@arcforgelabs/flow 2026.10.49 → 2026.10.51

package/server/db/migrations/meta/_journal.json

@@ -162,6 +162,13 @@
       "when": 1792733287865,
       "tag": "0022_contacts",
       "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1793110575758,
+      "tag": "0023_captures",
+      "breakpoints": true
     }
   ]
-}
+}

package/server/db/schema.js

@@ -858,3 +858,50 @@ export const jobFieldEvents = pgTable('job_field_events', {
   foreignKey({ name: 'job_field_events_field_same_org', columns: [t.organisationId, t.fieldId], foreignColumns: [jobFields.organisationId, jobFields.id] }).onDelete('cascade'),
   index('job_field_events_job').on(t.organisationId, t.sourceSystem, t.sourceJobRef, t.createdAt),
 ]);
+
+// A photo of a handwritten lab form (server/core/captures.js). The bytes live
+// in the object storage adapter; this row keeps the key, size, type and
+// checksum. `read` is what the vision reader returned (server/core/reader.js):
+// the fields, the model, the tokens and the cost. A new row is `reading`
+// while that runs, or `problem` when the reader is off. A person may type
+// the proposal either way. `done` means someone applied or discarded it.
+// The photo bytes are deleted then, and a row with no decision is deleted
+// after 7 days.
+export const CAPTURE_STATES = ['reading', 'ready', 'done', 'problem'];
+export const CAPTURE_SOURCES = ['phone', 'desk', 'api'];
+export const CAPTURE_DECISIONS = ['applied', 'discarded'];
+export const captures = pgTable('captures', {
+  id: id(),
+  organisationId: organisationId().references(() => organisations.id),
+  state: text('state').notNull(),
+  source: text('source').notNull(),
+  fileKey: text('file_key').notNull(),
+  fileType: text('file_type').notNull(),
+  fileSize: integer('file_size').notNull(),
+  fileSha256: text('file_sha256').notNull(),
+  idempotencyKey: text('idempotency_key').notNull(),
+  // Fields, model, token counts and cost in micros. Null until a read finishes.
+  read: jsonb('read'),
+  match: jsonb('match'),
+  proposal: jsonb('proposal').notNull().default(sql`'{"action":null,"jobId":null,"changes":[]}'::jsonb`),
+  problem: text('problem'),
+  decision: text('decision'),
+  decidedBy: uuid('decided_by').references(() => people.id, { onDelete: 'set null' }),
+  decidedAt: timestamp('decided_at', { withTimezone: true }),
+  photoDeletedAt: timestamp('photo_deleted_at', { withTimezone: true }),
+  createdBy: uuid('created_by').references(() => people.id, { onDelete: 'set null' }),
+  createdAt: createdAt(),
+  updatedAt: updatedAt(),
+}, (t) => [
+  unique('captures_org_id').on(t.organisationId, t.id),
+  unique('captures_org_idempotency').on(t.organisationId, t.idempotencyKey),
+  unique('captures_file_key').on(t.fileKey),
+  index('captures_photo_open').on(t.createdAt).where(sql`photo_deleted_at is null`),
+  check('captures_state_valid', inList('state', CAPTURE_STATES)),
+  check('captures_source_valid', inList('source', CAPTURE_SOURCES)),
+  check('captures_decision_valid', sql`${t.decision} is null or ${t.decision} in ('applied', 'discarded')`),
+  check('captures_done_has_decision', sql`(${t.state} = 'done') = (${t.decision} is not null)`),
+  check('captures_file_size_valid', sql`${t.fileSize} >= 0`),
+  check('captures_sha256_valid', sql`${t.fileSha256} ~ '^[0-9a-f]{64}$'`),
+  check('captures_problem_valid', sql`${t.problem} is null or length(${t.problem}) between 1 and 200`),
+]);

package/server/index.js

@@ -9,7 +9,12 @@ import { migrateDatabase, openDatabase } from './db/index.js';
 import {
   importEarlierAtStart, importEarlierLinksAtStart, importEarlierMappingsAtStart, resolveImportAtStart,
 } from './import/at-start.js';
+import { createAiPort, resolveReader } from './core/ai.js';
+import { createBedrockClient } from './core/ai-bedrock.js';
+import { createCaptureRetentionWorker } from './core/captures.js';
 import { createMonitoredLog } from './core/monitoring.js';
+import { createCaptureReader } from './core/reader.js';
+import { resolveObjectStorage } from './core/storage.js';
 import { createTracing, traceQueries } from './core/tracing.js';
 import { createPipelineWorker } from './core/pipeline.js';
 import { createReconcileWorker } from './core/reconcile.js';
@@ -117,6 +122,43 @@ if (jobsOn) createReconcileWorker({ db: database.db, integrations, log }).start(
 // with Send all ready, to the accounting integration that is on.
 if (jobsOn) createSendWorker({ db: database.db, integrations, log }).start();
 
+// Capture photos (server/core/storage.js). A bad storage setting stops boot.
+// On Replit, and where the local folder cannot be created, the default is
+// off. The retention pass
+// only deletes Flow's own files, so it still runs where background jobs are
+// off: a second copy deleting the same key does nothing.
+let storage = null;
+try {
+  const resolved = await resolveObjectStorage({ env: process.env, secrets });
+  storage = resolved.storage;
+  if (storage) console.log(`[storage] ${resolved.mode}`);
+  else console.log(`[storage] captures off (${resolved.reason})`);
+} catch (error) {
+  console.error(`[storage] ${error.message}`);
+  process.exit(1);
+}
+if (storage) createCaptureRetentionWorker({ db: database.db, storage, log }).start();
+
+// The vision reader (server/core/reader.js). A bad region or a model id that
+// is not an Australia profile stops boot. Off, or on without keys, stores
+// the photo and leaves the capture for a person to type.
+let reader = null;
+try {
+  const resolved = resolveReader({ env: process.env });
+  if (!resolved.on) console.log(`[reader] off (${resolved.reason})`);
+  else if (!storage) console.log('[reader] captures off (no file store)');
+  else {
+    const port = createAiPort(createBedrockClient(resolved));
+    reader = createCaptureReader({ db: database.db, storage, port, settings: resolved, log, jobsOn });
+    if (jobsOn) reader.worker.start();
+    else console.log('[reader] background jobs off: each capture is read in the upload');
+    console.log(`[reader] on (${resolved.region})`);
+  }
+} catch (error) {
+  console.error(`[reader] ${error.message}`);
+  process.exit(1);
+}
+
 let auth = null;
 if (settings.mode === 'clerk') {
   const { keys } = settings;
@@ -158,7 +200,11 @@ const trustProxy = process.env.REPL_ID || process.env.REPLIT_DEPLOYMENT ? 1 : fa
 
 const updates = createUpdateChecker();
 
-createApp({ database, schemaJournals: expectedSchema({ adapters: shippedAdapters }).journals, auth, trustProxy, updates, integrations, secrets, defaultFamily, log, tracing }).listen(port, () => {
+createApp({
+  database, schemaJournals: expectedSchema({ adapters: shippedAdapters }).journals, auth, trustProxy, updates, integrations, secrets, defaultFamily, log, tracing, storage,
+  publicOrigin: process.env.FLOW_PUBLIC_ORIGIN,
+  reader: reader ? { on: true, schedule: reader.schedule } : null,
+}).listen(port, () => {
   console.log(`[flow] listening on ${port}; design system ${defaultFamily} (FLOW_THEME)`);
 });
 

package/server/integrations/xero/connections.js

@@ -10,6 +10,8 @@ import { xeroError } from './client.js';
 // settings and are never stored. Tokens are never logged.
 
 const FORMAT = 'v1';
+// What a Custom Connection's row seals in place of a refresh token.
+export const CUSTOM_CONNECTION = 'custom-connection';
 
 function aad(organisationId) {
   return Buffer.from(`flow:xero:refresh-token:${organisationId}`);

package/server/integrations/xero/index.js

@@ -40,6 +40,7 @@ export const XERO_SETUP = {
   },
   fields: [
     { name: 'XERO_MODE', label: 'Mode', kind: 'choice', choices: [{ value: 'live', label: 'Live: your Xero organisation' }, { value: 'sandbox', label: 'Sandbox: a Xero Demo Company' }] },
+    { name: 'XERO_CONNECTION', label: 'Xero app type', kind: 'choice', choices: [{ value: 'app', label: 'Web app' }, { value: 'custom', label: 'Custom connection (Demo Company only)' }], help: 'Custom connection: no Xero sign-in step. Sandbox mode only.' },
     { name: 'XERO_REDIRECT_URI', label: 'Redirect URI', kind: 'url', suggest: 'callback', help: 'Register the same address on the Xero app.' },
     { name: 'XERO_CLIENT_ID', label: 'Client id', help: 'From the Xero app\'s Configuration.' },
     { name: 'XERO_CLIENT_SECRET', label: 'Client secret', secret: true, help: 'Stored encrypted. Flow never shows it again.' },

package/server/integrations/xero/oauth.js

@@ -1,8 +1,9 @@
 import { randomBytes } from 'node:crypto';
 import { DEFAULT_TIMEOUT_MS, xeroError } from './client.js';
 
-// Xero OAuth 2.0 (authorisation code with offline_access). Bodies that carry
-// tokens never reach a log or an error message.
+// Xero OAuth 2.0: the authorisation code with offline_access, or a Custom
+// Connection's client credentials (settings.js, XERO_CONNECTION). Bodies that
+// carry tokens never reach a log or an error message.
 
 export const STATE_TTL_MS = 10 * 60 * 1000;
 
@@ -58,7 +59,7 @@ async function tokenRequest(settings, fetchImpl, form, what) {
       oauthError: typeof body?.error === 'string' ? body.error.slice(0, 40) : null,
     });
   }
-  if (!body?.access_token || !body?.refresh_token) {
+  if (!body?.access_token || (form.grant_type !== 'client_credentials' && !body?.refresh_token)) {
     throw xeroError('xero_token_failed', `Xero's answer to ${what} had no tokens.`, { status: 502 });
   }
   return body;
@@ -73,6 +74,12 @@ export function refreshTokens(settings, fetchImpl, refreshToken) {
   return tokenRequest(settings, fetchImpl, { grant_type: 'refresh_token', refresh_token: refreshToken }, 'the token refresh');
 }
 
+// A Custom Connection's access token. There is no refresh token: Flow asks
+// again when the token runs out.
+export function clientCredentials(settings, fetchImpl) {
+  return tokenRequest(settings, fetchImpl, { grant_type: 'client_credentials', scope: settings.scope }, 'the Custom Connection token');
+}
+
 // Best effort: a disconnect deletes Flow's copy even when Xero is down.
 export async function revokeToken(settings, fetchImpl, refreshToken) {
   const basic = Buffer.from(`${settings.clientId}:${settings.clientSecret}`).toString('base64');

package/server/integrations/xero/routes.js

@@ -12,8 +12,8 @@ import { IMPORT_STATES, importOverview, linkXeroInvoice, makeFlowInvoice, matchX
 import { queueHistoryImport, resetImport } from './import.js';
 import { MIRROR_RESOURCES, mirrorStatus, mirrorXero } from './mirror.js';
 import { accountingStatus, checkSentInvoices } from './reconcile.js';
-import { decryptToken, deleteConnection, describeConnection, readConnection, saveConnection } from './connections.js';
-import { authorizeUrl, exchangeCode, fetchConnections, revokeToken, selectConnection } from './oauth.js';
+import { CUSTOM_CONNECTION, decryptToken, deleteConnection, describeConnection, readConnection, saveConnection } from './connections.js';
+import { authorizeUrl, clientCredentials, exchangeCode, fetchConnections, revokeToken, selectConnection } from './oauth.js';
 import { writesAllowed } from './settings.js';
 import { readXeroUsage } from './usage.js';
 import { saveEvents, signatureValid } from './webhooks.js';
@@ -23,7 +23,8 @@ import { messagePage as themedMessagePage } from '../../ui/page.js';
 // The Xero adapter's routes, mounted at /api/xero (server/integrations/port.js).
 //
 //   GET  /status?organisationId=   any signed-in person: mode and connection
-//   POST /connect                  owner: returns Xero's approval address
+//   POST /connect                  owner: returns Xero's approval address, or
+//                                  connects a Custom Connection at once
 //   GET  /oauth/callback           Xero sends the owner back here
 //   POST /disconnect               owner: revokes and forgets the connection
 //   POST /sync                     owner or admin: copies Xero contacts and items
@@ -182,8 +183,59 @@ export function createXeroRouter({ db, personAuth, runtime, log = console, butto
     });
   }));
 
+  // Keeps the one Xero organisation these tokens reach, after proving it is
+  // one Flow may use (a Demo Company in sandbox). A refused code-flow grant
+  // is revoked at Xero. Then the history import starts.
+  async function connectWith(tokens, { organisationId, personId }) {
+    const connections = await fetchConnections(settings, runtime.transport, tokens.access_token);
+    let chosen;
+    try {
+      chosen = selectConnection(connections, settings);
+      const probe = createXeroClient({
+        tenantId: chosen.tenantId,
+        accessToken: async () => tokens.access_token,
+        fetch: runtime.transport,
+        governor: runtime.governor,
+        apiBase: settings.endpoints.api,
+        log,
+      });
+      await runtime.assertEnvironment(probe);
+    } catch (error) {
+      // Refused: Xero keeps no grant for an organisation Flow will not use.
+      if (tokens.refresh_token) await revokeToken(settings, runtime.transport, tokens.refresh_token).catch(() => false);
+      throw error;
+    }
+    const previous = await readConnection(db, organisationId);
+    const connection = await saveConnection(db, {
+      organisationId,
+      mode: settings.mode,
+      tenantId: chosen.tenantId,
+      tenantName: chosen.tenantName ?? null,
+      scope: tokens.scope ?? settings.scope,
+      // A Custom Connection has no refresh token; the column holds a sealed
+      // marker that is never read (runtime.js asks Xero again instead).
+      refreshToken: tokens.refresh_token ?? CUSTOM_CONNECTION,
+      connectedBy: personId,
+      key: settings.tokenKey,
+    });
+    runtime.remember(organisationId, tokens);
+    // A new connection is a person acting: calls stopped before resume.
+    await runtime.guardFor(db).resume();
+    // Another Xero organisation starts its history from the beginning.
+    if (previous && previous.tenantId !== connection.tenantId) await resetImport(db, organisationId);
+    await queueHistoryImport(db, organisationId, { reason: 'connected' });
+    log.info?.(`[xero] organisation ${organisationId} connected to Xero tenant ${connection.tenantId} (${settings.mode}, ${settings.connection}) by person ${personId}`);
+    return connection;
+  }
+
+  // A Custom Connection connects here at once; a Xero app answers with the
+  // approval address the browser opens.
   router.post('/connect', ...owner, handle(log, async (req, res) => {
     const organisationId = await requireOrganisation(db, req.body?.organisationId);
+    if (settings.connection === 'custom') {
+      const connection = await connectWith(await clientCredentials(settings, runtime.transport), { organisationId, personId: req.person.id });
+      return res.json({ ok: true, connected: true, connection: describeConnection(connection), mode: settings.mode });
+    }
     if (!settings.redirectUri) {
       throw Object.assign(new FlowError('xero_redirect_uri_missing', 'Set FLOW_PUBLIC_ORIGIN (or XERO_REDIRECT_URI) to this installation\'s address, and register its /api/xero/oauth/callback on the Xero app.'), { status: 503 });
     }
@@ -202,42 +254,7 @@ export function createXeroRouter({ db, personAuth, runtime, log = console, butto
     }
     try {
       const tokens = await exchangeCode(settings, runtime.transport, typeof req.query.code === 'string' ? req.query.code : '');
-      const connections = await fetchConnections(settings, runtime.transport, tokens.access_token);
-      let chosen;
-      try {
-        chosen = selectConnection(connections, settings);
-        const probe = createXeroClient({
-          tenantId: chosen.tenantId,
-          accessToken: async () => tokens.access_token,
-          fetch: runtime.transport,
-          governor: runtime.governor,
-          apiBase: settings.endpoints.api,
-          log,
-        });
-        await runtime.assertEnvironment(probe);
-      } catch (error) {
-        // Refused: Xero keeps no grant for an organisation Flow will not use.
-        await revokeToken(settings, runtime.transport, tokens.refresh_token).catch(() => false);
-        throw error;
-      }
-      const previous = await readConnection(db, entry.organisationId);
-      const connection = await saveConnection(db, {
-        organisationId: entry.organisationId,
-        mode: settings.mode,
-        tenantId: chosen.tenantId,
-        tenantName: chosen.tenantName ?? null,
-        scope: tokens.scope ?? settings.scope,
-        refreshToken: tokens.refresh_token,
-        connectedBy: entry.personId,
-        key: settings.tokenKey,
-      });
-      runtime.remember(entry.organisationId, tokens);
-      // A new connection is a person acting: calls stopped before resume.
-      await runtime.guardFor(db).resume();
-      // Another Xero organisation starts its history from the beginning.
-      if (previous && previous.tenantId !== connection.tenantId) await resetImport(db, entry.organisationId);
-      await queueHistoryImport(db, entry.organisationId, { reason: 'connected' });
-      log.info?.(`[xero] organisation ${entry.organisationId} connected to Xero tenant ${connection.tenantId} (${settings.mode}) by person ${entry.personId}`);
+      const connection = await connectWith(tokens, entry);
       const organisation = connection.tenantName || 'your Xero organisation';
       return res.type('html').send(page(
         'Xero is connected',
@@ -257,7 +274,8 @@ export function createXeroRouter({ db, personAuth, runtime, log = console, butto
     const connection = await readConnection(db, organisationId);
     if (!connection) return res.json({ ok: true, disconnected: false });
     let revoked = false;
-    try {
+    // A Custom Connection has no token to revoke: it ends in Xero's My Apps.
+    if (settings.connection !== 'custom') try {
       revoked = await revokeToken(settings, runtime.transport, decryptToken(connection.refreshTokenEnc, settings.tokenKey, organisationId));
     } catch (error) {
       log.warn?.(`[xero] could not revoke the Xero token for organisation ${organisationId}: ${error.code ?? 'error'}`);

package/server/integrations/xero/runtime.js

@@ -2,7 +2,7 @@ import { createCallGuard } from '../call-guard.js';
 import { createXeroClient, xeroError } from './client.js';
 import { decryptToken, readConnection, storeRotatedToken } from './connections.js';
 import { createGovernor } from './governor.js';
-import { createStateStore, refreshTokens } from './oauth.js';
+import { clientCredentials, createStateStore, refreshTokens } from './oauth.js';
 import { createReplayFetch, DEFAULT_REPLAY_FIXTURES, loadReplayFixtures } from './replay.js';
 import { resolveXeroSettings, writesAllowed } from './settings.js';
 
@@ -101,10 +101,13 @@ export function createXeroRuntime({ settings, fetch, now = Date.now, log = conso
     return db.transaction(async (tx) => {
       const connection = usable(await readConnection(tx, organisationId, { lock: true }));
       await guard.check(connection.tenantId, { resource: 'token' });
-      const refreshToken = decryptToken(connection.refreshTokenEnc, settings.tokenKey, organisationId);
+      // A Custom Connection has no refresh token: Flow asks with the client
+      // id and secret again, and nothing rotates.
+      const custom = settings.connection === 'custom';
+      const refreshToken = custom ? null : decryptToken(connection.refreshTokenEnc, settings.tokenKey, organisationId);
       let tokens;
       try {
-        tokens = await refreshTokens(settings, transport, refreshToken);
+        tokens = custom ? await clientCredentials(settings, transport) : await refreshTokens(settings, transport, refreshToken);
       } catch (error) {
         // invalid_grant: the connection is gone. invalid_client: the app's
         // client id or secret is wrong. Neither clears without a person.
@@ -116,7 +119,7 @@ export function createXeroRuntime({ settings, fetch, now = Date.now, log = conso
         throw error;
       }
       await guard.record(connection.tenantId, { resource: 'token', statusCode: 200 });
-      await storeRotatedToken(tx, organisationId, { refreshToken: tokens.refresh_token, scope: tokens.scope, key: settings.tokenKey });
+      if (!custom) await storeRotatedToken(tx, organisationId, { refreshToken: tokens.refresh_token, scope: tokens.scope, key: settings.tokenKey });
       remember(organisationId, tokens);
       return tokens.access_token;
     });

package/server/integrations/xero/settings.js

@@ -10,6 +10,14 @@
 //            is not DEMO, so a sandbox can never write to a real ledger.
 //   replay   no network: recorded, synthetic Xero responses
 //            (server/integrations/xero/fixtures). Development and CI.
+//
+// XERO_CONNECTION says how Flow gets its Xero access tokens.
+//   app      (default) a Xero web app: an owner approves in the browser, and
+//            Flow keeps the rotating refresh token.
+//   custom   a Xero Custom Connection (client credentials): no browser step
+//            and no refresh token. Sandbox only: Xero makes Custom
+//            Connections free on the Demo Company, so a demo or a test
+//            session connects with the client id and secret alone.
 
 import { backgroundJobsOn } from '../../core/host.js';
 
@@ -29,6 +37,8 @@ export const XERO_ENDPOINTS = Object.freeze({
 export const XERO_CALLBACK_PATH = '/api/xero/oauth/callback';
 // accounting.payments.read: Flow reads payments back (ledger.js, mirror.js).
 export const DEFAULT_XERO_SCOPE = 'offline_access accounting.contacts accounting.invoices accounting.payments.read accounting.settings.read';
+// A Custom Connection has no refresh token, so it asks for no offline_access.
+export const DEFAULT_CUSTOM_SCOPE = DEFAULT_XERO_SCOPE.replace('offline_access ', '');
 export const DEFAULT_XERO_DAY_LIMIT = 1000;
 export const DEFAULT_DUE_DAYS = 30;
 export const DEFAULT_MIRROR_PAGE_SIZE = 200;
@@ -121,6 +131,12 @@ export function resolveXeroSettings(env = process.env) {
   if (!mode) return null;
   if (!XERO_MODES.includes(mode)) throw new Error('XERO_MODE must be "live", "sandbox", "replay" or unset');
 
+  const connection = (readEnv(env, 'XERO_CONNECTION') || 'app').toLowerCase();
+  if (!['app', 'custom'].includes(connection)) throw new Error('XERO_CONNECTION must be "app", "custom" or unset');
+  if (connection === 'custom' && mode !== 'sandbox') {
+    throw new Error('XERO_CONNECTION=custom works only with XERO_MODE=sandbox (a Xero Demo Company)');
+  }
+
   const clientId = readEnv(env, 'XERO_CLIENT_ID');
   const clientSecret = readEnv(env, 'XERO_CLIENT_SECRET');
   const tokenKey = decodeTokenKey(readEnv(env, 'XERO_TOKEN_KEY'));
@@ -150,11 +166,12 @@ export function resolveXeroSettings(env = process.env) {
 
   return {
     mode,
+    connection,
     clientId: clientId || (mode === 'replay' ? 'replay-client-id' : ''),
     clientSecret: clientSecret || (mode === 'replay' ? 'replay-client-secret' : ''),
     tokenKey,
     redirectUri: resolveRedirectUri(env),
-    scope: readEnv(env, 'XERO_SCOPE') || DEFAULT_XERO_SCOPE,
+    scope: readEnv(env, 'XERO_SCOPE') || (connection === 'custom' ? DEFAULT_CUSTOM_SCOPE : DEFAULT_XERO_SCOPE),
     tenantId,
     tenantName,
     liveWrites: readOnOff(env, 'XERO_ALLOW_LIVE_WRITES'),

package/server/ui/app-page.js

@@ -51,7 +51,7 @@ const BODY = `<div class="fx-app">
   <div id="toasts" class="fx-toasts" aria-live="polite"></div>
 </div>`;
 
-export const APP_PATHS = ['/sign-in', '/jobs', '/invoices', '/invoices/:id', '/reconcile', '/reconcile/:id', '/xero-import', '/people', '/integrations', '/integrations/:id', '/account', '/appearance', '/invoicing-settings', '/invoicing-settings/:id', '/automations', '/price-list', '/custom-fields'];
+export const APP_PATHS = ['/sign-in', '/jobs', '/invoices', '/invoices/:id', '/contacts', '/contacts/:id', '/reconcile', '/reconcile/:id', '/xero-import', '/people', '/integrations', '/integrations/:id', '/account', '/appearance', '/invoicing-settings', '/invoicing-settings/:id', '/automations', '/price-list', '/price-list/:id', '/custom-fields'];
 
 export function appPage({ defaultFamily }) {
   return renderPage({

package/server/ui/app.js

@@ -348,7 +348,7 @@ function renderSignedOut() {
     return;
   }
   $('sign-in-note').textContent = config.publicSignUp
-    ? 'Sign in, or ask for access with your work email.'
+    ? 'New here? Ask for access with your work email.'
     : 'Sign in with the account you were invited with.';
   // With public sign-up off the widget never creates a Clerk account: no
   // sign-up link, and an OAuth sign-in for an unknown email is not turned
@@ -867,6 +867,7 @@ async function renderIntegration(main, id) {
           current.id === 'xero' && current.state === 'ready' ? h('section', { class: 'fx-int-section' }, xeroConnection(body.organisations, canChange)) : null,
           current.id === 'seazona' ? h('section', { class: 'fx-int-section fx-card', style: { padding: '8px 20px 16px' } }, automationSection(ui(), 'seazona', 'Ready to invoice')) : null,
           on && current.state === 'ready' ? personSettingsSection(current) : null,
+          current.id === 'seazona' && current.state === 'ready' ? seazonaHistorySection() : null,
           current.id === 'xero' && current.state === 'ready' ? xeroImportSection(body.organisations) : null,
           current.id === 'xero' ? h('section', { class: 'fx-int-section fx-card', style: { padding: '8px 20px 16px' } }, automationSection(ui(), 'xero', 'Contacts')) : null,
           current.id === 'xero' ? h('section', { class: 'fx-int-section fx-card', style: { padding: '8px 20px 16px' } }, sendModeSection(ui())) : null,
@@ -978,6 +979,56 @@ function xeroImportSection(organisations) {
   return section;
 }
 
+// Seazona's history read (docs/SEAZONA.md, "The API backfill"): past orders
+// from a start day, a few calls a run inside the rate limit. Start and Stop
+// call no Seazona; the background lane reads. While it runs, the row reads
+// its progress again every 30 seconds, from Flow only.
+function seazonaHistorySection() {
+  const canAct = ['owner', 'admin'].includes(me?.person?.role);
+  const yearAgo = new Date(Date.now() - 365 * 86_400_000).toISOString().slice(0, 10);
+  const from = h('input', { class: 'fx-input', type: 'date', 'aria-label': 'Read from', value: yearAgo, disabled: !canAct });
+  const status = h('span', {}, 'Checking…');
+  const jobs = h('span', { class: 'fx-num' }, '…');
+  const control = h('span', { class: 'fx-row' });
+  const day = (value) => new Date(`${value}T00:00:00Z`).toLocaleDateString('en-AU', { dateStyle: 'medium', timeZone: 'UTC' });
+  const section = h('section', { class: 'fx-set fx-int-section fx-card', style: { padding: '8px 20px 16px' } },
+    h('h2', { class: 'fx-set__title' }, 'History'),
+    settingRow({ label: 'Read from', hint: status, help: 'Reads past Seazona orders into Flow, 10 every 2 minutes. Each job waits on hold and never drafts by itself.', control }),
+    settingRow({ label: 'Jobs read', control: jobs }));
+  const press = async (button, path, body) => {
+    button.disabled = true;
+    try {
+      await flow(path, { method: 'POST', ...(body ? { body: JSON.stringify(body) } : {}) });
+      toast(body ? 'History read started.' : 'History read stopped.', 'success');
+    } catch (error) {
+      toast(error.message, 'danger');
+      if (error.retryAfterMs) holdButton(button, error.retryAfterMs);
+    }
+    load();
+  };
+  const load = async () => {
+    let body;
+    try {
+      body = await flow('/api/seazona/history');
+    } catch (error) {
+      status.replaceChildren(error.message);
+      return;
+    }
+    const run = body.backfill;
+    jobs.replaceChildren(String(body.history?.jobs ?? 0));
+    if (run?.running) {
+      status.replaceChildren(`Reading ${day(run.nextDay ?? run.from)} · ${run.ordersRead} read`);
+      control.replaceChildren(h('button', { class: 'fx-btn fx-btn--sm', type: 'button', disabled: !canAct, onclick: (event) => press(event.currentTarget, '/api/seazona/history/backfill/stop') }, 'Stop'));
+      setTimeout(() => { if (section.isConnected) load(); }, 30_000);
+      return;
+    }
+    status.replaceChildren(run ? `${run.stopped ? 'Stopped' : 'Done'} · ${run.ordersRead} read from ${day(run.from)}` : 'Not started');
+    control.replaceChildren(from, h('button', { class: 'fx-btn fx-btn--sm fx-btn--primary', type: 'button', disabled: !canAct, onclick: (event) => press(event.currentTarget, '/api/seazona/history/backfill', { from: from.value }) }, 'Start'));
+  };
+  load();
+  return section;
+}
+
 // Once Xero is on: each organisation's connection, the history copy, and
 // Connect, which goes to Xero and comes back.
 function xeroConnection(organisations, canChange) {
@@ -1014,8 +1065,11 @@ function xeroConnection(organisations, canChange) {
         if (canChange) {
           control = h('button', { class: `fx-btn fx-btn--sm${status.connected && !stopped && !refused ? '' : ' fx-btn--primary'}`, type: 'button', onclick: async () => {
             try {
+              // A Custom Connection connects at once; a Xero app sends the
+              // browser to Xero to approve.
               const { authorizeUrl } = await flow('/api/xero/connect', { method: 'POST', body: JSON.stringify({ organisationId: organisation.id }) });
-              location.assign(authorizeUrl);
+              if (authorizeUrl) location.assign(authorizeUrl);
+              else location.reload();
             } catch (error) {
               toast(error.message, 'danger');
             }
@@ -1239,7 +1293,8 @@ drawModeToggles();
 // the Clerk instance is called.
 const LOCALIZATION = {
   signIn: {
-    start: { title: 'Sign in to Flow', subtitle: 'Choose how to sign in.' },
+    // titleCombined is the sign-in-or-sign-up screen (public sign-up on).
+    start: { title: 'Sign in', titleCombined: 'Sign in', subtitle: '' },
     password: { subtitle: 'Enter the password for your account.' },
   },
   signUp: { start: { title: 'Ask for access to Flow', subtitle: 'Use your work email. An owner approves new people.' } },

package/server/ui/flow.css

@@ -440,7 +440,12 @@ a.fx-strong:hover { text-decoration: underline; }
 .fx-toolbar { display: flex; flex-wrap: wrap; align-items: end; justify-content: space-between; gap: 12px; border-bottom: 1px solid var(--fx-line); }
 .fx-tabs { display: flex; gap: 2px; }
 .fx-tabs button { flex: none; }
-@media (max-width: 639px) { .fx-tabs { max-width: 100%; overflow-x: auto; scrollbar-width: none; } }
+/* Phones and tablets: the tabs scroll in one row and each is 44px tall, so
+   seven tabs never run past the page and a thumb hits each one. */
+@media (max-width: 1023px) {
+  .fx-tabs { max-width: 100%; overflow-x: auto; scrollbar-width: none; }
+  .fx-tabs button { min-height: 44px; }
+}
 .fx-tabs button {
   display: inline-flex; align-items: center; gap: 8px; padding: 10px 14px; margin-bottom: -1px;
   border: 0; border-bottom: 2px solid transparent; background: transparent; cursor: pointer;
@@ -1346,7 +1351,6 @@ body[data-state="loading"] .fx-loading { display: grid; justify-items: center; }
   /* Touch: every control a thumb uses is 44px (docs/MOBILE_TESTS.md). The
      icons and text keep their size; the box around them grows. */
   #menu-toggle, #search { width: 44px; height: 44px; }
-  .fx-tabs button { min-height: 44px; }
   /* The notice's buttons grow to 44px into its padding, so the notice
      stays one short line. */
   .fx-alerts__close { width: 44px; height: 44px; margin: -12px -8px; }

package/server/ui/invoice-rules.js

@@ -14,7 +14,7 @@ const TEST_LABELS = {
   is_not_one_of: 'is not one of', contains: 'contains', does_not_contain: 'does not contain',
   starts_with: 'starts with', does_not_start_with: 'does not start with', has_number: 'has a number', number_in_words: 'has a number beside words', one_word: 'is one word',
 };
-const ACTION_LABELS = { wait: 'Wait for a person', skip: 'Never draft', pending: 'Pending, with a note' };
+const ACTION_LABELS = { wait: 'Wait for a person', skip: 'Never draft', pending: 'Pending, with a note', non_chargeable: 'Non-chargeable' };
 const NO_VALUE = ['is_empty', 'is_not_empty', 'has_number', 'number_in_words', 'one_word'];
 const MANY = ['is_one_of', 'is_not_one_of'];
 const TYPED = ['contains', 'does_not_contain', 'starts_with', 'does_not_start_with'];