toga-ai 1.0.873 → 1.0.875

package/knowledge/1.0/apps/test/INDEX.md

@@ -3,7 +3,7 @@
 | Doc | Summary |
 |-----|---------|
 | [Test (test) Architecture](architecture.md) | Repo of ad-hoc developer scripts (not a deployed app); `team/` is the shared, documented surface — open to find/run a one-off script or add one. |
-| [2.0 Deployment — Per-Client SQL Generator](features/2-0-deployment-client-sql.md) | Standalone script that fans one SQL change-set across all 2.0 client DBs (prints to stdout, executes nothing); open when a schema/data change must run identical |
+| [2.0 Deployment — Per-Client SQL Generator (superseded)](features/2-0-deployment-client-sql.md) | SUPERSEDED by the Tools Multi-Client SQL tool — old offline script that fans one SQL change-set across a static list of 2.0 client DBs; open only when working o |
 | [Active Directory Authentication Test](features/active-directory-auth-test.md) | Interactive CLI REPL to test Active Directory authentication via `App_ActiveDirectory::isAuthenticated()`; open to verify AD login from a terminal. |
 | [Compass retrofix2 — Retroactive Data-Fix SQL Generator](features/compass-retrofix2-sql-generator.md) | Standalone 1.0 script emitting review-first SQL to retroactively repair historical Compass USA (`Client_Compass`, 2.0) order data broken by 50+ past bugs; open |
 | [Create Elastic Beanstalk Environment (script)](features/create-elastic-beanstalk.md) | Standalone constants-driven generator that PRINTS a ready-to-paste AWS CloudShell `create-environment` command for a new EB env in an existing app (never calls |

package/knowledge/1.0/apps/test/architecture.md

@@ -61,7 +61,7 @@ Run directly from a local dev environment (CLI or browser, depending on the scri
 | Script | Runs on | Targets | Doc |
 |---|---|---|---|
 | `aws/create_elastic_beanstalk.php` | standalone | AWS (EB) | [create-elastic-beanstalk](./features/create-elastic-beanstalk.md) |
-| `2.0 deployment/generate_client_sql.php` | standalone | 2.0 client DBs | [2-0-deployment-client-sql](./features/2-0-deployment-client-sql.md) |
+| `2.0 deployment/generate_client_sql.php` | standalone | 2.0 client DBs (superseded by Tools Multi-Client SQL) | [2-0-deployment-client-sql](./features/2-0-deployment-client-sql.md) |
 | `forecast-netsuite/discrepancy_analysis.php` | 1.0 | Forecast DB vs NetSuite | [forecast-netsuite-discrepancy-analysis](./features/forecast-netsuite-discrepancy-analysis.md) |
 | `tableViewBuilder/TableViewGenerator.php` | standalone | 2.0 TableViews | [tableview-builder](./features/tableview-builder.md) |
 | `active_directory_authentication_test.php` | 1.0 | Active Directory | [active-directory-auth-test](./features/active-directory-auth-test.md) |

package/knowledge/1.0/apps/test/features/2-0-deployment-client-sql.md

@@ -1,41 +1,45 @@
 ---
-title: 2.0 Deployment — Per-Client SQL Generator
+title: 2.0 Deployment — Per-Client SQL Generator (superseded)
 framework: "1.0"
 repo: test
 project: Test
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-09-22
 owners: [jcardinal]
 files:
   - test/team/2.0 deployment/generate_client_sql.php
+  - test/team/2.0 deployment/INPUT.sql
   - test/team/2.0 deployment/Clients_Db.txt
-  - test/team/2.0 deployment/Client.sql
+  - test/team/2.0 deployment/Logs_Clients_Db.txt
+  - test/team/2.0 deployment/NetSuite_Clients_Db.txt
 related:
   - ../architecture.md
+  - ../../tools/features/multi-client-sql.md
 ---
 
-Standalone script that fans one SQL change-set across all 2.0 client DBs (prints to stdout, executes nothing); open when a schema/data change must run identically per 2.0 client.
+SUPERSEDED by the Tools Multi-Client SQL tool — old offline script that fans one SQL change-set across a static list of 2.0 client DBs; open only when working offline.
 
 ## Summary
 
-`team/2.0 deployment/generate_client_sql.php` fans a single SQL change-set out across **all 2.0 client databases**. **Standalone** (no `App_` framework) — pure file processing. Use it when a schema/data change must run identically against every 2.0 client DB and you want one script to paste into a SQL client.
+Use [Tools Multi-Client SQL](../../tools/features/multi-client-sql.md) instead (live DB lists, module lists). This standalone script (no `App_` framework) stays as the offline fallback. Prints to stdout; executes nothing.
 
 ## How it works
 
-1. Reads `Clients_Db.txt` — newline-separated list of client database names (blank lines ignored).
-2. Reads `Client.sql` — the SQL template (e.g. `CREATE TABLE` / `ALTER` statements) to apply per client.
-3. For each client, emits a banner comment, `` USE `<client>`; ``, then the template SQL.
-4. Prints the combined SQL to **stdout** (with a generated-on header and client count). Does **not** execute anything — the developer reviews the output and runs it manually.
-
-Edit `Client.sql` to hold the change, keep `Clients_Db.txt` current, then run `php generate_client_sql.php` (or via browser) and run the output against the target cluster.
+1. Reads `INPUT.sql` — the SQL to apply per DB.
+2. Reads one static list file; switch lists by commenting between `Clients_Db.txt` / `Logs_Clients_Db.txt` / `NetSuite_Clients_Db.txt` in the script.
+3. Per DB: banner comment, `` USE `<db>`; ``, then the SQL. Prints the combined script with a header and DB count.
 
 ## Gotchas
 
-- Output is only as correct as `Clients_Db.txt` — a stale/missing client is silently skipped. Refresh the list before a deployment.
-- The script wraps each client block in `` USE `db`; `` — make sure `Client.sql` does **not** also switch databases or it will fight the `USE`.
+- Lists are static — a stale/missing DB is silently skipped. The Tools tool reads them live.
+- Do not put your own `USE` in `INPUT.sql`; it fights the generated `USE`.
 
 ## Related
 
 - [Test architecture](../architecture.md)
+
+## Change history
+
+- 2026-09-22 — Marked superseded by Tools Multi-Client SQL; corrected input file (`INPUT.sql`) and list-switching. (jcardinal)

package/knowledge/1.0/apps/tools/INDEX.md

@@ -12,6 +12,7 @@
 | [/errors Curation Console (Tools → shared Core Logs DB)](features/errors-curation-console.md) | Internal-only 1.0 Tools triage/curation screen (`/errors`) for the 2.0 Issue/Event error pipeline, reading the shared Core Logs DB via `db_toga2logs`; curates, |
 | [GitHub Audit (monthly code-churn report)](features/github-audit.md) | Internal monthly code-churn report at `/developers/github-audit` (lines added/removed across every `agilantsolutions` repo for one month); open for the two-phas |
 | [Legacy Email Notifier (tools /email-migration/notify)](features/legacy-email-notifier.md) | SSO-gated admin tool at `/email-migration/notify` that emails employees a digest of mail still hitting their legacy domains (asks senders to switch to `@togatec |
+| [Tools — Multi-Client SQL (per-client-DB SQL fan-out)](features/multi-client-sql.md) | Tools `/developers/multi-client-sql` — fans one SQL change-set across a live list of 2.0 client/log/archive/module DBs into a copy/download script (never execut |
 | [Tools MVC — Routing, CSRF & App_Database Access Patterns](features/mvc-data-access-patterns.md) | Load-bearing 1.0 (App_) conventions for adding a Tools page — routing (get/post), Origin-based CSRF, and App_Database access — plus the footguns (global transac |
 | [OneUptime Monitor Status Panel & Outage Alerting (tools /developer)](features/oneuptime-monitor-status-panel.md) | Live operational monitor column on the `/developer` wall-display dashboard (state-adaptive: calm green when healthy, loud amber/red when broken) fed by a same-o |
 | [Tools Persona-Gated Navigation (App_Nav)](features/persona-gated-navigation.md) | Tools two-level persona-gated navigation (`App_Nav`), a hard-coded `definition()` array driving left rail + dashboard and the single source of route→persona gat |

package/knowledge/1.0/apps/tools/architecture.md

@@ -31,6 +31,7 @@ related:
   - ./features/saml-sso-auth.md
   - ./features/persona-gated-navigation.md
   - ./features/developer-tools.md
+  - ./features/multi-client-sql.md
   - ./features/oneuptime-monitor-status-panel.md
   - ./features/github-audit.md
   - ../library/architecture.md
@@ -69,6 +70,7 @@ Tools is no longer only a click-through internal-tool shell: `/developer` (renam
 
 - **No cross-origin browser dependency any more — it is server-proxied.** Every fetch in this app is now same-origin and authenticated by the SSO session cookie, including the monitor column: the browser GETs `/v2/monitors/status/` (`App_Clickup_Monitors`), and the server does the cross-origin POST to the OneUptime **public** status-page API, reduces ~250 KB → ~1 KB, caches ~5s (APCu) and returns the api2 envelope. This removed the app's last cross-origin browser dependency and the CORS / edge-cache / autoplay coupling it carried; the status-page ID moved from a hardcoded HTML constant into config (`[oneuptime] status_page_id`, default `DEFAULT_STATUS_PAGE_ID`).
 - **Iframed pages carry their own permission policy.** `mvc/developer/get.php` embeds its asset in an iframe, and browser autoplay policy is scoped **per-iframe** — an iframed page that must play audio needs `allow="… autoplay"` on the frame or it is blocked silently. Unattended displays additionally never receive the user gesture browsers require before audio plays.
+- **External reads:** `/developers/multi-client-sql` reads Core via `[database_toga2core]` and GitHub (dbchanges2 `_main`) via the `GITHUB_TOKEN` env var only (EB environment property in prod) — see `features/multi-client-sql.md`.
 - **`crypto.randomUUID()` is undefined on a non-secure origin.** Browser code served over plain HTTP by hostname/LAN IP (not `localhost`) has no secure context, so `crypto.randomUUID()` and `crypto.subtle` throw. The dashboard now guards its per-request `transactionId` behind a helper (randomUUID → `getRandomValues` v4 → non-crypto id); any browser code in this app that must run over a non-secure origin must do the same rather than call `crypto.randomUUID` unguarded.
 
 ## Adding a tool

package/knowledge/1.0/apps/tools/features/multi-client-sql.md

@@ -0,0 +1,53 @@
+---
+title: Tools — Multi-Client SQL (per-client-DB SQL fan-out)
+framework: "1.0"
+repo: tools
+project: Tools
+client: shared
+type: feature
+status: active
+updated: 2026-09-22
+owners: [jcardinal]
+files:
+  - tools/_/app/developers/multiclientsql.php
+  - tools/mvc/developers/multi-client-sql/get.php
+  - tools/mvc/developers/multi-client-sql/post.php
+  - tools/_/app/nav.php
+related:
+  - ../architecture.md
+  - ./developer-tools.md
+  - ./persona-gated-navigation.md
+  - ../../test/features/2-0-deployment-client-sql.md
+---
+
+Tools `/developers/multi-client-sql` — fans one SQL change-set across a live list of 2.0 client/log/archive/module DBs into a copy/download script (never executes); open to use/extend it or for the `Databases` reserved-word gotcha.
+
+## Summary
+
+Replaces `test/team/2.0 deployment/generate_client_sql.php`. Development Team persona **only** (narrowed in `nav.php` + hardcoded `requireAuth` in `get.php` and `post.php`). Class `App_Developers_MultiClientSql`. Output is reviewed and run by the developer — the tool never executes SQL.
+
+## How it works
+
+1. Paste SQL, pick a list, untick/filter DBs. Generate builds the script **in the browser**: header + per-DB banner + `` USE `db`; `` + SQL. Copy / Download `.sql`. Warns if the SQL has its own `USE`.
+2. `post.php` action `lists` only returns JSON lists.
+3. Lists are dynamic — no tools commit when clients change:
+   - **All Clients / Client Logs / Client Archives** — live read of `Core.Clients` joined to `Core.Databases` on `clientDatabaseId` / `logDatabaseId` / `archiveDatabaseId`, via config `[database_toga2core]`. Every row (no active flag).
+   - **Module lists** — one per folder under `dbchanges2/_modules` (branch `_main`). A client is in the list when `Client_<Name>/_modules.txt` names the module (case-insensitive); DB name = client folder name. GitHub GraphQL, 2 calls (folder list, then all `_modules.txt` as aliased blobs). APCu cache 5 min + 7-day "last good" fallback shown with a warning. Warns when a module client is not in `Core.Clients`. One retry on a dropped connection; log names the failed step (`folder list` / `_modules.txt read`).
+4. GitHub token: **only** the `GITHUB_TOKEN` env var (read via `getenv` + `$_SERVER` + `$_ENV`, because php-fpm `clear_env`). No config fallback (developer decision). Own curl, not `App_Design_Github`. Needs read on `agilantsolutions/dbchanges2`; set as an EB environment property in prod.
+5. Every DB/folder name is checked against `^[A-Za-z0-9_]{1,64}$` before it goes into GraphQL or a `USE` line. Page writes via `textContent`/`.value` only.
+
+## Gotchas
+
+- `Databases` is a MySQL reserved word: `FROM Databases` / `JOIN Databases AS X` fails with error 1064. Backtick it (`` `Databases` ``) or qualify it (`Core.Databases`).
+- dbchanges2 has **no** `_production` branch; its deployed branch is `_main`.
+- A missing `[database_...]` config section is not catchable in 1.0 — `App_Error` renders its HTML error page and exits. The tool pre-checks `config['database_toga2core']` and throws a user-safe message. Local `config.dev-*.ini` files may lack that section.
+- CSS: a class rule with `display:flex` overrides the HTML `hidden` attribute — add `.scope [hidden]{display:none !important}`.
+
+## Related
+
+- [Developers folder tools](./developer-tools.md)
+- [Old offline script (test)](../../test/features/2-0-deployment-client-sql.md)
+
+## Change history
+
+- 2026-09-22 — Created; shipped and verified in production. (jcardinal)

package/knowledge/INDEX.md

@@ -15,7 +15,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **test** (Test) — 16 doc(s) → [1.0/apps/test/INDEX.md](1.0/apps/test/INDEX.md)
 - **toga** (TOGa) — 3 doc(s) → [1.0/apps/toga/INDEX.md](1.0/apps/toga/INDEX.md)
 - **store** (Store) — 3 doc(s) → [1.0/apps/store/INDEX.md](1.0/apps/store/INDEX.md)
-- **tools** (Tools) — 18 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
+- **tools** (Tools) — 19 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
 
 ## 2.0 framework
 

package/knowledge/sessions/2026-09-23-commerce-sso-and-cache-apeterson.md

@@ -0,0 +1,212 @@
+---
+type: session
+slug: commerce-sso-and-cache
+title: Commerce persisted-cache, session-gating and SSO sign-in screen
+author: apeterson
+repos: [toga2-commerce]
+framework: "2.0"
+client: shared
+status: active
+created: 2026-09-23
+updated: 2026-09-23
+---
+
+# Session: commerce-sso-and-cache
+**Date:** 2026-09-23
+**Project/Repo:** toga2-commerce (2.0), branch `TRUE-81991`
+**Task:** Implement the 2026-09-03 cache-diagnosis plan in toga2-commerce, then build an SSO sign-in screen for SSO tenants and consolidate how the app decides someone is signed in.
+
+---
+
+## What WORKED
+
+**The 2026-09-03 plan, implemented and verified.**
+- App default `staleTime` 24h → `0` plus `refetchOnWindowFocus: false` (`src/App.tsx`); heavy hooks
+  got `staleTime: 30_000` + `gcTime: 1h` (`src/pages/BundleView/hooks/useBundleQueryData.ts:26,42`,
+  `src/pages/Home/viewModel/useHomeViewModel.ts:150,175,201`). Evidence: `npx tsc --noEmit -p
+  tsconfig.app.json` exit 0 and `npx vite build` succeeded after each change.
+- `src/lib/queryCacheRestoration.ts` (new) — every cache clear now waits for restoration, cancels
+  in-flight queries, then clears; capped at 1.5s; an epoch counter makes a superseded clear no-op.
+  Persister set to `throttleTime: 0` (the 1000ms default let a queued write land AFTER the clear).
+- `src/lib/authStorage.ts` (new) — one `AUTH_STORAGE_KEYS` list used by BOTH logout paths, and by
+  `resetClientState()` which now runs on login as well as logout.
+- Build-id `buster` via `__BUILD_ID__` (`vite.config.ts` `define`, declared in `src/vite-env.d.ts`).
+  Verified in the bundle: 0 unresolved `__BUILD_ID__` occurrences, the `"dev"` literal present once.
+
+**Real bugs found and fixed (each confirmed in source before changing anything).**
+- `AUTH_STORAGE_KEYS` contained `"zu-cart-store"`, which is not a real key — the cart persists under
+  `"zu-cart"` (`src/stores/useCartStoreZu.ts:956`). The previous user's cart survived a 401 logout.
+- Clearing a persisted key is not enough: the zustand store must ALSO be reset in memory or the next
+  `set()` re-persists the old user's state. Added a `clearSettingsModal` action (that store had none)
+  and wired `useBundleBuilderZu` / `useUserStore` resets into `resetClientState()`.
+- `fetchPublicToken()` wrote the ANONYMOUS token to `localStorage` under `"accessToken"` — the same
+  key a real login writes — so every "is there an accessToken?" check was true for a logged-out
+  visitor. Root-caused: the public token is now a module variable in `src/api/axiosInstance.ts`,
+  never stored, and its refresh token is not stored at all.
+- The 401 handler gated logout on `"zu-user"`, a zustand store that clears itself independently. With
+  that key gone but the session live, logout was skipped and the app sat looping on 401.
+
+**Security fixes (all found by the `cso` reviewer, all verified in source).**
+- Open redirect on the post-auth return path (`src/utils/postAuthRedirect.ts`). Visiting
+  `https://<tenant>//evil.com` gives `pathname === "//evil.com"`, which the browser treats as
+  protocol-relative — so after a SUCCESSFUL login the user went to another origin with a live
+  session. Now only a single-slash same-origin path is stored or restored.
+- `window.location.href = ssoUrl` with no scheme check. Now must be `https:`, checked where fetched
+  AND at the click; a bad value means "not SSO" so the tenant falls back to the credential form.
+- Token refresh could run under the wrong identity. Made single-flight, then identity-scoped with an
+  epoch in `src/lib/session.ts` bumped on sign-in, sign-out and view-as, plus a second guard
+  comparing the stored refresh token.
+- View-as swap stored `response?.data.tokens.access` with only `response` optional-chained — a
+  malformed reply wrote the literal string `"undefined"` (truthy), so the app sent `Bearer undefined`
+  on every call. Now both tokens are validated and the session is left untouched on a bad reply.
+
+**SSO sign-in screen built.** Detection already existed inside `useAuthenticationFlow` as a mutation
+that jumped straight to the IdP — the user never saw a page. Extracted to `src/hooks/useClientSsoUrl.ts`
+(React Query, so the auth flow and the login page share one cached answer). `/login` now renders
+`src/pages/Login/view/SsoSignIn.tsx` for SSO tenants, else the credential form. Design came from the
+Claude Design project "TOGa Supply - SSO Sign In", rebuilt with commerce's own logo, theme tokens and
+per-tenant FIELDS copy. Every logout path already lands on `/login`, so SSO users get the SSO screen
+on sign-out with no extra code — verified by reading `src/routes.tsx`, NOT by running it.
+
+**First unit-test harness in the repo.** vitest + jsdom, `npm test` / `npm test:watch`,
+`vitest.config.ts`. 19 tests pass. Each was proven to fail on the pre-fix code first: reverting
+`hasSession` turned **5 red**; removing the single-flight and identity guards turned **3 red**
+(including both race tests). Race tests use a held-open promise, not real timing, so no flake.
+
+---
+
+## What did NOT work — DO NOT RETRY THESE
+
+- **Falling back to the anonymous token when a session exists but `accessToken` is missing.** I wrote
+  this thinking it fixed "a 401 with no explanation". It is backwards — the 401 IS the point. The
+  `cso` agent confirmed against api2 (`Component/Api/V2/V2.php:578-598`): `/auth/public` mints a
+  FULLY VALID JWT carrying `KEY_PUBLIC_ROLE`, and its client comes from the **Domains row, not the
+  user**. So the request would NOT 401 — it would return 200 with public-scoped rows (or `EZ-1`),
+  the refresh/logout path would never fire, and the tab would stay silently anonymous under a real
+  session. On a domain whose `clientId` differs from the signed-in user's, a write could land in the
+  wrong tenant's database. **Reverted.** A live session with no `accessToken` must send NO
+  `Authorization` header so it 401s.
+- **`hasSession()` as `Boolean(localStorage.getItem("user"))`.** Too loose — `"{}"`, `"null"` or a
+  half-written value booted the app into the signed-in state with no identity behind it. It must
+  parse and require a `uuid`. (This is one of the 5 tests that goes red on the loose version.)
+- **Anchoring the SSO footer inside the form column.** It only worked by accident of the nearest
+  positioned ancestor, and escaped the `xl:w-96` width. The footer belongs to the left PANEL — it is
+  now `SsoSignInFooter`, rendered as a sibling of the form column.
+- **Prefixing every per-session localStorage key so logout can clear by prefix.** My idea; the `cto`
+  agent rejected it with a concrete reason: renaming every zustand `persist` name silently orphans
+  every existing user's persisted state on deploy, and touches every `localStorage.getItem("zu-user")`
+  call site scattered through `src/api/`. Cheaper answer, which supply already uses: plain
+  `localStorage.clear()` on logout, since every key commerce writes is session state.
+- **`grep --include=*.ts` under zsh** fails with "no matches found" when the glob is unquoted —
+  quote it (`--include="*.ts"`). Cost two wasted tool calls.
+- **Python string-replace edits against this repo assuming space indentation.** Source is TABS, and
+  one line in `axiosInstance.ts` had a trailing-space blank line. Two `AssertionError`s before I
+  matched the real bytes. Check with `sed 's/\t/<TAB>/g'` first.
+
+---
+
+## Not tried yet (candidates for next session)
+
+1. **Compass Canada production SSO** — `https://compasscanada.togacommerce.com/home` sends users to
+   the credential form though the client uses SSO. Diagnostic SQL was handed over, NOT run. Candidate
+   causes in order: no `Domains` row matching the exact `https://compasscanada.togacommerce.com`
+   string; no `ClientAuthentications` row for that `clientId`+`environmentId`; `type` not the literal
+   `'SSO'`; or the PUBLIC role lacking `AclFieldPermissions` to read `ClientAuthentications.type`
+   (the call runs pre-login on the public token, so a null field fails silently). Note the production
+   build is plain `vite build` with NO `--mode`, so `MODE` is `production` and the query asks for
+   `Environments.slug LIKE 'PRODUCTION'`.
+2. **blox `fetchPublicToken` defect** (`toga-blox-npm/src/api/auth.ts:48-60`) — same bug commerce just
+   fixed locally; supply works around it in three places. Needs its own ticket; do NOT bundle it.
+3. **CTO-ranked, not done:** replace the `window.history.pushState`/`replaceState` monkey-patch in
+   `AuthContext.tsx` with supply's poll-on-interval + focus (Sentry patches history too, so the
+   cleanup can clobber it); make `login()` fail loudly instead of swallowing errors after tokens are
+   already written.
+4. **Narrow the core-parameters forced logout** to `META_LAST_REFRESH_DATETIME` only (it currently
+   compares the WHOLE `/core-parameters` blob, so any parameter edit logs out every user) and add
+   supply's notice toast.
+5. **Constrain the SSO URL's HOST**, not just its scheme, to the tenant's configured IdP domain. No
+   allowlist source exists today.
+6. **Unanswered since 2026-09-03:** do commerce bundle/item payloads carry prices or stock counts? If
+   they do, those queries need their spinner on `isFetching`, not `isLoading`.
+7. Point `performLogout` and the core-parameters logout at `/login` directly instead of `/`, to remove
+   the brief blank screen while `AuthRedirect` renders nothing.
+
+---
+
+## Current file state
+
+All work is on branch `TRUE-81991` in `toga2-commerce`, as three commits.
+`e546db3d` is pushed; **`93616f20 "Save"` and `fd92de42 "Save"` are LOCAL ONLY** and were made by the
+developer, not by Claude. Working tree otherwise clean (only `.env.development` modified, unrelated).
+
+| File | Status | Notes |
+|------|--------|-------|
+| `src/lib/session.ts` | new | `hasSession()` (parses `user`, requires a uuid, storage read inside the try) + the identity epoch |
+| `src/lib/session.test.ts` | new | 11 tests; 5 go red if `hasSession` is loosened |
+| `src/lib/authStorage.ts` | new | `AUTH_STORAGE_KEYS` + `clearAuthStorage()`, shared by both logout paths |
+| `src/lib/queryCacheRestoration.ts` | new | restoration gate, `clearPersistedQueryCache()`, epoch guard, 1.5s cap |
+| `src/hooks/useClientSsoUrl.ts` | new | `/domains` + `singleSignOnServiceUrl` lookup, `isSafeSsoUrl` https check |
+| `src/pages/Login/view/SsoSignIn.tsx` | new | SSO panel + `SsoSignInFooter` (footer is a sibling of the form column) |
+| `src/api/refreshAuthTokens.test.ts` | new | 8 tests; 3 go red without the single-flight + identity guards |
+| `vitest.config.ts` | new | jsdom, `src/**/*.test.ts` |
+| `src/api/axiosInstance.ts` | modified | in-memory public token, single-flight + identity-scoped refresh, `hasSession()` gates, `clearPublicToken()` |
+| `src/contexts/AuthContext.tsx` | modified | `resetClientState()` on login AND logout, async `logout()`, storage listener uses `hasSession()` only |
+| `src/hooks/useAuthenticationFlow.ts` | modified | SSO lookup removed; navigates to `/login`; gates on `hasSession()` |
+| `src/pages/Login/LoginPage.tsx` | modified | branches to the SSO panel; left panel is now `relative` |
+| `src/pages/Cart/api/CartApi.ts` | modified | view-as token validation + epoch bump + `clearPublicToken()` |
+| `src/utils/postAuthRedirect.ts` | modified | `isSafeDestination()` blocks the protocol-relative open redirect |
+| `src/stores/useSettingsModalStore.ts` | modified | added `clearSettingsModal` |
+| `src/App.tsx` | modified | `staleTime: 0`, `refetchOnWindowFocus: false`, `buster`, `throttleTime: 0` |
+| `vite.config.ts` / `src/vite-env.d.ts` | modified | `__BUILD_ID__` define + declaration |
+| `src/pages/Login/viewModel/FIELDS/LOGINDUMMYFIELDS.json` | modified | `SSOSECTIONFIELDS` (button, loading, copyright) |
+| `package.json` / `package-lock.json` | modified | vitest + jsdom devDeps, `test` scripts. Blox pin untouched at `1.1.1-production.139` |
+
+---
+
+## Decisions made
+
+- **`gcTime`, not `staleTime`, is the speed knob.** React Query paints cached data instantly whatever
+  `staleTime` says, and commerce gates every spinner on `isLoading` (false when cached data exists) —
+  so lowering `staleTime` costs no spinner. Rejected: keeping the 24h `staleTime` "for speed".
+- **One `hasSession()` predicate.** Four sites decided this off three different keys with three
+  different predicates, and the disagreements WERE the bugs. Rejected (CTO advice): collapsing `user`
+  and `zu-user` into one store — ~15 files, no user-visible gain. Unify the predicate, not the storage.
+- **`hasSession()` is a routing/UI signal only, never an authorization check.** The value is
+  user-writable; api2 enforces every permission server-side. Noted in the file so it does not drift.
+- **Keep tokens in `localStorage`.** api2 is Bearer-only with no cookie session; switching means
+  backend work plus CSRF protection that does not exist. Matches `2.0/standards/frontend.md` §12.
+- **SSO tenants land on `/login` and click through, rather than auto-redirecting.** Developer's call.
+  `/login` IS the SSO page — the same URL decides which screen to show.
+- **Commerce keeps its own FIELDS copy and theme**, not the Supply wording/art from the design.
+  Developer's call. Deviations from the mockup were listed rather than silently absorbed.
+- **Fix the public-token bug app-local, not in blox.** Per the app-level-over-core rule; the blox fix
+  changes behavior for every consumer and needs its own review.
+- **Dropped the `?ssoPreview=1` dev switch** at the developer's request after using it to verify the
+  screen. The `isSafeSsoUrl` https check stayed — that is a security fix, not test code.
+
+---
+
+## Blockers
+
+- **Compass Canada production SSO is broken and the cause is unconfirmed.** The diagnostic SQL has
+  not been run. Until the `/domains` lookup returns SSO for that tenant, the new screen cannot be
+  seen there — and it cannot be seen locally either, since the dev preview switch was removed.
+- **`93616f20` and `fd92de42` are unpushed local commits** with generic "Save" messages. They need
+  real commit messages (or a squash) before a PR.
+- The mid-session checkout moved to `_production` and back; the work was never lost, but confirm
+  `git branch --show-current` is `TRUE-81991` before doing anything.
+
+---
+
+## Exact next step
+
+> Run the Compass Canada diagnostic against the **Core production** database — the `SELECT` joining
+> `Core.Domains` → `Core.Environments` → `Core.Clients` → `Core.ClientAuthentications` filtered on
+> `d.domain LIKE '%compasscanada%'`. Read the result against four causes in order: no row / wrong
+> `domain` string, `authType` NULL (no `ClientAuthentications` row for that clientId+environmentId),
+> `authType` not the literal `'SSO'`, or — if the data is right — the PUBLIC role missing
+> `AclFieldPermissions` on `ClientAuthentications.type`, which you check by opening the site in a
+> private window and looking at the `/v2/domains` response in the Network tab.
+
+---
+_Saved by /session-save on 2026-09-23_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.873",
+  "version": "1.0.875",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",