toga-ai 1.0.237 → 1.0.239

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -6,5 +6,6 @@
6
6
  | [Cart Notification Emails — duplicate prevention](features/cart-notification-emails.md) | On the cart "Notifications" section a user can add CC email addresses to an order. | src/pages/Cart/CartPage.tsx, src/pages/Cart/view/cartForm/CartForm.tsx, src/stores/useEmailOptionsStore.ts, src/stores/useCartSalesQuoteZu.ts, src/pages/Cart/viewModel/FIELDS/*/*/*/CARTPAGE.ts |
7
7
  | [Cart Page — config-driven form architecture (current state + planned refactor)](features/cart-page-config-architecture.md) | The Cart page (`src/pages/Cart/`) is the most config-heavy page in `toga2-commerce`. | src/pages/Cart/CartPage.tsx, src/pages/Cart/view/cartForm/CartForm.tsx, src/pages/Cart/view/cartForm/CartFormSection.tsx, src/pages/Cart/view/cartForm/CartFormRenderer.tsx, src/pages/Cart/view/EditCart.tsx, src/pages/Cart/view/EditOrder.tsx, src/pages/Cart/viewModel/useEditOrderOrEditCartViewModel.ts, src/pages/Cart/viewModel/FIELDS/*/*/*/CARTPAGE.ts, src/hooks/useAssignClientFields.ts |
8
8
  | [Client Fields — per-tenant / language / role content & config](features/client-fields.md) | Almost no user-facing text, field layout, or page config is hard-coded in `toga2-commerce`. | src/fieldsConfig/index.ts, src/fieldsConfig/getClientLoginFields.ts, src/fieldsConfig/clientFields/COMPASS.json, src/fieldsConfig/clientFields/COMPASSCANADA.json, src/fieldsConfig/clientFields/QUAD.json, src/hooks/useAssignClientFields.ts, src/hooks/useDynamicConditionalFieldOptions.ts, src/stores/useFieldsStore.ts, src/components/BaseDetailField/BaseDetailField.tsx |
9
+ | [Config-Driven Expedited Shipping Gating (Cart)](features/expedited-shipping-gating.md) | On the toga2-commerce **Cart** page, expedited shipping options (**"2nd Day EOB"** and **"Next Day Air"**) are only offered in the *Shipping Method* dropdown wh | toga2-commerce/src/pages/Cart/helpers/shippingOptionGates.ts, toga2-commerce/src/pages/Cart/viewModel/FIELDS/shared/shippingOptionGates.ts, toga2-commerce/src/pages/Cart/view/cartForm/CartForm.tsx, toga2-commerce/src/pages/Cart/CartPage.tsx |
9
10
  | [Multi-Tenant Resolution & Theming](features/multi-tenant-theming.md) | `toga2-commerce` serves multiple clients from one codebase. | src/themeConfig/themes.json, src/themeConfig/ThemeContext.tsx, src/themeConfig/types.ts, src/components/ThemeSwitcher/ThemeSwitcher.tsx, src/components/AuthLayout/AuthLayout.tsx, src/api/axiosInstance.ts, src/contexts/AuthContext.tsx, tailwind.config.js |
10
11
  | [AWS Amplify Build & Deploy (non-prod environments)](workflows/amplify-build-and-deploy.md) | How `toga2-commerce` (React + Vite, "commerce2-react") builds and deploys on **AWS Amplify**. | toga2-commerce/amplify.yml, toga2-commerce/.gitattributes, toga2-commerce/package.json, toga2-commerce/.github/workflows/sync-stage-environments.yml |
@@ -0,0 +1,108 @@
1
+ ---
2
+ title: Config-Driven Expedited Shipping Gating (Cart)
3
+ framework: "2.0"
4
+ repo: toga2-commerce
5
+ project: TOGa Commerce
6
+ client: shared
7
+ type: feature
8
+ status: active
9
+ updated: 2026-06-30
10
+ owners: [tcox]
11
+ files:
12
+ - toga2-commerce/src/pages/Cart/helpers/shippingOptionGates.ts
13
+ - toga2-commerce/src/pages/Cart/viewModel/FIELDS/shared/shippingOptionGates.ts
14
+ - toga2-commerce/src/pages/Cart/view/cartForm/CartForm.tsx
15
+ - toga2-commerce/src/pages/Cart/CartPage.tsx
16
+ related:
17
+ - ../../../../clients/compass-usa/profile.md
18
+ - ../../../../clients/compass-canada/profile.md
19
+ ---
20
+
21
+ ## Summary
22
+ On the toga2-commerce **Cart** page, expedited shipping options (**"2nd Day EOB"** and
23
+ **"Next Day Air"**) are only offered in the *Shipping Method* dropdown when the cart contains
24
+ a **computer kit**. Otherwise they are filtered out of the options, and any previously
25
+ selected expedited method auto-resets to **"Standard Ground"**. The behavior is **config
26
+ driven** — a tenant opts in per shipping-method field via an `optionGates` entry; there is no
27
+ `if (clientSlug === ...)` branching. Omitting `optionGates` means expedited is always shown.
28
+
29
+ Applies today to all three tenants: **COMPASS**, **COMPASSCANADA** (English + French), and
30
+ **QUAD**.
31
+
32
+ ## Key files / entry points
33
+ - `src/pages/Cart/helpers/shippingOptionGates.ts` (NEW) — pure helpers + types:
34
+ `ShippingOptionGate` / `ShippingOptionRule`, `filterShippingOptionsByGates`,
35
+ `getHiddenShippingOptionNames`, `evaluateShippingOptionRule`, `findShippingMethodField`
36
+ (resolves the shipping field by `valueKey`, **not** by index), `getBaseShippingOptionName` +
37
+ `SHIPPING_OPTION_LABEL_SEPARATOR`, and `STANDARD_GROUND_SHIPPING_NAME`.
38
+ - `src/pages/Cart/viewModel/FIELDS/shared/shippingOptionGates.ts` (NEW) — the
39
+ `EXPEDITED_SHIPPING_GATE` config constant: `optionNames` `["2nd Day EOB","Next Day Air"]`,
40
+ `visibleWhen { item: "primaryItem", path: "item.itemCategory.name", operator: "equals",
41
+ value: "COMPUTERS" }`.
42
+ - 15 `CARTPAGE.ts` files (COMPASS x4 roles, COMPASSCANADA ENGLISH x4 + FRENCH x4, QUAD x3) —
43
+ each shipping-method field opts in via `optionGates: [EXPEDITED_SHIPPING_GATE]`.
44
+ - `src/pages/Cart/view/cartForm/CartForm.tsx` — filters `shippingMethodOptions` through the
45
+ gates (reactive on `cartData.cartBundles`) before the select renders; resolves the shipping
46
+ field via `findShippingMethodField`; uses `SHIPPING_OPTION_LABEL_SEPARATOR` for the
47
+ cost-suffix label.
48
+ - `src/pages/Cart/CartPage.tsx` — the warning-modal effect derives expedited names from the
49
+ config gates; a NEW auto-reset effect (guarded on `dirtyFields.shippingMethod` + loaded
50
+ options) resets a now-hidden expedited selection back to Standard Ground.
51
+
52
+ ## How it works
53
+ 1. The config layer (`EXPEDITED_SHIPPING_GATE`) declares which option names are gated and the
54
+ condition under which they are *visible* (`visibleWhen`). A shipping-method field opts in by
55
+ listing the gate in `optionGates`.
56
+ 2. A **"computer kit"** is identified by the bundle's **PRIMARY item** —
57
+ `bundleItemGroup.slug === "primary"` — having `item.itemCategory.name === "COMPUTERS"`. This
58
+ reuses the same `{ item, path, operator, value }` rule vocabulary as the existing bundle-page
59
+ one-per-order limit (`evaluateCartQuantityRestriction.ts` + `restrictedQuantity` in
60
+ `BUNDLEDETAILSPAGE.json` / `CartOverlay/Bundle.tsx`). `value` may be a string **or** a
61
+ `string[]`, so qualifying categories stay editable in config without code changes.
62
+ 3. Cart contents are sourced from `useCartStoreZu` (`cartData.cartBundles`), so detection
63
+ reacts to add/remove. A computer kit plus a non-computer item (printer/accessory) still
64
+ shows expedited; removing the kit hides it.
65
+ 4. `CartForm` runs `filterShippingOptionsByGates` over the fetched options before rendering the
66
+ select; `CartPage` runs the auto-reset effect so an already-chosen expedited method does not
67
+ silently survive once it is no longer offered.
68
+
69
+ This mirrors the toga2.5 / toga25-supply "named rule" / config-driven cart pattern: tenant
70
+ behavior is expressed in config, not in code branches.
71
+
72
+ ## Gotchas
73
+ - **Compass MacBook catalog categorization is INCONSISTENT, and it breaks the computer-kit
74
+ assumption.** Verified in prod `Client_Compass.Items`: MacBooks are spread across at least
75
+ **four** categories — `"APPLE LAPTOP"` (e.g. 14" MacBook Pro M5, partNumber `MDE54LL/A-S`),
76
+ `"COMPUTERS"` (14"/16" MacBook Pro M4, `MW2W3LLA-S` / `MX2X3LLA-S`), `"MAC & ACCESSORIES"`
77
+ (~18 older M1/M2 MacBook Air/Pro models), and `"PDC NEW HIRE - APPLE"`. The gate matches
78
+ `itemCategory.name === "COMPUTERS"` **only**, so MacBooks tagged `APPLE LAPTOP` /
79
+ `MAC & ACCESSORIES` do **not** qualify for expedited shipping (and would not trigger the
80
+ one-per-order limit either). Confirmed live on beta and prod: the "Compass 14\" Macbook"
81
+ kit's primary item resolves to `APPLE LAPTOP`. The backend assumption (Alex) was that all
82
+ MacBooks were already `COMPUTERS`; the data shows otherwise. **Team decision this session:**
83
+ keep the rule keyed to `COMPUTERS` only (intended). The fix is **catalog data
84
+ normalization** (or extending the config `value` list to
85
+ `["COMPUTERS","APPLE LAPTOP"]`) — it is *not* a code gap. Hand the categorization to the
86
+ catalog/data team.
87
+ - **The gate is UI-only, not server-enforced.** Shipping methods come from `/shipping-methods`
88
+ (UPS carrier, fetched in `useCartViewModel`) and are filtered client-side. The gate is a
89
+ selection restriction, not order validation. Follow-up recommended: enforce
90
+ expedited-requires-kit at order submission in **api2**.
91
+ - **Only the top-level primary item is scanned.** Nested child-bundle items are not inspected
92
+ for the computer category (consistent with the existing `checkCartContainsComputerKit`
93
+ detector). Fine today, but a miss if a `COMPUTERS` item ever lives only in a nested child
94
+ bundle.
95
+ - **No automated test was added.** The repo has no unit-test runner (Cypress only). Verified
96
+ via `tsc -b` (clean, twice) and an independent maker≠checker code review. ESLint could not
97
+ run locally (missing `eslint-plugin-react-compiler` — environment issue).
98
+
99
+ ## Change history
100
+ - 2026-06-30 — Built config-driven expedited-shipping gating: expedited methods shown only
101
+ when the cart holds a COMPUTERS-category computer kit, with auto-reset to Standard Ground
102
+ otherwise; tenant opt-in via `optionGates` (no client-slug branching). Code review fixed 3
103
+ findings: fail-open index read → resolve field by `valueKey`; substring `.includes` match →
104
+ base-name compare via `getBaseShippingOptionName`; edit-order silent-downgrade/load race →
105
+ reset guarded on dirty + loaded options. Documented the Compass MacBook category
106
+ inconsistency as a known gotcha (data-normalization item, not a code gap). (tcox)
107
+ </content>
108
+ </invoke>
@@ -27,7 +27,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
27
27
  - **talos** (TOGa IQ) — 7 doc(s) → [2.0/apps/talos/INDEX.md](2.0/apps/talos/INDEX.md)
28
28
  - **voice-to-voice** (TOGa Voice) — 4 doc(s) → [2.0/apps/voice-to-voice/INDEX.md](2.0/apps/voice-to-voice/INDEX.md)
29
29
  - **ai-bdr** (AI-BDR) — 4 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
30
- - **toga2-commerce** (TOGa Commerce) — 6 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
30
+ - **toga2-commerce** (TOGa Commerce) — 7 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
31
31
  - **toga25-supply** (TOGa 2.5 Supply) — 7 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
32
32
  - **toga-blox** (TOGa Blox) — 7 doc(s) → [2.0/apps/toga-blox/INDEX.md](2.0/apps/toga-blox/INDEX.md)
33
33
 
@@ -13,11 +13,12 @@ project: _Underscore
13
13
  client: compass-canada
14
14
  type: profile
15
15
  status: active
16
- updated: 2026-06-26
17
- owners: [jcardinal, bala]
16
+ updated: 2026-06-30
17
+ owners: [jcardinal, bala, tcox]
18
18
  files: []
19
19
  related:
20
20
  - ../compass-usa/profile.md
21
+ - ../../2.0/apps/toga2-commerce/features/expedited-shipping-gating.md
21
22
  ---
22
23
 
23
24
  ## Summary
@@ -41,6 +42,11 @@ to but distinct from Compass USA. Like Compass USA it spans the **2.0** commerce
41
42
  (`1_…` transmit SOs to MITS, `2_…` transmit POs to vendors, `3_…` status from G&T cXML,
42
43
  `4_…` import G&T ASNs).
43
44
 
45
+ ## Storefront notes (toga2-commerce)
46
+ - Runs the same `toga2-commerce` storefront (2.0, consumes api2), with English + French cart
47
+ configs (COMPASSCANADA ENGLISH / FRENCH). Cart expedited-shipping gating applies here too —
48
+ see [Config-Driven Expedited Shipping Gating](../../2.0/apps/toga2-commerce/features/expedited-shipping-gating.md).
49
+
44
50
  ## Notes
45
51
  - Customer language preference: `UserGlobalSettings.settingId = 2` (`en` / `fr-CA`); customer-
46
52
  facing emails are sent in EN or FR accordingly.
@@ -12,11 +12,12 @@ project: _Underscore
12
12
  client: compass-usa
13
13
  type: profile
14
14
  status: active
15
- updated: 2026-06-18
16
- owners: [jcardinal, bala]
15
+ updated: 2026-06-30
16
+ owners: [jcardinal, bala, tcox]
17
17
  files: []
18
18
  related:
19
19
  - features/asn-to-item-fulfillment.md
20
+ - ../../2.0/apps/toga2-commerce/features/expedited-shipping-gating.md
20
21
  ---
21
22
 
22
23
  ## Summary
@@ -32,7 +33,16 @@ separate, related client (see its own profile).
32
33
  Client-specific model overrides live under `_underscore/Model/Compass/`.
33
34
  - **1.0:** worker crons under `worker/crons/toga2/compass/` handle email-based imports and
34
35
  notifications.
35
- - Storefront: compass.togacommerce.com / compass.togahub.com.
36
+ - Storefront: compass.togacommerce.com / compass.togahub.com. The storefront app repo is
37
+ **`toga2-commerce`** (2.0, consumes api2).
38
+
39
+ ## Storefront notes (toga2-commerce)
40
+ - Cart expedited-shipping gating: expedited methods ("2nd Day EOB", "Next Day Air") are shown
41
+ only when the cart contains a COMPUTERS-category computer kit — see
42
+ [Config-Driven Expedited Shipping Gating](../../2.0/apps/toga2-commerce/features/expedited-shipping-gating.md).
43
+ **Known data issue:** many Compass MacBooks are categorized `APPLE LAPTOP` /
44
+ `MAC & ACCESSORIES`, not `COMPUTERS`, so those kits do **not** qualify for expedited — a
45
+ catalog-data normalization matter, not a code gap.
36
46
 
37
47
  ## Vendors & integrations
38
48
  - **Office Depot (ODP)** — vendor id 1. ASNs arrive via **cXML** (direct V2 API) and via the
@@ -0,0 +1,75 @@
1
+ ---
2
+ type: session
3
+ slug: talos-pricing-platform
4
+ title: Talos pricing platform (DB + tools UI + worker2 automation) and tools SSO login fix
5
+ author: jcardinal
6
+ repos: [tools, worker2, dbchanges2]
7
+ framework: "both"
8
+ client: shared
9
+ status: active
10
+ created: 2026-06-30
11
+ updated: 2026-06-30
12
+ ---
13
+
14
+ # Session: talos-pricing-platform
15
+ **Date:** 2026-06-30
16
+ **Project/Repo:** tools (1.0) + worker2 (2.0) + dbchanges2 (2.0 Team DB)
17
+ **Task:** Build a data-driven Talos pricing platform (Team-DB schema + tools onboarding/dashboard UI + worker2 cron automation) to replace the Excel calculator; then fix tools SSO login that was failing in production.
18
+
19
+ ---
20
+
21
+ ## What WORKED
22
+ - **Schema (Team DB):** `dbchanges2/Team/2026-06-29a - TalosPricingTables.sql` — 9 tables created, SQL-reviewed (0 critical), all 7 important review fixes applied (dtUpdated on fact tables, DECIMAL(6,4) margins, isFeature* boolean naming, DECIMAL(14,8) calibration factors, full column comments, band-range CHECK). Tables live in the **Team** DB; `dbchanges2/Team/` is the migration folder (Team-DB migrations use unqualified table names).
23
+ - **worker2 automation:** `worker2/Worker/Talos/Pricing.php` (`_Worker_Talos_Pricing`) + `worker2/Database/TalosPricingCrons.sql` — `php -l` clean. Three monthly cron actions: ImportAwsActuals (Cost Explorer), RecomputeMargins (calibration + margin/streak/recommendation), MonthlyReport (PhpSpreadsheet xlsx + templated email). initialize() registers Team DB via `_underscore::DB_TEAM` (mirrors `_Worker_Team_Transcripts`).
24
+ - **tools UI:** nav folder + 6 pages + estimator + CSS, all `php -l` clean. `App_Talos_Estimator` (`tools/_/app/talos/estimator.php`), onboarding get/post, pricing dashboard, usage benchmarks, cost-factors get/post. Live JS estimate + recommended per-band fees on the onboarding form.
25
+ - **SSO 500 fix:** `tools/mvc/sso/get.php` `tools_ssoFail()` — added `if (!headers_sent())` guard around `http_response_code(401)`. `php -l` clean. Root cause confirmed: `App_FrameworkIndex::render()` flushes the preloader buffer (`page.php:213`) BEFORE `body()`/`loadFile()`, so headers are already sent when an mvc page runs.
26
+ - **SSO key sourcing:** `tools/_/app/auth.php` `App_Auth::decryptHandoffValue()` rewritten to read `API_SECRET_ACCESS_TOKEN` / `API_SECRET_ACCESS_TOKEN_PREVIOUS` from `Core.Parameters` (rotated there) via new cached `handoffKeys()` + `const CORE_DB='db_toga2core'`. `php -l` clean.
27
+ - **Crypto format confirmed:** `App_String::encryptWithKey/decryptWithKey` (library/app/string.php:1075-1094) = AES-256-CBC, `base64(iv . base64ciphertext)`, interoperable with 2.0 `_String`. The user's real `?saml=` payload decoded to exactly that shape — proving the SSO failure was a stale-key/config mismatch, not a format bug.
28
+ - **Knowledge captured + pushed twice:** pricing platform (6 docs incl. an approved ELEVATED architecture section in `2.0/apps/talos/architecture.md`) and SSO fixes (2 tools feature-doc updates). Both PUSHED to `_main`.
29
+
30
+ ## What did NOT work — DO NOT RETRY THESE
31
+ - **`App_Database::escape()` does NOT exist** — the 1.0 escaper is `App_Database::sqlEscape()`. Using `::escape` fatals.
32
+ - **Passing `App_Database::query(...)` inline to `buildArrayOfRows()`/`fetchOne()`** triggers PHP "Only variables should be passed by reference" (both take `&$res`); with display_errors on it renders into output. MUST assign the query result to a variable first (the login post.php does this).
33
+ - **Reading SSO tokens from `config.production.ini` `[saml]`** — they go stale because the gateway rotates `API_SECRET_ACCESS_TOKEN`; that stale token was why decrypt returned false and login failed. Do not rely on config tokens; use Core.Parameters.
34
+ - **Calling `http_response_code()` / `header()` / `session_regenerate_id()` from any page loaded inside `body()`** — the preloader buffer is already flushed, so it fatals/no-ops. Always guard with `headers_sent()`.
35
+ - **Writing `[database_team]`/`[database_toga2core]` into config with a guessed host** — avoided deliberately; the 2.0 Core/Team host (`production-core-cluster…us-west-2`, from config.alpha.ini `[database_prod_toga2core]`) differs from the 1.0 prod-cluster and the 2.0 client cluster (`reader1.client.database.togahub.com` = db_true). Don't assume they're the same host.
36
+
37
+ ## Not tried yet (candidates for next session)
38
+ - Seeding/calibrating `TalosCostFactors` from the real Langfuse aggregates (estimator currently ships placeholder DEFAULTS).
39
+ - Wiring the xlsx as an actual email attachment — `_Email` attachment support is unconfirmed (`MonthlyReport` writes xlsx to a temp path; email body has the HTML table meanwhile).
40
+ - Confirming the AWS Cost Explorer cost-allocation tag key (worker assumes `Client`).
41
+ - Creating the leadership `EmailTemplates` record in Client_True and replacing the placeholder `REPORT_EMAIL_TEMPLATE` UUID in `_Worker_Talos_Pricing`.
42
+ - Verifying the live SSO login end-to-end after the `[database_toga2core]` connection is added + deployed.
43
+
44
+ ## Current file state
45
+ | File | Status | Notes |
46
+ |------|--------|-------|
47
+ | dbchanges2/Team/2026-06-29a - TalosPricingTables.sql | created | 9 Talos* tables, reviewed+fixed. Apply to Team DB. |
48
+ | worker2/Worker/Talos/Pricing.php | created | `_Worker_Talos_Pricing`; lint clean. REPORT_EMAIL_TEMPLATE is a placeholder UUID. |
49
+ | worker2/Database/TalosPricingCrons.sql | created | 3 Core.CronJobs seeds (4th of month). Not yet inserted. |
50
+ | tools/_/app/nav.php | modified | Added "Talos Pricing" folder (4 links; Cost Factors narrowed to technical personas). |
51
+ | tools/_/app/talos/estimator.php | created | `App_Talos_Estimator`; placeholder DEFAULT factors. |
52
+ | tools/mvc/talos/onboarding/get.php + post.php | created | Form + live estimate; writes TalosClients + TalosPricingBands in a txn. |
53
+ | tools/mvc/talos/pricing/get.php | created | Read-only margin/recommendation dashboard (db_team). |
54
+ | tools/mvc/talos/benchmarks/get.php | created | Per-user-per-month usage averages (db_team). |
55
+ | tools/mvc/talos/factors/get.php + post.php | created | Technical-only cost-factor editor (upsert TalosCostFactors). |
56
+ | tools/assets/css/style.css | modified | Appended .pricing-table / .badge / form-grid / estimate-readout styles. |
57
+ | tools/mvc/sso/get.php | modified | headers_sent() guard in tools_ssoFail() (500→graceful 401). |
58
+ | tools/_/app/auth.php | modified | decryptHandoffValue() reads keys from Core.Parameters via db_toga2core; added handoffKeys() + CORE_DB const. |
59
+
60
+ ## Decisions made
61
+ - **Pricing model:** flat monthly ORG FEE (the adjustable margin lever) + per-user fee that STEPS by user-count band; band rate schedule locked at signing. On a band crossing the per-user fee auto-steps to the agreed rate, THEN the org fee is adjusted to restore margin. Rejected: pure per-user banded (no lever) and both-vary.
62
+ - **Cost methodology:** calibrate Langfuse→AWS (monthly factor = AWS_actual / Langfuse_costCorrected; new clients use a global blended factor). Rejected: AWS-only and Langfuse-only. Always use Langfuse's cache-corrected cost (it undercounts cache badly).
63
+ - **Table location:** the **Team** DB (`_underscore::DB_TEAM`) — what the user called "Core.Teams". Tenant link to Core.Clients is a plain indexed column, NOT a hard FK (Team DB may be a separate instance).
64
+ - **Onboarding writes:** direct DB write from the 1.0 tools app (not via api2) for speed.
65
+ - **SSO keys from Core.Parameters:** sourced at runtime (rotated) instead of static config, via a `db_toga2core` connection alias; keeps current→previous rotation fallback. Rejected: continuing to read config `[saml]` tokens.
66
+
67
+ ## Blockers
68
+ - **SSO login still fails until the `[database_toga2core]` connection is added to the tools configs and tools is redeployed** — the `db_toga2core` alias is referenced by `App_Auth::CORE_DB` but no `[database_toga2core]` section exists in `config.production.ini` yet (developer is handling creds). Section template: hostname `production-core-cluster.cluster-clwbyqvxdm4q.us-west-2.rds.amazonaws.com`, username awsroot, dbname `Core`.
69
+ - All Talos UI pages need the `[database_team]` connection (db_team → Team DB) before they render data (also developer-supplied creds).
70
+
71
+ ## Exact next step
72
+ > Add the `[database_toga2core]` section (alias db_toga2core, dbname=Core, host=production-core-cluster…us-west-2) to `tools/config.production.ini` (and the dev configs you test with), deploy tools, then attempt a fresh SSO login at https://tools.togatech.com/sso to confirm `decryptHandoffValue()` succeeds against the live rotated key.
73
+
74
+ ---
75
+ _Saved by /session-save on 2026-06-30_
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "toga-ai",
3
- "version": "1.0.237",
3
+ "version": "1.0.239",
4
4
  "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
5
5
  "keywords": [
6
6
  "claude",