toga-ai 1.0.793 → 1.0.794

package/knowledge/2.0/apps/toga2-commerce/INDEX.md

@@ -5,7 +5,7 @@
 | [TOGa Commerce (toga2-commerce / commerce2-react) Architecture](architecture.md) | `toga2-commerce` (npm package name **`commerce2-react`**, product name **TOGa Commerce**) is the customer-facing **B2B commerce storefront** of the 2.0 platform |
 | [Bundle item visibility & selectability (the three flags, and why they are enforced nowhere but the client)](features/bundle-item-visibility-and-selectability.md) | Which components of a kit a shopper can see and choose is decided **entirely in the browser**. |
 | [Cart Bundle Submission & the bundleUuid Identity Contract](features/cart-bundle-submission-and-identity.md) | How cart **bundles** (kits) are turned into `SalesOrderItems` when a cart is submitted or an existing order is edited, and the **identity-field contract** every |
-| [Cart Notification Emails — duplicate prevention](features/cart-notification-emails.md) | On the cart "Notifications" section a user can add CC email addresses to an order. |
+| [Cart Notification Emails — auto-add/remove lifecycle + duplicate prevention](features/cart-notification-emails.md) | On the cart "Notifications" section a user can add CC email addresses to an order. |
 | [Cart Order-Total & Shipping Computation](features/cart-order-total-computation.md) | The Cart summary section (subtotal / shipping / tax / total) is **data-driven** from `cartData`. |
 | [Cart Page — config-driven form architecture (current state + planned refactor)](features/cart-page-config-architecture.md) | The Cart page (`src/pages/Cart/`) is the most config-heavy page in `toga2-commerce`. |
 | [Catalog cache freshness — the 24h persisted query cache, and how to opt a query out of it](features/catalog-cache-freshness.md) | TOGa Commerce runs a **single `QueryClient` with a 24-hour default `staleTime`**, and persists it to **`localStorage["commerce"]`** through `PersistQueryClientP |

package/knowledge/2.0/apps/toga2-commerce/features/cart-notification-emails.md

@@ -1,16 +1,18 @@
 ---
-title: Cart Notification Emails — duplicate prevention
+title: Cart Notification Emails — auto-add/remove lifecycle + duplicate prevention
 framework: "2.0"
 repo: toga2-commerce
 project: TOGa Commerce
 client: shared
 type: feature
 status: active
-updated: 2026-07-27
+updated: 2026-09-10
 owners: ["bala", "tcox"]
 files:
   - src/pages/Cart/CartPage.tsx
   - src/pages/Cart/view/cartForm/CartForm.tsx
+  - src/pages/Cart/view/cartForm/EditCart.tsx
+  - src/pages/Cart/view/cartForm/EditOrder.tsx
   - src/stores/useEmailOptionsStore.ts
   - src/stores/useCartSalesQuoteZu.ts
   - src/pages/Cart/viewModel/FIELDS/*/*/*/CARTPAGE.ts
@@ -21,12 +23,19 @@ related:
 ---
 
 ## Summary
-On the cart "Notifications" section a user can add CC email addresses to an order. Adding the
-same address twice (often with different casing) used to slip through to the API and blow up on
-submit with a MySQL 1062 duplicate-key error on the `SalesOrderEmailAddresses.salesOrderId_emailAddress`
-unique index (whose collation `utf8mb4_0900_ai_ci` is case-insensitive). This feature blocks
-duplicates case-insensitively in the frontend and shows a sapphire info message instead of letting
-the error reach the user.
+On the cart "Notifications" section a user can add CC email addresses to an order. Two jobs live
+here:
+
+1. **Duplicate prevention.** Adding the same address twice (often with different casing) used to
+   slip through to the API and blow up on submit with a MySQL 1062 duplicate-key error on the
+   `SalesOrderEmailAddresses.salesOrderId_emailAddress` unique index (collation
+   `utf8mb4_0900_ai_ci` is case-insensitive). The frontend blocks duplicates case-insensitively and
+   shows a sapphire info message instead of letting the error reach the user.
+2. **Auto-add/remove lifecycle.** Picking an **order-for user** or a **Delegate Manager**
+   auto-adds their notification emails. **Changing the pick must remove the previous person's
+   auto-added emails.** Until 2026-09-10 it did not: the old person and their manager stayed in the
+   list, still checked, and still in the submit payload — so notifications went to the wrong
+   people unless the buyer noticed and unchecked them.
 
 ## Key files / entry points
 - `CartPage.tsx` — `handleAddEmail`: validates the email regex, then on success calls
@@ -35,10 +44,23 @@ the error reach the user.
 - `CartForm.tsx` — owns the duplicate UX. `handleAddEmailWithDuplicateCheck` wraps the passed-in
   `handleAddEmail`: it case-insensitively checks the existing `emails` list and, on a match, shows
   the message instead of adding. The **Add Email** button calls this wrapper.
-- `useEmailOptionsStore.ts` — `addEmailOption` de-dupes the checkbox list.
-- `useCartSalesQuoteZu.ts` — `addEmail` de-dupes the actual `salesOrderEmailAddresses` payload.
+- `CartPage.tsx` — also owns the **Delegate Manager** lifecycle:
+  `advancedSelectConfig.delegateManager.onSelect` / `.onClearInput`, the
+  `lastDelegateManagerEmailRef` (useRef), the `removeDelegateManagerEmail` guard, the
+  `watch("hasDelegateManager")` and `watch("delegateManager")` effects, and `handleClearUser`.
+- `EditCart.tsx` — cart-checkout mode. The order-for change effect (`onSuccess` of the user fetch)
+  owns add **and** remove of the order-for user's emails, plus the local `ensureEmailSelected`
+  helper and the `orderForUserChanged` flag.
+- `EditOrder.tsx` — edit-order mode. Still has the **original add-only** order-for pattern.
+- `useEmailOptionsStore.ts` — `addEmailOption` de-dupes the checkbox list; `removeEmailOption`
+  removes case-insensitively; `selectEmailOption(email)` marks an option checked (idempotent —
+  never toggles).
+- `useCartSalesQuoteZu.ts` — `addEmail` de-dupes and `removeEmail` removes from the actual
+  `salesOrderEmailAddresses` payload, both case-insensitively.
 
 ## How it works
+
+### Duplicate prevention
 1. **Before (manual add):** clicking Add Email runs `handleAddEmailWithDuplicateCheck` in
    `CartForm`. It compares `(e.email ?? "").trim().toLowerCase()` against the normalized input. On a
    match it sets `duplicateEmailMessage` and returns (does not add).
@@ -53,6 +75,41 @@ the error reach the user.
 5. A `useEffect` clears the message when the input, selected user (`orderForUser?.uuid`), or email
    list (`emails.length`) changes.
 
+### Order-for user — add AND remove (`EditCart.tsx`, cart-checkout mode only)
+Auto-added set per user: **their email**, `supervisorUser.email`, and
+`c_supportedByUserId.email`.
+
+1. On success of the order-for user fetch, read the **previous** user from
+   `useSelectedUserZu.getState().selectedUser` — the store, **not** the render closure (the closure
+   is stale inside the query callback).
+2. If the previous uuid differs from the new one (`orderForUserChanged`), remove that person's three
+   auto-added addresses from **both** `useEmailOptionsStore` and
+   `useCartSalesQuoteZu.salesOrder.salesOrderEmailAddresses`. **Never remove the logged-in user's
+   own address** even if it matches one of the three.
+3. Re-seed the new user's addresses through the local **`ensureEmailSelected(email)`** helper:
+   `addEmailOption` → `selectEmailOption` → `addEmail`. Idempotent, so re-running it is safe.
+4. The seeding block runs when `salesOrderEmailAddresses` is empty **or** when
+   `orderForUserChanged`. Before the fix it ran only on empty, so the second pick's emails were
+   added **un-checked** and never reached the payload.
+
+### Delegate Manager email lifecycle (`CartPage.tsx`, cart-checkout mode)
+"Associate" in the Compass UI = Delegate Manager. Its email is tracked by
+**`lastDelegateManagerEmailRef`** (a `useRef`), because the form value cannot be used (see
+Gotchas). The email is parsed out of the option label, which has the shape
+`"First Last (email)"`.
+
+| Action | What happens |
+|---|---|
+| Pick a manager | `onSelect` removes the *previous* ref email if different, adds the new one checked, sets the ref |
+| Click the field's **X** | `onClearInput` removes the ref email and clears the ref |
+| Un-check "has delegate manager" | the `watch("hasDelegateManager")` effect removes the ref email and empties the field |
+| Clear the order-for user | `handleClearUser` also un-checks the box, empties the field, and clears the ref |
+| Restore a saved cart | the `watch("delegateManager")` effect seeds the ref; a restored name has no `"(email)"`, so it falls back to `salesOrder.approvalUser.email` |
+
+**`removeDelegateManagerEmail` never removes an address that is also** the order-for user's, their
+supervisor's, their support tech's, or the logged-in user's — those are owned by the order-for
+lifecycle above.
+
 ## Data model
 Frontend only. The payload list maps to the `SalesOrderEmailAddresses` table (api2/backend), which
 has a case-insensitive unique index on `(salesOrderId, emailAddress)`.
@@ -67,19 +124,57 @@ the message resolves to `undefined` and renders blank.
 - The real source of the 1062 was `useCartSalesQuoteZu.addEmail` comparing with `===`
   (case-sensitive). Both stores must compare case-insensitively; fixing only the UI list is not
   enough because `addEmail` builds the payload.
+- **Removes must be case-insensitive too, not just adds.** Both stores' *adds* were already
+  case-insensitive while their *removes* used exact match, so a hand-typed `Bob@X.com` survived a
+  remove of `bob@x.com` and shipped in the payload. `removeEmailOption` and `removeEmail` are now
+  case-insensitive.
+- **`handleEmailChange` TOGGLES — never use it to seed.** Re-running it on an already-checked
+  address **un-checks** it. Use the idempotent `ensureEmailSelected` /
+  `selectEmailOption` path for any auto-seeding.
+- **`CartFormSection` overwrites the form value BEFORE your handler runs.** It calls
+  `field.onChange(value)` and *then* `config.onSelect(value, valueKey)` (same for
+  `field.onChange(null)` before `config.onClearInput`). So
+  `formMethods.getValues("delegateManager")` inside those handlers already holds the **new** value
+  — you **cannot** read the previous pick from the form. Keep the previous value in a `useRef`.
+- **Read the previous order-for user from the store, not the closure.** Inside the user-fetch
+  `onSuccess` the render closure's `selectedUser` is stale; use
+  `useSelectedUserZu.getState().selectedUser`.
+- **`delegateManager` defaults to a truthy object** (`{uuid:"",name:""}`) now that it is a typed
+  form field, so `if (formValues.delegateManager)` is always true. Check
+  `formValues.delegateManager?.uuid` instead (3 call sites: `EditCart.tsx` ×2, `EditOrder.tsx` ×1).
+- **`EditOrder.tsx` (edit-order mode) still has the add-only order-for pattern** — the same
+  wrong-recipient bug very likely exists there. Left alone deliberately: edit-order has different
+  manager rules (`assignedTo`). Fix it as its own task.
 - Normalize with `(x ?? "").trim().toLowerCase()`, not `x?.trim().toLowerCase()` — both are
   nullish-safe (optional chaining short-circuits the whole chain, it does not throw), but `(x ?? "")`
   guarantees a string and avoids an `undefined === undefined` match edge.
 - Adding the label to only some `CARTPAGE.ts` files leaves other client/role/language users with a
   blank message.
 - Do not use a toaster or `setError` (red) for this — product wants the sapphire info style.
-- **Now pinned by e2e.** `cypress/e2e/cartPage/cartV2.cy.ts` covers both the auto-population
-  (order-for user + supervisor emails, protected rows unremovable) and the case-insensitive
-  duplicate block surfacing the *"This email has already been added"* banner. These are exactly
-  the parity behaviors the config-cart refactor spike silently lost, so keep the spec green when
-  touching this flow (see [cypress-testing](../workflows/cypress-testing.md)).
+- **e2e coverage is branch-dependent — check before you rely on it.** On `_production`,
+  `cypress/e2e/cartPage/cartV2.cy.ts` covers both the auto-population (order-for user + supervisor
+  emails, protected rows unremovable) and the case-insensitive duplicate block surfacing the
+  *"This email has already been added"* banner — the exact parity behaviors the config-cart
+  refactor spike silently lost, so keep it green (see
+  [cypress-testing](../workflows/cypress-testing.md)). But on `#sprint86` that file **does not
+  exist** and every spec in `cypress/e2e/cartPage/cart.cy.ts` is **commented out**, so there is no
+  net for this flow there. Verify manually on such a branch.
+- **ESLint cannot run in this repo checkout** (pre-existing): `.eslintrc.cjs` references
+  `eslint-plugin-react-compiler`, which is not installed. Type-check with
+  `npx tsc --noEmit -p tsconfig.app.json` instead.
 
 ## Change history
+- 2026-09-10 — FIXED: changing the order-for user or the Delegate Manager left the previous
+  person's auto-added emails checked and in the submit payload, so notifications went to the wrong
+  people (reported by a Compass USA user on `compass.togacommerce.com`; fix is client-neutral).
+  Order-for path (`EditCart.tsx`) now removes the prior user's three auto-added addresses and
+  re-seeds via the idempotent `ensureEmailSelected` (replacing the toggling `handleEmailChange`),
+  and seeds on `orderForUserChanged` as well as on empty. Delegate Manager path (`CartPage.tsx`)
+  gained `lastDelegateManagerEmailRef` + `removeDelegateManagerEmail` covering pick / re-pick / X /
+  un-check / clear-user / restore. Stores: added `selectEmailOption`, made `removeEmailOption` and
+  `removeEmail` case-insensitive. `hasDelegateManager` / `delegateManager` are now typed form fields
+  with defaults, so delegate checks moved to `?.uuid`. Edit-order mode not fixed (different manager
+  rules). (tcox)
 - 2026-07-27 — No behavior change. This duplicate-prevention UX (email auto-population +
   case-insensitive duplicate banner) is now covered by cart e2e slice 1 (`cartV2.cy.ts`); linked
   the [cypress-testing](../workflows/cypress-testing.md) workflow doc. (tcox)

package/knowledge/2.0/apps/toga2-commerce/features/cart-page-config-architecture.md

@@ -6,7 +6,7 @@ project: TOGa Commerce
 client: shared
 type: feature
 status: active
-updated: 2026-07-27
+updated: 2026-09-10
 owners: ["apeterson", "tcox"]
 files:
   - src/pages/Cart/CartPage.tsx
@@ -85,6 +85,17 @@ based on `inEditMode`. `CartFormRenderer.tsx` exists only on the `implement-conf
   Two mode-change `reset()` effects (~lines 267, 282) re-seed from that same union shape. This is
   wrong for per-client field sets: it registers fields a client never renders and bakes one client's
   default into all of them, and risks RHF controlled/uncontrolled warnings.
+  As of 2026-09-10 `hasDelegateManager` (`false`) and `delegateManager` (`{uuid:"",name:""}`) are
+  part of that union and are typed in `CartFormFieldNames` — previously they were undefined and
+  untyped. Because the default object is **truthy**, any check on the field must test
+  `delegateManager?.uuid`, not the object.
+- **`CartFormSection` runs `field.onChange` BEFORE the config handler.** For an `advancedSelect` it
+  calls `field.onChange(value)` then `config?.onSelect(value, valueKey)` (and
+  `field.onChange(null)` then `config?.onClearInput(valueKey)`). So a config handler can never read
+  the field's **previous** value from the form — it is already overwritten. Handlers that need the
+  prior pick must keep it in a `useRef` (see
+  [cart-notification-emails](cart-notification-emails.md) for the Delegate Manager case). The
+  planned `hydrateCartConfig` (Phase 5) must preserve this ordering contract or document a change.
 - **Client differences are hardcoded, not config.** Examples observed: COMPASS renders
   `DuplicateKitGuardrail`, QUAD does not; COMPASS seeds the cart form (cost center / manager / emails)
   from the order-for user, QUAD does not. These are per-client conditionals in cart code today.
@@ -285,6 +296,11 @@ extension** of toga2.5's philosophy, not a literal copy.
    edit-order mode?
 
 ## Change history
+- 2026-09-10 — Two gotchas added from cart-notification work: `hasDelegateManager` /
+  `delegateManager` are now typed form fields in the union `defaultValues` (truthy default → check
+  `?.uuid`), and documented that `CartFormSection` calls `field.onChange` **before** the
+  `advancedSelect` config's `onSelect`/`onClearInput`, so a handler cannot read the field's previous
+  value. No refactor progress. (tcox)
 - 2026-07-27 — Phase 0 oracle is now partly real: cart e2e slice 1 (`cartV2.cy.ts`, 12 tests)
   landed and pins the exact parity behaviors the prior spike lost (notification-email
   auto-population, duplicate-email surfacing) plus render/gating/clear/empty flows. Corrected the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.793",
+  "version": "1.0.794",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",