toga-ai 1.0.100 → 1.0.102

package/knowledge/clients/rate/INDEX.md

@@ -2,5 +2,6 @@
 
 | Doc | Framework | Summary | Files |
 |-----|-----------|---------|-------|
+| [Rate Monthly Reconciliation Report](features/monthly-reconciliation-report.md) | 1.0 | A monthly cron that emails an Excel reconciliation report covering all Rate subscription sales orders and their linked PayPal payments for the prior calendar mo | worker/crons/notifications/reports/rate/send_monthly_rate_purchases_report.php, worker/schedules/cron.worker.notification.json |
 | [Rate SAML SSO](features/saml-sso.md) | 2.0 | Rate uses Azure AD as its IdP (`login.rate.com`). | _underscore/Model/Rate/ClientAuthentication.php, saml/Controller/Index.php, toga2-view/src/hooks/useAuthenticationFlow.ts |
 | [Rate](profile.md) | 2.0 | Rate is a mortgage/lending client. |  |

package/knowledge/clients/rate/features/monthly-reconciliation-report.md

@@ -0,0 +1,85 @@
+---
+title: Rate Monthly Reconciliation Report
+framework: "1.0"
+repo: worker
+project: Worker
+client: rate
+type: client-feature
+status: active
+updated: 2026-06-16
+owners: ["rgirish"]
+files:
+  - worker/crons/notifications/reports/rate/send_monthly_rate_purchases_report.php
+  - worker/schedules/cron.worker.notification.json
+related:
+  - clients/rate/features/saml-sso.md
+  - clients/rate/profile.md
+---
+
+## Summary
+
+A monthly cron that emails an Excel reconciliation report covering all Rate subscription
+sales orders and their linked PayPal payments for the prior calendar month. Used by AIG
+(for contract reconciliation) and the TOGA accounts team (for billing verification).
+
+## How it works
+
+1. Runs on the 1st of each month via `cron.worker.notification.json`.
+2. Queries `Client_Rate` for all `SalesOrders` whose `dateOrder` falls within the prior
+   month, joined through `Entitlements_SalesOrders` → `Entitlements` → `Subscriptions`.
+   Filtered to `Subscriptions.token LIKE 'I-%'` (PayPal recurring subscription tokens only).
+3. Also joins `SalesOrders_Payments` → `Payments` for transaction-level detail.
+4. Builds a 16-column Excel sheet ("Monthly Reconciliation") using PhpSpreadsheet.
+5. Emails the `.xlsx` as an attachment. If no orders found, sends a plain no-data notice.
+
+## Report columns
+
+| # | Column | Source |
+|---|---|---|
+| 1 | Customer Name | `Customers.name` |
+| 2 | Email | `ContactEmailAddresses.emailAddress` |
+| 3 | Address | `Addresses` (line1, line2, city, state, zip via `CONCAT_WS`) |
+| 4 | Entitlement # | `Entitlements.number` |
+| 5 | AIG Contract # | `Entitlements.c_aigContractNumber` |
+| 6 | Sales Order # | `SalesOrders.number` |
+| 7 | Description | `SalesOrders.description` |
+| 8 | Order Date | `SalesOrders.dateOrder` |
+| 9 | Subscription Token | `Subscriptions.token` |
+| 10 | Active | `Subscriptions.isActive` (Yes/No) |
+| 11 | Date Cancelled | `Subscriptions.dateCancelled` |
+| 12 | Date End | `Subscriptions.dateEnd` |
+| 13 | Transaction ID | `Payments.transactionIdentifier` |
+| 14 | Amount | `Payments.amount` |
+| 15 | Payment Date | `Payments.dtStamp` |
+| 16 | Payment Note | `Payments.note` |
+
+## Key design decisions
+
+- **Filtered by `SalesOrders.dateOrder`**, not `Entitlements.dtCreated` — catches recurring
+  monthly payments, not just the original purchase date.
+- **`Subscriptions.token LIKE 'I-%'`** — restricts to PayPal recurring billing agreement
+  tokens; excludes any one-off or non-PayPal orders.
+- **LEFT JOIN on Payments** — a sales order with no payment record still appears in the
+  report (payment columns will be blank). This surfaces orders missing payment data.
+- Ordered by `Subscriptions.id ASC, SalesOrders.dateOrder ASC` — groups all orders per
+  subscriber chronologically.
+
+## Recipients
+
+Currently `$emailTo` in the script. Update there to add AIG or additional recipients.
+
+## Gotchas / known issues
+
+- **`c_aigContractNumber`** is the display string from AIG (e.g. `1000045859462`). The
+  companion `c_aigContractId` (Int32) is used by the AIG cancel API but is not included
+  in this report — add it if AIG requests it for matching.
+- **To run manually for testing**, comment out the `WHERE` date filter. Restore it before
+  leaving the script — the cron runs on the 1st and will pull all-time data otherwise.
+- The script file is named `send_monthly_rate_purchases_report.php` (historical name) but
+  the report it generates is now the reconciliation report — the filename was not renamed.
+
+## Change history
+
+- 2026-06-16 — Rebuilt from a new-purchases report into a full reconciliation report: query
+  now drives off `SalesOrders.dateOrder` (not `Entitlements.dtCreated`), adds Payments join,
+  16-column sheet replacing the old 11-column sheet, filtered to PayPal tokens (rgirish)

package/knowledge/clients/rate/profile.md

@@ -5,15 +5,17 @@ apps:
   - _underscore
   - saml
   - toga2-view
+  - worker
 project: SAML SSO Gateway
 client: rate
 type: profile
 status: active
-updated: 2026-06-11
+updated: 2026-06-16
 owners: ["rgirish"]
 files: []
 related:
   - clients/rate/features/saml-sso.md
+  - clients/rate/features/monthly-reconciliation-report.md
 ---
 
 ## Summary

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.100",
+  "version": "1.0.102",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/skills/create-elastic-beanstalk/SKILL.md

@@ -1,217 +0,0 @@
----
-name: create-elastic-beanstalk
-description: Generates a ready-to-paste AWS CloudShell command that creates a new Elastic Beanstalk environment following True/Agilant conventions. Use this skill whenever the user wants to create, spin up, or provision a new Elastic Beanstalk environment, add an EB environment to an existing application, or asks for the CloudShell command to launch a beanstalk. Trigger immediately even if they just say "make me a new beanstalk for X" or "new EB env in the API app".
----
-
-# Create Elastic Beanstalk Environment
-
-## What this skill does
-
-You interview the user, then output a **single copy-paste CloudShell command** that creates a new
-Elastic Beanstalk *environment* inside an *existing* EB *application*. The command must run as-is
-when pasted into AWS CloudShell — no placeholders left behind, no editing required.
-
-You do **not** run any AWS commands yourself (you are not in CloudShell). You gather the answers,
-fill in the proven values below, and print the final command for the developer to paste.
-
-## The core rule: PRODUCTION vs everything else
-
-The value of the `ENVIRONMENT` variable decides almost everything. If the user's `ENVIRONMENT`
-value is exactly `production`, use the **PRODUCTION profile**. Any other value
-(`client-alpha`, `qa-beta`, `sandbox-dev`, etc.) uses the **NON-PROD profile**.
-
-These two profiles live in **different AWS accounts** with different VPCs, subnets, roles, and
-storage. The developer's CloudShell session must be logged into the matching account — always tell
-them which account to confirm before they paste.
-
-### PRODUCTION profile — AWS account `654654170868`
-
-| Setting | Value |
-|---|---|
-| VPC | `vpc-08030daf1c2dad280` |
-| Instance (private) subnets | `subnet-0e135d4093ab60b2f,subnet-0c6579c05a0f51ac6,subnet-096d9f8f0617949ef` |
-| ELB (public) subnets | `subnet-016ceecffa8c484dd,subnet-0a03a9af3536ab3e2,subnet-0f4272cd10edeee8d` |
-| Instance profile | `ElasticBeanstalk-EC2-Instance-Profile` |
-| Service role | `arn:aws:iam::654654170868:role/service-role/aws-elasticbeanstalk-service-role` |
-| Storage | `gp2` (SSD), 10 GB |
-| Load balancer | **Dedicated** application LB (`LoadBalancerIsShared=false`), public-facing |
-| Default instance type | `t4g.large` |
-| Default instance count | Min = Max = `2` |
-
-### NON-PROD profile — AWS account `975050298201`
-
-| Setting | Value |
-|---|---|
-| VPC | `vpc-0c5319e7df6f736c5` |
-| Instance (private) subnets | `subnet-0d6acbaf19ee03fa9,subnet-0f5085f369274c305,subnet-0133a6098281928c7` (`true-test-private-web-a/b/c`) |
-| Instance profile | `aws-elasticbeanstalk-ec2-role` |
-| Service role | `arn:aws:iam::975050298201:role/aws-elasticbeanstalk-service-role` |
-| Storage | `standard` (magnetic), 10 GB |
-| Load balancer | **Shared** application LB (`LoadBalancerIsShared=true`) — must pick one (see list) |
-| Default instance type | `t4g.micro` |
-| Default instance count | Min = Max = `1` |
-
-> Non-prod uses a **shared** ALB, so do NOT set `ELBScheme`, `ELBSubnets`, or
-> `AssociatePublicIpAddress`. Elastic Beanstalk rejects subnet config on a shared load balancer; it
-> simply attaches a listener rule to the existing ALB.
-
-## Always-true conventions (both profiles)
-
-- **Platform:** PHP on Amazon Linux 2023, Apache proxy, **arm64** (`SupportedArchitectures=arm64`,
-  `t4g` family). Default solution stack: `64bit Amazon Linux 2023 v4.13.1 running PHP 8.5`.
-- **Key pair:** `true-aws-infrastructure-production`.
-- **Deployments:** `AllAtOnce` — **always**, no exceptions.
-- **No real autoscaling:** AWS won't let you disable it, so neuter the trigger — watch
-  `CPUUtilization` with `LowerThreshold=2000000` and `UpperThreshold=6000000` so it never breaches.
-  Always use `Unit=Percent`. Set Min = Max instance count so the group size is pinned.
-- **Instances** always go in the **private** subnets; load balancers in **public** subnets.
-- **On-Demand only** — always default to On-Demand instances (`EnableSpot=false`), never Spot.
-
-## Interview the user (ask before generating anything)
-
-Ask these together in one message. Don't generate the command until you have the answers.
-
-1. **`ENVIRONMENT` value** — what string goes in the `ENVIRONMENT` variable? (e.g. `production`,
-   `client-delta`, `qa-hotfix`). This selects the profile. Treat exactly `production` as PRODUCTION.
-
-2. **EB application** — which existing application? It must already exist (this skill never creates
-   the application). Known applications: `SAML`, `talos-backend`, `TOGA Technology`, `API`,
-   `TOGaCommerce`, `TOGaIQ`, `Worker`. If unsure, have them run:
-   `aws elasticbeanstalk describe-applications --query 'Applications[].ApplicationName' --output table`
-
-3. **Environment name** — the name for the new environment (e.g. `api-client-delta`). Lowercase,
-   hyphenated, ≤ 40 chars.
-
-4. **Shared ALB (NON-PROD only)** — which shared ALB should it attach to? Ask for the ALB **name**;
-   the generated command resolves the ARN at runtime so it can't go stale. Known shared ALBs in
-   account `975050298201` (`describe-load-balancers` to refresh):
-   `true-alb-sandbox-dev`, `true-alb-sandbox-client`, `true-alb-client-alpha`,
-   `true-alb-client-beta`, `true-alb-client-gamma`, `true-alb-qa-alpha`, `true-alb-qa-beta`,
-   `true-alb-qa-gamma`, `true-alb-qa-hotfix`, `true-alb-qa-task`, `true-alb-qc-alpha`,
-   `true-alb-qc-beta`, `true-alb-qc-gamma`, `true-alb-qc-hotfix`, `true-alb-qc-performance`,
-   `true-alb-qc-security`, `true-alb-qc-task`.
-
-5. **Instance type** — confirm or change. Default `t4g.micro` (non-prod) / `t4g.large` (prod). Must
-   be arm64 `t4g` family; `t4g.micro` is the floor.
-
-6. **Instance count** — confirm or change. Default Min = Max = `1` (non-prod) / `2` (prod). It's
-   pinned (no scaling), so Min and Max are set equal.
-
-7. **PHP version** *(optional)* — default `8.5`. Other current AL2023 options: `8.1`, `8.2`, `8.3`,
-   `8.4`. Maps to solution stack `64bit Amazon Linux 2023 v4.13.1 running PHP <ver>`.
-
-8. **CNAME prefix** *(optional)* — defaults to the environment name.
-
-## Generating the command
-
-Substitute every value at generation time so the printed command has no placeholders. Build the
-option settings as a JSON heredoc, then call `create-environment`.
-
-Before the command, print a one-line **account check** banner, e.g.:
-> ⚠️ Confirm your CloudShell is logged into account **975050298201** (non-prod) before pasting.
-
-### NON-PROD template (shared ALB)
-
-```bash
-# Target account: 975050298201  |  App: <APP>  |  Env: <ENV_NAME>  |  ENVIRONMENT=<ENV_VALUE>
-SHARED_ALB_ARN=$(aws elbv2 describe-load-balancers \
-  --names "<SHARED_ALB_NAME>" \
-  --query 'LoadBalancers[0].LoadBalancerArn' --output text)
-
-cat > /tmp/eb-options.json <<EOF
-[
-  {"Namespace":"aws:autoscaling:asg","OptionName":"MinSize","Value":"<COUNT>"},
-  {"Namespace":"aws:autoscaling:asg","OptionName":"MaxSize","Value":"<COUNT>"},
-  {"Namespace":"aws:ec2:instances","OptionName":"InstanceTypes","Value":"<INSTANCE_TYPE>"},
-  {"Namespace":"aws:ec2:instances","OptionName":"SupportedArchitectures","Value":"arm64"},
-  {"Namespace":"aws:ec2:instances","OptionName":"EnableSpot","Value":"false"},
-  {"Namespace":"aws:autoscaling:launchconfiguration","OptionName":"IamInstanceProfile","Value":"aws-elasticbeanstalk-ec2-role"},
-  {"Namespace":"aws:autoscaling:launchconfiguration","OptionName":"EC2KeyName","Value":"true-aws-infrastructure-production"},
-  {"Namespace":"aws:autoscaling:launchconfiguration","OptionName":"RootVolumeType","Value":"standard"},
-  {"Namespace":"aws:autoscaling:launchconfiguration","OptionName":"RootVolumeSize","Value":"10"},
-  {"Namespace":"aws:autoscaling:launchconfiguration","OptionName":"DisableIMDSv1","Value":"true"},
-  {"Namespace":"aws:ec2:vpc","OptionName":"VPCId","Value":"vpc-0c5319e7df6f736c5"},
-  {"Namespace":"aws:ec2:vpc","OptionName":"Subnets","Value":"subnet-0d6acbaf19ee03fa9,subnet-0f5085f369274c305,subnet-0133a6098281928c7"},
-  {"Namespace":"aws:elasticbeanstalk:environment","OptionName":"LoadBalancerType","Value":"application"},
-  {"Namespace":"aws:elasticbeanstalk:environment","OptionName":"LoadBalancerIsShared","Value":"true"},
-  {"Namespace":"aws:elasticbeanstalk:environment","OptionName":"ServiceRole","Value":"arn:aws:iam::975050298201:role/aws-elasticbeanstalk-service-role"},
-  {"Namespace":"aws:elbv2:loadbalancer","OptionName":"SharedLoadBalancer","Value":"${SHARED_ALB_ARN}"},
-  {"Namespace":"aws:elasticbeanstalk:command","OptionName":"DeploymentPolicy","Value":"AllAtOnce"},
-  {"Namespace":"aws:elasticbeanstalk:environment:proxy","OptionName":"ProxyServer","Value":"apache"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"MeasureName","Value":"CPUUtilization"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"Statistic","Value":"Average"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"Unit","Value":"Percent"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"LowerThreshold","Value":"2000000"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"UpperThreshold","Value":"6000000"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"LowerBreachScaleIncrement","Value":"-1"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"UpperBreachScaleIncrement","Value":"1"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"BreachDuration","Value":"5"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"Period","Value":"5"},
-  {"Namespace":"aws:autoscaling:trigger","OptionName":"EvaluationPeriods","Value":"1"},
-  {"Namespace":"aws:elasticbeanstalk:application:environment","OptionName":"ENVIRONMENT","Value":"<ENV_VALUE>"}
-]
-EOF
-
-aws elasticbeanstalk create-environment \
-  --application-name "<APP>" \
-  --environment-name "<ENV_NAME>" \
-  --cname-prefix "<CNAME_PREFIX>" \
-  --solution-stack-name "64bit Amazon Linux 2023 v4.13.1 running PHP <PHP_VER>" \
-  --option-settings file:///tmp/eb-options.json
-```
-
-### PRODUCTION template (dedicated public ALB)
-
-Same shape, but in account `654654170868`, with the dedicated-LB differences:
-
-- Drop the `SHARED_ALB_ARN` lookup and the `aws:elbv2:loadbalancer SharedLoadBalancer` line.
-- `LoadBalancerIsShared` → `false`.
-- `IamInstanceProfile` → `ElasticBeanstalk-EC2-Instance-Profile`.
-- `ServiceRole` → `arn:aws:iam::654654170868:role/service-role/aws-elasticbeanstalk-service-role`.
-- `RootVolumeType` → `gp2`.
-- `VPCId` → `vpc-08030daf1c2dad280`; `Subnets` → the three prod private subnets.
-- Add the public-facing LB lines:
-  ```
-  {"Namespace":"aws:ec2:vpc","OptionName":"ELBScheme","Value":"public"},
-  {"Namespace":"aws:ec2:vpc","OptionName":"ELBSubnets","Value":"subnet-016ceecffa8c484dd,subnet-0a03a9af3536ab3e2,subnet-0f4272cd10edeee8d"},
-  {"Namespace":"aws:ec2:vpc","OptionName":"AssociatePublicIpAddress","Value":"false"},
-  ```
-- Defaults: `InstanceTypes=t4g.large`, count `2`.
-- Everything else identical: AllAtOnce, `Unit=Percent` trigger 2000000–6000000, `EnableSpot=false`,
-  arm64, Apache, key pair, 10 GB root volume.
-
-## After printing the command
-
-Tell the developer, concisely:
-
-1. **Confirm the account** — CloudShell must be in `654654170868` (prod) or `975050298201`
-   (non-prod). Paste fails or misbehaves if they're in the wrong account.
-2. The application must already exist; this only creates the environment.
-3. Watch it come up: `aws elasticbeanstalk describe-environments --environment-names "<ENV_NAME>" --query 'Environments[0].{Status:Status,Health:Health,CNAME:CNAME}' --output table`
-4. If EB complains about a missing listener rule on a shared ALB, the env still creates; the rule is
-   added automatically once the environment is `Ready`.
-
-## Reviewing / cloning an existing environment
-
-To copy settings from a known-good environment, dump its full config (this is how this skill's
-values were sourced):
-
-```bash
-aws elasticbeanstalk describe-configuration-settings \
-  --application-name "<APP>" --environment-name "<EXISTING_ENV>" \
-  --query 'ConfigurationSettings[0].OptionSettings[].{NS:Namespace,Opt:OptionName,Val:Value}' \
-  --output table
-```
-
-If the user is targeting an account other than the two above, ask them to run that command (plus
-`aws ec2 describe-subnets` and `aws elbv2 describe-load-balancers`) and paste the output so you can
-build a matching profile rather than guessing.
-
-## Conventions baked in (don't silently change these)
-
-- All-at-once deploys, arm64/t4g, Apache, private-subnet instances, public-subnet LBs, the
-  2000000–6000000 never-trigger CPU hack (`Unit=Percent`), pinned Min=Max instance count, the
-  `true-aws-infrastructure-production` key pair, 10 GB root volume (SSD `gp2` prod / magnetic
-  `standard` non-prod), On-Demand instances.
-- If the user explicitly asks to deviate (e.g. enable Spot, change storage), honor it but call out
-  that it departs from the standard.