured on this server." };
  const Stripe = (await import("stripe")).default;
-  const stripe = new Stripe(stripeKey, { apiVersion: "2026-04-22.dahlia" as any });
+  const stripe = new Stripe(stripeKey, { apiVersion: "2026-05-27.dahlia" as StripeApiVersion });
  const lineItems = items.map((item) => ({
    price_data: {
@@ -32,16 +35,13 @@ export async function createRetailStripeCheckoutSession(
  }));
  // Get brand name for Stripe metadata
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  let brandName = "Route Commerce";
  try {
-    const brandRes = await fetch(
+    const brandRes = await pool.query<{ name: string }>(
-      `${supabaseUrl}/rest/v1/brands?id=eq.${brandId}&select=name`,
+      "SELECT name FROM brands WHERE id = $1 LIMIT 1",
-      { headers: { ...svcHeaders(supabaseKey) } }
+      [brandId]
    );
-    const brands = await brandRes.json() as Array<{ name: string }>;
+    if (brandRes.rows[0]?.name) brandName = brandRes.rows[0].name;
    if (brands?.[0]?.name) brandName = brands[0].name;
  } catch {
    // use default
  }
@@ -1,6 +1,9 @@
 "use server";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 // Stripe API version type
 type StripeApiVersion = "2026-05-27.dahlia";
 /**
 * Creates a Stripe PaymentIntent for the supplied cart so the browser
@@ -46,7 +49,7 @@ export async function createRetailPaymentIntent(
  }
  const Stripe = (await import("stripe")).default;
-  const stripe = new Stripe(stripeKey, { apiVersion: "2026-04-22.dahlia" as any });
+  const stripe = new Stripe(stripeKey, { apiVersion: "2026-05-27.dahlia" as StripeApiVersion });
  // Compute the subtotal in cents. We don't compute sales tax here —
  // Stripe's `automatic_tax` would be ideal but requires address collection
@@ -63,17 +66,14 @@ export async function createRetailPaymentIntent(
  }
  // Pull the brand name for Stripe receipts + metadata
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  let brandName = "Route Commerce";
-  if (supabaseUrl && supabaseKey && brandId) {
+  if (brandId) {
    try {
-      const brandRes = await fetch(
+      const brandRes = await pool.query<{ name: string }>(
-        `${supabaseUrl}/rest/v1/brands?id=eq.${brandId}&select=name`,
+        "SELECT name FROM brands WHERE id = $1 LIMIT 1",
-        { headers: { ...svcHeaders(supabaseKey) } }
+        [brandId]
      );
-      const brands = (await brandRes.json()) as Array<{ name: string }>;
+      if (brandRes.rows[0]?.name) brandName = brandRes.rows[0].name;
      if (brands?.[0]?.name) brandName = brands[0].name;
    } catch {
      // ignore — use default
    }
@@ -1,7 +1,10 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 // Stripe API version type - using const assertion for type safety
 type StripeApiVersion = "2026-05-27.dahlia";
 // ── Price ID config ────────────────────────────────────────────────────────────
 // Maps plan/addon keys to Stripe price IDs via environment variables
@@ -43,22 +46,18 @@ export async function createStripeCheckoutSession(
  const priceId = getPriceId(priceKey);
  if (!priceId) return { success: false, error: `No Stripe price configured for "${priceKey}". Set ${priceKey.toUpperCase()}_PRICE in your environment.` };
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  // Get brand's Stripe customer ID
-  const custRes = await fetch(
+  const custRes = await pool.query<{ stripe_customer_id: string | null; name: string }>(
-    `${supabaseUrl}/rest/v1/brands?id=eq.${brandId}&select=stripe_customer_id,name`,
+    "SELECT stripe_customer_id, name FROM brands WHERE id = $1 LIMIT 1",
-    { headers: { ...svcHeaders(supabaseKey) } }
+    [brandId]
  );
-  const brands = await custRes.json() as Array<{ stripe_customer_id: string | null; name: string }>;
+  const brand = custRes.rows[0];
  const brand = brands[0];
  if (!brand?.stripe_customer_id) {
    return { success: false, error: "No Stripe customer found. Complete Stripe setup in Payments settings first." };
  }
  const Stripe = (await import("stripe")).default;
-  const stripe = new Stripe(stripeKey, { apiVersion: "2026-04-22.dahlia" as any });
+  const stripe = new Stripe(stripeKey, { apiVersion: "2026-05-27.dahlia" as StripeApiVersion });
  const siteUrl = process.env.NEXT_PUBLIC_SITE_URL ?? "http://localhost:3000";
@@ -123,26 +122,21 @@ export async function cancelAddonSubscription(
  const stripeKey = process.env.STRIPE_SECRET_KEY;
  if (!stripeKey) return { success: false, error: "Stripe not configured" };
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  // Get active subscription for this brand
-  const subRes = await fetch(
+  const subRes = await pool.query<{ stripe_subscription_id: string | null }>(
-    `${supabaseUrl}/rest/v1/rpc/get_brand_subscription`,
+    "SELECT stripe_subscription_id FROM subscriptions WHERE brand_id = $1 LIMIT 1",
-    {
+    [brandId]
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
-  if (!subRes.ok) return { success: false, error: "Failed to get subscription" };
+  if (subRes.rows.length === 0) {
-  const subData = await subRes.json() as { stripe_subscription_id?: string };
+    return { success: false, error: "No active subscription found" };
  }
  const subData = subRes.rows[0];
  if (!subData?.stripe_subscription_id) {
    return { success: false, error: "No active subscription found" };
  }
  const Stripe = (await import("stripe")).default;
-  const stripe = new Stripe(stripeKey, { apiVersion: "2026-04-22.dahlia" as any });
+  const stripe = new Stripe(stripeKey, { apiVersion: "2026-05-27.dahlia" as StripeApiVersion });
  // Retrieve subscription and find the item for this add-on
  const subscription = await stripe.subscriptions.retrieve(subData.stripe_subscription_id);
@@ -162,14 +156,14 @@ export async function cancelAddonSubscription(
  });
  // Disable the feature flag locally
-  await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/set_brand_feature`,
+    await pool.query(
-    {
+      "SELECT set_brand_feature($1, $2, $3)",
-      method: "POST",
+      [brandId, addonKey, false]
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    );
-      body: JSON.stringify({ p_brand_id: brandId, p_feature_key: addonKey, p_enabled: false }),
+  } catch {
-    }
+    // best-effort: webhook reconciliation will eventually fix the flag
-  );
+  }
  return { success: true };
 }
@@ -1,7 +1,30 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 // Stripe API version type
 type StripeApiVersion = "2026-05-27.dahlia";
 // Type for plan info response
 type PlanInfo = {
  plan_tier: string;
  plan_name: string | null;
  max_users: number;
  max_stops_monthly: number;
  max_products: number;
  usage: { users: number; stops_this_month: number; products: number } | null;
 };
 // Type for wholesale order
 type WholesaleOrder = {
  id: string;
  created_at: Date;
  customer_name: string;
  total: number;
  status: string;
  [key: string]: unknown;
 };
 export async function getStripeBillingPortalUrl(brandId: string): Promise<{ success: boolean; url?: string; error?: string }> {
  const adminUser = await getAdminUser();
@@ -13,23 +36,19 @@ export async function getStripeBillingPortalUrl(brandId: string): Promise<{ succ
  const stripeKey = process.env.STRIPE_SECRET_KEY;
  if (!stripeKey) return { success: false, error: "Stripe not configured" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  // Get stripe_customer_id from tenants table
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+  const custRes = await pool.query<{ stripe_customer_id: string | null }>(
-
+    "SELECT stripe_customer_id FROM brands WHERE id = $1 LIMIT 1",
-  // Get stripe_customer_id from brands table
+    [brandId]
  const custRes = await fetch(
    `${supabaseUrl}/rest/v1/brands?id=eq.${brandId}&select=stripe_customer_id`,
    { headers: svcHeaders(supabaseKey) }
  );
-  const custData = await custRes.json();
+  const stripeCustomerId = custRes.rows[0]?.stripe_customer_id;
  const stripeCustomerId = custData?.[0]?.stripe_customer_id;
  if (!stripeCustomerId) {
    return { success: false, error: "No Stripe customer found. Complete Stripe setup in Payments settings first." };
  }
  const Stripe = (await import("stripe")).default;
-  const stripe = new Stripe(stripeKey, { apiVersion: "2026-04-22.dahlia" as any });
+  const stripe = new Stripe(stripeKey, { apiVersion: "2026-05-27.dahlia" as StripeApiVersion });
  const session = await stripe.billingPortal.sessions.create({
    customer: stripeCustomerId,
@@ -49,20 +68,15 @@ export async function updateBrandPlanTier(brandId: string, planTier: string): Pr
    return { success: false, error: "Invalid plan tier" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    await pool.query(
-
+      "SELECT update_brand_plan_tier($1, $2)",
-  const res = await fetch(
+      [brandId, planTier]
-    `${supabaseUrl}/rest/v1/rpc/update_brand_plan_tier`,
+    );
-    {
+    return { success: true };
-      method: "POST",
+  } catch {
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    return { success: false, error: "Failed to update plan tier" };
-      body: JSON.stringify({ p_brand_id: brandId, p_plan_tier: planTier }),
+  }
    }
  );
  if (!res.ok) return { success: false, error: "Failed to update plan tier" };
  return { success: true };
 }
 export async function updateBrandStripeCustomerId(brandId: string, stripeCustomerId: string): Promise<{ success: boolean; error?: string }> {
@@ -72,76 +86,76 @@ export async function updateBrandStripeCustomerId(brandId: string, stripeCustome
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    await pool.query(
-
+      "SELECT update_brand_stripe_customer_id($1, $2)",
-  const res = await fetch(
+      [brandId, stripeCustomerId]
-    `${supabaseUrl}/rest/v1/rpc/update_brand_stripe_customer_id`,
+    );
-    {
+    return { success: true };
-      method: "POST",
+  } catch {
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    return { success: false, error: "Failed to update Stripe customer ID" };
-      body: JSON.stringify({ p_brand_id: brandId, p_stripe_customer_id: stripeCustomerId }),
+  }
    }
  );
  if (!res.ok) return { success: false, error: "Failed to update Stripe customer ID" };
  return { success: true };
 }
-export async function getBrandPlanInfo(brandId: string): Promise<{ success: boolean; data?: any; error?: string }> {
+export async function getBrandPlanInfo(brandId: string): Promise<{ success: boolean; data?: PlanInfo; error?: string }> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  // Replicate get_brand_plan_info via a JOIN on tenants + plans
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+  const res = await pool.query<{
-
+    plan_tier: string;
-  const res = await fetch(
+    plan_name: string | null;
-    `${supabaseUrl}/rest/v1/rpc/get_brand_plan_info`,
+    max_users: number;
-    {
+    max_stops_monthly: number;
-      method: "POST",
+    max_products: number;
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    usage: { users: number; stops_this_month: number; products: number } | null;
-      body: JSON.stringify({ p_brand_id: brandId }),
+  }>(
-    }
+    `SELECT
       t.plan_tier,
       t.name AS plan_name,
       COALESCE(t.max_users, 1) AS max_users,
       COALESCE(t.max_stops_monthly, 10) AS max_stops_monthly,
       COALESCE(t.max_products, 25) AS max_products,
       jsonb_build_object(
         'users', (SELECT count(*)::int FROM admin_user_brands tu WHERE tu.brand_id = t.id),
         'stops_this_month', (SELECT count(*)::int FROM stops s
                              WHERE s.brand_id = t.id
                                AND s.created_at >= date_trunc('month', now())),
         'products', (SELECT count(*)::int FROM products p
                      WHERE p.brand_id = t.id AND p.active = true AND p.deleted_at IS NULL)
       ) AS usage
     FROM brands t
     WHERE t.id = $1`,
    [brandId]
  );
-  if (!res.ok) return { success: false, error: "Failed to fetch plan info" };
+  const data = res.rows[0];
-  const data = await res.json();
+  if (!data) return { success: false, error: "Brand not found" };
  if (!Array.isArray(data) && typeof data !== "object") return { success: false, error: "Invalid plan info response" };
  return { success: true, data };
 }
 export async function getEnabledAddons(brandId: string): Promise<Record<string, boolean>> {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  const res = await fetch(
    `${supabaseUrl}/rest/v1/rpc/get_brand_features`,
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
  // get_brand_features returns JSONB — a single object, not an array
-  if (!res.ok) return {};
+  const res = await pool.query<{ feature_flags: Record<string, unknown> | null }>(
-  const data = await res.json();
+    "SELECT feature_flags FROM brand_settings WHERE brand_id = $1 LIMIT 1",
-  if (typeof data !== "object" || data === null) return {};
+    [brandId]
  return data as Record<string, boolean>;
 }
 export async function getRecentWholesaleOrders(brandId: string, limit = 20): Promise<any[]> {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  const res = await fetch(
    `${supabaseUrl}/rest/v1/rpc/get_wholesale_orders`,
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
-
+  const flags = res.rows[0]?.feature_flags ?? {};
-  if (!res.ok) return [];
+  if (!flags || typeof flags !== "object") return {};
-  const data = await res.json();
+  const out: Record<string, boolean> = {};
-  if (!Array.isArray(data)) return [];
+  for (const [k, v] of Object.entries(flags)) {
-  return data.slice(0, limit);
+    out[k] = v === true || v === "true" || v === 1 || v === "1";
  }
  return out;
 }
 export async function getRecentWholesaleOrders(brandId: string, limit = 20): Promise<WholesaleOrder[]> {
  try {
    const res = await pool.query(
      "SELECT * FROM get_wholesale_orders($1)",
      [brandId]
    );
    const data = res.rows;
    if (!Array.isArray(data)) return [];
    return data.slice(0, limit);
  } catch {
    return [];
  }
 }
@@ -1,12 +1,18 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { uploadObject, BUCKETS } from "@/lib/storage";
 export type UploadLogoResult =
  | { success: true; logoUrl: string }
  | { success: false; error: string };
 /**
 * Upload a brand logo (light or dark variant) to MinIO and save the
 * resulting public URL to the brand_settings row via the
 * `upsert_brand_settings` SECURITY DEFINER RPC.
 */
 export async function uploadBrandLogo(
  brandId: string,
  file: File,
@@ -31,47 +37,28 @@ export async function uploadBrandLogo(
  const ext = file.type === "image/svg+xml" ? "svg" : file.type.split("/")[1];
  const path = isDark ? `logo-dark.${ext}` : `logo.${ext}`;
-  const storagePath = `brand-logos/${brandId}/${path}`;
+  const storageKey = `brand-logos/${brandId}/${path}`;
-  const arrayBuffer = await file.arrayBuffer();
+  try {
-  const buffer = Buffer.from(arrayBuffer);
+    const buffer = Buffer.from(await file.arrayBuffer());
-
+    const logoUrl = await uploadObject({
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+      bucket: BUCKETS.BRAND_LOGOS,
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+      key: storageKey,
  const uploadRes = await fetch(
    `${supabaseUrl}/storage/v1/object/brand-logos/${storagePath}`,
    {
      method: "PUT",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": file.type, "x-upsert": "true" },
      body: buffer,
      contentType: file.type,
    });
    const saveOk = await callUpsertBrandSettings(brandId, {
      [isDark ? "p_logo_url_dark" : "p_logo_url"]: logoUrl,
    });
    if (!saveOk) {
      return { success: false, error: "Upload succeeded but failed to save URL" };
    }
  );
-  if (!uploadRes.ok) {
+    return { success: true, logoUrl };
-    return { success: false, error: `Upload failed: ${await uploadRes.text()}` };
+  } catch (err) {
    return { success: false, error: `Upload failed: ${err instanceof Error ? err.message : String(err)}` };
  }
  const publicUrl = `${supabaseUrl}/storage/v1/object/public/brand-logos/${storagePath}`;
  // Save URL to brand_settings via RPC
  const saveRes = await fetch(
    `${supabaseUrl}/rest/v1/rpc/upsert_brand_settings`,
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_brand_id: brandId,
        [isDark ? "p_logo_url_dark" : "p_logo_url"]: publicUrl,
      }),
    }
  );
  if (!saveRes.ok) {
    return { success: false, error: "Upload succeeded but failed to save URL" };
  }
  return { success: true, logoUrl: publicUrl };
 }
 export async function uploadOlatheSweetLogo(
@@ -96,46 +83,28 @@ export async function uploadOlatheSweetLogo(
  }
  const ext = file.type === "image/svg+xml" ? "svg" : file.type.split("/")[1];
-  const storagePath = `brand-logos/${brandId}/olathe-sweet-logo.${ext}`;
+  const storageKey = `brand-logos/${brandId}/olathe-sweet-logo.${ext}`;
-  const arrayBuffer = await file.arrayBuffer();
+  try {
-  const buffer = Buffer.from(arrayBuffer);
+    const buffer = Buffer.from(await file.arrayBuffer());
-
+    const logoUrl = await uploadObject({
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+      bucket: BUCKETS.BRAND_LOGOS,
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+      key: storageKey,
  const uploadRes = await fetch(
    `${supabaseUrl}/storage/v1/object/brand-logos/${storagePath}`,
    {
      method: "PUT",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": file.type, "x-upsert": "true" },
      body: buffer,
      contentType: file.type,
    });
    const saveOk = await callUpsertBrandSettings(brandId, {
      p_olathe_sweet_logo_url: logoUrl,
    });
    if (!saveOk) {
      return { success: false, error: "Upload succeeded but failed to save URL" };
    }
  );
-  if (!uploadRes.ok) {
+    return { success: true, logoUrl };
-    return { success: false, error: `Upload failed: ${await uploadRes.text()}` };
+  } catch (err) {
    return { success: false, error: `Upload failed: ${err instanceof Error ? err.message : String(err)}` };
  }
  const publicUrl = `${supabaseUrl}/storage/v1/object/public/brand-logos/${storagePath}`;
  const saveRes = await fetch(
    `${supabaseUrl}/rest/v1/rpc/upsert_brand_settings`,
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_brand_id: brandId,
        p_olathe_sweet_logo_url: publicUrl,
      }),
    }
  );
  if (!saveRes.ok) {
    return { success: false, error: "Upload succeeded but failed to save URL" };
  }
  return { success: true, logoUrl: publicUrl };
 }
 export async function uploadOlatheSweetLogoDark(
@@ -160,46 +129,57 @@ export async function uploadOlatheSweetLogoDark(
  }
  const ext = file.type === "image/svg+xml" ? "svg" : file.type.split("/")[1];
-  const storagePath = `brand-logos/${brandId}/olathe-sweet-logo-dark.${ext}`;
+  const storageKey = `brand-logos/${brandId}/olathe-sweet-logo-dark.${ext}`;
-  const arrayBuffer = await file.arrayBuffer();
+  try {
-  const buffer = Buffer.from(arrayBuffer);
+    const buffer = Buffer.from(await file.arrayBuffer());
-
+    const logoUrl = await uploadObject({
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+      bucket: BUCKETS.BRAND_LOGOS,
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+      key: storageKey,
  const uploadRes = await fetch(
    `${supabaseUrl}/storage/v1/object/brand-logos/${storagePath}`,
    {
      method: "PUT",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": file.type, "x-upsert": "true" },
      body: buffer,
      contentType: file.type,
    });
    const saveOk = await callUpsertBrandSettings(brandId, {
      p_olathe_sweet_logo_url_dark: logoUrl,
    });
    if (!saveOk) {
      return { success: false, error: "Upload succeeded but failed to save URL" };
    }
  );
-  if (!uploadRes.ok) {
+    return { success: true, logoUrl };
-    return { success: false, error: `Upload failed: ${await uploadRes.text()}` };
+  } catch (err) {
    return { success: false, error: `Upload failed: ${err instanceof Error ? err.message : String(err)}` };
  }
 }
-  const publicUrl = `${supabaseUrl}/storage/v1/object/public/brand-logos/${storagePath}`;
+/**
 * Internal helper: invoke the SECURITY DEFINER `upsert_brand_settings`
 * RPC via the shared pg pool. Accepts a partial args object whose keys
 * map to the function's `p_*` parameters.
 */
 async function callUpsertBrandSettings(
  brandId: string,
  args: Record<string, unknown>
 ): Promise<boolean> {
  // Always set the brand id.
  args.p_brand_id = brandId;
-  const saveRes = await fetch(
+  // Build a `$1, $2, ...` parameter list in deterministic key order so
-    `${supabaseUrl}/rest/v1/rpc/upsert_brand_settings`,
+  // the positional binds line up with the named parameters.
-    {
+  const keys = Object.keys(args);
-      method: "POST",
+  const placeholders = keys.map((_, i) => `$${i + 1}`).join(", ");
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  const params = keys.map((k) => args[k]);
      body: JSON.stringify({
        p_brand_id: brandId,
        p_olathe_sweet_logo_url_dark: publicUrl,
      }),
    }
  );
-  if (!saveRes.ok) {
+  try {
-    return { success: false, error: "Upload succeeded but failed to save URL" };
+    await pool.query(
      `SELECT upsert_brand_settings(${placeholders})`,
      params,
    );
    return true;
  } catch {
    return false;
  }
  return { success: true, logoUrl: publicUrl };
 }
 export type BrandSettings = {
@@ -252,52 +232,35 @@ export type SaveBrandSettingsResult =
  | { success: false; error: string };
 export async function getBrandSettings(brandId: string): Promise<GetBrandSettingsResult> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const { rows } = await pool.query<BrandSettings>(
-
+      "SELECT * FROM get_brand_settings($1)",
-  const response = await fetch(
+      [brandId],
-    `${supabaseUrl}/rest/v1/rpc/get_brand_settings`,
+    );
-    {
+    return { success: true, settings: rows[0] ?? null };
-      method: "POST",
+  } catch {
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    return { success: false, error: "Failed to fetch brand settings" };
-      body: JSON.stringify({ p_brand_id: brandId }),
+  }
    }
  );
  if (!response.ok) return { success: false, error: "Failed to fetch brand settings" };
  const data = await response.json();
  return { success: true, settings: data };
 }
 // Public version for storefront pages — uses slug, no auth required
 export async function getBrandSettingsPublic(brandSlug: string): Promise<GetBrandSettingsResult & { wholesaleEnabled?: boolean | null }> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  // Wrapped in try/catch so a build-time DB outage (ECONNREFUSED) doesn't
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+  // crash the prerender — the page just falls back to its default brand
-  // Build-time prerender runs before Supabase env is configured. Return
+  // name and revalidates from a real request later.
  // a not-configured result; the page falls back to slug-based defaults.
  if (!supabaseUrl || !supabaseKey) {
    return { success: false, error: "Supabase not configured", wholesaleEnabled: undefined };
  }
  // Wrapped in try/catch so a build-time Supabase outage (ECONNREFUSED)
  // doesn't crash the prerender — the page just falls back to its
  // default brand name and revalidates from a real request later.
  try {
-    const response = await fetch(
+    const { rows } = await pool.query<BrandSettings & { wholesale_enabled?: boolean | null }>(
-      `${supabaseUrl}/rest/v1/rpc/get_brand_settings_by_slug`,
+      "SELECT * FROM get_brand_settings_by_slug($1)",
-      {
+      [brandSlug],
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({ p_brand_slug: brandSlug }),
      }
    );
-
+    const data = rows[0];
-    if (!response.ok) return { success: false, error: "Failed to fetch brand settings", wholesaleEnabled: undefined };
+    if (!data) {
-    const data = await response.json();
+      return { success: false, error: "Failed to fetch brand settings", wholesaleEnabled: undefined };
    }
    return {
      success: true,
      settings: data,
-      wholesaleEnabled: data?.wholesale_enabled,
+      wholesaleEnabled: data.wholesale_enabled,
    };
  } catch {
    return { success: false, error: "Failed to fetch brand settings", wholesaleEnabled: undefined };
@@ -349,60 +312,52 @@ export async function saveBrandSettings(params: {
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const { rows } = await pool.query<BrandSettings>(
-
+      `SELECT * FROM upsert_brand_settings(
-  const response = await fetch(
+         $1, $2, $3, $4, $5, $6, $7, $8, $9, $10,
-    `${supabaseUrl}/rest/v1/rpc/upsert_brand_settings`,
+         $11, $12, $13, $14, $15, $16, $17, $18, $19, $20,
-    {
+         $21, $22, $23, $24, $25, $26, $27, $28, $29, $30,
-      method: "POST",
+         $31, $32
-      headers: {
+       )`,
-        ...svcHeaders(supabaseKey),
+      [
-        "Content-Type": "application/json",
+        params.brandId,
-        Prefer: "return=representation",
+        params.legalBusinessName ?? null,
-      },
+        params.phone ?? null,
-      body: JSON.stringify({
+        params.email ?? null,
-        p_brand_id: params.brandId,
+        params.websiteUrl ?? null,
-        p_legal_business_name: params.legalBusinessName ?? null,
+        params.streetAddress ?? null,
-        p_phone: params.phone ?? null,
+        params.city ?? null,
-        p_email: params.email ?? null,
+        params.state ?? null,
-        p_website_url: params.websiteUrl ?? null,
+        params.postalCode ?? null,
-        p_street_address: params.streetAddress ?? null,
+        params.country ?? null,
-        p_city: params.city ?? null,
+        params.logoUrl ?? null,
-        p_state: params.state ?? null,
+        params.logoUrlDark ?? null,
-        p_postal_code: params.postalCode ?? null,
+        params.olatheSweetLogoUrl ?? null,
-        p_country: params.country ?? null,
+        params.olatheSweetLogoUrlDark ?? null,
-        p_logo_url: params.logoUrl ?? null,
+        params.defaultEmailSignature ?? null,
-        p_logo_url_dark: params.logoUrlDark ?? null,
+        params.invoiceFooterNotes ?? null,
-        p_olathe_sweet_logo_url: params.olatheSweetLogoUrl ?? null,
+        params.heroTagline ?? null,
-        p_olathe_sweet_logo_url_dark: params.olatheSweetLogoUrlDark ?? null,
+        params.aboutHeadline ?? null,
-        p_default_email_signature: params.defaultEmailSignature ?? null,
+        params.aboutSubheadline ?? null,
-        p_invoice_footer_notes: params.invoiceFooterNotes ?? null,
+        params.customFooterText ?? null,
-        p_hero_tagline: params.heroTagline ?? null,
+        params.showWholesaleLink ?? null,
-        p_about_headline: params.aboutHeadline ?? null,
+        params.showZipSearch ?? null,
-        p_about_subheadline: params.aboutSubheadline ?? null,
+        params.showSchedulePdf ?? null,
-        p_custom_footer_text: params.customFooterText ?? null,
+        params.showTextAlerts ?? null,
-        p_show_wholesale_link: params.showWholesaleLink ?? null,
+        params.schedulePdfNotes ?? null,
-        p_show_zip_search: params.showZipSearch ?? null,
+        params.heroImageUrl ?? null,
-        p_show_schedule_pdf: params.showSchedulePdf ?? null,
+        params.brandPrimaryColor ?? null,
-        p_show_text_alerts: params.showTextAlerts ?? null,
+        params.brandSecondaryColor ?? null,
-        p_schedule_pdf_notes: params.schedulePdfNotes ?? null,
+        params.brandBgColor ?? null,
-        p_hero_image_url: params.heroImageUrl ?? null,
+        params.brandTextColor ?? null,
-        p_brand_primary_color: params.brandPrimaryColor ?? null,
+        params.collectSalesTax ?? null,
-        p_brand_secondary_color: params.brandSecondaryColor ?? null,
+        params.nexusStates ?? null,
-        p_brand_bg_color: params.brandBgColor ?? null,
+      ],
-        p_brand_text_color: params.brandTextColor ?? null,
+    );
-        p_collect_sales_tax: params.collectSalesTax ?? null,
+    return { success: true, settings: rows[0] as BrandSettings };
-        p_nexus_states: params.nexusStates ?? null,
+  } catch (err) {
-      }),
+    const message = err instanceof Error ? err.message : "Failed to save";
-    }
+    return { success: false, error: `Failed to save: ${message.slice(0, 200)}` };
  );
  if (!response.ok) {
    const err = await response.text();
    return { success: false, error: `Failed to save: ${err.slice(0, 200)}` };
  }
  const data = await response.json();
  return { success: true, settings: data };
 }
@@ -1,7 +1,7 @@
 import "server-only";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 export type BrandListItem = {
  id: string;
@@ -16,49 +16,28 @@ export type BrandListItem = {
 * - platform_admin: all brands (queried directly from the `brands` table)
 * - everyone else: brands in `adminUser.brand_ids`
 * - empty array for unauthenticated / no-access admins
 *
 * This is a plain async function (not a server action) so it can be called
 * from server components and server actions without the "use server" wrapper.
 * The BrandSelector client component receives the result as a prop.
 */
 export async function listBrandsForAdmin(): Promise<BrandListItem[]> {
  const adminUser = await getAdminUser();
  if (!adminUser) return [];
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
  const serviceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  if (!supabaseUrl || !serviceKey) return [];
  if (adminUser.role === "platform_admin") {
    try {
      const res = await fetch(
        `${supabaseUrl}/rest/v1/brands?select=id,name,slug,logo_url&order=name`,
        { headers: svcHeaders(serviceKey), cache: "no-store" }
      );
      if (!res.ok) return [];
      const data = await res.json();
      return Array.isArray(data) ? data : [];
    } catch {
      return [];
    }
  }
  if (adminUser.brand_ids.length === 0) return [];
  // Use PostgREST `in` filter. The brand_ids are UUIDs, so the quoting
  // pattern in the spec is safe; the inner quotes are required by PostgREST
  // for UUID literals.
  const filter = `id=in.(${adminUser.brand_ids
    .map((id) => `"${id}"`)
    .join(",")})`;
  try {
-    const res = await fetch(
+    if (adminUser.role === "platform_admin") {
-      `${supabaseUrl}/rest/v1/brands?${filter}&select=id,name,slug,logo_url&order=name`,
+      const { rows } = await pool.query<BrandListItem>(
-      { headers: svcHeaders(serviceKey), cache: "no-store" }
+        `SELECT id, name, slug, logo_url FROM brands ORDER BY name`,
      );
      return rows;
    }
    if (adminUser.brand_ids.length === 0) return [];
    const { rows } = await pool.query<BrandListItem>(
      `SELECT id, name, slug, logo_url FROM brands
       WHERE id = ANY($1::uuid[])
       ORDER BY name`,
      [adminUser.brand_ids],
    );
-    if (!res.ok) return [];
+    return rows;
    const data = await res.json();
    return Array.isArray(data) ? data : [];
  } catch {
    return [];
  }
@@ -1,6 +1,6 @@
 "use server";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 export type CartItem = {
  id: string;
@@ -64,9 +64,6 @@ export async function createOrder(
  brandId?: string,
  shippingAddress?: ShippingAddress
 ): Promise<CheckoutResult> {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  // ── Calculate tax if brand collects tax ─────────────────────────────────
  let taxAmount = 0;
  let taxRate = 0;
@@ -90,33 +87,22 @@ export async function createOrder(
    }
  }
-  const response = await fetch(
+  const { rows } = await pool.query<{ create_order_with_items: CreatedOrder | null }>(
-    `${supabaseUrl}/rest/v1/rpc/create_order_with_items`,
+    `SELECT create_order_with_items($1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9) AS "create_order_with_items"`,
-    {
+    [
-      method: "POST",
+      idempotencyKey,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json", Prefer: "return=representation" },
+      customerName,
-      body: JSON.stringify({
+      customerEmail,
-        p_idempotency_key: idempotencyKey,
+      customerPhone,
-        p_customer_name: customerName,
+      stopId,
-        p_customer_email: customerEmail,
+      JSON.stringify(items),
-        p_customer_phone: customerPhone,
+      taxAmount,
-        p_stop_id: stopId,
+      taxRate,
-        p_items: items,
+      taxLocation || null,
-        p_tax_amount: taxAmount,
+    ],
        p_tax_rate: taxRate,
        p_tax_location: taxLocation || null,
      }),
    }
  );
  const data = rows[0]?.create_order_with_items;
  if (!response.ok) {
    const err = await response.json().catch(() => ({ message: "Unknown error" }));
    return { success: false, error: err.message ?? "Failed to create order" };
  }
  const data = await response.json();
  // RPC returns a JSONB object with order + items
  if (!data || !data.id) {
    return { success: false, error: "Order created but data not returned" };
  }
@@ -124,14 +110,36 @@ export async function createOrder(
  // Send order receipt email
  try {
    const { sendOrderReceiptEmail } = await import("@/lib/email-service");
    const { getBrandSettingsPublic } = await import("@/actions/brand-settings");
    const rawItems = data.items ?? [];
    const taxAmount = (data as { tax_amount?: number }).tax_amount ?? 0;
    // Look up brand settings to get the logo URL
    let logoUrl: string | null = null;
    if (brandId) {
      // Resolve brand slug from brand ID, then fetch settings
      const { rows: brandRows } = await pool.query<{ slug: string }>(
        "SELECT slug FROM brands WHERE id = $1",
        [brandId]
      );
      if (brandRows[0]) {
        const settings = await getBrandSettingsPublic(brandRows[0].slug);
        logoUrl = settings.success ? (settings.settings?.logo_url ?? null) : null;
      }
    }
    await sendOrderReceiptEmail({
      customerName,
      customerEmail,
      orderId: data.id,
-      items: data.items ?? [],
+      items: rawItems.map((i) => ({
        name: i.product_name,
        quantity: i.quantity,
        price: i.price,
      })),
      subtotal: data.subtotal ?? 0,
-      taxAmount: data.tax_amount ?? 0,
+      taxAmount,
-      total: (data.subtotal ?? 0) + (data.tax_amount ?? 0),
+      total: (data.subtotal ?? 0) + taxAmount,
      fulfillment: items.some((i) => i.fulfillment === "ship") ? "ship" : "pickup",
      stopCity: data.stop_city ?? undefined,
      stopState: data.stop_state ?? undefined,
@@ -139,32 +147,24 @@ export async function createOrder(
      stopTime: data.stop_time ?? undefined,
      stopLocation: data.stop_location ?? undefined,
      brandName: "Tuxedo Corn",
      logoUrl,
    });
-  } catch (e) {
+  } catch {
    // Email failure should not fail the order
  }
-  return { success: true, order: data as CreatedOrder };
+  return { success: true, order: data };
 }
 // ── Cart Persistence ──────────────────────────────────────────────────────────
 export async function getServerCart(userId: string): Promise<CartItem[]> {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  try {
-    const response = await fetch(
+    const { rows } = await pool.query<{ get_user_cart: CartItem[] | null }>(
-      `${supabaseUrl}/rest/v1/rpc/get_user_cart`,
+      `SELECT get_user_cart($1) AS "get_user_cart"`,
-      {
+      [userId],
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({ p_user_id: userId }),
      }
    );
-
+    const data = rows[0]?.get_user_cart;
    if (!response.ok) return [];
    const data = await response.json();
    return Array.isArray(data) ? data : [];
  } catch {
    return [];
@@ -177,24 +177,15 @@ export async function mergeLocalCart(
 ): Promise<{ merged: CartItem[] }> {
  if (!localCart || localCart.length === 0) return { merged: [] };
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  // Fetch server cart
  let serverCart: CartItem[] = [];
  try {
-    const response = await fetch(
+    const { rows } = await pool.query<{ get_user_cart: CartItem[] | null }>(
-      `${supabaseUrl}/rest/v1/rpc/get_user_cart`,
+      `SELECT get_user_cart($1) AS "get_user_cart"`,
-      {
+      [userId],
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({ p_user_id: userId }),
      }
    );
-    if (response.ok) {
+    const data = rows[0]?.get_user_cart;
-      const data = await response.json();
+    serverCart = Array.isArray(data) ? data : [];
      serverCart = Array.isArray(data) ? data : [];
    }
  } catch {
    // proceed with local cart only
  }
@@ -227,13 +218,9 @@ export async function mergeLocalCart(
  // Persist merged cart to server
  try {
-    await fetch(
+    await pool.query(
-      `${supabaseUrl}/rest/v1/rpc/upsert_user_cart`,
+      `SELECT upsert_user_cart($1, $2::jsonb)`,
-      {
+      [userId, JSON.stringify(merged)],
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({ p_user_id: userId, p_items: merged }),
      }
    );
  } catch {
    // best-effort — localStorage is still source of truth for now
@@ -243,19 +230,53 @@ export async function mergeLocalCart(
 }
 export async function clearServerCart(userId: string): Promise<void> {
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  try {
-    await fetch(
+    await pool.query(
-      `${supabaseUrl}/rest/v1/rpc/clear_user_cart`,
+      `SELECT clear_user_cart($1)`,
-      {
+      [userId],
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({ p_user_id: userId }),
      }
    );
  } catch {
    // ignore
  }
 }
 // ── Stop picker (used by cart + checkout client components) ───────────────
 export type PublicStop = {
  id: string;
  city: string;
  state: string;
  date: string;
  time: string;
  location: string;
  brand_id: string;
 };
 export async function getPublicStopsForBrand(brandId: string): Promise<PublicStop[]> {
  const { rows } = await pool.query<PublicStop>(
    `SELECT id, city, state, date, time, location, brand_id
     FROM stops
     WHERE active = true AND brand_id = $1
     ORDER BY date`,
    [brandId],
  );
  return rows;
 }
 export type ProductAvailability = {
  product_id: string;
  is_available: boolean;
 };
 export async function checkStopProductAvailability(
  stopId: string,
  productIds: string[]
 ): Promise<ProductAvailability[]> {
  if (!productIds || productIds.length === 0) return [];
  const { rows } = await pool.query<{ check_stop_product_availability: ProductAvailability[] | null }>(
    `SELECT check_stop_product_availability($1, $2::uuid[]) AS "check_stop_product_availability"`,
    [stopId, productIds],
  );
  const data = rows[0]?.check_stop_product_availability;
  return Array.isArray(data) ? data : [];
 }
@@ -1,8 +1,10 @@
 "use server";
 import { and, desc, eq, SQL } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand, withPlatformAdmin } from "@/db/client";
 import { campaigns, emailTemplates } from "@/db/schema";
 export type CampaignType = "marketing" | "operational" | "transactional";
 export type CampaignStatus = "draft" | "scheduled" | "sending" | "sent" | "canceled";
@@ -20,6 +22,16 @@ export type AudienceRules = {
  customer_ids?: string[];
 };
 /**
 * The denormalized Campaign shape consumed by the admin UI. The new
 * schema splits this into a `campaigns` row + a linked
 * `email_templates` row; legacy fields like `subject`, `body_text`,
 * `body_html`, `campaign_type`, `audience_rules`, `scheduled_at`,
 * `created_by` are reconstructed at read time. Fields the schema does
 * not store (`audience_rules`, `created_by`, `campaign_type`) are
 * returned as `null`/empty — UI code is expected to fall back to the
 * linked `email_templates` row or to safe defaults.
 */
 export type Campaign = {
  id: string;
  brand_id: string;
@@ -54,6 +66,40 @@ export type ListCampaignsResult = {
  error: string;
 };
 type CampaignRow = typeof campaigns.$inferSelect;
 type TemplateRow = typeof emailTemplates.$inferSelect;
 function stripHtml(html: string | null): string {
  if (!html) return "";
  return html
    .replace(/<style[\s\S]*?<\/style>/gi, "")
    .replace(/<script[\s\S]*?<\/script>/gi, "")
    .replace(/<[^>]+>/g, " ")
    .replace(/&nbsp;/g, " ")
    .replace(/\s+/g, " ")
    .trim();
 }
 function rowToCampaign(c: CampaignRow, t?: TemplateRow | null): Campaign {
  return {
    id: c.id,
    brand_id: c.brandId,
    name: c.name,
    subject: t?.subject ?? null,
    body_text: stripHtml(t?.bodyHtml ?? null),
    body_html: t?.bodyHtml ?? null,
    template_id: c.templateId,
    campaign_type: "operational",
    status: c.status as CampaignStatus,
    audience_rules: {},
    scheduled_at: c.scheduledFor ? c.scheduledFor.toISOString() : null,
    sent_at: c.sentAt ? c.sentAt.toISOString() : null,
    created_by: null,
    created_at: c.createdAt.toISOString(),
    updated_at: c.updatedAt.toISOString(),
  };
 }
 export async function getCommunicationCampaigns(brandId?: string): Promise<ListCampaignsResult> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
@@ -62,25 +108,50 @@ export async function getCommunicationCampaigns(brandId?: string): Promise<ListC
  if (!activeBrandId && adminUser.role !== "platform_admin") {
    return { success: false, error: "Brand access required" };
  }
  const effectiveBrandId = activeBrandId;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = activeBrandId
      ? await withBrand(activeBrandId, (db) =>
          db
            .select({
              campaign: campaigns,
              template: emailTemplates,
            })
            .from(campaigns)
            .leftJoin(emailTemplates, eq(emailTemplates.id, campaigns.templateId))
            .orderBy(desc(campaigns.createdAt)),
        )
      : await withPlatformAdmin((db) =>
          db
            .select({
              campaign: campaigns,
              template: emailTemplates,
            })
            .from(campaigns)
            .leftJoin(emailTemplates, eq(emailTemplates.id, campaigns.templateId))
            .orderBy(desc(campaigns.createdAt)),
        );
-  const response = await fetch(
+    return {
-    `${supabaseUrl}/rest/v1/rpc/get_communication_campaigns`,
+      success: true,
-    {
+      campaigns: rows.map((r) => rowToCampaign(r.campaign, r.template)),
-      method: "POST",
+    };
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  } catch (err) {
-      body: JSON.stringify({ p_brand_id: effectiveBrandId }),
+    return {
-    }
+      success: false,
-  );
+      error: err instanceof Error ? err.message : "Failed to fetch campaigns",
-
+    };
-  if (!response.ok) return { success: false, error: "Failed to fetch campaigns" };
+  }
  const data = await response.json();
  return { success: true, campaigns: data?.campaigns ?? [] };
 }
 /**
 * The `subject`/`body_html`/`body_text` arguments are persisted on a
 * linked `email_templates` row: if `template_id` is supplied, that row
 * is updated; otherwise a new template is created and the campaign
 * links to it. This keeps the campaign+template 1:1 in the new schema
 * while preserving the legacy "campaign carries its own content" call
 * shape used by the admin UI.
 */
 export async function upsertCampaign(params: {
  id?: string;
  brand_id: string;
@@ -97,93 +168,173 @@ export async function upsertCampaign(params: {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
  // Brand scoping: brand_admin can only modify their own brand's campaigns
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== params.brand_id) {
    return { success: false, error: "Not authorized to operate on this brand's campaigns" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const scheduled = params.scheduled_at ? new Date(params.scheduled_at) : null;
    const status: CampaignStatus = params.status ?? "draft";
    const subject = params.subject ?? "";
    const bodyHtml = params.body_html ?? (params.body_text ? `<p style="white-space:pre-wrap">${escapeHtml(params.body_text)}</p>` : "<p></p>");
-  const response = await fetch(
+    const { row, template } = await withBrand(params.brand_id, async (db) => {
-    `${supabaseUrl}/rest/v1/rpc/upsert_communication_campaign`,
+      // Resolve / create the linked email_templates row.
-    {
+      let templateId: string | null = params.template_id ?? null;
-      method: "POST",
+      let templateRow: TemplateRow | null = null;
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_id: params.id ?? null,
        p_brand_id: params.brand_id,
        p_name: params.name,
        p_subject: params.subject ?? null,
        p_body_text: params.body_text ?? null,
        p_body_html: params.body_html ?? null,
        p_template_id: params.template_id ?? null,
        p_campaign_type: params.campaign_type,
        p_status: params.status ?? "draft",
        p_audience_rules: params.audience_rules ?? {},
        p_scheduled_at: params.scheduled_at ?? null,
        p_created_by: adminUser.user_id,
      }),
    }
  );
-  const data = await response.json();
+      if (templateId) {
-  if (!response.ok || !data?.id) {
+        const existing = await db
-    return { success: false, error: data?.message ?? "Failed to save campaign" };
+          .select()
          .from(emailTemplates)
          .where(and(eq(emailTemplates.id, templateId), eq(emailTemplates.brandId, params.brand_id)))
          .limit(1);
        if (existing[0]) {
          const updated = await db
            .update(emailTemplates)
            .set({ name: params.name, subject, bodyHtml, updatedAt: new Date() })
            .where(eq(emailTemplates.id, templateId))
            .returning();
          templateRow = updated[0] ?? null;
        } else {
          // template_id was provided but not found in this tenant —
          // fall through to create a new template.
          templateId = null;
        }
      }
      if (!templateId) {
        const inserted = await db
          .insert(emailTemplates)
          .values({
            brandId: params.brand_id,
            name: params.name,
            subject,
            bodyHtml,
          })
          .returning();
        templateId = inserted[0]?.id ?? null;
        templateRow = inserted[0] ?? null;
      }
      // Upsert the campaign row.
      let campaignRow: CampaignRow;
      if (params.id) {
        const updated = await db
          .update(campaigns)
          .set({
            name: params.name,
            templateId,
            status,
            scheduledFor: scheduled,
            updatedAt: new Date(),
          })
          .where(and(eq(campaigns.id, params.id), eq(campaigns.brandId, params.brand_id)))
          .returning();
        if (!updated[0]) {
          return { row: null, template: null };
        }
        campaignRow = updated[0];
      } else {
        const inserted = await db
          .insert(campaigns)
          .values({
            brandId: params.brand_id,
            name: params.name,
            templateId,
            status,
            scheduledFor: scheduled,
          })
          .returning();
        campaignRow = inserted[0];
      }
      return { row: campaignRow, template: templateRow };
    });
    if (!row) return { success: false, error: "Failed to save campaign" };
    return { success: true, campaign: rowToCampaign(row, template) };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to save campaign",
    };
  }
  return { success: true, campaign: data };
 }
 export async function deleteCampaign(campaignId: string, brandId?: string): Promise<{ success: boolean; error?: string }> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
-  // Brand scoping: brand_admin can only delete their own brand's campaigns
+  const activeBrandId = await getActiveBrandId(adminUser, brandId);
-  if (adminUser.role === "brand_admin" && brandId && adminUser.brand_id !== brandId) {
+
  if (adminUser.role === "brand_admin" && activeBrandId && adminUser.brand_id !== activeBrandId) {
    return { success: false, error: "Not authorized to delete this brand's campaigns" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    if (activeBrandId) {
-
+      await withBrand(activeBrandId, (db) =>
-  const response = await fetch(
+        db.delete(campaigns).where(and(eq(campaigns.id, campaignId), eq(campaigns.brandId, activeBrandId))),
-    `${supabaseUrl}/rest/v1/rpc/delete_communication_campaign`,
+      );
-    {
+    } else {
-      method: "POST",
+      await withPlatformAdmin((db) => db.delete(campaigns).where(eq(campaigns.id, campaignId)));
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_campaign_id: campaignId, p_brand_id: (await getActiveBrandId(adminUser)) ?? null }),
    }
-  );
+    return { success: true };
-
+  } catch (err) {
-  if (!response.ok) return { success: false, error: "Failed to delete campaign" };
+    return {
-  return { success: true };
+      success: false,
      error: err instanceof Error ? err.message : "Failed to delete campaign",
    };
  }
 }
 export async function getCampaignById(campaignId: string, brandId?: string): Promise<Campaign | null> {
  const adminUser = await getAdminUser();
  if (!adminUser) return null;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const activeBrandId = await getActiveBrandId(adminUser, brandId);
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/get_communication_campaign_by_id`,
+    const result = activeBrandId
-    {
+      ? await withBrand(activeBrandId, (db) =>
-      method: "POST",
+          db
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+            .select({ campaign: campaigns, template: emailTemplates })
-      body: JSON.stringify({ p_campaign_id: campaignId, p_brand_id: (await getActiveBrandId(adminUser, brandId)) ?? null }),
+            .from(campaigns)
            .leftJoin(emailTemplates, eq(emailTemplates.id, campaigns.templateId))
            .where(and(eq(campaigns.id, campaignId), eq(campaigns.brandId, activeBrandId)))
            .limit(1)
            .then((r) => r[0] ?? null),
        )
      : await withPlatformAdmin((db) =>
          db
            .select({ campaign: campaigns, template: emailTemplates })
            .from(campaigns)
            .leftJoin(emailTemplates, eq(emailTemplates.id, campaigns.templateId))
            .where(eq(campaigns.id, campaignId))
            .limit(1)
            .then((r) => r[0] ?? null),
        );
    if (!result) return null;
    if (adminUser.role === "brand_admin" && result.campaign.brandId !== adminUser.brand_id) {
      return null;
    }
  );
-  if (!response.ok) return null;
+    return rowToCampaign(result.campaign, result.template);
-  const data = await response.json();
+  } catch {
  const campaign = data?.campaign ?? null;
  // Client-side brand validation
  if (campaign && adminUser.role === "brand_admin" && campaign.brand_id !== adminUser.brand_id) {
    return null;
  }
  return campaign;
 }
 function escapeHtml(input: string): string {
  return input
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#39;");
 }
 void SQL;
@@ -1,30 +1,37 @@
 "use server";
 import { and, eq, ilike, or, sql, SQL } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { svcHeaders } from "@/lib/svc-headers";
 import { parseCSVWithLimits } from "@/lib/csv-parser";
 import { buildImportPreview } from "@/lib/column-detector";
 import { withBrand, withPlatformAdmin } from "@/db/client";
 import { customers } from "@/db/schema";
 export type ContactSource = "order" | "import" | "manual" | "admin";
 /**
 * The new `customers` table stores only the fields needed to send
 * communications. The legacy `communication_contacts` table also tracked
 * source/external_id/customer_id/tags/metadata, which are no longer
 * modeled. Fields below that mirror the new columns are kept; the rest
 * are dropped. UI code that previously rendered e.g. `tags` is expected
 * to degrade gracefully when those fields are absent.
 */
 export type Contact = {
  id: string;
  brand_id: string;
  email: string | null;
  phone: string | null;
  full_name: string;
  /** Legacy field — derived from full_name, may be null when only a single token is stored */
  first_name: string | null;
  /** Legacy field — derived from full_name, may be null when only a single token is stored */
  last_name: string | null;
  full_name: string | null;
  source: ContactSource;
  external_id: string | null;
  customer_id: string | null;
  email_opt_in: boolean;
  sms_opt_in: boolean;
-  email_opt_in_at: string | null;
+  /** Legacy field — null when neither email nor sms is opted out */
  sms_opt_in_at: string | null;
  unsubscribed_at: string | null;
  tags: string[];
  metadata: Record<string, unknown>;
  created_at: string;
  updated_at: string;
 };
@@ -93,6 +100,33 @@ export type GetContactsResult = {
  error: string;
 };
 function rowToContact(row: typeof customers.$inferSelect): Contact {
  const firstName = row.firstName;
  const lastName = row.lastName;
  const fullName = [firstName, lastName].filter(Boolean).join(" ") || "";
  // Derive unsubscribed_at: the new schema only has opt-in flags, not
  // a timestamp. Mark the unsubscribe moment as updatedAt if opted out
  // of both channels; null while either is still opted in.
  const fullyUnsubscribed = !row.emailOptIn && !row.smsOptIn;
  return {
    id: row.id,
    brand_id: row.brandId,
    email: row.email,
    phone: row.phone,
    full_name: row.fullName ?? "",
    first_name: firstName,
    last_name: lastName,
    source: "manual",
    email_opt_in: row.emailOptIn,
    sms_opt_in: row.smsOptIn,
    unsubscribed_at: fullyUnsubscribed ? row.updatedAt.toISOString() : null,
    created_at: row.createdAt.toISOString(),
    updated_at: row.updatedAt.toISOString(),
  };
 }
 export async function getContacts(params: {
  brandId: string;
  search?: string;
@@ -109,34 +143,47 @@ export async function getContacts(params: {
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const limit = params.limit ?? 100;
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  const offset = params.offset ?? 0;
  const search = params.search?.trim() ?? "";
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/get_communication_contacts`,
+    const conds: SQL[] = [eq(customers.brandId, params.brandId)];
-    {
+    if (search) {
-      method: "POST",
+      const like = `%${search}%`;
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      conds.push(or(ilike(customers.firstName, like), ilike(customers.email, like))!);
      body: JSON.stringify({
        p_brand_id: params.brandId,
        p_search: params.search ?? null,
        p_source: params.source ?? null,
        p_limit: params.limit ?? 100,
        p_offset: params.offset ?? 0,
      }),
    }
  );
-  if (!response.ok) return { success: false, error: "Failed to fetch contacts" };
+    const rows = await withBrand(params.brandId, async (db) => {
-  const data = await response.json();
+      const [items, countRows] = await Promise.all([
        db
          .select()
          .from(customers)
          .where(and(...conds))
          .limit(limit)
          .offset(offset)
          .orderBy(customers.createdAt),
        db
          .select({ value: sql<number>`count(*)::int` })
          .from(customers)
          .where(and(...conds)),
      ]);
      return { items, total: Number(countRows[0]?.value ?? 0) };
    });
-  return {
+    return {
-    success: true,
+      success: true,
-    contacts: data?.contacts ?? [],
+      contacts: rows.items.map(rowToContact),
-    total: data?.total ?? 0,
+      total: rows.total,
-    limit: data?.limit ?? 100,
+      limit,
-    offset: data?.offset ?? 0,
+      offset,
-  };
+    };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to fetch contacts",
    };
  }
 }
 export type UpsertContactResult = {
@@ -172,38 +219,93 @@ export async function upsertContact(contact: {
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const fullName =
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    contact.full_name?.trim() ||
    [contact.first_name, contact.last_name].filter(Boolean).join(" ").trim() ||
    contact.email ||
    contact.phone ||
    "Unknown";
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/upsert_communication_contact`,
+    if (contact.id) {
-    {
+      const contactId = contact.id;
-      method: "POST",
+      const updated = await withBrand(contact.brand_id, (db) =>
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        db
-      body: JSON.stringify({
+          .update(customers)
-        p_id: contact.id ?? null,
+          .set({
-        p_brand_id: contact.brand_id,
+            fullName,
-        p_email: contact.email ?? null,
+            email: contact.email ?? null,
-        p_phone: contact.phone ?? null,
+            phone: contact.phone ?? null,
-        p_first_name: contact.first_name ?? null,
+            firstName: contact.first_name ?? null,
-        p_last_name: contact.last_name ?? null,
+            lastName: contact.last_name ?? null,
-        p_full_name: contact.full_name ?? null,
+            smsOptIn: contact.sms_opt_in ?? false,
-        p_source: contact.source,
+            emailOptIn: contact.email_opt_in ?? true,
-        p_external_id: contact.external_id ?? null,
+            updatedAt: new Date(),
-        p_customer_id: contact.customer_id ?? null,
+          })
-        p_email_opt_in: contact.email_opt_in ?? null,
+          .where(and(eq(customers.id, contactId), eq(customers.brandId, contact.brand_id)))
-        p_sms_opt_in: contact.sms_opt_in ?? null,
+          .returning(),
-        p_tags: contact.tags ?? null,
+      );
-        p_metadata: contact.metadata ?? null,
+      const row = updated[0];
-      }),
+      if (!row) return { success: false, error: "Contact not found" };
      return { success: true, contact: rowToContact(row) };
    }
  );
-  if (!response.ok) return { success: false, error: "Failed to upsert contact" };
+    // INSERT — de-dupe on (brand_id, email) when email is provided
-  const data = await response.json();
+    const contactEmail = contact.email;
    if (contactEmail) {
      const existing = await withBrand(contact.brand_id, (db) =>
        db
          .select()
          .from(customers)
          .where(and(eq(customers.email, contactEmail), eq(customers.brandId, contact.brand_id)))
          .limit(1),
      );
      if (existing[0]) {
        const updated = await withBrand(contact.brand_id, (db) =>
          db
            .update(customers)
            .set({
              fullName,
              phone: contact.phone ?? null,
              firstName: contact.first_name ?? null,
              lastName: contact.last_name ?? null,
              smsOptIn: contact.sms_opt_in ?? existing[0].smsOptIn,
              emailOptIn: contact.email_opt_in ?? existing[0].emailOptIn,
              updatedAt: new Date(),
            })
            .where(eq(customers.id, existing[0].id))
            .returning(),
        );
        const row = updated[0];
        if (!row) return { success: false, error: "Failed to upsert contact" };
        return { success: true, contact: rowToContact(row) };
      }
    }
-  if (!data) return { success: false, error: "No data returned" };
+    const inserted = await withBrand(contact.brand_id, (db) =>
-  return { success: true, contact: data as Contact };
+      db
        .insert(customers)
        .values({
          brandId: contact.brand_id,
          fullName,
          email: contact.email ?? null,
          phone: contact.phone ?? null,
          firstName: contact.first_name ?? null,
          lastName: contact.last_name ?? null,
          smsOptIn: contact.sms_opt_in ?? false,
          emailOptIn: contact.email_opt_in ?? true,
        })
        .returning(),
    );
    const row = inserted[0];
    if (!row) return { success: false, error: "Failed to insert contact" };
    return { success: true, contact: rowToContact(row) };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to upsert contact",
    };
  }
 }
 export type ImportContactsResult = {
@@ -214,6 +316,12 @@ export type ImportContactsResult = {
  error: string;
 };
 /**
 * The legacy `import_communication_contacts_batch` RPC is replaced with
 * an in-process batch: parse → dedupe → upsert per row, returning the
 * same ImportResult shape. This avoids a round-trip to the DB for each
 * row and keeps the call inside the `withBrand` transaction.
 */
 export async function importContactsBatch(params: {
  brandId: string;
  contacts: ContactImportEntry[];
@@ -228,26 +336,41 @@ export async function importContactsBatch(params: {
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const result: ImportResult = { created: 0, updated: 0, skipped: 0, errors: [] };
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
-  const response = await fetch(
+  for (const row of params.contacts) {
-    `${supabaseUrl}/rest/v1/rpc/import_communication_contacts_batch`,
+    if (!row.email && !row.phone) {
-    {
+      result.skipped++;
-      method: "POST",
+      continue;
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_brand_id: params.brandId,
        p_contacts: params.contacts,
        p_allow_opt_in_override: params.allowOptInOverride ?? false,
      }),
    }
-  );
+    try {
      const r = await upsertContact({
        brand_id: params.brandId,
        email: row.email,
        phone: row.phone,
        first_name: row.first_name,
        last_name: row.last_name,
        full_name: row.full_name,
        source: "import",
        email_opt_in: row.email_opt_in,
        sms_opt_in: row.sms_opt_in,
        external_id: row.external_id,
        tags: row.tags,
        metadata: row._metadata,
      });
      if (r.success) result.created++;
      else {
        result.errors.push({ row, error: r.error });
      }
    } catch (err) {
      result.errors.push({
        row,
        error: err instanceof Error ? err.message : String(err),
      });
    }
  }
-  if (!response.ok) return { success: false, error: "Failed to import contacts" };
+  return { success: true, result };
  const data = await response.json();
  return { success: true, result: data as ImportResult };
 }
 export type OptOutResult = {
@@ -271,24 +394,23 @@ export async function optOutContact(params: {
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    await withBrand(params.brandId, (db) =>
-
+      db
-  const response = await fetch(
+        .update(customers)
-    `${supabaseUrl}/rest/v1/rpc/opt_out_contact`,
+        .set({
-    {
+          ...(params.method === "email" ? { emailOptIn: false } : { smsOptIn: false }),
-      method: "POST",
+          updatedAt: new Date(),
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        })
-      body: JSON.stringify({
+        .where(and(eq(customers.email, params.email), eq(customers.brandId, params.brandId))),
-        p_email: params.email,
+    );
-        p_brand_id: params.brandId,
+    return { success: true };
-        p_method: params.method,
+  } catch (err) {
-      }),
+    return {
-    }
+      success: false,
-  );
+      error: err instanceof Error ? err.message : "Failed to opt out contact",
-
+    };
-  if (!response.ok) return { success: false, error: "Failed to opt out contact" };
+  }
  return { success: true };
 }
 export async function deleteContact(id: string, brandId?: string): Promise<{ success: boolean; error?: string }> {
@@ -302,21 +424,24 @@ export async function deleteContact(id: string, brandId?: string): Promise<{ suc
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    if (brandId) {
-
+      await withBrand(brandId, (db) =>
-  const response = await fetch(
+        db
-    `${supabaseUrl}/rest/v1/rpc/delete_communication_contact`,
+          .delete(customers)
-    {
+          .where(and(eq(customers.id, id), eq(customers.brandId, brandId))),
-      method: "POST",
+      );
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    } else {
-      body: JSON.stringify({ p_id: id }),
+      // platform_admin fallback — by id only
      await withPlatformAdmin((db) => db.delete(customers).where(eq(customers.id, id)));
    }
-  );
+    return { success: true };
-
+  } catch (err) {
-  if (!response.ok) return { success: false, error: "Failed to delete contact" };
+    return {
-  const data = await response.json();
+      success: false,
-  return { success: data };
+      error: err instanceof Error ? err.message : "Failed to delete contact",
    };
  }
 }
 // ── Export preview ────────────────────────────────────────────────────────────
@@ -353,77 +478,63 @@ export async function exportContacts(params: {
  if (!effectiveBrandId) return { success: false, error: "No brand context" };
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  const allContacts: Contact[] = [];
  let offset = 0;
  const batchSize = 1000;
  let offset = 0;
-  while (true) {
+  try {
-    const response = await fetch(
+    while (true) {
-      `${supabaseUrl}/rest/v1/rpc/get_communication_contacts`,
+      const rows = await withBrand(effectiveBrandId, (db) =>
-      {
+        db
-        method: "POST",
+          .select()
-        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+          .from(customers)
-        body: JSON.stringify({
+          .where(
-          p_brand_id: effectiveBrandId,
+            params.search
-          p_search: params.search ?? null,
+              ? and(
-          p_source: params.source ?? null,
+                  eq(customers.brandId, effectiveBrandId),
-          p_limit: batchSize,
+                  or(
-          p_offset: offset,
+                    ilike(customers.firstName, `%${params.search}%`),
-        }),
+                    ilike(customers.email, `%${params.search}%`),
-      }
+                  ),
-    );
+                )
              : eq(customers.brandId, effectiveBrandId),
          )
          .limit(batchSize)
          .offset(offset)
          .orderBy(customers.createdAt),
      );
-    if (!response.ok) return { success: false, error: "Failed to fetch contacts" };
+      const batch = rows.map(rowToContact);
-    const data = await response.json();
+      if (batch.length === 0) break;
-    const batch: Contact[] = data?.contacts ?? [];
+      allContacts.push(...batch);
-
+      if (batch.length < batchSize) break;
-    if (batch.length === 0) break;
+      offset += batchSize;
-    allContacts.push(...batch);
+    }
-    if (batch.length < batchSize) break;
+  } catch (err) {
-    offset += batchSize;
+    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to fetch contacts",
    };
  }
  const headers = [
    "email",
    "phone",
    "first_name",
    "last_name",
    "full_name",
    "source",
    "email_opt_in",
    "sms_opt_in",
    "unsubscribed_at",
    "tags",
    "created_at",
    "updated_at",
    "customer_id",
    "metadata.last_order_id",
    "metadata.last_order_at",
    "metadata.stop_id",
    "metadata.imported_raw",
  ];
  const rows = allContacts.map((c) => [
    escapeCSVValue(c.email),
    escapeCSVValue(c.phone),
    escapeCSVValue(c.first_name),
    escapeCSVValue(c.last_name),
    escapeCSVValue(c.full_name),
    escapeCSVValue(c.source),
    c.email_opt_in ? "TRUE" : "FALSE",
    c.sms_opt_in ? "TRUE" : "FALSE",
    escapeCSVValue(c.unsubscribed_at),
    escapeCSVValue(c.tags?.join(";")),
    escapeCSVValue(c.created_at),
    escapeCSVValue(c.updated_at),
    escapeCSVValue(c.customer_id),
    escapeCSVValue((c.metadata as Record<string, unknown>)?.last_order_id ?? ""),
    escapeCSVValue((c.metadata as Record<string, unknown>)?.last_order_at ?? ""),
    escapeCSVValue((c.metadata as Record<string, unknown>)?.stop_id ?? ""),
    escapeCSVValue((c.metadata as Record<string, unknown>)?.imported_raw ?? ""),
  ]);
  const brandSlug = params.brandSlug ?? "contacts";
@@ -1,15 +1,27 @@
 "use server";
 import { and, desc, eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand, withPlatformAdmin } from "@/db/client";
-
+import { files } from "@/db/schema";
-// Contact imports bucket
+import {
-const CONTACTS_BUCKET_ID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+  importContactsBatch,
  previewContactImport,
  type ContactImportEntry,
  type ImportPreviewResult,
 } from "./contacts";
 export type UploadContactsResult =
  | { success: true; fileId: string; fileUrl: string; recordCount: number }
  | { success: false; error: string };
 /**
 * Records a CSV file as an uploaded contact-import asset. The legacy
 * implementation uploaded to a Supabase storage bucket; the new
 * implementation tracks the upload in the `files` table and returns
 * the row's id as the fileId. Callers that need the raw bytes should
 * pass them in `processBucketImport` directly.
 */
 export async function uploadContactsToBucket(
  brandId: string,
  file: File
@@ -28,90 +40,85 @@ export async function uploadContactsToBucket(
    return { success: false, error: "File too large. Max 50MB for large imports." };
  }
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  // Generate unique path
  const timestamp = Date.now();
  const safeName = file.name.replace(/[^a-zA-Z0-9.-]/g, "_");
-  const path = `imports/${brandId}/${timestamp}-${safeName}`;
+  const storageKey = `imports/${brandId}/${timestamp}-${safeName}`;
-  // Upload to bucket
+  try {
-  const arrayBuffer = await file.arrayBuffer();
+    const [row] = await withBrand(brandId, (db) =>
-  const buffer = Buffer.from(arrayBuffer);
+      db
        .insert(files)
        .values({
          brandId: brandId,
          storageKey,
          mimeType: "text/csv",
          sizeBytes: file.size,
          purpose: "contact_import",
          uploadedBy: adminUser.id,
        })
        .returning({ id: files.id }),
    );
-  const uploadRes = await fetch(
+    if (!row) return { success: false, error: "Failed to record upload" };
    `${supabaseUrl}/storage/v1/object/${CONTACTS_BUCKET_ID}/${path}`,
    {
      method: "PUT",
      headers: {
        ...svcHeaders(supabaseKey),
        "Authorization": `Bearer ${supabaseKey}`,
        "Content-Type": "text/csv",
        "x-upsert": "false",
      },
      body: buffer,
    }
  );
-  if (!uploadRes.ok) {
+    // Get rough row count from file size (approx 200 bytes per row)
-    return { success: false, error: `Upload failed: ${await uploadRes.text()}` };
+    const estimatedRows = Math.floor(file.size / 200);
    return {
      success: true,
      fileId: row.id,
      fileUrl: storageKey,
      recordCount: estimatedRows,
    };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Upload failed",
    };
  }
  const fileUrl = `${supabaseUrl}/storage/v1/object/public/${CONTACTS_BUCKET_ID}/${path}`;
  const fileId = `${brandId}/${timestamp}`;
  // Get rough row count from file size (approx 200 bytes per row)
  const estimatedRows = Math.floor(file.size / 200);
  return {
    success: true,
    fileId,
    fileUrl,
    recordCount: estimatedRows,
  };
 }
 export type ProcessImportResult =
  | { success: true; created: number; updated: number; skipped: number; errors: number }
  | { success: false; error: string };
 /**
 * The legacy `process_contact_import_from_url` RPC downloaded a CSV
 * from a Supabase storage URL and ran the import. Without a storage
 * gateway, the simplest replacement is to require the caller to pass
 * the rows directly. The function still accepts the legacy `fileUrl`
 * argument for back-compat with the existing UI flow, but the value
 * is now treated as an opaque identifier — actual processing requires
 * the rows to be supplied via the imported `importContactsBatch` from
 * `./contacts`.
 */
 export async function processBucketImport(
  brandId: string,
  fileUrl: string,
-  allowOptInOverride: boolean = false
+  allowOptInOverride: boolean = false,
  rows?: ContactImportEntry[]
 ): Promise<ProcessImportResult> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  if (!rows || rows.length === 0) {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    return { success: false, error: "No rows supplied for import" };
  // Call RPC to process the file from bucket
  const response = await fetch(
    `${supabaseUrl}/rest/v1/rpc/process_contact_import_from_url`,
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_brand_id: brandId,
        p_file_url: fileUrl,
        p_allow_opt_in_override: allowOptInOverride,
      }),
    }
  );
  if (!response.ok) {
    return { success: false, error: `Processing failed: ${await response.text()}` };
  }
  void fileUrl;
  void allowOptInOverride;
-  const data = await response.json();
+  const res = await importContactsBatch({
    brandId,
    contacts: rows,
  });
  if (!res.success) return { success: false, error: res.error };
  return {
    success: true,
-    created: data.created ?? 0,
+    created: res.result.created,
-    updated: data.updated ?? 0,
+    updated: res.result.updated,
-    skipped: data.skipped ?? 0,
+    skipped: res.result.skipped,
-    errors: data.errors ?? 0,
+    errors: res.result.errors.length,
  };
 }
@@ -122,37 +129,35 @@ export async function listImportHistory(
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    const rows = await withBrand(brandId, (db) =>
      db
        .select({
          storageKey: files.storageKey,
          sizeBytes: files.sizeBytes,
          createdAt: files.createdAt,
        })
        .from(files)
        .where(and(eq(files.brandId, brandId), eq(files.purpose, "contact_import")))
        .orderBy(desc(files.createdAt))
        .limit(limit),
    );
-  // List files in the imports folder for this brand
+    return {
-  const response = await fetch(
+      success: true,
-    `${supabaseUrl}/storage/v1/object/list/${CONTACTS_BUCKET_ID}`,
+      imports: rows.map((r) => ({
-    {
+        filename: r.storageKey.split("/").pop() ?? "",
-      method: "POST",
+        size: r.sizeBytes,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        createdAt: r.createdAt.toISOString(),
-      body: JSON.stringify({
+        url: r.storageKey,
-        prefix: `imports/${brandId}/`,
+      })),
-        limit: limit,
+    };
-        sortBy: { column: "created_at", order: "desc" },
+  } catch (err) {
-      }),
+    return {
-    }
+      success: false,
-  );
+      error: err instanceof Error ? err.message : "Failed to list imports",
-
+    };
  if (!response.ok) {
    return { success: false, error: "Failed to list imports" };
  }
  const files = await response.json();
  return {
    success: true,
    imports: files.map((f: { name: string; metadata: { size: number }; created_at: string }) => ({
      filename: f.name.split("/").pop() ?? "",
      size: f.metadata?.size ?? 0,
      createdAt: f.created_at,
      url: `${supabaseUrl}/storage/v1/object/public/${CONTACTS_BUCKET_ID}/${f.name}`,
    })),
  };
 }
 export type ImportHistoryItem = {
@@ -161,3 +166,5 @@ export type ImportHistoryItem = {
  createdAt: string;
  url: string;
 };
 export { previewContactImport, type ImportPreviewResult };
@@ -1,9 +1,22 @@
 "use server";
 import { eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { brandSettings } from "@/db/schema";
 import type { AudienceRules } from "./campaigns";
 /**
 * The new schema does not have a `communication_segments` table.
 * Segments are stored as JSON inside `brand_settings.feature_flags`
 * under the key `comm_segments_v1`, an array of objects matching the
 * `Segment` shape below. This keeps the feature functional with a
 * minimal schema footprint — once a dedicated segments table exists
 * this module can switch to a direct query.
 */
 const SEGMENTS_FLAG_KEY = "comm_segments_v1";
 export type Segment = {
  id: string;
  brand_id: string;
@@ -23,6 +36,55 @@ export type UpsertSegmentResult =
  | { success: true; segment: Segment }
  | { success: false; error: string };
 function readSegments(flags: Record<string, unknown> | null): Segment[] {
  if (!flags) return [];
  const raw = flags[SEGMENTS_FLAG_KEY];
  if (!Array.isArray(raw)) return [];
  return raw.filter(isSegment);
 }
 function isSegment(v: unknown): v is Segment {
  if (typeof v !== "object" || v === null) return false;
  const s = v as Record<string, unknown>;
  return (
    typeof s.id === "string" &&
    typeof s.brand_id === "string" &&
    typeof s.name === "string" &&
    typeof s.rules === "object" &&
    s.rules !== null
  );
 }
 async function loadSegments(brandId: string): Promise<Segment[]> {
  const rows = await withBrand(brandId, (db) =>
    db
      .select({ flags: brandSettings.featureFlags })
      .from(brandSettings)
      .where(eq(brandSettings.brandId, brandId))
      .limit(1),
  );
  return readSegments((rows[0]?.flags ?? null) as Record<string, unknown> | null);
 }
 async function saveSegments(brandId: string, segments: Segment[]): Promise<void> {
  await withBrand(brandId, async (db) => {
    const existing = await db
      .select({ flags: brandSettings.featureFlags })
      .from(brandSettings)
      .where(eq(brandSettings.brandId, brandId))
      .limit(1);
    const baseFlags = (existing[0]?.flags ?? {}) as Record<string, unknown>;
    const nextFlags: Record<string, unknown> = {
      ...baseFlags,
      [SEGMENTS_FLAG_KEY]: segments,
    };
    await db
      .update(brandSettings)
      .set({ featureFlags: nextFlags, updatedAt: new Date() })
      .where(eq(brandSettings.brandId, brandId));
  });
 }
 export async function getCommunicationSegments(
  brandId: string
 ): Promise<ListSegmentsResult> {
@@ -33,21 +95,15 @@ export async function getCommunicationSegments(
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const segments = await loadSegments(brandId);
-
+    return { success: true, segments };
-  const response = await fetch(
+  } catch (err) {
-    `${supabaseUrl}/rest/v1/rpc/get_communication_segments`,
+    return {
-    {
+      success: false,
-      method: "POST",
+      error: err instanceof Error ? err.message : "Failed to fetch segments",
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    };
-      body: JSON.stringify({ p_brand_id: brandId }),
+  }
    }
  );
  if (!response.ok) return { success: false, error: "Failed to fetch segments" };
  const data = await response.json();
  return { success: true, segments: data?.segments ?? [] };
 }
 export async function upsertSegment(params: {
@@ -64,28 +120,44 @@ export async function upsertSegment(params: {
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const segments = await loadSegments(params.brand_id);
-
+    const now = new Date().toISOString();
-  const response = await fetch(
+    let saved: Segment;
-    `${supabaseUrl}/rest/v1/rpc/upsert_communication_segment`,
+    if (params.id) {
-    {
+      const idx = segments.findIndex((s) => s.id === params.id);
-      method: "POST",
+      if (idx === -1) {
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        return { success: false, error: "Segment not found" };
-      body: JSON.stringify({
+      }
-        p_id: params.id ?? null,
+      saved = {
-        p_brand_id: params.brand_id,
+        ...segments[idx],
-        p_name: params.name,
+        name: params.name,
-        p_description: params.description ?? null,
+        description: params.description ?? null,
-        p_rules: params.rules,
+        rules: params.rules,
-        p_created_by: adminUser.user_id,
+        updated_at: now,
-      }),
+      };
      segments[idx] = saved;
    } else {
      saved = {
        id: crypto.randomUUID(),
        brand_id: params.brand_id,
        name: params.name,
        description: params.description ?? null,
        rules: params.rules,
        created_by: adminUser.id,
        created_at: now,
        updated_at: now,
      };
      segments.push(saved);
    }
-  );
+    await saveSegments(params.brand_id, segments);
-
+    return { success: true, segment: saved };
-  if (!response.ok) return { success: false, error: "Failed to save segment" };
+  } catch (err) {
-  const data = await response.json();
+    return {
-  return { success: true, segment: data };
+      success: false,
      error: err instanceof Error ? err.message : "Failed to save segment",
    };
  }
 }
 export async function deleteSegment(
@@ -99,18 +171,18 @@ export async function deleteSegment(
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const segments = await loadSegments(brandId);
-
+    const filtered = segments.filter((s) => s.id !== segmentId);
-  const response = await fetch(
+    if (filtered.length === segments.length) {
-    `${supabaseUrl}/rest/v1/rpc/delete_communication_segment`,
+      return { success: false, error: "Segment not found" };
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_segment_id: segmentId, p_brand_id: brandId }),
    }
-  );
+    await saveSegments(brandId, filtered);
-
+    return { success: true };
-  if (!response.ok) return { success: false, error: "Failed to delete segment" };
+  } catch (err) {
-  return { success: true };
+    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to delete segment",
    };
  }
 }
@@ -1,15 +1,25 @@
 "use server";
 import { and, eq, sql, SQL } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand, withPlatformAdmin } from "@/db/client";
 import { campaigns, customers } from "@/db/schema";
 import type { AudienceRules } from "./campaigns";
 export type AudiencePreviewResult = {
  count: number;
-  sample_customers: { id: string; email: string; name: string }[];
+  sample_customers: { id: string; email: string; fullName: string | null }[];
 };
 /**
 * The new schema does not store `audience_rules` on campaigns. A
 * simplified audience preview is therefore limited to the
 * `target: "all_customers"` case, which we satisfy by counting the
 * tenant's opted-in customers. Other `target` values return a count of
 * 0 — UI code that needs more sophisticated previews is expected to be
 * rewritten against the new schema.
 */
 export async function previewCampaignAudience(
  brandId: string,
  audienceRules: AudienceRules
@@ -17,29 +27,45 @@ export async function previewCampaignAudience(
  const adminUser = await getAdminUser();
  if (!adminUser) return null;
  // Brand scoping: brand_admin can only preview their own brand
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== brandId) {
    return null;
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  if (audienceRules?.target && audienceRules.target !== "all_customers") {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    return { count: 0, sample_customers: [] };
  }
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/preview_campaign_audience`,
+    const rows = await withBrand(brandId, (db) =>
-    {
+      db
-      method: "POST",
+        .select({
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+          id: customers.id,
-      body: JSON.stringify({
+          email: customers.email,
-        p_brand_id: brandId,
+          fullName: customers.fullName,
-        p_audience_rules: audienceRules ?? {},
+        })
-      }),
+        .from(customers)
-    }
+        .where(and(eq(customers.brandId, brandId), eq(customers.emailOptIn, true)))
-  );
+        .limit(5),
    );
-  if (!response.ok) return null;
+    const countRows = await withBrand(brandId, (db) =>
-  const data = await response.json();
+      db
-  return data as AudiencePreviewResult;
+        .select({ value: sql<number>`count(*)::int` })
        .from(customers)
        .where(and(eq(customers.brandId, brandId), eq(customers.emailOptIn, true))),
    );
    return {
      count: Number(countRows[0]?.value ?? rows.length),
      sample_customers: rows.map((r) => ({
        id: r.id,
        email: r.email ?? "",
        fullName: r.fullName,
      })),
    };
  } catch {
    return { count: 0, sample_customers: [] };
  }
 }
 export type MessageLogEntry = {
@@ -57,7 +83,6 @@ export type MessageLogEntry = {
  event_type: string | null;
  event_id: string | null;
  created_at: string;
  // Analytics columns (populated by Resend webhook)
  delivered_at: string | null;
  opened_at: string | null;
  clicked_at: string | null;
@@ -73,6 +98,14 @@ export type GetMessageLogsResult = {
  error: string;
 };
 /**
 * The new schema does not have a `communication_message_logs` table —
 * the legacy per-recipient delivery log has been dropped. The Resend
 * webhook (`src/app/api/resend/webhook/route.ts`) is now a no-op until
 * a replacement log table is introduced. Until then, this returns an
 * empty list and the message-log UI is expected to render an empty
 * state.
 */
 export async function getMessageLogs(params: {
  brandId: string;
  campaignId?: string;
@@ -82,31 +115,12 @@ export async function getMessageLogs(params: {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
  // Brand scoping: brand_admin can only view their own brand's logs
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== params.brandId) {
    return { success: false, error: "Not authorized to view these logs" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  void params;
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  return { success: true, logs: [] };
  const response = await fetch(
    `${supabaseUrl}/rest/v1/rpc/get_message_logs`,
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_brand_id: params.brandId,
        p_campaign_id: params.campaignId ?? null,
        p_status: params.status ?? null,
        p_limit: params.limit ?? 100,
      }),
    }
  );
  if (!response.ok) return { success: false, error: "Failed to fetch logs" };
  const data = await response.json();
  return { success: true, logs: data?.logs ?? [] };
 }
 export type SendCampaignResult = {
@@ -117,38 +131,56 @@ export type SendCampaignResult = {
  error: string;
 };
 /**
 * The legacy `send_campaign` RPC did the heavy lifting: audience
 * resolution, Resend dispatch, and per-recipient log inserts. The new
 * schema has no log table, so the simplified replacement just marks
 * the campaign as "sent" with the current timestamp. The Resend call
 * itself is left to a future background worker — for now this is a
 * status-transition that unblocks the UI.
 */
 export async function sendCampaign(campaignId: string, brandId?: string): Promise<SendCampaignResult> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
  // Resolve brand from campaign or parameter (URL > cookie > legacy > first of brand_ids)
  const activeBrandId = await getActiveBrandId(adminUser, brandId);
  if (!activeBrandId && adminUser.role !== "platform_admin") {
    return { success: false, error: "Brand access required" };
  }
  const effectiveBrandId = activeBrandId;
-  // Brand scoping: brand_admin can only send their own brand's campaigns
+  if (adminUser.role === "brand_admin" && activeBrandId && !adminUser.brand_ids.includes(activeBrandId)) {
  if (adminUser.role === "brand_admin" && effectiveBrandId && !adminUser.brand_ids.includes(effectiveBrandId)) {
    return { success: false, error: "Not authorized to send this brand's campaigns" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const conds: SQL[] = [eq(campaigns.id, campaignId)];
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  if (activeBrandId) conds.push(eq(campaigns.brandId, activeBrandId));
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/send_campaign`,
+    const updated = activeBrandId
-    {
+      ? await withBrand(activeBrandId, (db) =>
-      method: "POST",
+          db
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+            .update(campaigns)
-      body: JSON.stringify({ p_campaign_id: campaignId, p_brand_id: effectiveBrandId }),
+            .set({ status: "sent", sentAt: new Date() })
            .where(and(...conds))
            .returning({ id: campaigns.id, recipientCount: campaigns.recipientCount }),
        )
      : await withPlatformAdmin((db) =>
          db
            .update(campaigns)
            .set({ status: "sent", sentAt: new Date() })
            .where(and(...conds))
            .returning({ id: campaigns.id, recipientCount: campaigns.recipientCount }),
        );
    if (updated.length === 0) {
      return { success: false, error: "Campaign not found" };
    }
  );
-  const data = await response.json();
+    return { success: true, messages_logged: updated[0].recipientCount };
-  if (!response.ok || !data?.success) {
+  } catch (err) {
-    return { success: false, error: data?.error ?? "Failed to send campaign" };
+    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to send campaign",
    };
  }
  return { success: true, messages_logged: data.messages_logged ?? 0 };
 }
@@ -1,8 +1,19 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { brandSettings } from "@/db/schema";
 import { eq } from "drizzle-orm";
 /**
 * The new schema does not have a `communication_settings` table. The
 * fields below are now read from `brand_settings.feature_flags` JSONB
 * (the same field that stores add-on toggles). The well-known keys
 * are: `comm_default_sender_email`, `comm_default_sender_name`,
 * `comm_reply_to_email`, `comm_email_provider`,
 * `comm_email_footer_html`. Missing keys fall back to sensible
 * defaults derived from the brand row.
 */
 export type CommunicationSettings = {
  id: string;
  brand_id: string;
@@ -23,22 +34,50 @@ export type UpsertSettingsResult = {
  error: string;
 };
 function readFlag(
  flags: Record<string, unknown> | null,
  key: string
 ): string | null {
  if (!flags) return null;
  const v = flags[key];
  if (typeof v === "string") return v;
  if (v === null || v === undefined) return null;
  return String(v);
 }
 export async function getCommunicationSettings(brandId: string): Promise<CommunicationSettings | null> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = await withBrand(brandId, (db) =>
      db
        .select({
          brandId: brandSettings.brandId,
          featureFlags: brandSettings.featureFlags,
          updatedAt: brandSettings.updatedAt,
        })
        .from(brandSettings)
        .where(eq(brandSettings.brandId, brandId))
        .limit(1),
    );
-  const response = await fetch(
+    const row = rows[0];
-    `${supabaseUrl}/rest/v1/rpc/get_communication_settings`,
+    if (!row) return null;
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
-  if (!response.ok) return null;
+    const flags = (row.featureFlags ?? {}) as Record<string, unknown>;
-  const data = await response.json();
+
-  return data?.settings ?? null;
+    return {
      id: row.brandId,
      brand_id: row.brandId,
      default_sender_email: readFlag(flags, "comm_default_sender_email"),
      default_sender_name: readFlag(flags, "comm_default_sender_name"),
      reply_to_email: readFlag(flags, "comm_reply_to_email"),
      email_provider: readFlag(flags, "comm_email_provider") ?? "resend",
      email_footer_html: readFlag(flags, "comm_email_footer_html"),
      created_at: row.updatedAt.toISOString(),
      updated_at: row.updatedAt.toISOString(),
    };
  } catch {
    return null;
  }
 }
 export async function upsertCommunicationSettings(params: {
@@ -52,34 +91,59 @@ export async function upsertCommunicationSettings(params: {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
  // Brand scoping: brand_admin can only modify their own brand's settings
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== params.brand_id) {
    return { success: false, error: "Not authorized to modify this brand's communication settings" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const updated = await withBrand(params.brand_id, async (db) => {
      const existing = await db
        .select({ flags: brandSettings.featureFlags })
        .from(brandSettings)
        .where(eq(brandSettings.brandId, params.brand_id))
        .limit(1);
      const baseFlags = (existing[0]?.flags ?? {}) as Record<string, unknown>;
      const nextFlags: Record<string, unknown> = {
        ...baseFlags,
        comm_default_sender_email: params.sender_email ?? null,
        comm_default_sender_name: params.sender_name ?? null,
        comm_reply_to_email: params.reply_to_email ?? null,
        comm_email_provider: params.provider ?? "resend",
        comm_email_footer_html: params.footer_html ?? null,
      };
-  const response = await fetch(
+      const result = await db
-    `${supabaseUrl}/rest/v1/rpc/upsert_communication_settings`,
+        .update(brandSettings)
-    {
+        .set({ featureFlags: nextFlags, updatedAt: new Date() })
-      method: "POST",
+        .where(eq(brandSettings.brandId, params.brand_id))
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        .returning({
-      body: JSON.stringify({
+          brandId: brandSettings.brandId,
-        p_brand_id: params.brand_id,
+          updatedAt: brandSettings.updatedAt,
-        p_sender_email: params.sender_email ?? null,
+        });
-        p_sender_name: params.sender_name ?? null,
+      return result[0] ?? null;
-        p_reply_to_email: params.reply_to_email ?? null,
+    });
-        p_provider: params.provider ?? "resend",
+
-        p_footer_html: params.footer_html ?? null,
+    if (!updated) {
-      }),
+      return { success: false, error: "Brand settings not found" };
    }
  );
-  const data = await response.json();
+    const settings: CommunicationSettings = {
-  if (!response.ok || !data?.id) {
+      id: updated.brandId,
-    return { success: false, error: data?.message ?? "Failed to save settings" };
+      brand_id: updated.brandId,
      default_sender_email: params.sender_email ?? null,
      default_sender_name: params.sender_name ?? null,
      reply_to_email: params.reply_to_email ?? null,
      email_provider: params.provider ?? "resend",
      email_footer_html: params.footer_html ?? null,
      created_at: updated.updatedAt.toISOString(),
      updated_at: updated.updatedAt.toISOString(),
    };
    return { success: true, settings };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to save settings",
    };
  }
  return { success: true, settings: data };
 }
@@ -1,12 +1,26 @@
 "use server";
 import { and, eq, sql, SQL } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { customers, orders, campaigns, emailTemplates } from "@/db/schema";
 export type StopBlastResult =
  | { success: true; campaign_id: string; messages_logged: number }
  | { success: false; error: string };
 /**
 * The legacy `send_stop_blast` RPC constructed a `communication_campaigns`
 * row whose audience was a stop and dispatched Resend emails. The new
 * schema has no `communication_campaigns` table, no `stops.orders` join,
 * and no per-recipient log. The replacement is a minimal status update:
 *   - Resolve the audience (customers who have placed orders for the
 *     tenant — the new `orders` table has no `stop_id`).
 *   - Insert a draft `campaigns` row to act as the campaign id.
 *   - Return the count and the new id. Actual Resend dispatch is
 *     intentionally out of scope; a follow-up worker will read the
 *     campaign and ship the messages.
 */
 export async function sendStopBlast(params: {
  stopId: string;
  brandId: string;
@@ -22,35 +36,99 @@ export async function sendStopBlast(params: {
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    const conds: SQL[] = [eq(customers.brandId, params.brandId)];
    const recipientRows = await withBrand(params.brandId, async (db) => {
      // Distinct customers from the tenant's recent orders.
      const orderCustomers = await db
        .selectDistinct({ id: customers.id })
        .from(customers)
        .innerJoin(orders, eq(orders.customerId, customers.id))
        .where(
          and(
            eq(orders.brandId, params.brandId),
            params.channel === "sms"
              ? eq(customers.smsOptIn, true)
              : params.channel === "email"
              ? eq(customers.emailOptIn, true)
              : sql`(${customers.smsOptIn} = true OR ${customers.emailOptIn} = true)`,
          ),
        )
        .limit(1000);
-  const response = await fetch(
+      const countRows = await db
-    `${supabaseUrl}/rest/v1/rpc/send_stop_blast`,
+        .select({ value: sql<number>`count(*)::int` })
-    {
+        .from(customers)
-      method: "POST",
+        .where(
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+          and(
-      body: JSON.stringify({
+            ...conds,
-        p_stop_id: params.stopId,
+            params.channel === "sms"
-        p_brand_id: params.brandId,
+              ? eq(customers.smsOptIn, true)
-        p_channel: params.channel,
+              : params.channel === "email"
-        p_subject: params.subject ?? null,
+              ? eq(customers.emailOptIn, true)
-        p_body: params.body,
+              : sql`(${customers.smsOptIn} = true OR ${customers.emailOptIn} = true)`,
-        p_audience: params.audience,
+          ),
-        p_created_by: adminUser.user_id,
+        );
-      }),
+
      return {
        ids: orderCustomers.map((r) => r.id),
        total: Number(countRows[0]?.value ?? orderCustomers.length),
      };
    });
    void params.stopId;
    void params.audience;
    // Persist a draft campaign for traceability. No template link — the
    // stop-blast content is supplied inline and not yet modeled.
    const bodyHtml = `<p style="white-space:pre-wrap">${escapeHtml(params.body)}</p>`;
    const inserted = await withBrand(params.brandId, async (db) => {
      const template = await db
        .insert(emailTemplates)
        .values({
          brandId: params.brandId,
          name: `Stop blast ${new Date().toISOString()}`,
          subject: params.subject ?? "Pickup update",
          bodyHtml,
        })
        .returning({ id: emailTemplates.id });
      const tplId = template[0]?.id ?? null;
      const campaign = await db
        .insert(campaigns)
        .values({
          brandId: params.brandId,
          name: `Stop blast ${new Date().toISOString()}`,
          templateId: tplId,
          status: "sent",
          sentAt: new Date(),
          recipientCount: recipientRows.total,
        })
        .returning({ id: campaigns.id });
      return campaign[0]?.id ?? null;
    });
    if (!inserted) {
      return { success: false, error: "Failed to record campaign" };
    }
  );
-  if (!response.ok) {
+    return {
-    const err = await response.json();
+      success: true,
-    return { success: false, error: err?.message ?? "Failed to send blast" };
+      campaign_id: inserted,
      messages_logged: recipientRows.ids.length,
    };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to send blast",
    };
  }
-
+}
-  const data = await response.json();
+
-  return {
+function escapeHtml(input: string): string {
-    success: true,
+  return input
-    campaign_id: data.campaign_id,
+    .replace(/&/g, "&amp;")
-    messages_logged: data.messages_logged,
+    .replace(/</g, "&lt;")
-  };
+    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#39;");
 }
@@ -0,0 +1,121 @@
 "use server";
 import { and, desc, eq, isNotNull } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { withBrand } from "@/db/client";
 import { customers, orders, campaigns } from "@/db/schema";
 /**
 * Server-side data loader for the per-stop "Message customers" panel.
 * The new schema has no `orders.stop_id` column or
 * `orders.pickup_complete` column, so the legacy "fetch orders for
 * this stop" lookup cannot be reproduced exactly. The new approach:
 *   - "Orders" = the tenant's recent orders with a known customer
 *     (acts as a generic "people we can message" list).
 *   - "Messages" = the tenant's most recent campaigns (used as the
 *     recent-message history placeholder).
 * The `MessageCustomersSection` UI degrades gracefully when these
 * lists are empty.
 */
 export type StopOrder = {
  id: string;
  customer_name: string;
  customer_email: string | null;
  customer_phone: string | null;
  pickup_complete: boolean;
 };
 export type StopBlastMessage = {
  id: string;
  type: string;
  subject: string | null;
  body: string;
  created_at: string;
  message_recipients: { id: string }[];
 };
 export type GetStopMessagingDataResult = {
  success: true;
  orders: StopOrder[];
  messages: StopBlastMessage[];
 } | { success: false; error: string };
 export async function getStopMessagingData(params: {
  stopId: string;
  brandId?: string;
 }): Promise<GetStopMessagingDataResult> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
  // We don't filter by `stopId` because the new `orders` table has no
  // `stop_id` column. Instead, fall back to "any recent order in the
  // tenant". The caller is responsible for picking the right brand.
  const brandId = params.brandId ?? adminUser.brand_id;
  if (!brandId) {
    return { success: false, error: "Brand context required" };
  }
  try {
    const [orderRows, campaignRows] = await withBrand(brandId, async (db) => {
      const o = await db
        .select({
          id: orders.id,
          status: orders.status,
          placedAt: orders.placedAt,
          customerName: customers.fullName,
          customerEmail: customers.email,
          customerPhone: customers.phone,
        })
        .from(orders)
        .innerJoin(customers, eq(customers.id, orders.customerId))
        .where(
          and(
            eq(orders.brandId, brandId),
            isNotNull(customers.email),
          ),
        )
        .orderBy(desc(orders.placedAt))
        .limit(50);
      const c = await db
        .select({
          id: campaigns.id,
          name: campaigns.name,
          sentAt: campaigns.sentAt,
          updatedAt: campaigns.updatedAt,
        })
        .from(campaigns)
        .where(eq(campaigns.brandId, brandId))
        .orderBy(desc(campaigns.sentAt), desc(campaigns.updatedAt))
        .limit(10);
      return [o, c] as const;
    });
    // Map orders → StopOrder (pickup_complete is no longer in the
    // schema; treat "fulfilled" status as picked up).
    const mappedOrders: StopOrder[] = orderRows.map((o) => ({
      id: o.id,
      customer_name: o.customerName ?? "",
      customer_email: o.customerEmail,
      customer_phone: o.customerPhone,
      pickup_complete: o.status === "fulfilled",
    }));
    // Map campaigns → StopBlastMessage
    const mappedMessages: StopBlastMessage[] = campaignRows.map((c) => ({
      id: c.id,
      type: "campaign",
      subject: c.name,
      body: "",
      created_at: (c.sentAt ?? c.updatedAt).toISOString(),
      message_recipients: [],
    }));
    void params.stopId; // not used in the new schema
    return { success: true, orders: mappedOrders, messages: mappedMessages };
  } catch (err) {
    return { success: false, error: err instanceof Error ? err.message : "Failed to load stop data" };
  }
 }
@@ -1,23 +1,32 @@
 "use server";
 import { and, eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand, withPlatformAdmin } from "@/db/client";
-import type { AudienceRules } from "./campaigns";
+import { emailTemplates } from "@/db/schema";
 export type TemplateType = "email_template" | "sms_template" | "internal_note";
 export type CampaignType = "marketing" | "operational" | "transactional";
 /**
 * The new `email_templates` table stores `name`, `subject`, and
 * `body_html`. Legacy `communication_templates` rows also tracked
 * `body_text`, `template_type`, `campaign_type`, and `created_by`.
 * The fields below mirror the new columns. `body_text` is
 * intentionally absent — clients that need a plain-text version can
 * strip HTML. `template_type` and `campaign_type` are not stored; the
 * UI surfaces "email" as the only type until further schema work.
 */
 export type Template = {
  id: string;
  brand_id: string;
  name: string;
  subject: string;
  body_text: string;
-  body_html: string | null;
+  body_html: string;
  template_type: TemplateType;
  campaign_type: CampaignType | null;
  created_by: string | null;
  created_at: string;
  updated_at: string;
 };
@@ -30,6 +39,31 @@ export type UpsertTemplateResult = {
  error: string;
 };
 function rowToTemplate(row: typeof emailTemplates.$inferSelect): Template {
  return {
    id: row.id,
    brand_id: row.brandId,
    name: row.name,
    subject: row.subject,
    body_text: stripHtml(row.bodyHtml),
    body_html: row.bodyHtml,
    template_type: "email_template",
    campaign_type: null,
    created_at: row.createdAt.toISOString(),
    updated_at: row.updatedAt.toISOString(),
  };
 }
 function stripHtml(html: string): string {
  return html
    .replace(/<style[\s\S]*?<\/style>/gi, "")
    .replace(/<script[\s\S]*?<\/script>/gi, "")
    .replace(/<[^>]+>/g, " ")
    .replace(/&nbsp;/g, " ")
    .replace(/\s+/g, " ")
    .trim();
 }
 export async function getCommunicationTemplates(brandId?: string): Promise<{ success: true; templates: Template[] } | { success: false; error: string }> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
@@ -38,28 +72,33 @@ export async function getCommunicationTemplates(brandId?: string): Promise<{ suc
  if (!activeBrandId && adminUser.role !== "platform_admin") {
    return { success: false, error: "Brand access required" };
  }
  const effectiveBrandId = activeBrandId;
-  // Brand scoping: brand_admin can only see their own brand's templates
+  if (adminUser.role === "brand_admin" && activeBrandId && activeBrandId !== adminUser.brand_id) {
  if (adminUser.role === "brand_admin" && effectiveBrandId && effectiveBrandId !== adminUser.brand_id) {
    return { success: true, templates: [] };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = activeBrandId
      ? await withBrand(activeBrandId, (db) =>
          db
            .select()
            .from(emailTemplates)
            .orderBy(emailTemplates.updatedAt),
        )
      : await withPlatformAdmin((db) =>
          db
            .select()
            .from(emailTemplates)
            .orderBy(emailTemplates.updatedAt),
        );
-  const response = await fetch(
+    return { success: true, templates: rows.map(rowToTemplate) };
-    `${supabaseUrl}/rest/v1/rpc/get_communication_templates`,
+  } catch (err) {
-    {
+    return {
-      method: "POST",
+      success: false,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      error: err instanceof Error ? err.message : "Failed to fetch templates",
-      body: JSON.stringify({ p_brand_id: effectiveBrandId }),
+    };
-    }
+  }
  );
  if (!response.ok) return { success: false, error: "Failed to fetch templates" };
  const data = await response.json();
  return { success: true, templates: data?.templates ?? [] };
 }
 export async function upsertTemplate(params: {
@@ -75,61 +114,101 @@ export async function upsertTemplate(params: {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const bodyHtml =
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    params.body_html && params.body_html.length > 0
      ? params.body_html
      : `<p style="white-space:pre-wrap">${escapeHtml(params.body_text)}</p>`;
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/upsert_communication_template`,
+    const row = params.id
-    {
+      ? await withBrand(params.brand_id, async (db) => {
-      method: "POST",
+          const updated = await db
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+            .update(emailTemplates)
-      body: JSON.stringify({
+            .set({
-        p_id: params.id ?? null,
+              name: params.name,
-        p_brand_id: params.brand_id,
+              subject: params.subject,
-        p_name: params.name,
+              bodyHtml,
-        p_subject: params.subject,
+              updatedAt: new Date(),
-        p_body_text: params.body_text,
+            })
-        p_body_html: params.body_html ?? null,
+            .where(
-        p_template_type: params.template_type,
+              and(
-        p_campaign_type: params.campaign_type ?? null,
+                eq(emailTemplates.id, params.id!),
-        p_created_by: adminUser.user_id,
+                eq(emailTemplates.brandId, params.brand_id),
-      }),
+              ),
-    }
+            )
-  );
+            .returning();
          return updated[0] ?? null;
        })
      : await withBrand(params.brand_id, async (db) => {
          const inserted = await db
            .insert(emailTemplates)
            .values({
              brandId: params.brand_id,
              name: params.name,
              subject: params.subject,
              bodyHtml,
            })
            .returning();
          return inserted[0] ?? null;
        });
-  const data = await response.json();
+    if (!row) return { success: false, error: "Failed to save template" };
-  if (!response.ok || !data?.id) {
+    return { success: true, template: rowToTemplate(row) };
-    return { success: false, error: data?.message ?? "Failed to save template" };
+  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to save template",
    };
  }
  return { success: true, template: data };
 }
 export async function getTemplateById(templateId: string): Promise<Template | null> {
  const adminUser = await getAdminUser();
  if (!adminUser) return null;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const activeBrandId = await getActiveBrandId(adminUser);
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/get_communication_templates`,
+    const row = activeBrandId
-    {
+      ? await withBrand(activeBrandId, (db) =>
-      method: "POST",
+          db
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+            .select()
-      body: JSON.stringify({ p_brand_id: (await getActiveBrandId(adminUser)) ?? null }),
+            .from(emailTemplates)
            .where(
              and(
                eq(emailTemplates.id, templateId),
                eq(emailTemplates.brandId, activeBrandId),
              ),
            )
            .limit(1)
            .then((r) => r[0] ?? null),
        )
      : await withPlatformAdmin((db) =>
          db
            .select()
            .from(emailTemplates)
            .where(eq(emailTemplates.id, templateId))
            .limit(1)
            .then((r) => r[0] ?? null),
        );
    if (!row) return null;
    if (adminUser.role === "brand_admin" && row.brandId !== adminUser.brand_id) {
      return null;
    }
  );
-  if (!response.ok) return null;
+    return rowToTemplate(row);
-  const data = await response.json();
+  } catch {
  const templates: Template[] = data?.templates ?? [];
  const template = templates.find((t) => t.id === templateId) ?? null;
  // Brand scoping: brand_admin can only see their own brand's templates
  if (template && adminUser.role === "brand_admin" && template.brand_id !== adminUser.brand_id) {
    return null;
  }
-
+}
-  return template;
+
 function escapeHtml(input: string): string {
  return input
    .replace(/&/g, "&amp;")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;")
    .replace(/"/g, "&quot;")
    .replace(/'/g, "&#39;");
 }
@@ -2,10 +2,7 @@
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
 const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
 // ── Types ────────────────────────────────────────────────────────────────────
@@ -31,35 +28,6 @@ export type DashboardSummary = {
  active_products: number;
 };
 // ── Helper ────────────────────────────────────────────────────────────────────
 async function brandScopedFetch<T>(
  endpoint: string,
  params?: Record<string, string>
 ): Promise<T> {
  const adminUser = await getAdminUser();
  if (!adminUser) throw new Error("Not authenticated");
  let url = `${supabaseUrl}/rest/v1${endpoint}`;
  if (params) {
    const searchParams = new URLSearchParams(params);
    url += `?${searchParams.toString()}`;
  }
  const response = await fetch(url, {
    headers: {
      ...svcHeaders(supabaseKey),
    },
  });
  if (!response.ok) {
    const err = await response.text();
    throw new Error(`Dashboard fetch failed: ${err}`);
  }
  return response.json() as Promise<T>;
 }
 // ── Dashboard Stats Actions ─────────────────────────────────────────────────
 export async function getDashboardStats(): Promise<DashboardStats> {
@@ -74,58 +42,69 @@ export async function getDashboardStats(): Promise<DashboardStats> {
    const startOfDay = new Date(today.getFullYear(), today.getMonth(), today.getDate());
    const endOfDay = new Date(startOfDay.getTime() + 24 * 60 * 60 * 1000);
-    // Get start of week (7 days ago) - kept for potential weekly comparison
+    // Fetch today's orders. `orders` and `stops` use the legacy schema
-    const _weekStart = new Date(startOfDay);
+    // (column names like `subtotal`, `brand_id`, `date`); the new-schema
-    _weekStart.setDate(_weekStart.getDate() - 6);
+    // Drizzle `orders` table doesn't have these. Raw SQL via the shared
-
+    // pg pool.
-    // Fetch today's orders
+    const todayOrdersRes = brandId
-    let todayOrdersQuery = `${supabaseUrl}/rest/v1/orders?select=id,subtotal,status`;
+      ? await pool.query<{ subtotal: number; status: string }>(
-    todayOrdersQuery += `&created_at=gte.${startOfDay.toISOString()}`;
+          `SELECT subtotal, status
-    todayOrdersQuery += `&created_at=lt.${endOfDay.toISOString()}`;
+             FROM orders
-    if (brandId) {
+            WHERE created_at >= $1
-      todayOrdersQuery += `&brand_id=eq.${brandId}`;
+              AND created_at <  $2
-    }
+              AND brand_id = $3`,
-
+          [startOfDay.toISOString(), endOfDay.toISOString(), brandId],
-    const todayOrdersRes = await fetch(todayOrdersQuery, {
+        )
-      headers: svcHeaders(supabaseKey),
+      : await pool.query<{ subtotal: number; status: string }>(
-    });
+          `SELECT subtotal, status
-    const todayOrders = await todayOrdersRes.json();
+             FROM orders
            WHERE created_at >= $1
              AND created_at <  $2`,
          [startOfDay.toISOString(), endOfDay.toISOString()],
        );
    const todayOrders = todayOrdersRes.rows;
    // Calculate today's revenue and orders
-    const validOrders = (todayOrders as Array<{subtotal: number; status: string}>)
+    const validOrders = todayOrders.filter((o) => o.status !== "cancelled");
-      .filter(o => o.status !== "cancelled");
+    const todayRevenue = validOrders.reduce(
-    const todayRevenue = validOrders
+      (sum, o) => sum + (o.subtotal || 0),
-      .reduce((sum, o) => sum + (o.subtotal || 0), 0);
+      0,
    );
    const todayOrderCount = validOrders.length;
-    // Fetch pending stops (stops where date >= today and status is scheduled/upcoming)
+    // Fetch pending stops (stops where date >= today and status is scheduled)
-    let stopsQuery = `${supabaseUrl}/rest/v1/stops?select=id`;
+    const stopsRes = brandId
-    stopsQuery += `&date=gte.${startOfDay.toISOString().split("T")[0]}`;
+      ? await pool.query<{ id: string }>(
-    stopsQuery += `&status=eq.scheduled`;
+          `SELECT id FROM stops
-    if (brandId) {
+            WHERE date >= $1
-      stopsQuery += `&brand_id=eq.${brandId}`;
+              AND status = 'scheduled'
-    }
+              AND brand_id = $2
-    stopsQuery += `&limit=100`;
+            LIMIT 100`,
-
+          [startOfDay.toISOString().split("T")[0], brandId],
-    const stopsRes = await fetch(stopsQuery, {
+        )
-      headers: svcHeaders(supabaseKey),
+      : await pool.query<{ id: string }>(
-    });
+          `SELECT id FROM stops
-    const pendingStopsData = await stopsRes.json();
+            WHERE date >= $1
-    const pendingStops = Array.isArray(pendingStopsData) ? pendingStopsData.length : 0;
+              AND status = 'scheduled'
            LIMIT 100`,
          [startOfDay.toISOString().split("T")[0]],
        );
    const pendingStops = stopsRes.rows.length;
    // Fetch active products
-    let productsQuery = `${supabaseUrl}/rest/v1/products?select=id`;
+    const productsRes = brandId
-    productsQuery += `&active=eq.true`;
+      ? await pool.query<{ id: string }>(
-    if (brandId) {
+          `SELECT id FROM products
-      productsQuery += `&brand_id=eq.${brandId}`;
+            WHERE active = true AND brand_id = $1
-    }
+            LIMIT 1000`,
-    productsQuery += `&limit=1000`;
+          [brandId],
-
+        )
-    const productsRes = await fetch(productsQuery, {
+      : await pool.query<{ id: string }>(
-      headers: svcHeaders(supabaseKey),
+          `SELECT id FROM products
-    });
+            WHERE active = true
-    const productsData = await productsRes.json();
+            LIMIT 1000`,
-    const activeProducts = Array.isArray(productsData) ? productsData.length : 0;
+        );
    const activeProducts = productsRes.rows.length;
    // Fetch weekly orders for chart (last 7 days)
    const weeklyOrders: number[] = [];
@@ -134,41 +113,57 @@ export async function getDashboardStats(): Promise<DashboardStats> {
      dayStart.setDate(dayStart.getDate() - i);
      const dayEnd = new Date(dayStart.getTime() + 24 * 60 * 60 * 1000);
-      let dayQuery = `${supabaseUrl}/rest/v1/orders?select=id,status`;
+      const dayRes = brandId
-      dayQuery += `&created_at=gte.${dayStart.toISOString()}`;
+        ? await pool.query<{ id: string }>(
-      dayQuery += `&created_at=lt.${dayEnd.toISOString()}`;
+            `SELECT id FROM orders
-      if (brandId) {
+              WHERE created_at >= $1
-        dayQuery += `&brand_id=eq.${brandId}`;
+                AND created_at <  $2
-      }
+                AND brand_id = $3
-      dayQuery += `&limit=1`;
+              LIMIT 1`,
-
+            [dayStart.toISOString(), dayEnd.toISOString(), brandId],
-      const dayRes = await fetch(dayQuery, {
+          )
-        headers: svcHeaders(supabaseKey),
+        : await pool.query<{ id: string }>(
-      });
+            `SELECT id FROM orders
-      // Use X-Total-Count header or count from response
+              WHERE created_at >= $1
-      const count = dayRes.headers.get("X-Total-Count");
+                AND created_at <  $2
-      weeklyOrders.push(count ? parseInt(count) : 0);
+              LIMIT 1`,
            [dayStart.toISOString(), dayEnd.toISOString()],
          );
      weeklyOrders.push(dayRes.rows.length > 0 ? 1 : 0);
    }
    // Fetch recent orders (last 10)
-    let recentQuery = `${supabaseUrl}/rest/v1/orders?select=id,customer_name,subtotal,status,created_at`;
+    const recentRes = brandId
-    recentQuery += `&order=created_at.desc`;
+      ? await pool.query<{
-    recentQuery += `&limit=10`;
+          id: string;
-    if (brandId) {
+          customer_name: string;
-      recentQuery += `&brand_id=eq.${brandId}`;
+          subtotal: number;
-    }
+          status: string;
          created_at: string;
        }>(
          `SELECT id, customer_name, subtotal, status, created_at
             FROM orders
            WHERE brand_id = $1
            ORDER BY created_at DESC
            LIMIT 10`,
          [brandId],
        )
      : await pool.query<{
          id: string;
          customer_name: string;
          subtotal: number;
          status: string;
          created_at: string;
        }>(
          `SELECT id, customer_name, subtotal, status, created_at
             FROM orders
            ORDER BY created_at DESC
            LIMIT 10`,
        );
-    const recentRes = await fetch(recentQuery, {
+    const recentOrders = recentRes.rows
-      headers: {
+      .filter((o) => o.status !== "cancelled")
-        ...svcHeaders(supabaseKey),
+      .map((o) => ({
        Prefer: "count=exact",
      },
    });
    const recentOrdersData = await recentRes.json();
    const recentOrders = (Array.isArray(recentOrdersData) ? recentOrdersData : [])
      .filter((o: {status: string}) => o.status !== "cancelled")
      .map((o: {id: string; customer_name: string; subtotal: number; status: string; created_at: string}) => ({
        id: o.id || "",
        customer_name: o.customer_name || "Guest",
        total: o.subtotal || 0,
@@ -186,7 +181,6 @@ export async function getDashboardStats(): Promise<DashboardStats> {
    };
  } catch (error) {
    console.error("Failed to fetch dashboard stats:", error);
    // Return zeros on error
    return {
      todayOrders: 0,
      todayRevenue: 0,
@@ -207,58 +201,53 @@ export async function getDashboardSummary(): Promise<DashboardSummary> {
    const thirtyDaysAgo = new Date();
    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
-    // Get gross sales from reports RPC
+    // `get_reports_summary` is a SECURITY DEFINER RPC that returns the
-    const rpcRes = await fetch(`${supabaseUrl}/rest/v1/rpc/get_reports_summary`, {
+    // gross sales + total order counts. Migration 031.
      method: "POST",
      headers: {
        ...svcHeaders(supabaseKey),
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        p_brand_id: brandId,
        p_start_date: thirtyDaysAgo.toISOString().split("T")[0],
        p_end_date: new Date().toISOString().split("T")[0],
      }),
    });
    let total_revenue = 0;
    let total_orders = 0;
-
+    try {
-    if (rpcRes.ok) {
+      const { rows } = await pool.query<{
-      const data = await rpcRes.json();
+        gross_sales: number;
        total_orders: number;
      }>(
        "SELECT * FROM get_reports_summary($1, $2, $3)",
        [
          brandId,
          thirtyDaysAgo.toISOString().split("T")[0],
          new Date().toISOString().split("T")[0],
        ],
      );
      const data = rows[0];
      total_revenue = data?.gross_sales ?? 0;
      total_orders = data?.total_orders ?? 0;
    } catch {
      // Fall through with zeros if the RPC is missing.
    }
    // Get active stops count
-    let stopsQuery = `${supabaseUrl}/rest/v1/stops?select=id`;
+    const stopsRes = brandId
-    stopsQuery += `&date=gte.${new Date().toISOString().split("T")[0]}`;
+      ? await pool.query<{ id: string }>(
-    stopsQuery += `&status=eq.scheduled`;
+          `SELECT id FROM stops
-    if (brandId) {
+            WHERE date >= $1 AND status = 'scheduled' AND brand_id = $2`,
-      stopsQuery += `&brand_id=eq.${brandId}`;
+          [new Date().toISOString().split("T")[0], brandId],
-    }
+        )
-
+      : await pool.query<{ id: string }>(
-    const stopsRes = await fetch(stopsQuery, {
+          `SELECT id FROM stops
-      headers: {
+            WHERE date >= $1 AND status = 'scheduled'`,
-        ...svcHeaders(supabaseKey),
+          [new Date().toISOString().split("T")[0]],
-        Prefer: "count=exact",
+        );
-      },
+    const activeStops = stopsRes.rows.length;
    });
    const activeStops = parseInt(stopsRes.headers.get("X-Total-Count") || "0");
    // Get active products count
-    let productsQuery = `${supabaseUrl}/rest/v1/products?select=id&active=eq.true`;
+    const productsRes = brandId
-    if (brandId) {
+      ? await pool.query<{ id: string }>(
-      productsQuery += `&brand_id=eq.${brandId}`;
+          `SELECT id FROM products WHERE active = true AND brand_id = $1`,
-    }
+          [brandId],
-
+        )
-    const productsRes = await fetch(productsQuery, {
+      : await pool.query<{ id: string }>(
-      headers: {
+          `SELECT id FROM products WHERE active = true`,
-        ...svcHeaders(supabaseKey),
+        );
-        Prefer: "count=exact",
+    const activeProducts = productsRes.rows.length;
      },
    });
    const activeProducts = parseInt(productsRes.headers.get("X-Total-Count") || "0");
    return {
      total_revenue,
@@ -1,12 +1,14 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { svcHeaders } from "@/lib/svc-headers";
-const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+/**
-const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+ * The new schema does not have an `abandoned_carts` table. The legacy
-
+ * "detect abandoned wholesale carts, enroll them, and run a 3-step
-// ── Types ─────────────────────────────────────────────────────────────────────
+ * recovery email sequence" feature has been retired. The mailer
 * functions below still build and dispatch Resend messages, but the
 * detection, enrollment, and persistence layer are gone.
 */
 export type AbandonedCart = {
  id: string;
@@ -38,7 +40,6 @@ export type GetAbandonedCartsResult = {
 // ── Sequence email intervals ───────────────────────────────────────────────────
 const EMAIL_INTERVALS_HOURS = [1, 24, 48] as const;
 const LOCALE_CART_SUBJECT: Record<string, Record<number, { subject: string; heading: string; body: string }>> = {
  en: {
    1: {
@@ -65,7 +66,7 @@ const LOCALE_CART_SUBJECT: Record<string, Record<number, { subject: string; head
    },
    2: {
      subject: "¿Aún lo estás pensando? Tu carrito sigue aquí",
-      heading: "Un pequeño recordatorio",
+      heading: "Un pequeño record",
      body: "Tu pedido al por mayor aún está esperando. Reserva tu fecha de recogida antes de que se llene.",
    },
    3: {
@@ -86,28 +87,13 @@ export async function getAbandonedCarts(brandId: string): Promise<GetAbandonedCa
    return { success: false, error: "Not authorized" };
  }
-  const res = await fetch(
+  void brandId;
-    `${supabaseUrl}/rest/v1/rpc/get_abandoned_carts`,
+  // The abandoned_carts table has been retired. Return an empty list
-    {
+  // and zeroed stats. The admin dashboard degrades to the empty state.
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
  if (!res.ok) return { success: false, error: "Failed to fetch abandoned carts" };
  const data = await res.json();
  // Supabase TABLE(func) returns [{carts: ...}] — extract from first row
  const row = Array.isArray(data) ? data[0] : data;
  const carts: AbandonedCart[] = row?.carts ?? [];
  return {
    success: true,
-    carts,
+    carts: [],
-    stats: {
+    stats: { total: 0, recovered: 0, active: 0, expired: 0 },
      total: carts.length,
      recovered: carts.filter(c => c.status === "recovered").length,
      active: carts.filter(c => c.status === "active").length,
      expired: carts.filter(c => c.status === "expired").length,
    },
  };
 }
@@ -124,20 +110,9 @@ export async function manuallyCloseAbandonedCart(
    return { success: false, error: "Not authorized" };
  }
-  const res = await fetch(
+  void cartId;
-    `${supabaseUrl}/rest/v1/rpc/update_abandoned_cart`,
+  void brandId;
-    {
+  return { success: false, error: "Abandoned-cart persistence has been retired" };
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_id: cartId,
        p_status: "manually_closed",
        p_manually_closed_by: adminUser.id,
      }),
    }
  );
  if (!res.ok) return { success: false, error: "Failed to close cart" };
  return { success: true };
 }
 // ── Build email HTML ───────────────────────────────────────────────────────────
@@ -217,6 +192,7 @@ export async function sendAbandonedCartEmail(
    adminUrl,
  });
  void brandId;
  const RESEND_API_KEY = process.env.RESEND_API_KEY ?? "";
  if (!RESEND_API_KEY) return { success: false, error: "Resend not configured" };
@@ -241,25 +217,6 @@ export async function sendAbandonedCartEmail(
      return { success: false, error: err };
    }
    const data = await res.json();
    // Update cart record
    await fetch(
      `${supabaseUrl}/rest/v1/rpc/update_abandoned_cart`,
      {
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({
          p_id: cart.id,
          p_sequence_step: step,
          p_last_email_sent_at: new Date().toISOString(),
          p_next_email_at: step < 3 ? new Date(Date.now() + EMAIL_INTERVALS_HOURS[step] * 3600000).toISOString() : null,
          p_status: step >= 3 ? "expired" : "active",
          p_expired_at: step >= 3 ? new Date().toISOString() : null,
        }),
      }
    );
    return { success: true };
  } catch (e) {
    return { success: false, error: String(e) };
@@ -279,32 +236,15 @@ export async function resendAbandonedCartEmail(
    return { success: false, error: "Not authorized" };
  }
-  const res = await fetch(
+  void cartId;
-    `${supabaseUrl}/rest/v1/rpc/manual_resend_abandoned_cart_email`,
+  void brandId;
-    {
+  return { success: false, error: "Abandoned-cart persistence has been retired" };
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_cart_id: cartId, p_step: 1 }),
    }
  );
  if (!res.ok) return { success: false, error: "Failed to resend email" };
  return { success: true };
 }
 // ── Mark cart as recovered when order is placed ────────────────────────────────
 export async function markCartRecovered(cartId: string, orderId: string): Promise<void> {
-  await fetch(
+  void cartId;
-    `${supabaseUrl}/rest/v1/rpc/update_abandoned_cart`,
+  void orderId;
-    {
+  // No DB call — abandoned_carts persistence is gone.
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({
        p_id: cartId,
        p_status: "recovered",
        p_recovered_order_id: orderId,
        p_recovered_at: new Date().toISOString(),
      }),
    }
  );
 }
@@ -1,12 +1,14 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { svcHeaders } from "@/lib/svc-headers";
-const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+/**
-const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+ * The new schema does not have a `welcome_sequence` table. The legacy
-
+ * "enroll a contact in a multi-step onboarding email sequence" feature
-// ── Types ─────────────────────────────────────────────────────────────────────
+ * has been retired; the mailer functions below still build and send
 * Resend messages, but the persistence layer is gone. The functions
 * now return empty data and no-op on updates.
 */
 export type WelcomeSequenceEntry = {
  id: string;
@@ -112,27 +114,15 @@ export async function getWelcomeSequence(brandId: string): Promise<GetWelcomeSeq
    return { success: false, error: "Not authorized" };
  }
-  const res = await fetch(
+  // The welcome_sequence table has been retired; return an empty list
-    `${supabaseUrl}/rest/v1/rpc/get_welcome_sequence`,
+  // and zeroed stats. The cron API route in
-    {
+  // `src/app/api/email-automation/welcome-sequence/route.ts` will see
-      method: "POST",
+  // an empty result and skip the per-brand work.
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  void brandId;
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
  if (!res.ok) return { success: false, error: "Failed to fetch welcome sequence" };
  const data = await res.json();
  const row = Array.isArray(data) ? data[0] : data;
  const entries: WelcomeSequenceEntry[] = row?.entries ?? [];
  return {
    success: true,
-    entries,
+    entries: [],
-    stats: {
+    stats: { total: 0, completed: 0, active: 0, unsubscribed: 0 },
      total: entries.length,
      completed: entries.filter(e => e.status === "completed").length,
      active: entries.filter(e => e.status === "active").length,
      unsubscribed: entries.filter(e => e.status === "unsubscribed").length,
    },
  };
 }
@@ -228,26 +218,8 @@ export async function sendWelcomeEmail(
      return { success: false, error: err };
    }
-    const data = await res.json();
+    // No DB to update — the welcome_sequence table is gone. Reporting
-    const isLastEmail = step >= 4;
+    // success here means the email was dispatched; the cron can move on.
    // Update sequence entry
    await fetch(
      `${supabaseUrl}/rest/v1/rpc/update_welcome_sequence`,
      {
        method: "POST",
        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
        body: JSON.stringify({
          p_id: entry.id,
          p_sequence_step: step,
          p_last_email_sent_at: new Date().toISOString(),
          p_next_email_at: isLastEmail ? null : new Date(Date.now() + 24 * 3600000).toISOString(),
          p_status: isLastEmail ? "completed" : "active",
          p_completed_at: isLastEmail ? new Date().toISOString() : null,
        }),
      }
    );
    return { success: true };
  } catch (e) {
    return { success: false, error: String(e) };
@@ -267,14 +239,10 @@ export async function resendWelcomeEmail(
    return { success: false, error: "Not authorized" };
  }
-  const res = await fetch(
+  void entryId;
-    `${supabaseUrl}/rest/v1/rpc/manual_resend_welcome_email`,
+  void brandId;
-    {
+  // The welcome_sequence table is gone — there is nothing to look up
-      method: "POST",
+  // and no draft email to redispatch from here. Manual resend is a
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  // no-op until a new persistence layer is added.
-      body: JSON.stringify({ p_entry_id: entryId, p_step: 1 }),
+  return { success: false, error: "Welcome sequence persistence has been retired" };
    }
  );
  if (!res.ok) return { success: false, error: "Failed to resend email" };
  return { success: true };
 }
@@ -1,9 +1,23 @@
 "use server";
 import { desc, eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand, withPlatformAdmin } from "@/db/client";
 import { campaigns } from "@/db/schema";
 import type { AudienceRules } from "@/actions/communications/campaigns";
 /**
 * `harvest-reach/campaigns` re-exports the marketing `Campaign` shape
 * but adds an analytics helper. The data layer is shared with
 * `actions/communications/campaigns.ts`; this module adapts the
 * narrower `Campaign` from there to the legacy `harvest-reach` shape
 * (with `subject`, `body_text`, `body_html`, `campaign_type`,
 * `audience_rules`, `scheduled_at`, `created_by`). Fields the new
 * schema does not store are filled with sensible defaults — UI code
 * that depends on the legacy fields should be updated to read them
 * from `email_templates` joined by `template_id`.
 */
 export type CampaignType = "marketing" | "operational" | "transactional";
 export type CampaignStatus = "draft" | "scheduled" | "sending" | "sent" | "canceled";
@@ -40,9 +54,25 @@ export type CampaignAnalytics = {
  sent_at: string | null;
 };
-// ──────────────────────────────────────────────────────────────
+function rowToCampaign(row: typeof campaigns.$inferSelect): Campaign {
-// getHarvestReachCampaigns
+  return {
-// ──────────────────────────────────────────────────────────────
+    id: row.id,
    brand_id: row.brandId,
    name: row.name,
    subject: null,
    body_text: null,
    body_html: null,
    template_id: row.templateId,
    campaign_type: "operational",
    status: row.status as CampaignStatus,
    audience_rules: {},
    scheduled_at: row.scheduledFor ? row.scheduledFor.toISOString() : null,
    sent_at: row.sentAt ? row.sentAt.toISOString() : null,
    created_by: null,
    created_at: row.createdAt.toISOString(),
    updated_at: row.updatedAt.toISOString(),
  };
 }
 export async function getHarvestReachCampaigns(
  brandId: string
@@ -53,27 +83,31 @@ export async function getHarvestReachCampaigns(
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = await withBrand(brandId, (db) =>
-
+      db
-  const response = await fetch(
+        .select()
-    `${supabaseUrl}/rest/v1/rpc/get_communication_campaigns`,
+        .from(campaigns)
-    {
+        .orderBy(desc(campaigns.createdAt)),
-      method: "POST",
+    );
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    return { success: true, campaigns: rows.map(rowToCampaign) };
-      body: JSON.stringify({ p_brand_id: brandId }),
+  } catch (err) {
-    }
+    return {
-  );
+      success: false,
-
+      error: err instanceof Error ? err.message : "Failed to fetch campaigns",
-  if (!response.ok) return { success: false, error: "Failed to fetch campaigns" };
+    };
-  const data = await response.json();
+  }
  return { success: true, campaigns: data?.campaigns ?? [] };
 }
-// ──────────────────────────────────────────────────────────────
+/**
-// getCampaignAnalytics
+ * The legacy `get_campaign_analytics` RPC computed aggregate engagement
-// ──────────────────────────────────────────────────────────────
+ * metrics from the per-recipient `communication_message_logs` table.
-
+ * That table is gone in the new schema. The replacement returns a
 * zeros-and-rate object keyed by campaign id, with the only real
 * number being the campaign's `recipient_count`. The UI is expected
 * to render "no analytics available" until a new log table is
 * introduced.
 */
 export async function getCampaignAnalytics(
  brandId: string,
  campaignId?: string
@@ -82,21 +116,38 @@ export async function getCampaignAnalytics(
  if (!adminUser) return [];
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== brandId) return [];
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = campaignId
      ? await withBrand(brandId, (db) =>
          db
            .select()
            .from(campaigns)
            .where(eq(campaigns.id, campaignId)),
        )
      : await withBrand(brandId, (db) =>
          db
            .select()
            .from(campaigns)
            .orderBy(desc(campaigns.createdAt)),
        );
-  const response = await fetch(
+    return rows.map((r) => ({
-    `${supabaseUrl}/rest/v1/rpc/get_campaign_analytics`,
+      campaign_id: r.id,
-    {
+      campaign_name: r.name,
-      method: "POST",
+      total_sent: r.recipientCount,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      total_delivered: 0,
-      body: JSON.stringify({
+      total_opened: 0,
-        p_brand_id: brandId,
+      total_clicked: 0,
-        p_campaign_id: campaignId ?? null,
+      total_bounced: 0,
-      }),
+      delivered_rate: 0,
-    }
+      open_rate: 0,
-  );
+      click_rate: 0,
-
+      bounce_rate: 0,
-  if (!response.ok) return [];
+      sent_at: r.sentAt ? r.sentAt.toISOString() : null,
-  return (await response.json()) as CampaignAnalytics[];
+    }));
  } catch {
    return [];
  }
 }
 void withPlatformAdmin;
@@ -1,7 +1,9 @@
 "use server";
 import { and, eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { products } from "@/db/schema";
 export type ProductOption = {
  id: string;
@@ -10,6 +12,13 @@ export type ProductOption = {
  price: number;
 };
 /**
 * The legacy `get_products_for_segment_picker` RPC returned a
 * `(id, name, type, price)` denormalized view. The new `products`
 * table does not have a `type` column, so every row is reported as
 * "product" — UI code that previously bucketed items by `type` will
 * see a single bucket until the schema gains a `type` column.
 */
 export async function getProductsForSegmentPicker(
  brandId: string
 ): Promise<ProductOption[]> {
@@ -17,18 +26,25 @@ export async function getProductsForSegmentPicker(
  if (!adminUser) return [];
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== brandId) return [];
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = await withBrand(brandId, (db) =>
-
+      db
-  const response = await fetch(
+        .select({
-    `${supabaseUrl}/rest/v1/rpc/get_products_for_segment_picker`,
+          id: products.id,
-    {
+          name: products.name,
-      method: "POST",
+          priceCents: products.priceCents,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+          active: products.active,
-      body: JSON.stringify({ p_brand_id: brandId }),
+        })
-    }
+        .from(products)
-  );
+        .where(and(eq(products.brandId, brandId), eq(products.active, true))),
-
+    );
-  if (!response.ok) return [];
+    return rows.map((r) => ({
-  return (await response.json()) as ProductOption[];
+      id: r.id,
      name: r.name,
      type: "product",
      price: r.priceCents / 100,
    }));
  } catch {
    return [];
  }
 }
@@ -1,7 +1,9 @@
 "use server";
 import { and, eq, ilike, or, SQL, sql } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { customers, brandSettings } from "@/db/schema";
 import type { AudienceRules } from "@/actions/communications/campaigns";
 export type SegmentFilterType =
@@ -37,6 +39,8 @@ export type SegmentRuleV2 = {
 // AudienceRules is imported from @/actions/communications/campaigns
 const SEGMENTS_FLAG_KEY = "comm_segments_v1";
 export type Segment = {
  id: string;
  brand_id: string;
@@ -51,7 +55,7 @@ export type Segment = {
 export type CustomerSample = {
  id: string;
  email: string;
-  name: string;
+  fullName: string | null;
  tags: string[];
  phone: string | null;
 };
@@ -61,9 +65,41 @@ export type PreviewResult = {
  sample_customers: CustomerSample[];
 };
-// ──────────────────────────────────────────────────────────────
+function isSegmentList(v: unknown): v is Segment[] {
-// getHarvestReachSegments
+  return Array.isArray(v) && v.every((s) => s && typeof s === "object" && "rules" in s);
-// ──────────────────────────────────────────────────────────────
+}
 async function loadSegments(brandId: string): Promise<Segment[]> {
  const rows = await withBrand(brandId, (db) =>
    db
      .select({ flags: brandSettings.featureFlags })
      .from(brandSettings)
      .where(eq(brandSettings.brandId, brandId))
      .limit(1),
  );
  const raw = (rows[0]?.flags ?? {}) as Record<string, unknown>;
  const list = raw[SEGMENTS_FLAG_KEY];
  return isSegmentList(list) ? list : [];
 }
 async function saveSegments(brandId: string, segments: Segment[]): Promise<void> {
  await withBrand(brandId, async (db) => {
    const existing = await db
      .select({ flags: brandSettings.featureFlags })
      .from(brandSettings)
      .where(eq(brandSettings.brandId, brandId))
      .limit(1);
    const baseFlags = (existing[0]?.flags ?? {}) as Record<string, unknown>;
    const nextFlags: Record<string, unknown> = {
      ...baseFlags,
      [SEGMENTS_FLAG_KEY]: segments,
    };
    await db
      .update(brandSettings)
      .set({ featureFlags: nextFlags, updatedAt: new Date() })
      .where(eq(brandSettings.brandId, brandId));
  });
 }
 export async function getHarvestReachSegments(
  brandId: string
@@ -75,27 +111,17 @@ export async function getHarvestReachSegments(
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const segments = await loadSegments(brandId);
-
+    return { success: true, segments };
-  const response = await fetch(
+  } catch (err) {
-    `${supabaseUrl}/rest/v1/rpc/get_communication_segments`,
+    return {
-    {
+      success: false,
-      method: "POST",
+      error: err instanceof Error ? err.message : "Failed to fetch segments",
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    };
-      body: JSON.stringify({ p_brand_id: brandId }),
+  }
    }
  );
  if (!response.ok) return { success: false, error: "Failed to fetch segments" };
  const data = await response.json();
  return { success: true, segments: data?.segments ?? [] };
 }
 // ──────────────────────────────────────────────────────────────
 // upsertHarvestReachSegment
 // ──────────────────────────────────────────────────────────────
 export async function upsertHarvestReachSegment(params: {
  id?: string;
  brand_id: string;
@@ -110,34 +136,44 @@ export async function upsertHarvestReachSegment(params: {
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const segments = await loadSegments(params.brand_id);
-
+    const now = new Date().toISOString();
-  const response = await fetch(
+    let saved: Segment;
-    `${supabaseUrl}/rest/v1/rpc/upsert_communication_segment`,
+    if (params.id) {
-    {
+      const idx = segments.findIndex((s) => s.id === params.id);
-      method: "POST",
+      if (idx === -1) return { success: false, error: "Segment not found" };
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      saved = {
-      body: JSON.stringify({
+        ...segments[idx],
-        p_id: params.id ?? null,
+        name: params.name,
-        p_brand_id: params.brand_id,
+        description: params.description ?? null,
-        p_name: params.name,
+        rules: params.rules,
-        p_description: params.description ?? null,
+        updated_at: now,
-        p_rules: params.rules,
+      };
-        p_created_by: adminUser.user_id,
+      segments[idx] = saved;
-      }),
+    } else {
      saved = {
        id: crypto.randomUUID(),
        brand_id: params.brand_id,
        name: params.name,
        description: params.description ?? null,
        rules: params.rules,
        created_by: adminUser.id,
        created_at: now,
        updated_at: now,
      };
      segments.push(saved);
    }
-  );
+    await saveSegments(params.brand_id, segments);
-
+    return { success: true, segment: saved };
-  if (!response.ok) return { success: false, error: "Failed to save segment" };
+  } catch (err) {
-  const data = await response.json();
+    return {
-  return { success: true, segment: data };
+      success: false,
      error: err instanceof Error ? err.message : "Failed to save segment",
    };
  }
 }
 // ──────────────────────────────────────────────────────────────
 // deleteHarvestReachSegment
 // ──────────────────────────────────────────────────────────────
 export async function deleteHarvestReachSegment(
  segmentId: string,
  brandId: string
@@ -149,26 +185,30 @@ export async function deleteHarvestReachSegment(
    return { success: false, error: "Not authorized" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const segments = await loadSegments(brandId);
-
+    const filtered = segments.filter((s) => s.id !== segmentId);
-  const response = await fetch(
+    if (filtered.length === segments.length) {
-    `${supabaseUrl}/rest/v1/rpc/delete_communication_segment`,
+      return { success: false, error: "Segment not found" };
    {
      method: "POST",
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_segment_id: segmentId, p_brand_id: brandId }),
    }
-  );
+    await saveSegments(brandId, filtered);
-
+    return { success: true };
-  if (!response.ok) return { success: false, error: "Failed to delete segment" };
+  } catch (err) {
-  return { success: true };
+    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to delete segment",
    };
  }
 }
-// ──────────────────────────────────────────────────────────────
+/**
-// previewSegmentWithCustomers
+ * The legacy `preview_campaign_audience` RPC evaluated a (combinator +
-// ──────────────────────────────────────────────────────────────
+ * filter[]) rule tree against a join of customers, orders, products,
-
+ * etc. The new schema has only `customers` and `orders`; the new
 * preview therefore counts the tenant's opted-in customers. The
 * `SegmentRuleV2` shape is preserved for round-tripping but no longer
 * influences the count.
 */
 export async function previewSegmentWithCustomers(
  brandId: string,
  rules: SegmentRuleV2
@@ -179,23 +219,43 @@ export async function previewSegmentWithCustomers(
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== brandId) {
    return null;
  }
  void rules;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const conds: SQL[] = [eq(customers.brandId, brandId), eq(customers.emailOptIn, true)];
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/preview_campaign_audience`,
+    const [samples, counts] = await withBrand(brandId, async (db) => {
-    {
+      const sample = await db
-      method: "POST",
+        .select({
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+          id: customers.id,
-      body: JSON.stringify({
+          email: customers.email,
-        p_brand_id: brandId,
+          fullName: customers.fullName,
-        p_audience_rules: rules,
+          phone: customers.phone,
-      }),
+        })
-    }
+        .from(customers)
-  );
+        .where(and(...conds))
        .limit(5);
      const c = await db
        .select({ value: sql<number>`count(*)::int` })
        .from(customers)
        .where(and(...conds));
      return [sample, c] as const;
    });
-  if (!response.ok) return null;
+    return {
-  const data = await response.json();
+      count: Number(counts[0]?.value ?? 0),
-  return data as PreviewResult;
+      sample_customers: samples.map((s) => ({
        id: s.id,
        email: s.email ?? "",
        fullName: s.fullName,
        tags: [],
        phone: s.phone,
      })),
    };
  } catch {
    return { count: 0, sample_customers: [] };
  }
 }
 void or;
 void ilike;
@@ -1,7 +1,9 @@
 "use server";
 import { and, eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { stops } from "@/db/schema";
 export type StopOption = {
  id: string;
@@ -15,6 +17,31 @@ export type StopOption = {
  is_past: boolean;
 };
 /**
 * The legacy `get_stops_for_segment_picker` RPC returned a denormalized
 * `(id, city, state, date, time, location, zip, ...)` row. The new
 * `stops` table only stores `name`, `address`, and a JSONB `schedule`
 * array — the structured city/state/zip columns are gone. The
 * replacement returns one option per stop, deriving display fields
 * from `address` and the schedule. `city`, `state`, `zip`, `date`,
 * `time` are best-effort extracted from the address string; missing
 * values fall back to "—".
 */
 function parseAddress(address: string): { city: string; state: string; zip: string } {
  // Best-effort: "123 Main St, City, ST 12345"
  const parts = address.split(",").map((s) => s.trim());
  const stateZip = parts[parts.length - 1] ?? "";
  const stateZipMatch = stateZip.match(/^([A-Z]{2})\s+(\d{5}(?:-\d{4})?)$/);
  if (stateZipMatch) {
    return {
      city: parts.length >= 2 ? parts[parts.length - 2] : "",
      state: stateZipMatch[1],
      zip: stateZipMatch[2],
    };
  }
  return { city: parts[1] ?? "", state: "", zip: "" };
 }
 export async function getStopsForSegmentPicker(
  brandId: string,
  stopId?: string
@@ -23,21 +50,45 @@ export async function getStopsForSegmentPicker(
  if (!adminUser) return [];
  if (adminUser.role === "brand_admin" && adminUser.brand_id !== brandId) return [];
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const rows = await withBrand(brandId, (db) =>
      db
        .select({
          id: stops.id,
          name: stops.name,
          address: stops.address,
          date: stops.date,
          time: stops.time,
        })
        .from(stops)
        .where(
          stopId
            ? and(eq(stops.brandId, brandId), eq(stops.id, stopId))
            : eq(stops.brandId, brandId),
        ),
    );
-  const response = await fetch(
+    const now = Date.now();
-    `${supabaseUrl}/rest/v1/rpc/get_stops_for_segment_picker`,
+    return rows.map((r) => {
-    {
+      const { city, state, zip } = parseAddress(r.address ?? "");
-      method: "POST",
+      const dateStr = r.date ?? "";
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      const timeStr = r.time ?? "";
-      body: JSON.stringify({
+      const ts = dateStr ? new Date(dateStr).getTime() : NaN;
-        p_brand_id: brandId,
+      const isUpcoming = Number.isFinite(ts) ? ts >= now : false;
-        p_stop_id: stopId ?? null,
+      const isPast = Number.isFinite(ts) ? ts < now : false;
-      }),
+      return {
-    }
+        id: r.id,
-  );
+        city,
-
+        state,
-  if (!response.ok) return [];
+        date: dateStr,
-  return (await response.json()) as StopOption[];
+        time: timeStr,
        location: r.name,
        zip,
        is_upcoming: isUpcoming,
        is_past: isPast,
      };
    });
  } catch {
    return [];
  }
 }
@@ -1,15 +1,26 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withTx, pool } from "@/lib/db";
 import { orders, orderItems, customers } from "@/db/schema";
 import { eq } from "drizzle-orm";
 export type ImportOrdersResult =
  | { success: true; imported: number; errors: { row: number; error: string }[] }
  | { success: false; error: string };
 /**
 * Bulk-import orders. Replaces the legacy `create_order_with_items` SECURITY
 * DEFINER RPC (`supabase/migrations/021_shipping_only_brand.sql`). The new
 * `orders` schema doesn't have `subtotal`, `customer_name`, `customer_email`,
 * `customer_phone`, or `stop_id` columns — totals are stored in
 * `total_cents` and customers are referenced by `customer_id`. For each
 * imported order we upsert a `customers` row keyed on email+tenant, then
 * insert the `orders` + `order_items` rows.
 */
 export async function importOrdersBatch(
  brandId: string,
-  orders: Array<{
+  ordersToImport: Array<{
    customer_name: string;
    customer_email: string;
    customer_phone: string;
@@ -25,38 +36,82 @@ export async function importOrdersBatch(
    return { success: false, error: "Not authorized for this brand" };
  }
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  const results = { imported: 0, errors: [] as { row: number; error: string }[] };
-  for (const order of orders) {
+  for (let i = 0; i < ordersToImport.length; i++) {
-    const idempotencyKey = crypto.randomUUID();
+    const order = ordersToImport[i];
-
+    try {
-    const response = await fetch(
+      // Compute total_cents server-side from current product prices.
-      `${supabaseUrl}/rest/v1/rpc/create_order_with_items`,
+      const productIds = order.items.map((it) => it.product_id);
-      {
+      if (productIds.length === 0) {
-        method: "POST",
+        results.errors.push({ row: i, error: "Order has no items" });
-        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        continue;
        body: JSON.stringify({
          p_idempotency_key: idempotencyKey,
          p_customer_name: order.customer_name,
          p_customer_email: order.customer_email,
          p_customer_phone: order.customer_phone,
          p_stop_id: order.stop_id,
          p_items: order.items.map((it) => ({
            id: it.product_id,
            quantity: it.quantity,
            fulfillment: it.fulfillment,
          })),
        }),
      }
    );
-    if (!response.ok) {
+      // Fetch product prices for the brand.
-      results.errors.push({ row: 0, error: `Failed to import order for ${order.customer_name}` });
+      const productRes = await pool.query<{ id: string; price_cents: number }>(
-    } else {
+        `SELECT id, price_cents FROM products WHERE brand_id = $1 AND id = ANY($2::uuid[])`,
        [brandId, productIds]
      );
      const priceMap = new Map(productRes.rows.map((p) => [p.id, p.price_cents]));
      let totalCents = 0;
      for (const it of order.items) {
        const unit = priceMap.get(it.product_id);
        if (typeof unit !== "number") {
          results.errors.push({ row: i, error: `Unknown product: ${it.product_id}` });
          totalCents = -1;
          break;
        }
        totalCents += unit * it.quantity;
      }
      if (totalCents < 0) continue;
      // Determine fulfillment: pickup | ship | mixed based on items.
      const fulfillments = new Set(order.items.map((it) => it.fulfillment));
      const fulfillment: "pickup" | "ship" | "mixed" =
        fulfillments.size > 1
          ? "mixed"
          : (Array.from(fulfillments)[0] as "pickup" | "ship" | "mixed") ?? "pickup";
      // Insert in a single transaction: customers + orders + order_items.
      await withTx(async (client) => {
        // Upsert customer by (brand_id, email).
        const customerRes = await client.query<{ id: string }>(
          `INSERT INTO customers (brand_id, name, email, phone, email_opt_in)
           VALUES ($1, $2, $3, $4, true)
           ON CONFLICT (brand_id, email) WHERE email IS NOT NULL
           DO UPDATE SET name = EXCLUDED.name, phone = EXCLUDED.phone, updated_at = now()
           RETURNING id`,
          [brandId, order.customer_name, order.customer_email || null, order.customer_phone || null]
        );
        const customerId = customerRes.rows[0]?.id ?? null;
        const orderRes = await client.query<{ id: string }>(
          `INSERT INTO orders (brand_id, customer_id, total_cents, status, fulfillment)
           VALUES ($1, $2, $3, 'pending', $4)
           RETURNING id`,
          [brandId, customerId, totalCents, fulfillment]
        );
        const orderId = orderRes.rows[0]?.id;
        if (!orderId) throw new Error("Order insert returned no id");
        for (const it of order.items) {
          const unit = priceMap.get(it.product_id) ?? 0;
          await client.query(
            `INSERT INTO order_items (order_id, product_id, quantity, price_cents, fulfillment)
             VALUES ($1, $2, $3, $4, $5)`,
            [orderId, it.product_id, it.quantity, unit, it.fulfillment === "shipping" ? "ship" : it.fulfillment]
          );
        }
      });
      results.imported++;
    } catch (err) {
      results.errors.push({
        row: i,
        error: `Failed to import order for ${order.customer_name}: ${err instanceof Error ? err.message : String(err)}`,
      });
    }
  }
@@ -1,15 +1,24 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { withBrand } from "@/db/client";
 import { products } from "@/db/schema";
 export type ImportProductsResult =
  | { success: true; created: number; updated: number; errors: { product: string; error: string }[] }
  | { success: false; error: string };
 /**
 * Bulk-import products. Replaces the legacy `bulk_upsert_products` SECURITY
 * DEFINER RPC. The new `products` schema drops the legacy `type`, `is_taxable`,
 * `pickup_type`, and `image_url` columns; we keep `name`, `description`,
 * `price_cents`, and `active`. Without an id we always INSERT (no upsert
 * key for matching — the caller can run an update path separately if
 * deduplication is needed).
 */
 export async function importProductsBatch(
  brandId: string,
-  products: Array<{
+  productsToImport: Array<{
    name: string;
    description: string;
    price: number;
@@ -26,19 +35,33 @@ export async function importProductsBatch(
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  let created = 0;
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  const errors: { product: string; error: string }[] = [];
-  const response = await fetch(
+  for (const p of productsToImport) {
-    `${supabaseUrl}/rest/v1/rpc/bulk_upsert_products`,
+    const priceCents = Math.round(Number(p.price) * 100);
-    {
+    if (!Number.isFinite(priceCents) || priceCents < 0) {
-      method: "POST",
+      errors.push({ product: p.name, error: "Invalid price" });
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      continue;
      body: JSON.stringify({ p_brand_id: brandId, p_products: products }),
    }
-  );
+    try {
      await withBrand(brandId, (db) =>
        db.insert(products).values({
          brandId: brandId,
          name: p.name,
          description: p.description ?? null,
          priceCents,
          active: p.active,
        })
      );
      created++;
    } catch (err) {
      errors.push({
        product: p.name,
        error: err instanceof Error ? err.message : String(err),
      });
    }
  }
-  if (!response.ok) return { success: false, error: "Import failed" };
+  return { success: true, created, updated: 0, errors };
  const data = await response.json();
  return { success: true, created: data.created, updated: data.updated, errors: data.errors ?? [] };
 }
@@ -1,7 +1,7 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { DEFAULT_MODELS, type AIProvider as AIProviderType } from "@/lib/ai-provider-models";
 // ── Types ────────────────────────────────────────────────────────────────────────
@@ -33,33 +33,31 @@ const MINIMAX_DEFAULT_BASE_URL = "https://api.minimax.io/v1";
 // ── Get AI provider settings ─────────────────────────────────────────────────────
 export async function getAIProviderSettings(brandId: string): Promise<AIProviderSettings> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+    const res = await pool.query<{
-
+      provider: string | null;
-  const response = await fetch(
+      api_key: string | null;
-    `${supabaseUrl}/rest/v1/rpc/get_ai_provider_settings`,
+      org_id: string | null;
-    {
+      model: string | null;
-      method: "POST",
+      custom_endpoint: string | null;
-      headers: {
+    }>(
-        ...svcHeaders(supabaseKey!),
+      "SELECT * FROM get_ai_provider_settings($1)",
-        "Content-Type": "application/json",
+      [brandId]
-      },
+    );
-      body: JSON.stringify({ p_brand_id: brandId }),
+    const data = res.rows[0];
    if (!data) {
      return { provider: "openai", apiKey: "", model: "gpt-4o-mini" };
    }
-  );
+    return {
-
+      provider: (data.provider as AIProvider) ?? "openai",
-  if (!response.ok) {
+      apiKey: data.api_key ?? "",
      orgId: data.org_id ?? undefined,
      model: data.model ?? "gpt-4o-mini",
      customEndpoint: data.custom_endpoint ?? undefined,
    };
  } catch {
    return { provider: "openai", apiKey: "", model: "gpt-4o-mini" };
  }
  const data = await response.json();
  return {
    provider: (data.provider as AIProvider) ?? "openai",
    apiKey: data.api_key ?? "",
    orgId: data.org_id,
    model: data.model ?? "gpt-4o-mini",
    customEndpoint: data.custom_endpoint,
  };
 }
 // ── Save AI provider settings ───────────────────────────────────────────────────
@@ -75,9 +73,6 @@ export async function setAIProviderSettings(
  const current = await getAIProviderSettings(brandId);
  const merged = { ...current, ...settings };
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
  const payload = {
    provider: merged.provider,
    api_key: merged.apiKey,
@@ -86,24 +81,16 @@ export async function setAIProviderSettings(
    custom_endpoint: merged.customEndpoint ?? null,
  };
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/set_ai_provider_settings`,
+    await pool.query(
-    {
+      "SELECT set_ai_provider_settings($1, $2::jsonb)",
-      method: "POST",
+      [brandId, JSON.stringify(payload)]
-      headers: {
+    );
-        ...svcHeaders(supabaseKey!),
+    return { success: true };
-        "Content-Type": "application/json",
+  } catch (err) {
-      },
+    const msg = err instanceof Error ? err.message : "Failed to save";
-      body: JSON.stringify({ p_brand_id: brandId, p_settings: payload }),
+    return { success: false, error: msg };
    }
  );
  const data = await response.json();
  if (!response.ok || !data) {
    return { success: false, error: data?.message ?? "Failed to save" };
  }
  return { success: true };
 }
 // ── Dynamic AI client factory ────────────────────────────────────────────────────
@@ -206,24 +193,15 @@ export async function getAIClient(brandId: string): Promise<{
 // ── Custom integrations ─────────────────────────────────────────────────────────
 export async function getCustomIntegrations(brandId: string): Promise<CustomIntegration[]> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+    const res = await pool.query<CustomIntegration>(
-
+      "SELECT * FROM get_custom_integrations($1)",
-  const response = await fetch(
+      [brandId]
-    `${supabaseUrl}/rest/v1/rpc/get_custom_integrations`,
+    );
-    {
+    return res.rows ?? [];
-      method: "POST",
+  } catch {
-      headers: {
+    return [];
-        ...svcHeaders(supabaseKey!),
+  }
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ p_brand_id: brandId }),
    }
  );
  if (!response.ok) return [];
  const data = await response.json();
  return data ?? [];
 }
 export async function upsertCustomIntegration(
@@ -234,25 +212,16 @@ export async function upsertCustomIntegration(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (adminUser.brand_id && adminUser.brand_id !== brandId) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+    const res = await pool.query<CustomIntegration>(
-
+      "SELECT * FROM upsert_custom_integration($1, $2::jsonb)",
-  const response = await fetch(
+      [brandId, JSON.stringify(integration)]
-    `${supabaseUrl}/rest/v1/rpc/upsert_custom_integration`,
+    );
-    {
+    return { success: true, integrations: res.rows };
-      method: "POST",
+  } catch (err) {
-      headers: {
+    const msg = err instanceof Error ? err.message : "Failed to save";
-        ...svcHeaders(supabaseKey!),
+    return { success: false, error: msg };
-        "Content-Type": "application/json",
+  }
      },
      body: JSON.stringify({ p_brand_id: brandId, p_integration: integration }),
    }
  );
  const data = await response.json();
  if (!response.ok) return { success: false, error: data?.message ?? "Failed to save" };
  return { success: true, integrations: data };
 }
 export async function deleteCustomIntegration(
@@ -263,25 +232,14 @@ export async function deleteCustomIntegration(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (adminUser.brand_id && adminUser.brand_id !== brandId) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+    await pool.query(
-
+      "SELECT delete_custom_integration($1, $2)",
-  const response = await fetch(
+      [brandId, integrationId]
-    `${supabaseUrl}/rest/v1/rpc/delete_custom_integration`,
+    );
-    {
+    return { success: true };
-      method: "POST",
+  } catch (err) {
-      headers: {
+    const msg = err instanceof Error ? err.message : "Failed to delete";
-        ...svcHeaders(supabaseKey!),
+    return { success: false, error: msg };
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ p_brand_id: brandId, p_integration_id: integrationId }),
    }
  );
  if (!response.ok) {
    const data = await response.json();
    return { success: false, error: data?.message ?? "Failed to delete" };
  }
  return { success: true };
 }
@@ -1,7 +1,7 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 // ── Types ─────────────────────────────────────────────────────────────────────
@@ -24,28 +24,25 @@ export type SaveCredentialsResult =
 // ── Resend Credentials ─────────────────────────────────────────────────────────
 export async function getResendCredentials(brandId: string): Promise<ResendCredentials> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const res = await pool.query<{
-
+      api_key: string | null;
-  const response = await fetch(
+      from_email: string | null;
-    `${supabaseUrl}/rest/v1/rpc/get_resend_credentials`,
+      from_name: string | null;
-    {
+    }>(
-      method: "POST",
+      "SELECT * FROM get_resend_credentials($1)",
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      [brandId]
-      body: JSON.stringify({ p_brand_id: brandId }),
+    );
-    }
+    const data = res.rows[0];
-  );
+    if (!data) return { api_key: null, from_email: null, from_name: null };
-
+    return {
-  if (!response.ok) {
+      api_key: data.api_key ?? null,
      from_email: data.from_email ?? null,
      from_name: data.from_name ?? null,
    };
  } catch {
    return { api_key: null, from_email: null, from_name: null };
  }
  const data = await response.json();
  return {
    api_key: data?.api_key ?? null,
    from_email: data?.from_email ?? null,
    from_name: data?.from_name ?? null,
  };
 }
 export async function saveResendCredentials(
@@ -66,9 +63,6 @@ export async function saveResendCredentials(
    return { success: false, error: "Not authorized" };
  }
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  // Get current credentials to merge
  const current = await getResendCredentials(brandId);
  const merged = {
@@ -77,50 +71,39 @@ export async function saveResendCredentials(
    from_name: credentials.from_name !== undefined ? credentials.from_name : current.from_name,
  };
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/set_resend_credentials`,
+    await pool.query(
-    {
+      "SELECT set_resend_credentials($1, $2::jsonb)",
-      method: "POST",
+      [brandId, JSON.stringify(merged)]
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    );
-      body: JSON.stringify({
+    return { success: true };
-        p_brand_id: brandId,
+  } catch {
        p_credentials: merged,
      }),
    }
  );
  if (!response.ok) {
    return { success: false, error: "Failed to save Resend credentials" };
  }
  return { success: true };
 }
 // ── Twilio Credentials ─────────────────────────────────────────────────────────
 export async function getTwilioCredentials(brandId: string): Promise<TwilioCredentials> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const res = await pool.query<{
-
+      account_sid: string | null;
-  const response = await fetch(
+      auth_token: string | null;
-    `${supabaseUrl}/rest/v1/rpc/get_twilio_credentials`,
+      phone_number: string | null;
-    {
+    }>(
-      method: "POST",
+      "SELECT * FROM get_twilio_credentials($1)",
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      [brandId]
-      body: JSON.stringify({ p_brand_id: brandId }),
+    );
-    }
+    const data = res.rows[0];
-  );
+    if (!data) return { account_sid: null, auth_token: null, phone_number: null };
-
+    return {
-  if (!response.ok) {
+      account_sid: data.account_sid ?? null,
      auth_token: data.auth_token ?? null,
      phone_number: data.phone_number ?? null,
    };
  } catch {
    return { account_sid: null, auth_token: null, phone_number: null };
  }
  const data = await response.json();
  return {
    account_sid: data?.account_sid ?? null,
    auth_token: data?.auth_token ?? null,
    phone_number: data?.phone_number ?? null,
  };
 }
 export async function saveTwilioCredentials(
@@ -141,9 +124,6 @@ export async function saveTwilioCredentials(
    return { success: false, error: "Not authorized" };
  }
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  // Get current credentials to merge
  const current = await getTwilioCredentials(brandId);
  const merged = {
@@ -152,23 +132,15 @@ export async function saveTwilioCredentials(
    phone_number: credentials.phone_number !== undefined ? credentials.phone_number : current.phone_number,
  };
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/set_twilio_credentials`,
+    await pool.query(
-    {
+      "SELECT set_twilio_credentials($1, $2::jsonb)",
-      method: "POST",
+      [brandId, JSON.stringify(merged)]
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    );
-      body: JSON.stringify({
+    return { success: true };
-        p_brand_id: brandId,
+  } catch {
        p_credentials: merged,
      }),
    }
  );
  if (!response.ok) {
    return { success: false, error: "Failed to save Twilio credentials" };
  }
  return { success: true };
 }
 // ── Test Connection Functions ─────────────────────────────────────────────────
@@ -3,7 +3,7 @@
 import { revalidateTag } from "next/cache";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 export type LocationInput = {
  name: string;
@@ -56,39 +56,37 @@ export async function createLocation(
  const effectiveBrandId = activeBrandId;
  if (!effectiveBrandId) return { success: false, error: "No brand selected" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const { rows } = await pool.query<{ id: string; slug: string }>(
-
+      `SELECT * FROM admin_create_location(
-  const res = await fetch(
+         $1, $2, $3, $4, $5, $6, $7, $8, $9, $10
-    `${supabaseUrl}/rest/v1/rpc/admin_create_location`,
+       )`,
-    {
+      [
-      method: "POST",
+        effectiveBrandId,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        input.name,
-      body: JSON.stringify({
+        input.address ?? null,
-        p_brand_id: effectiveBrandId,
+        input.city ?? null,
-        p_name: input.name,
+        input.state ?? null,
-        p_address: input.address ?? null,
+        input.zip ?? null,
-        p_city: input.city ?? null,
+        input.phone ?? null,
-        p_state: input.state ?? null,
+        input.contact_name ?? null,
-        p_zip: input.zip ?? null,
+        input.contact_email ?? null,
-        p_phone: input.phone ?? null,
+        input.notes ?? null,
-        p_contact_name: input.contact_name ?? null,
+      ],
-        p_contact_email: input.contact_email ?? null,
+    );
-        p_notes: input.notes ?? null,
+    const data = rows[0];
-        p_active: input.active ?? true,
+    if (!data) {
-      }),
+      return { success: false, error: "Insert failed" };
    }
-  );
+    revalidateTag("locations", "default");
-
+    revalidateTag(`brand:${effectiveBrandId}:locations`, "default");
-  if (!res.ok) {
+    return { success: true, id: data.id, slug: data.slug };
-    const err = await res.json().catch(() => ({ message: "Request failed" }));
+  } catch (err) {
-    return { success: false, error: (err as { message?: string }).message ?? "Insert failed" };
+    return {
      success: false,
      error: err instanceof Error ? err.message : "Insert failed",
    };
  }
  const data = await res.json();
  revalidateTag("locations", "default");
  revalidateTag(`brand:${effectiveBrandId}:locations`, "default");
  return { success: true, id: data.id, slug: data.slug };
 }
 // ── Create (batch) ───────────────────────────────────────────────────────────
@@ -108,24 +106,21 @@ export async function createLocationsBatch(
  const effectiveBrandId = activeBrandId;
  if (!effectiveBrandId) return { success: false, created: 0, error: "No brand selected" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  let inserted: { id?: string }[] = [];
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  try {
-
+    const { rows } = await pool.query<{ id?: string }>(
-  const res = await fetch(
+      "SELECT * FROM admin_create_locations_batch($1, $2::jsonb)",
-    `${supabaseUrl}/rest/v1/rpc/admin_create_locations_batch`,
+      [effectiveBrandId, JSON.stringify(locations)],
-    {
+    );
-      method: "POST",
+    inserted = rows;
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  } catch (err) {
-      body: JSON.stringify({ p_brand_id: effectiveBrandId, p_locations: locations }),
+    return {
-    }
+      success: false,
-  );
+      created: 0,
-
+      error: err instanceof Error ? err.message : "Insert failed",
-  if (!res.ok) {
+    };
    const err = await res.json().catch(() => ({ message: "Request failed" }));
    return { success: false, created: 0, error: (err as { message?: string }).message ?? "Insert failed" };
  }
  const inserted = await res.json();
  revalidateTag("locations", "default");
  revalidateTag(`brand:${effectiveBrandId}:locations`, "default");
  return {
@@ -144,25 +139,23 @@ export async function updateLocation(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_stops) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  let data: { success?: boolean; error?: string } = {};
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  try {
-
+    const { rows } = await pool.query<{ success?: boolean; error?: string }>(
-  const res = await fetch(
+      "SELECT * FROM admin_update_location($1, $2, $3::jsonb)",
-    `${supabaseUrl}/rest/v1/rpc/admin_update_location`,
+      [locationId, brandId, JSON.stringify(updates)],
-    {
+    );
-      method: "POST",
+    data = rows[0] ?? {};
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  } catch (err) {
-      body: JSON.stringify({ p_location_id: locationId, p_brand_id: brandId, p_updates: updates }),
+    return {
-    }
+      success: false,
-  );
+      error: err instanceof Error ? err.message : "Update failed",
-
+    };
  if (!res.ok) {
    const err = await res.json().catch(() => ({ message: "Request failed" }));
    return { success: false, error: (err as { message?: string }).message ?? "Update failed" };
  }
-  const data = await res.json();
+  if (!data.success) {
-  if (!data.success) return { success: false, error: data.error ?? "Update failed" };
+    return { success: false, error: data.error ?? "Update failed" };
  }
  revalidateTag("locations", "default");
  revalidateTag(`brand:${brandId}:locations`, "default");
@@ -178,25 +171,23 @@ export async function deleteLocation(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_stops) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  let data: { success?: boolean; error?: string } = {};
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  try {
-
+    const { rows } = await pool.query<{ success?: boolean; error?: string }>(
-  const res = await fetch(
+      "SELECT * FROM admin_delete_location($1, $2)",
-    `${supabaseUrl}/rest/v1/rpc/admin_delete_location`,
+      [locationId, brandId],
-    {
+    );
-      method: "POST",
+    data = rows[0] ?? {};
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  } catch (err) {
-      body: JSON.stringify({ p_location_id: locationId, p_brand_id: brandId }),
+    return {
-    }
+      success: false,
-  );
+      error: err instanceof Error ? err.message : "Delete failed",
-
+    };
  if (!res.ok) {
    const err = await res.json().catch(() => ({ message: "Request failed" }));
    return { success: false, error: (err as { message?: string }).message ?? "Delete failed" };
  }
-  const data = await res.json();
+  if (!data.success) {
-  if (!data.success) return { success: false, error: data.error ?? "Delete failed" };
+    return { success: false, error: data.error ?? "Delete failed" };
  }
  revalidateTag("locations", "default");
  revalidateTag(`brand:${brandId}:locations`, "default");
@@ -210,27 +201,18 @@ export async function adminListLocations(
  const adminUser = await getAdminUser();
  if (!adminUser) return [];
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
  // Application-layer brand scoping: platform_admin (brand_id: null) gets all
  // brands; everyone else gets only their own brand.
  const activeBrandId = await getActiveBrandId(adminUser, brandId);
  const effectiveBrandId = activeBrandId;
-  const res = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/admin_list_locations`,
+    const { rows } = await pool.query<LocationWithCount>(
-    {
+      "SELECT * FROM admin_list_locations($1)",
-      method: "POST",
+      [effectiveBrandId],
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    );
-      body: JSON.stringify({ p_brand_id: effectiveBrandId }),
+    return Array.isArray(rows) ? rows : [];
-      next: { revalidate: 60, tags: ["locations", `brand:${effectiveBrandId ?? "all"}:locations`] },
+  } catch {
-    }
+    return [];
-  );
+  }
  if (!res.ok) return [];
  const data = await res.json();
  return Array.isArray(data) ? (data as LocationWithCount[]) : [];
 }
 // ── Read (public, by brand slug) ─────────────────────────────────────────────
@@ -244,22 +226,15 @@ export async function getPublicLocationsForBrand(
 ): Promise<PublicLocation[]> {
  if (!brandSlug) return [];
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const { rows } = await pool.query<PublicLocation>(
-
+      "SELECT * FROM get_locations_for_brand($1)",
-  const res = await fetch(
+      [brandSlug],
-    `${supabaseUrl}/rest/v1/rpc/get_locations_for_brand`,
+    );
-    {
+    return Array.isArray(rows) ? rows : [];
-      method: "POST",
+  } catch {
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    return [];
-      body: JSON.stringify({ p_brand_slug: brandSlug }),
+  }
      next: { revalidate: 300, tags: ["locations", `brand:${brandSlug}:locations`] },
    }
  );
  if (!res.ok) return [];
  const data = await res.json();
  return Array.isArray(data) ? (data as PublicLocation[]) : [];
 }
 // ── Attach a stop to a location ──────────────────────────────────────────────
@@ -272,29 +247,23 @@ export async function attachStopToLocation(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_stops) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  let data: { success?: boolean; error?: string } = {};
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  try {
-
+    const { rows } = await pool.query<{ success?: boolean; error?: string }>(
-  const res = await fetch(
+      "SELECT * FROM admin_attach_location_to_stop($1, $2, $3)",
-    `${supabaseUrl}/rest/v1/rpc/admin_attach_location_to_stop`,
+      [stopId, locationId, brandId],
-    {
+    );
-      method: "POST",
+    data = rows[0] ?? {};
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  } catch (err) {
-      body: JSON.stringify({
+    return {
-        p_stop_id: stopId,
+      success: false,
-        p_location_id: locationId,
+      error: err instanceof Error ? err.message : "Attach failed",
-        p_brand_id: brandId,
+    };
      }),
    }
  );
  if (!res.ok) {
    const err = await res.json().catch(() => ({ message: "Request failed" }));
    return { success: false, error: (err as { message?: string }).message ?? "Attach failed" };
  }
-  const data = await res.json();
+  if (!data.success) {
-  if (!data.success) return { success: false, error: data.error ?? "Attach failed" };
+    return { success: false, error: data.error ?? "Attach failed" };
  }
  revalidateTag("stops", "default");
  revalidateTag("locations", "default");
@@ -1,56 +0,0 @@
 "use server";
 import { cookies } from "next/headers";
 import { createServerClient } from "@supabase/ssr";
 export type LoginWithPasswordResult =
  | { success: true; redirect: true }
  | { success: false; error: string };
 export async function loginWithPassword(
  email: string,
  password: string
 ): Promise<LoginWithPasswordResult> {
  const cookieStore = await cookies();
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
  if (!supabaseUrl || !supabaseAnonKey) {
    return { success: false, error: "Server misconfiguration." };
  }
  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
    cookies: {
      getAll() {
        return cookieStore.getAll();
      },
      setAll(cookiesToSet) {
        cookiesToSet.forEach(({ name, value, options }) => {
          cookieStore.set(name, value, options);
        });
      },
    },
  });
  const { data, error } = await supabase.auth.signInWithPassword({
    email,
    password,
  });
  if (error || !data.user) {
    return { success: false, error: error?.message || "Invalid credentials" };
  }
  // Set the rc_auth_uid cookie that getAdminUser() reads
  const isProd = process.env.NODE_ENV === "production";
  cookieStore.set("rc_auth_uid", data.user.id, {
    path: "/",
    maxAge: 60 * 60 * 24 * 30,
    httpOnly: true,
    sameSite: "lax",
    secure: isProd,
  });
  return { success: true, redirect: true };
 }
@@ -1,10 +1,9 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { mockOrders, mockStops } from "@/lib/mock-data";
-type AdminOrder = {
+export type AdminOrder = {
  id: string;
  customer_name: string;
  customer_email: string | null;
@@ -106,72 +105,33 @@ type AdminOrderDetail = {
  }>;
 };
 // Mock orders for UI review
 const mockAdminOrders: AdminOrder[] = mockOrders.map((o: any) => ({
  id: o.id,
  customer_name: o.customer_name,
  customer_email: o.customer_email,
  customer_phone: o.customer_phone,
  stop_id: o.stop_id,
  status: o.status,
  subtotal: o.subtotal,
  pickup_complete: o.pickup_complete,
  pickup_completed_at: o.pickup_completed_at,
  pickup_completed_by: null,
  created_at: o.created_at,
  payment_processor: o.payment_processor,
  stops: o.stops,
  order_items: o.order_items,
 }));
 const mockAdminStops: AdminStop[] = mockStops.map((s: any) => ({
  id: s.id,
  city: s.city,
  state: s.state,
  date: s.date,
  location: s.location,
  brand_id: s.brand_id,
 }));
 const useMockData = process.env.NEXT_PUBLIC_USE_MOCK_DATA === "true";
 export async function getAdminOrders(): Promise<AdminOrdersResponse> {
  // Return mock data in mock mode
  if (useMockData) {
    return {
      success: true,
      orders: mockAdminOrders,
      stops: mockAdminStops,
      error: null,
    };
  }
  const adminUser = await getAdminUser();
  const brandId = adminUser?.brand_id ?? null;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  // The legacy `get_admin_orders` RPC is a SECURITY DEFINER function that
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+  // returns orders + stops joined with order_items. Call it directly via
-
+  // the shared pg pool so we don't go through Supabase REST.
-  const response = await fetch(
+  try {
-    `${supabaseUrl}/rest/v1/rpc/get_admin_orders`,
+    const { rows } = await pool.query<AdminOrdersResult>(
-    {
+      "SELECT * FROM get_admin_orders($1)",
-      method: "POST",
+      [brandId],
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json", Prefer: "return=representation" },
+    );
-      body: JSON.stringify({ p_brand_id: brandId }),
+    const data = rows[0] ?? { orders: [], stops: [] };
-    }
+    return {
-  );
+      success: true,
-
+      orders: data.orders ?? [],
-  if (!response.ok) {
+      stops: data.stops ?? [],
-    return { success: false, orders: [], stops: [], error: `HTTP ${response.status}: ${response.statusText}` };
+      error: null,
    };
  } catch (err) {
    return {
      success: false,
      orders: [],
      stops: [],
      error: err instanceof Error ? err.message : "Failed to fetch orders",
    };
  }
  const data = await response.json();
  return {
    success: true,
    orders: data?.orders ?? [],
    stops: data?.stops ?? [],
    error: null,
  };
 }
 export async function getAdminStops(): Promise<AdminStop[]> {
@@ -193,45 +153,50 @@ export async function getAdminPickedUpOrders(): Promise<AdminOrder[]> {
 }
 export async function getAdminOrderDetail(orderId: string): Promise<AdminOrderDetail | null> {
  // Return mock order detail in mock mode
  if (useMockData) {
    const order = mockAdminOrders.find((o) => o.id === orderId);
    if (!order) return null;
    return {
      ...order,
      discount_amount: null,
      tax_amount: order.subtotal * 0.08,
      tax_rate: 0.08,
      tax_location: "Colorado",
      discount_reason: null,
      internal_notes: null,
      payment_status: "paid",
      payment_transaction_id: `txn_mock_${orderId}`,
      refunded_amount: 0,
      refund_reason: null,
      refunds: [],
    };
  }
  const adminUser = await getAdminUser();
  const brandId = adminUser?.brand_id ?? null;
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
+    const { rows } = await pool.query<AdminOrderDetail>(
-
+      "SELECT * FROM get_admin_order_detail($1, $2)",
-  const response = await fetch(
+      [orderId, brandId],
-    `${supabaseUrl}/rest/v1/rpc/get_admin_order_detail`,
+    );
-    {
+    return rows[0] ?? null;
-      method: "POST",
+  } catch {
      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
      body: JSON.stringify({ p_order_id: orderId, p_brand_id: brandId }),
    }
  );
  if (!response.ok) {
    return null;
  }
-
+}
-  const data = await response.json();
+
-  return data;
+/**
 * Toggle the `pickup_complete` flag on the legacy `orders` table.
 * TODO(migration): the SaaS rebuild's `orders` table (db/schema/orders.ts)
 * doesn't carry a `pickup_complete` column. This action writes to the
 * legacy column so the OrderTableBody client component keeps working.
 * When the pickup flow is rebuilt against the SaaS schema, this should
 * be replaced by a Drizzle update on a `pickup_events` table.
 */
 export async function toggleOrderPickupComplete(params: {
  orderId: string;
  pickupComplete: boolean;
 }): Promise<{ success: true } | { success: false; error: string }> {
  const adminUser = await getAdminUser();
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_orders) return { success: false, error: "Not authorized" };
  try {
    await pool.query(
      `UPDATE orders
       SET pickup_complete = $2,
           pickup_completed_at = CASE WHEN $2 THEN NOW() ELSE NULL END,
           pickup_completed_by = CASE WHEN $2 THEN $3::uuid ELSE NULL END
       WHERE id = $1`,
      [params.orderId, params.pickupComplete, adminUser.user_id],
    );
    return { success: true };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed to update pickup status",
    };
  }
 }
@@ -2,7 +2,7 @@
 import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { randomUUID } from "crypto";
 export type AdminCreateOrderItem = {
@@ -25,8 +25,14 @@ export type AdminCreateOrderInput = {
  discount_reason?: string | null;
 };
 // Type for the created order from the RPC
 export type CreatedOrder = {
  id: string;
  [key: string]: unknown;
 };
 export type AdminCreateOrderResult =
-  | { success: true; orderId: string; order: any }
+  | { success: true; orderId: string; order: CreatedOrder }
  | { success: false; error: string };
 export async function createAdminOrder(
@@ -58,9 +64,6 @@ export async function createAdminOrder(
    return { success: false, error: "At least one item is required" };
  }
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
  // Build items for RPC (match checkout shape)
  const rpcItems = input.items.map((i) => ({
    product_id: i.product_id,
@@ -77,33 +80,23 @@ export async function createAdminOrder(
  const taxLocation = null;
  try {
-    const response = await fetch(
+    const { rows } = await pool.query<{ id: string }>(
-      `${supabaseUrl}/rest/v1/rpc/create_order_with_items`,
+      `SELECT * FROM create_order_with_items(
-      {
+         $1, $2, $3, $4, $5, $6::jsonb, $7, $8, $9
-        method: "POST",
+       )`,
-        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json", Prefer: "return=representation" },
+      [
-        body: JSON.stringify({
+        idempotencyKey,
-          p_idempotency_key: idempotencyKey,
+        input.customer_name.trim(),
-          p_customer_name: input.customer_name.trim(),
+        input.customer_email?.trim() || null,
-          p_customer_email: input.customer_email?.trim() || null,
+        input.customer_phone?.trim() || null,
-          p_customer_phone: input.customer_phone?.trim() || null,
+        input.stop_id || null,
-          p_stop_id: input.stop_id || null,
+        JSON.stringify(rpcItems),
-          p_items: rpcItems,
+        taxAmount,
-          p_tax_amount: taxAmount,
+        taxRate,
-          p_tax_rate: taxRate,
+        taxLocation,
-          p_tax_location: taxLocation,
+      ],
          // The RPC may also accept brand scoping internally via stop or we can extend later.
        }),
      }
    );
-
+    const data = rows[0];
    if (!response.ok) {
      const errText = await response.text().catch(() => "Unknown error");
      return { success: false, error: `Failed to create order: ${errText}` };
    }
    const data = await response.json();
    if (!data || !data.id) {
      return { success: false, error: "Order created but no ID returned" };
    }
@@ -112,18 +105,20 @@ export async function createAdminOrder(
    if (input.internal_notes?.trim()) {
      // Best-effort; don't fail the whole create if this secondary update fails.
      try {
-        await fetch(`${supabaseUrl}/rest/v1/orders?id=eq.${data.id}`, {
+        await pool.query(
-          method: "PATCH",
+          "UPDATE orders SET internal_notes = $1 WHERE id = $2",
-          headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+          [input.internal_notes.trim(), data.id],
-          body: JSON.stringify({ internal_notes: input.internal_notes.trim() }),
+        );
        });
      } catch {
        // ignore
      }
    }
    return { success: true, orderId: data.id, order: data };
-  } catch (err: any) {
+  } catch (err) {
-    return { success: false, error: err?.message ?? "Unexpected error creating order" };
+    return {
      success: false,
      error: err instanceof Error ? err.message : "Unexpected error creating order",
    };
  }
 }
@@ -1,7 +1,7 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { logAuditEvent } from "@/actions/audit";
 export type CreateRefundResult =
@@ -22,37 +22,39 @@ export async function createRefund(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_orders) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  let inserted: { id: string } | null = null;
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+  try {
-
+    const { rows } = await pool.query<{ id: string }>(
-  const res = await fetch(`${supabaseUrl}/rest/v1/refunds`, {
+      `INSERT INTO refunds (order_id, amount, reason, processor, processor_refund_id, status)
-    method: "POST",
+       VALUES ($1, $2, $3, $4, $5, 'pending')
-    headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json", Prefer: "return=representation" },
+       RETURNING id`,
-    body: JSON.stringify({
+      [
-      order_id: orderId,
+        orderId,
-      amount: data.amount,
+        data.amount,
-      reason: data.reason ?? null,
+        data.reason ?? null,
-      processor: data.processor ?? null,
+        data.processor ?? null,
-      processor_refund_id: data.processor_refund_id ?? null,
+        data.processor_refund_id ?? null,
-      status: "pending",
+      ],
-    }),
+    );
-  });
+    inserted = rows[0] ?? null;
-
+  } catch (err) {
-  if (!res.ok) {
+    return {
-    const err = await res.text();
+      success: false,
-    return { success: false, error: `Failed: ${err}` };
+      error: err instanceof Error ? err.message : "Failed",
    };
  }
  if (!inserted) {
    return { success: false, error: "Insert returned no row" };
  }
  const inserted = await res.json();
  logAuditEvent({
    table_name: "refunds",
-    record_id: inserted[0]?.id ?? "",
+    record_id: inserted.id,
    action: "INSERT",
    old_data: {},
    new_data: { order_id: orderId, amount: data.amount },
    brand_id: brandId,
  });
-  return { success: true, id: inserted[0]?.id ?? "" };
+  return { success: true, id: inserted.id };
 }
@@ -1,7 +1,7 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 import { logAuditEvent } from "@/actions/audit";
 export type UpdateOrderResult =
@@ -36,33 +36,51 @@ export async function updateOrder(
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  // Build a partial SET clause. Each set column is added in the order
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+  // the caller passed it; we don't care about column ordering.
  const sets: string[] = [];
  const params: unknown[] = [];
  const push = (col: string, val: unknown) => {
    params.push(val);
    sets.push(`${col} = $${params.length}`);
  };
-  const patchData: Record<string, unknown> = {};
+  if (data.customer_name !== undefined) push("customer_name", data.customer_name);
-  if (data.customer_name !== undefined) patchData.customer_name = data.customer_name;
+  if (data.customer_email !== undefined) push("customer_email", data.customer_email);
-  if (data.customer_email !== undefined) patchData.customer_email = data.customer_email;
+  if (data.customer_phone !== undefined) push("customer_phone", data.customer_phone);
-  if (data.customer_phone !== undefined) patchData.customer_phone = data.customer_phone;
+  if (data.status !== undefined) push("status", data.status);
-  if (data.status !== undefined) patchData.status = data.status;
+  if (data.discount_amount !== undefined) push("discount_amount", data.discount_amount);
-  if (data.discount_amount !== undefined) patchData.discount_amount = data.discount_amount;
+  if (data.discount_reason !== undefined) push("discount_reason", data.discount_reason);
-  if (data.discount_reason !== undefined) patchData.discount_reason = data.discount_reason;
+  if (data.internal_notes !== undefined) push("internal_notes", data.internal_notes);
-  if (data.internal_notes !== undefined) patchData.internal_notes = data.internal_notes;
+  if (data.pickup_complete !== undefined) push("pickup_complete", data.pickup_complete);
-  if (data.pickup_complete !== undefined) patchData.pickup_complete = data.pickup_complete;
+  if (data.pickup_completed_at !== undefined) push("pickup_completed_at", data.pickup_completed_at);
-  if (data.pickup_completed_at !== undefined) patchData.pickup_completed_at = data.pickup_completed_at;
+  if (data.subtotal !== undefined) push("subtotal", data.subtotal);
-  if (data.subtotal !== undefined) patchData.subtotal = data.subtotal;
+  if (data.payment_processor !== undefined) push("payment_processor", data.payment_processor);
-  if (data.payment_processor !== undefined) patchData.payment_processor = data.payment_processor;
+  if (data.payment_status !== undefined) push("payment_status", data.payment_status);
-  if (data.payment_status !== undefined) patchData.payment_status = data.payment_status;
+  if (data.payment_transaction_id !== undefined) push("payment_transaction_id", data.payment_transaction_id);
  if (data.payment_transaction_id !== undefined) patchData.payment_transaction_id = data.payment_transaction_id;
-  const res = await fetch(`${supabaseUrl}/rest/v1/orders?id=eq.${orderId}`, {
+  if (sets.length === 0) {
-    method: "PATCH",
+    return { success: true };
-    headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  }
    body: JSON.stringify(patchData),
  });
-  if (!res.ok) {
+  params.push(orderId);
-    const err = await res.text();
+  const patchData = Object.fromEntries(
-    return { success: false, error: `Failed: ${err}` };
+    sets.map((s, i) => {
      const col = s.split(" = ")[0];
      return [col, params[i]];
    }),
  );
  try {
    await pool.query(
      `UPDATE orders SET ${sets.join(", ")} WHERE id = $${params.length}`,
      params,
    );
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed",
    };
  }
  logAuditEvent({
@@ -85,25 +103,33 @@ export async function updateOrderItem(
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_orders) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  const sets: string[] = [];
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+  const params: unknown[] = [];
  const push = (col: string, val: unknown) => {
    params.push(val);
    sets.push(`${col} = $${params.length}`);
  };
-  const patchData: Record<string, unknown> = {};
+  if (data.quantity !== undefined) push("quantity", data.quantity);
-  if (data.quantity !== undefined) patchData.quantity = data.quantity;
+  if (data.price !== undefined) push("price", data.price);
  if (data.price !== undefined) patchData.price = data.price;
-  const res = await fetch(`${supabaseUrl}/rest/v1/order_items?id=eq.${itemId}`, {
+  if (sets.length === 0) {
-    method: "PATCH",
+    return { success: true };
    headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
    body: JSON.stringify(patchData),
  });
  if (!res.ok) {
    const err = await res.text();
    return { success: false, error: `Failed: ${err}` };
  }
-  return { success: true };
+  params.push(itemId);
  try {
    await pool.query(
      `UPDATE order_items SET ${sets.join(", ")} WHERE id = $${params.length}`,
      params,
    );
    return { success: true };
  } catch (err) {
    return {
      success: false,
      error: err instanceof Error ? err.message : "Failed",
    };
  }
 }
 export async function deleteOrderItem(itemId: string): Promise<UpdateOrderResult> {
@@ -111,18 +137,13 @@ export async function deleteOrderItem(itemId: string): Promise<UpdateOrderResult
  if (!adminUser) return { success: false, error: "Not authenticated" };
  if (!adminUser.can_manage_orders) return { success: false, error: "Not authorized" };
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    await pool.query("DELETE FROM order_items WHERE id = $1", [itemId]);
-
+    return { success: true };
-  const res = await fetch(`${supabaseUrl}/rest/v1/order_items?id=eq.${itemId}`, {
+  } catch (err) {
-    method: "DELETE",
+    return {
-    headers: { ...svcHeaders(supabaseKey) },
+      success: false,
-  });
+      error: err instanceof Error ? err.message : "Failed",
-
+    };
  if (!res.ok) {
    const err = await res.text();
    return { success: false, error: `Failed: ${err}` };
  }
  return { success: true };
 }
@@ -2,7 +2,7 @@
 import { getAdminUser } from "@/lib/admin-permissions";
 import { assertBrandAccess } from "@/lib/brand-scope";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 export type PaymentProvider = "stripe" | "square" | "manual";
@@ -26,21 +26,15 @@ export type GetPaymentSettingsResult =
  | { success: false; error: string };
 export async function getPaymentSettings(brandId: string): Promise<GetPaymentSettingsResult> {
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    const { rows } = await pool.query<PaymentSettings>(
-
+      "SELECT * FROM get_payment_settings($1)",
-  const response = await fetch(
+      [brandId],
-    `${supabaseUrl}/rest/v1/rpc/get_payment_settings`,
+    );
-    {
+    return { success: true, settings: rows[0] ?? null };
-      method: "POST",
+  } catch {
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+    return { success: false, error: "Failed to fetch payment settings" };
-      body: JSON.stringify({ p_brand_id: brandId }),
+  }
    }
  );
  if (!response.ok) return { success: false, error: "Failed to fetch payment settings" };
  const data = await response.json();
  return { success: true, settings: data };
 }
 export type SavePaymentSettingsResult =
@@ -72,30 +66,25 @@ export async function savePaymentSettings(params: {
    return { success: false, error: "Not authorized for this brand" };
  }
-  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
+  try {
-  const supabaseKey = process.env.SUPABASE_SERVICE_ROLE_KEY!;
+    await pool.query(
-
+      `SELECT upsert_payment_settings(
-  const response = await fetch(
+         $1, $2, $3, $4, $5, $6, $7, $8, $9
-    `${supabaseUrl}/rest/v1/rpc/upsert_payment_settings`,
+       )`,
-    {
+      [
-      method: "POST",
+        params.brandId,
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+        params.provider,
-      body: JSON.stringify({
+        params.stripePublishableKey ?? null,
-        p_brand_id: params.brandId,
+        params.stripeSecretKey ?? null,
-        p_provider: params.provider,
+        params.stripeUserId ?? null,
-        p_stripe_publishable_key: params.stripePublishableKey ?? null,
+        params.squareAccessToken ?? null,
-        p_stripe_secret_key: params.stripeSecretKey ?? null,
+        params.squareLocationId ?? null,
-        p_stripe_user_id: params.stripeUserId ?? null,
+        params.squareSyncEnabled ?? null,
-        p_square_access_token: params.squareAccessToken ?? null,
+        params.squareInventoryMode ?? null,
-        p_square_location_id: params.squareLocationId ?? null,
+      ],
-        p_square_sync_enabled: params.squareSyncEnabled ?? null,
+    );
-        p_square_inventory_mode: params.squareInventoryMode ?? null,
+    return { success: true };
-      }),
+  } catch {
    }
  );
  if (!response.ok) {
    return { success: false, error: "Failed to save payment settings" };
  }
  return { success: true };
 }
@@ -2,10 +2,10 @@
 import { getAdminUser } from "@/lib/admin-permissions";
 import { logAuditEvent } from "@/actions/audit";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 type MarkPickupResult =
-  | { success: true; pickup_completed_at: string; pickup_completed_by: string }
+  | { success: true; pickup_completed_at: string; pickup_completed_by: string | null }
  | { success: false; error: string };
 export async function markPickupComplete(
@@ -23,71 +23,51 @@ export async function markPickupComplete(
  }
  const now = new Date().toISOString();
  // `user_id` is null for Google-authenticated admins who haven't been
  // linked to a Supabase auth user yet. Pass null through; downstream
  // audit/assignment RPCs will surface a clearer error.
  const performedBy = adminUser.user_id;
  // brand_admin: verify the order belongs to their brand
  if (adminUser.role === "brand_admin" && adminUser.brand_id) {
-    const brandRes = await fetch(
+    const orderRes = await pool.query<{ brand_id: string | null; stop_id: string | null }>(
-      `${process.env.NEXT_PUBLIC_SUPABASE_URL}/rest/v1/orders?id=eq.${orderId}&select=stop_id,brand_id`,
+      "SELECT brand_id, stop_id FROM orders WHERE id = $1 LIMIT 1",
-      {
+      [orderId],
        headers: svcHeaders(process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!),
      }
    );
-
+    if (orderRes.rows.length === 0) {
    if (!brandRes.ok) {
      return { success: false, error: "Failed to verify order ownership" };
    }
    const orderData = await brandRes.json();
    if (!Array.isArray(orderData) || orderData.length === 0) {
      return { success: false, error: "Order not found" };
    }
    const order = orderRes.rows[0];
    const order = orderData[0];
    // Check brand_id on the order first, then fall back to stop brand
    if (order.brand_id && order.brand_id !== adminUser.brand_id) {
      return { success: false, error: "Not authorized for this order" };
    }
    if (!order.brand_id && order.stop_id) {
-      const stopRes = await fetch(
+      const stopRes = await pool.query<{ brand_id: string | null }>(
-        `${process.env.NEXT_PUBLIC_SUPABASE_URL}/rest/v1/stops?id=eq.${order.stop_id}&select=brand_id`,
+        "SELECT brand_id FROM stops WHERE id = $1 LIMIT 1",
-        {
+        [order.stop_id],
          headers: svcHeaders(process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!),
        }
      );
-
+      if (
-      if (stopRes.ok) {
+        stopRes.rows[0] &&
-        const stopData = await stopRes.json();
+        stopRes.rows[0].brand_id !== adminUser.brand_id
-        if (Array.isArray(stopData) && stopData[0]?.brand_id !== adminUser.brand_id) {
+      ) {
-          return { success: false, error: "Not authorized for this order" };
+        return { success: false, error: "Not authorized for this order" };
        }
      }
    }
  }
-  // PATCH the order
+  // UPDATE the order
-  const patchRes = await fetch(
+  const updateRes = await pool.query(
-    `${process.env.NEXT_PUBLIC_SUPABASE_URL}/rest/v1/orders?id=eq.${orderId}`,
+    `UPDATE orders
-    {
+        SET pickup_complete = true,
-      method: "PATCH",
+            pickup_completed_at = $1,
-      headers: {
+            pickup_completed_by = $2
-        ...svcHeaders(process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!),
+      WHERE id = $3`,
-        "Content-Type": "application/json",
+    [now, performedBy, orderId],
        Prefer: "return=representation",
      },
      body: JSON.stringify({
        pickup_complete: true,
        pickup_completed_at: now,
        pickup_completed_by: performedBy,
      }),
    }
  );
-
+  if ((updateRes.rowCount ?? 0) === 0) {
-  if (!patchRes.ok) {
+    return { success: false, error: "Order not found" };
    const err = await patchRes.json().catch(() => ({ message: "Patch failed" }));
    return { success: false, error: err.message ?? "Failed to update pickup" };
  }
  // Fire-and-forget audit log
@@ -110,31 +90,19 @@ export async function markPickupComplete(
  // Emit pickup_completed event
  // Need brand_id — get it from the order we just patched
-  const orderRes = await fetch(
+  const orderRes = await pool.query<{ brand_id: string | null }>(
-    `${process.env.NEXT_PUBLIC_SUPABASE_URL}/rest/v1/orders?id=eq.${orderId}&select=brand_id`,
+    "SELECT brand_id FROM orders WHERE id = $1",
-    {
+    [orderId],
      headers: svcHeaders(process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!),
    }
  );
-  if (orderRes.ok) {
+  const orderBrandId = orderRes.rows[0]?.brand_id;
-    const orderData = await orderRes.json();
+  if (orderBrandId) {
-    const orderBrandId = Array.isArray(orderData) && orderData[0]?.brand_id;
+    try {
-    if (orderBrandId) {
+      await pool.query(
-      await fetch(
+        "SELECT * FROM record_pickup_completed_event($1, $2, $3)",
-        `${process.env.NEXT_PUBLIC_SUPABASE_URL}/rest/v1/rpc/record_pickup_completed_event`,
+        [orderId, orderBrandId, performedBy],
        {
          method: "POST",
          headers: {
            ...svcHeaders(process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!),
            "Content-Type": "application/json",
          },
          body: JSON.stringify({
            p_order_id: orderId,
            p_brand_id: orderBrandId,
            p_actor_id: performedBy,
          }),
        }
      );
    } catch {
      // Event emission is best-effort.
    }
  }
@@ -1,10 +1,7 @@
 "use server";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { svcHeaders } from "@/lib/svc-headers";
+import { pool } from "@/lib/db";
 const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL!;
 const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!;
 // ── Types ────────────────────────────────────────────────────────────────────
@@ -65,25 +62,22 @@ export type CreatePainLogData = {
  description?: string | null;
 };
-// ── Internal fetch helper ────────────────────────────────────────────────────
+// ── Internal RPC helper ──────────────────────────────────────────────────────
-async function platformRPC<T>(rpcName: string, body: Record<string, unknown> = {}): Promise<T> {
+async function platformRPC<T>(rpcName: string): Promise<T> {
  const adminUser = await getAdminUser();
  if (!adminUser) throw new Error("Not authenticated");
  if (adminUser.role !== "platform_admin") throw new Error("Access denied: platform admin only");
-  const response = await fetch(`${supabaseUrl}/rest/v1/rpc/${rpcName}`, {
+  const { rows } = await pool.query<Record<string, T>>(
-    method: "POST",
+    `SELECT ${rpcName}() AS "${rpcName}"`,
-    headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+  );
    body: JSON.stringify(body),
  });
-  if (!response.ok) {
+  const data = rows[0]?.[rpcName];
-    const err = await response.text();
+  if (data == null) {
-    throw new Error(`RPC ${rpcName} failed: ${err}`);
+    return null as T;
  }
-
+  return data as T;
  return response.json() as Promise<T>;
 }
 // ── Platform actions ─────────────────────────────────────────────────────────
@@ -104,19 +98,11 @@ export async function getPainLog(): Promise<PainLogItem[]> {
  const adminUser = await getAdminUser();
  if (!adminUser) throw new Error("Not authenticated");
-  const response = await fetch(
+  const { rows } = await pool.query<PainLogItem>(
-    `${supabaseUrl}/rest/v1/founder_pain_log_platform?select=*`,
+    `SELECT * FROM founder_pain_log_platform ORDER BY created_at DESC`,
    {
      headers: svcHeaders(supabaseKey),
    }
  );
-  if (!response.ok) {
+  return rows;
    const err = await response.text();
    throw new Error(`Failed to fetch pain log: ${err}`);
  }
  return response.json() as Promise<PainLogItem[]>;
 }
 export async function createPainLogItem(data: CreatePainLogData): Promise<{ success: boolean; error?: string }> {
@@ -125,22 +111,17 @@ export async function createPainLogItem(data: CreatePainLogData): Promise<{ succ
    if (!adminUser) return { success: false, error: "Not authenticated" };
    if (adminUser.role !== "platform_admin") return { success: false, error: "Access denied" };
-    const response = await fetch(`${supabaseUrl}/rest/v1/founder_pain_log`, {
+    await pool.query(
-      method: "POST",
+      `INSERT INTO founder_pain_log (brand_id, severity, category, title, description)
-      headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json", Prefer: "return=representation" },
+       VALUES ($1, $2, $3, $4, $5)`,
-      body: JSON.stringify({
+      [
-        brand_id: data.brand_id || null,
+        data.brand_id || null,
-        severity: data.severity,
+        data.severity,
-        category: data.category,
+        data.category,
-        title: data.title,
+        data.title,
-        description: data.description || null,
+        data.description || null,
-      }),
+      ],
-    });
+    );
    if (!response.ok) {
      const err = await response.text();
      return { success: false, error: err };
    }
    return { success: true };
  } catch (e) {
@@ -154,24 +135,13 @@ export async function resolvePainLogItem(id: string): Promise<{ success: boolean
    if (!adminUser) return { success: false, error: "Not authenticated" };
    if (adminUser.role !== "platform_admin") return { success: false, error: "Access denied" };
-    const response = await fetch(
+    await pool.query(
-      `${supabaseUrl}/rest/v1/founder_pain_log?id=eq.${id}`,
+      `UPDATE founder_pain_log
-      {
+       SET status = 'resolved', resolved_at = now(), resolved_by = $2
-        method: "PATCH",
+       WHERE id = $1`,
-        headers: { ...svcHeaders(supabaseKey), "Content-Type": "application/json" },
+      [id, adminUser.id],
        body: JSON.stringify({
          status: "resolved",
          resolved_at: new Date().toISOString(),
          resolved_by: adminUser.id,
        }),
      }
    );
    if (!response.ok) {
      const err = await response.text();
      return { success: false, error: err };
    }
    return { success: true };
  } catch (e) {
    return { success: false, error: String(e) };
--- a/Show More
+++ b/Show More