toga-ai 1.0.1016 → 1.0.1017

package/knowledge/2.0/apps/_underscore/features/email-send-pipeline.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-23
-owners: ["bala", "tcox", "dfranks", "apeterson", "jcardinal"]
+updated: 2026-10-14
+owners: ["bala", "tcox", "dfranks", "apeterson", "jcardinal", "rgirish"]
 files:
   - _underscore/Email.php
   - _underscore/String.php
@@ -102,6 +102,14 @@ derive one from the other).
   inbox.** Whatever the caller rendered (placeholders resolved, built tables, escaping applied) is
   in the `body` column the moment `send()` returns. This is the cheapest way to verify a new email:
   query the row, not your mail client.
+- **⚠ client-sandbox does not deliver email (seen 2026-10-13).** Two separate faults:
+  1. Some sandbox `Logs_<Client>` DBs lack the `Email` / `EmailAttachment` tables, so `_Email::send()`
+     fails with 500 `Table 'Logs_Elite.Email' doesn't exist`. Fix: create them from the
+     `dbchanges2/Logs_Client` blank DB plus the `2026-09-23a` EmailReview columns.
+  2. Even with the tables, the `Infrastructure/Email/Send/Run` cron is configured but `PENDING` rows
+     never go out on client-sandbox (`Logs_Compass` had 95 stuck). In non-prod, mail is rewritten
+     to `devteam@togatech.com` ("DEVELOPMENT MODE") anyway — so read the link/body from the
+     `Logs_<Client>.Email` row instead of waiting for mail.
 - **⚠ `debug_mode` / `send_debug_emails_to` redirects at QUEUE time ONLY — never at send time.**
   The redirect happens inside `_Email::send()` as it writes the `PENDING` row, so the row is
   **already addressed** by the time the Send worker reads it. The worker does no redirect of its
@@ -202,6 +210,7 @@ derive one from the other).
     for a hotfix.
 
 ## Change history
+- 2026-10-14 — Gotcha: client-sandbox missing `Logs_<Client>.Email` tables and a Send cron that never drains `PENDING` rows (rgirish)
 - 2026-09-23 — Review hold: `HELD`/`CANCELLED` statuses, `emailTemplateId`/`reviewOfEmailId`/
   `dtReviewed`/`reviewedBy` columns, `setIsHeld`/`setEmailTemplateId`/`setReviewOfEmailId`;
   `send()` now returns the log id; stale "enqueues" docblock fixed. (jcardinal)

package/knowledge/2.0/apps/_underscore/features/item-fulfillment-stage-lifecycle-and-order-status.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
-owners: [bala]
+updated: 2026-10-14
+owners: [bala, rgirish]
 files:
   - _underscore/Model/Client/SalesOrder.php
   - _underscore/Model/Quad/SalesOrder.php
@@ -114,16 +114,30 @@ fulfillment statuses — filter widened to `['_picked','_packed','_shipped']`:
 |---|---|---|
 | Base, Quad (non-SA) | Pending → Picked → Packed → Partially Fulfilled → Fulfilled | all IF stages |
 | Compass USA + Canada | Pending → Partially Fulfilled → Fulfilled | **shipped IF stage only**; fulfilled-vs-partial rule differs per region (`_fulfillmentStatus()`) |
-| Elite | pendingFulfillment → partiallyFulfilled → fulfilled → shipped → delivered (+ canceled) | fulfillment + shipment state; **no approval stage** |
+| Elite | pendingFulfillment → picked → packed → partiallyFulfilled → shipped / fulfilled → delivered (+ canceled) | all IF stages + shipment state; **no approval stage** |
 
 Quad `SA%` orders delegate to the base machine; an explicit `salesOrderStageId` overrides the
 calculated status everywhere.
 
 **Elite is a third policy, not a variant of Compass.** `_Model_Elite_SalesOrder::_status`
-(`FIELD_SQL` override, with four private helper builders, plus `_Model_Elite_SalesOrderStatus`) walks
-a **six-status ladder**: `pendingFulfillment`, `partiallyFulfilled`, `fulfilled`, `shipped`,
-`delivered`, `canceled`. The two new statuses (`shipped`, `delivered`) were seeded into
-`Client_Elite.SalesOrderStatuses`. **Elite has no approval model at all**, so the Compass status
+(`FIELD_SQL` override, with private helper builders, plus `_Model_Elite_SalesOrderStatus`) walks
+an **eight-status ladder**: Pending Fulfillment → Picked → Packed → Partially Fulfilled →
+Shipped / Fulfilled → Delivered, plus Canceled (covers NetSuite *Cancelled* and *Closed*).
+`shipped`/`delivered` were added first; **`picked`/`packed` were added 2026-10-08**:
+- When shipped qty = 0 and a **picked** NetSuite IF exists → `picked`; else if a **packed** IF
+  exists → `packed`. Picked wins when both exist (same as the base `_Model_Client_SalesOrder`).
+  The counts come from the private helper `buildCountOfFulfillmentsWithStatus()`.
+- No import change was needed: the 1.0 sync (`sync_togasupply_elite.php` →
+  `syncItemFulfillmentFromNetsuite`) already imported `_picked`/`_packed` IFs into
+  `ItemFulfillmentStages`. `_status` only counted shipped, so orders jumped Pending Fulfillment →
+  Delivered.
+- Data: `dbchanges2/Client_Elite/2026-10-08a - SalesOrderStatusPickedPacked.sql` (picked `F5A623`,
+  packed `4DBCC4`) and `dbchanges2/Core/2026-10-08a - SalesOrderStatusVocabularyFulfillmentTerms.sql`
+  (Core `Messages` + `sales-order-status` `VocabularyTerms` for picked/packed/shipped/delivered).
+- **Decision:** NetSuite order-header billing statuses (*Pending Billing*, *Billed*) are **not**
+  shown as their own Elite status.
+- Prod-verified 2026-10-14: SR-14847 / SO 292745 shows Picked.
+ **Elite has no approval model at all**, so the Compass status
 logic — which is written around the MR/MA approval flow — does not apply and must not be copied
 across. The override also fixed a **`billed` → `pendingFulfillment` mislabel affecting 13 orders**.
 
@@ -197,6 +211,17 @@ Fan-out (`Client/`, every client) + a Compass-Canada-specific set. Execution is
   `_Model_Client_ItemFulfillmentStatus`); only the shipped check uses a constant. Adding a base IF
   picked/packed constant would let the literal be removed.
 
+- **A new order-status slug needs TWO data rows, or the toga25-supply UI shows a blank badge.**
+  The table pill reads `Client_<Tenant>.SalesOrderStatuses` (name + `colorHex`); the record-modal
+  header badge reads the **Core** `sales-order-status` vocabulary terms (`VocabularyTerms` +
+  `Messages`). Elite's header badge was blank for `shipped`/`delivered` until the Core terms were
+  added (2026-10-08). No frontend code change is needed for a new slug.
+
+## Change history
+- 2026-10-14 — Elite `_status` now shows Picked / Packed from NetSuite IF stages; Core vocabulary
+  terms added for picked/packed/shipped/delivered; billing statuses kept out by decision (rgirish)
+- 2026-09-16 — Compass per-region `_fulfillmentStatus()` seam; Elite six-status ladder documented (bala)
+
 ## Related
 - [Recursive Item Fulfillments](recursive-item-fulfillments.md) — the engine that mirrors IFs (and
   now their stages) up the chain.

package/knowledge/2.0/apps/_underscore/features/user-email-as-identity-and-password-reset.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
-owners: [ajean]
+updated: 2026-10-14
+owners: [ajean, rgirish]
 files:
   - _underscore/Model/Client/User.php
   - api2/Component/Api/V2/V2.php
@@ -16,6 +16,8 @@ related:
   - ./record-change-audit-log.md
   - ../../../1.0/apps/tools/features/compass-user-persona-admin.md
   - ../../../clients/compass-usa/features/people-file-user-lifecycle.md
+  - ../../toga25-supply/features/forgot-password-and-create-password.md
+  - ./email-send-pipeline.md
 ---
 
 Why `Users.email` in 2.0 is a login identity + tenant-routing key (forgot-password takeover primitive, domain routing); open before building any UI/job that edits an email address.
@@ -35,13 +37,13 @@ Verified on code 2026-09-04 while adding email editing to the [Tools Compass adm
 
 Key entry points:
 
-- **`_underscore/Model/Client/User.php:95-105`** — the forgot-password lookup and token mint.
+- **`_underscore/Model/Client/User.php` `sendForgotPasswordEmail()`** — the forgot-password lookup and token mint; `updatePassword()` checks the token and sets the password.
 - **`api2/Component/Api/V2/V2.php:762-765`** — binds the authenticated session to the row carrying the address.
 - **`api2/Component/Api/V2/V2.php:611-621`** — resolves `clientId` from the email **domain** via `Core.ClientEmailDomains` when the request host does not identify the client.
 
 ### The forgot-password chain (the takeover primitive)
 
-`_underscore/Model/Client/User.php:95-105`:
+`_underscore/Model/Client/User.php` `sendForgotPasswordEmail()`:
 
 1. Selects `Users` **by email** with **no `isActive` filter** and **no duplicate handling**.
 2. `fetchRow()` takes the **FIRST** row returned — order is not defined.
@@ -53,6 +55,20 @@ So whoever controls an address that appears on a `Users` row can request, receiv
 - A **dead (inactive) row** can be password-reset but **cannot be logged into**.
 - The chain works end-to-end on an **ACTIVE** user.
 
+### The two scripted APIs and the reset token
+
+- **`GET /users/sendForgotPasswordEmail?userEmail=`** and **`GET /users/updatePassword?password=&token=`**
+  — `Core.RecordScripts` 8 and 9, **GET only**. The `Public` role needs `AclRecordScripts` rows for
+  both, or a logged-out user cannot call them.
+- The emailed link is `<request Origin>/create-password?token=…`. The host comes from the JWT `aud`
+  (the request Origin), so it **must be a `Core.Domains` row** for that client.
+- Email body comes from the `EmailTemplates` row `623c8869-4c59-409d-a6ff-c5d8818c9161` (per client
+  DB; Talos uses its own template).
+- **Token lifetime is 30 minutes** (`const PASSWORD_RESET_TOKEN_SECONDS = 1800`, was 24h until
+  2026-10-13). `updatePassword()` returns `false` when the signature is bad **or** `exp` has passed.
+  The token is **still reusable inside the 30 minutes** — single-use would need a new `Users` column.
+- Applies to every client and every app that uses this flow (toga2-supply, toga25-supply, Talos).
+
 ### Tenant routing from the email domain
 
 `V2.php:611-621` derives `clientId` from the address's domain through `Core.ClientEmailDomains` whenever the request host does not identify the client. An editable email is therefore also a **tenant-routing control**, not just a credential hint. The related cross-client login branch (a home user authenticating against another tenant) is documented in [/auth/login resolves the client from the email domain](../../api2/features/login-cross-client-user-resolution.md).
@@ -63,9 +79,24 @@ So whoever controls an address that appears on a `Users` row can request, receiv
 - **⚠ Do not assume the database enforces one email per user.** The 2.0 blank-client template declares `UNIQUE KEY email (email)`, but **live tenants have diverged** — both Compass tenants have no unique key and no index on `email` (prod-verified 2026-09-04). Any code that writes an email must check for a cross-row collision itself. Evidence and the full index list: [PEOPLE-file User Lifecycle](../../../clients/compass-usa/features/people-file-user-lifecycle.md).
 - **⚠ Treat an email write as a security change, not a data change.** Minimum rails for any UI or job that sets `Users.email`: confirm the value twice, validate the domain against `Core.ClientEmailDomains`, refuse when another row in the tenant already holds the address, and write an audit row **before** the update. That is the shape the [Tools Compass admin](../../../1.0/apps/tools/features/compass-user-persona-admin.md) shipped.
 - **An email is also a worker matching key.** worker2's `ensureCrossRegionUsersActive()` matches Compass users on **email**, so changing an address can silently remove a user from a hardcoded protected set — a second reason email edits need an explicit block list.
+- **⚠ `_Http::validateJsonWebToken()` checks the signature only, never `exp`.** Any code that trusts
+  a JWT must check `exp` itself. Before 2026-10-13, `updatePassword()` did not, so a reset link
+  never expired.
+- **Follow-up owed:** the "Forgot Password" `EmailTemplates` text still says "Link Valid for 1 Hour";
+  it should say 30 minutes (per client DB).
+- **⚠ Known security debt (accepted, not fixed):** `sendForgotPasswordEmail` BCCs
+  `devteam@togatech.com` with the **live** reset link, and because `updatePassword` is GET-only the
+  new password travels in the query string and lands in `Logs_<Client>.Api`.
+- **Testing tip:** in non-prod, mail is redirected to the dev team, so pull the reset link from the
+  `Logs_<Client>.Email` row body instead of an inbox (see [Email Send Pipeline](./email-send-pipeline.md)).
 - **Never paste real addresses into tickets or the KB.** Reference the mechanism and the column, not the person.
 
+## Change history
+- 2026-10-14 — Reset token now 30 min and `updatePassword()` rejects expired tokens; documented the two scripted APIs, Public ACL, `Core.Domains` link host, and the BCC / query-string exposure (rgirish)
+- 2026-09-16 — Created: email as login identity and tenant-routing key (ajean)
+
 ## Related
+- [toga25-supply Forgot / Create Password pages](../../toga25-supply/features/forgot-password-and-create-password.md)
 
 - [/auth/login resolves the client from the email domain](../../api2/features/login-cross-client-user-resolution.md)
 - [Record change audit log](./record-change-audit-log.md)

package/knowledge/2.0/apps/toga25-supply/INDEX.md

@@ -9,6 +9,7 @@
 | [Client-Configurable Fields (useClientFields / fieldsConfig)](features/client-configurable-fields.md) | Config that varies by client (or client × role) — field overrides, filter buttons, group-by, column pickers, layout toggles — resolved through `src/fieldsConfig |
 | [Column State (URL-driven show/hide, order & pinning)](features/column-visibility.md) | URL-driven "Columns" button + modal (`cols` param) for show/hide + order + pinning of table columns, client-configurable then Surface-driven; open for column-vi |
 | [Force Logout on Deployment (useDeploymentGuard)](features/force-logout-on-deployment.md) | Force-signs-out every user when a deploy bumps a Core parameter, so session + caches reset to the new build; open when debugging surprise logouts or `useDeploym |
+| [Forgot password & Create password pages (toga25-supply)](features/forgot-password-and-create-password.md) | The toga25-supply forgot-password and create-password pages: routes, page states, router-state notices, and the two backend scripted APIs they call. |
 | [Loading & save-error states (table skeletons, shimmers, Refresh busy pill, save-error toaster)](features/loading-and-error-states.md) | Owning doc for how supply shows loading (table skeleton, sub-section shimmer, Refresh busy pill, sales-order modal skeletons) and failed saves (error toaster, n |
 | [Meta-Driven Page & Table Setup](features/meta-driven-table-data.md) | A page is meta-driven end to end — page meta + table meta + table data, each keyed by slug via toga-blox hooks; pagination-vs-infinite is decided solely by meta |
 | [Persisted React Query cache (localStorage `supply-chain-query-cache`)](features/persisted-query-cache.md) | `localStorage["supply-chain-query-cache"]` is the whole React Query cache dehydrated to disk (survives reloads AND sessions); the owning doc for staleTime rules |

package/knowledge/2.0/apps/toga25-supply/features/forgot-password-and-create-password.md

@@ -0,0 +1,83 @@
+---
+title: Forgot password & Create password pages (toga25-supply)
+framework: "2.0"
+repo: toga25-supply
+project: TOGa 2.5 Supply
+client: shared
+type: feature
+status: active
+updated: 2026-10-14
+owners: [rgirish]
+files:
+  - toga25-supply/src/routes.tsx
+  - toga25-supply/src/pages/Login/LoginPage.tsx
+  - toga25-supply/src/pages/Login/view/AuthNotice.tsx
+  - toga25-supply/src/pages/ForgotPassword/ForgotPasswordPage.tsx
+  - toga25-supply/src/pages/ForgotPassword/viewModel/useForgotPasswordViewModel.ts
+  - toga25-supply/src/pages/CreatePassword/CreatePasswordPage.tsx
+  - toga25-supply/src/pages/CreatePassword/viewModel/useCreatePasswordViewModel.ts
+  - toga25-supply/src/pages/CreatePassword/helpers/passwordRules.ts
+related:
+  - ./sso-redirect-and-session-gating.md
+  - ../workflows/porting-a-page-from-toga2-supply.md
+  - ../../_underscore/features/user-email-as-identity-and-password-reset.md
+  - ../../_underscore/features/email-send-pipeline.md
+---
+
+The toga25-supply forgot-password and create-password pages: routes, page states, router-state notices, and the two backend scripted APIs they call.
+
+## Summary
+
+toga25-supply has its own **Forgot password** and **Create password** pages (2026-10). The flow is a
+copy of toga2-supply's, redesigned to a provided design (light mode). The backend is **unchanged** —
+the same two `_underscore` scripted APIs every app uses.
+
+## How it works
+
+### Routes
+
+`/forgot-password` and `/create-password` are **public** routes in `src/routes.tsx`, next to `/login`.
+
+### Login page
+
+- Centered **"Forgot password?"** link.
+- Wrong credentials → red `AuthNotice` with a reset link. Shown **only** when
+  `useLoginPageViewModel` throws `"Invalid Credentials"` (not for other errors).
+- Router state `passwordUpdated` → green "Password updated." notice.
+- `AuthNotice.tsx` is the shared notice component for all three pages.
+
+### Forgot password page
+
+1. User enters the email → calls `GET /users/sendForgotPasswordEmail?userEmail=`.
+2. Switches to a **"Check your email"** view with **Change** (edit the address), **Back to Sign In**,
+   and a **30-second resend countdown**.
+3. Router state `linkExpired` → amber "link expired" notice.
+
+The API always returns `true` (it does not reveal whether the address exists).
+
+### Create password page
+
+1. Reads `token` from the URL **once**, then strips it from the URL.
+2. Missing token, or the API returns `false` → navigate to `/forgot-password` with `linkExpired`.
+3. Calls `GET /users/updatePassword?password=&token=`.
+4. Success → navigate to `/` with `passwordUpdated`.
+5. Rules (in `helpers/passwordRules.ts`, with `passwordRules.test.ts`): 12+ characters, an uppercase
+   letter, a number, a special character.
+
+Backend details (token lifetime 30 min, Public ACL, `Core.Domains` link host) live in
+[Users.email & password reset](../../_underscore/features/user-email-as-identity-and-password-reset.md).
+
+## Gotchas
+
+- **Send the password with axios `params`, never by building the URL.** `updatePassword` is a
+  GET-only scripted API, so the password goes in the query string; `params` encodes `&`, `#`, `+`.
+  A hand-built URL breaks on those characters.
+- **Use `font-medium`, not `font-semibold`.** The app font loads only weights 300/400/500/700, so
+  Tailwind `font-semibold` (600) falls back to the heavy 700.
+- **The reset link host is the request Origin.** A new app host must be a `Core.Domains` row for the
+  client, or the emailed link points to the wrong place / the call fails.
+- **Testing on non-prod:** mail is redirected to the dev team and client-sandbox does not send at
+  all — read the token from the `Logs_<Client>.Email` row body.
+
+## Change history
+- 2026-10-14 — Created: forgot-password + create-password pages ported from toga2-supply and redesigned (rgirish)

package/knowledge/INDEX.md

@@ -31,7 +31,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **toga2-view** (TOGa View Frontend) — 12 doc(s) → [2.0/apps/toga2-view/INDEX.md](2.0/apps/toga2-view/INDEX.md)
 - **toga2-hub** (TOGa Hub) — 2 doc(s) → [2.0/apps/toga2-hub/INDEX.md](2.0/apps/toga2-hub/INDEX.md)
 - **toga2-commerce** (TOGa Commerce) — 30 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
-- **toga25-supply** (TOGa 2.5 Supply) — 23 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
+- **toga25-supply** (TOGa 2.5 Supply) — 24 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
 - **toga25-iq** (TOGa IQ) — 1 doc(s) → [2.0/apps/toga25-iq/INDEX.md](2.0/apps/toga25-iq/INDEX.md)
 - **toga25-desk** (TOGa Desk 2.5) — 1 doc(s) → [2.0/apps/toga25-desk/INDEX.md](2.0/apps/toga25-desk/INDEX.md)
 - **toga25-blox** (TOGa Blox 2.5) — 3 doc(s) → [2.0/apps/toga25-blox/INDEX.md](2.0/apps/toga25-blox/INDEX.md)

package/knowledge/clients/elite/profile.md

@@ -18,7 +18,7 @@ project: Worker
 client: elite
 type: profile
 status: active
-updated: 2026-09-24
+updated: 2026-10-14
 owners: [snaredla, apeterson, tcox, bala, rgirish, jcardinal]
 files:
   - worker2/Worker/Elite.php
@@ -85,9 +85,10 @@ method still carries GroWrk-specific rules. TO↔PO links: [TO↔PO link reconci
 so it is **prod-only drift owed a `dbchanges2` catch-up**. Full write-up in
 [netsuite-togasupply-sync](features/netsuite-togasupply-sync.md).
 
-**Elite order status is its own six-status ladder.** `_Model_Elite_SalesOrder::_status` emits
-pendingFulfillment / partiallyFulfilled / fulfilled / shipped / delivered / canceled. **Elite has no
-approval model**, so the Compass status logic does not transfer - see
+**Elite order status is its own ladder.** `_Model_Elite_SalesOrder::_status` emits
+pendingFulfillment / picked / packed / partiallyFulfilled / shipped / fulfilled / delivered / canceled
+(picked/packed added 2026-10-08 from NetSuite IF stages; billing statuses are deliberately not shown).
+**Elite has no approval model**, so the Compass status logic does not transfer - see
 [IF stage lifecycle & order status](../../2.0/apps/_underscore/features/item-fulfillment-stage-lifecycle-and-order-status.md).
 
 ## Supply Inventory grouping — "Units by Items" is two levels, not three (2026-09-21)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1016",
+  "version": "1.0.1017",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",