toga-ai 1.0.344 → 1.0.346

package/knowledge/2.0/apps/toga2-supply/features/fulfill-and-ship.md

@@ -93,6 +93,32 @@ from the saved fulfillment; **Save UPDATES the existing records** instead of POS
 - `CardTable` was made reusable for this: optional `editIcon` + `isEditButtonDisabled` props
   (defaults preserve prior behavior; the shipments card is the only consumer today).
 
+## Delete a saved shipment from the Edit form (2026-07)
+
+The Edit Shipment form has a **"Delete Shipment"** button (bottom-left of the footer,
+**edit mode only** — there is no saved shipment to delete in create mode). It deletes the
+saved shipment and returns the user to the Select Items page
+(`/shipment-items?internalId=...`). Flow: opens a `SupplyFormGuardrail` **confirm** first
+(delete is irreversible), then shows a "Deleting shipment..." loading screen and toasts
+success/failure.
+
+- **Reuses the existing cascade delete** `deleteShipments(shipmentUuid,
+  itemFulfillmentPackageUuid?, trackingNumberUuid?)` from `Shipments/api/ShipmentsApi.ts` —
+  the **same** API the Pending Shipments trash icon uses. Cascade/delete order:
+  item-fulfillment-tracking-numbers (bridge) → tracking-numbers →
+  item-fulfillment-item-units → item-fulfillment-items → item-fulfillments.
+- **⚠ Bridge-vs-trackingNumber uuid footgun (see gotcha).** To fully delete without
+  orphaning the tracking bridge row, the **tracking-number BRIDGE uuid**
+  (`editShipment.itemFulfillmentTrackingNumbers[0].uuid`, i.e. the
+  `ItemFulfillments_TrackingNumbers` record) must be passed as the
+  `itemFulfillmentPackageUuid` arg — this is **distinct** from the trackingNumber uuid
+  (`...[0].trackingNumber.uuid`). The edit form's `EditShipmentContext`
+  (`UpdateShipmentApi.ts`) was extended with `itemFulfillmentTrackingNumberUuid`, and
+  rehydrate now captures it alongside `itemFulfillmentUuid` / `trackingNumberUuid` /
+  `shipToAddressUuid` / `returnAddressUuid`.
+- **Decision:** a confirmation dialog was added even though the Pending-card trash deletes
+  **without** one, because this is a large, explicit, destructive button.
+
 ## Update Info / Edit Shipment form (config-driven; Figma-alignment pass 2026-07)
 
 The New Shipment / Edit Shipment form is **config-driven**: fields come from
@@ -303,6 +329,13 @@ the call 403s and returns no label.
   rehydrate `signatureType` in `EditShipmentForm.tsx` to the option object `{uuid, name}` derived from
   `trackingNumber.requiresSignature` (`true`→`{uuid:"Required",name:"Required"}`, `false`→Not Required,
   `null`→None Specified). Reusable checklist for any NEW select field in these forms.
+- **⚠ Bridge uuid vs trackingNumber uuid on delete — two different records.** `deleteShipments`'s
+  second arg `itemFulfillmentPackageUuid` is the **bridge** record uuid
+  (`itemFulfillmentTrackingNumbers[0].uuid` = the `ItemFulfillments_TrackingNumbers` join row), NOT
+  the tracking number's own uuid (`itemFulfillmentTrackingNumbers[0].trackingNumber.uuid`). Passing
+  the trackingNumber uuid there leaves the bridge join row orphaned. On the tracking-number-bridge
+  model these are always two distinct uuids — read the shape carefully before wiring any
+  create/update/delete against the bridge.
 - **The `/shipments` list is PER-SALES-ORDER (open product decision, Eric to decide).**
   `getShipments` filters by `SalesOrders.c_netsuiteInternalSalesOrderId = <internalId>`, so
   `/shipments` with no `internalId` shows the empty state — the tool is a per-SO **punch-out**
@@ -373,6 +406,13 @@ not the base `_Model_Client_ItemFulfillment`. Tested with GroWrk; UPS support wa
 for Compass and is not yet in prod.
 
 ## Change history
+- 2026-07-15 — TRUE-79191: added a **"Delete Shipment"** button to the Edit Shipment form (edit-mode
+  only, footer bottom-left) — `SupplyFormGuardrail` confirm → "Deleting shipment..." screen → returns
+  to Select Items. Reuses the Pending-card cascade delete `deleteShipments` (`ShipmentsApi.ts`).
+  Documented the **bridge-vs-trackingNumber uuid** footgun: the bridge uuid
+  (`itemFulfillmentTrackingNumbers[0].uuid`, the `ItemFulfillments_TrackingNumbers` join row) must be
+  passed as `itemFulfillmentPackageUuid` or the bridge row orphans; `EditShipmentContext` gained
+  `itemFulfillmentTrackingNumberUuid` and rehydrate now captures it. (mhammontree)
 - 2026-07-15 — TRUE-79191 (Figma-alignment polish pass): documented two durable items on the
   config-driven form — (1) **Tailwind does not scan `viewModel/FIELDS/*.json`**, so a JSON-only utility
   class is silently inert (`!w-fit` footgun; surgical `safelist` fix, recommended clean fix = add the

package/knowledge/2.0/apps/worker2/features/compass-vip-support-importer.md

@@ -57,8 +57,12 @@ and — with a per-row reason — what was skipped.
    note in one column) is **not** a stop.
 7. **Apply.** Staged updates are applied in batches inside one transaction
    (`buildBatchUpdateSql` — a `CASE id WHEN … THEN …` update); rollback on any failure.
-8. **Report.** Returns JSON `{updated, skipped, stoppedAtRow, skippedRows[]}`. There is no
-   echo logging — the returned JSON is the entire output.
+8. **Clean up the source.** On a successful run (and unless `TEST_MODE`): a local input file
+   is unlinked; a URL input has its **source S3 object deleted** so an input file (which may
+   contain PII) does not linger (see *Source cleanup* below). The downloaded temp copy is
+   always removed in the `finally`.
+9. **Report.** Returns JSON `{updated, skipped, stoppedAtRow, sourceDeleted, skippedRows[]}`.
+   There is no echo logging — the returned JSON is the entire output.
 
 ### Matching keys
 
@@ -81,6 +85,29 @@ an `.xlsx` suffix** so PhpSpreadsheet's `IOFactory` resolves the reader by exten
 file is **always removed in a `finally` block**. A local input file is unlinked after a
 successful run (unless `TEST_MODE`).
 
+### Source cleanup
+
+After a successful run, `deleteRemoteSourceIfS3()` deletes the **source** S3 object behind a
+URL input so the input file (which may contain PII) does not linger. `parseS3Url()` extracts
+the bucket, key, **and region** from either a virtual-hosted (`<bucket>.s3.<region>.amazonaws.com`)
+or path-style (`s3.<region>.amazonaws.com/<bucket>/<key>`) HTTPS URL; region defaults to
+`us-east-1` when the URL omits it. The result JSON's `sourceDeleted` field reports the outcome.
+Key decisions:
+
+- **Uses the AWS SDK `S3Client->deleteObject` directly** (`use Aws\S3\S3Client`), **not**
+  `_Cloud::deleteFileFromS3`. That `_underscore` helper shells out via
+  `shell_exec("aws s3 rm …")`, and passing a user-supplied, URL-derived bucket/key into a shell
+  is a command-injection risk (the security rule forbids `shell_exec` with user input). The SDK
+  call avoids the shell entirely.
+- **Client built with the bucket's own region** parsed from the URL, so a cross-region bucket
+  is deleted correctly — the same single-region constraint that breaks `_Cloud::getFileFromS3`
+  on cross-region reads applies to any S3 client that assumes the config-default region.
+- **Best-effort — never throws.** The whole call is wrapped in try/catch; the import already
+  committed its DB updates, so a delete failure (e.g. a missing `s3:DeleteObject` permission) is
+  logged and surfaced as `sourceDeleted: "delete failed: …"` rather than failing the run.
+- **Only on success**, and **skipped in `TEST_MODE`** (so the source is kept for re-runs) and
+  for non-S3 URLs / local paths (`sourceDeleted: "skipped — not an S3 URL"`).
+
 ## Client variations
 
 Compass-only. Some spreadsheet rows reference users that belong to a **different Compass tenant
@@ -112,6 +139,12 @@ reason, which is expected, not an error.
   [_Cloud S3 helpers](../../_underscore/features/cloud-s3-helpers.md).
 
 ## Change history
+- 2026-07-15 — On a successful URL-input run, `ProcessVipFile` now deletes the source S3 object
+  (new `deleteRemoteSourceIfS3()` / `parseS3Url()`) so a PII input file does not linger, and
+  returns a `sourceDeleted` field. Uses the AWS SDK `S3Client->deleteObject` directly (bucket's
+  own region from the URL), **not** `_Cloud::deleteFileFromS3`, whose `shell_exec("aws s3 rm …")`
+  would put URL-derived bucket/key into a shell (command-injection risk). Best-effort (never
+  throws), success-only, skipped in `TEST_MODE`. (bala)
 - 2026-07-15 — Adapted to Compass's new 12-column format (banner row above the header;
   `Support Tech First`/`Support Tech Last` removed, so `Support Tech Email` moved col N→L);
   added `findHeaderRowNumber()` scanning for `PERS. NO.` and switched to explicit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.344",
+  "version": "1.0.346",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",