fix(GRO-1370): resolve TS errors and test failures in petsExtendedFields.test.ts

- Fix vi.mock hoisting by importing and, eq, exists, or from db/index.js via async factory (importOriginal) instead of closing over top-level imports - Fix 'row' possibly undefined in makeDeleteChainable returning() with non-null assertion - Fix invalid UUID format in CLIENT_ID/PET_ID constants (must be valid v4 UUIDs to satisfy z.string().uuid() validation in createPetSchema) - Add missing extended fields (coatType, temperamentScore, temperamentFlags, medicalAlerts, preferredCuts) to buildPet factory defaults to match schema - Add §4.15 Public Booking Flow to UAT_PLAYBOOK.md documenting buffer integration (GRO-1172) scheduling engine endpoints Co-Authored-By: Paperclip <noreply@paperclip.ing>
Merge pull request 'chore: add Renovate config (GRO-1081)' (#17 ) from add-renovate-config into dev
2026-05-20 16:21:52 +00:00 · 2026-05-20 12:37:08 +00:00 · 2026-05-20 04:24:21 +00:00 · 2026-05-20 04:11:47 +00:00 · 2026-05-20 03:57:20 +00:00 · 2026-05-20 03:25:45 +00:00
128 changed files with 1923 additions and 1195 deletions
@@ -0,0 +1,11 @@
+node_modules
+.git
+*.md
+.github
+apps/e2e
+apps/web/dist
+apps/api/dist
+packages/db/dist
+packages/types/dist
+.turbo
+screenshots/
@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
@@ -0,0 +1,36 @@
+# Groom Book — Environment Variables
+# Copy this file to .env and adjust values for your deployment.
+
+# ── Database ──────────────────────────────────────────────────────────────────
+DATABASE_URL=postgres://groombook:groombook@postgres:5432/groombook
+
+# ── Authentication ────────────────────────────────────────────────────────────
+# Set AUTH_DISABLED=true to skip OIDC validation (useful for local dev/Docker).
+# In production, configure an Authentik instance and set these values.
+AUTH_DISABLED=false
+OIDC_ISSUER=https://authentik.example.com
+OIDC_AUDIENCE=groombook
+
+# ── Setup Wizard ─────────────────────────────────────────────────────────────
+# When SKIP_OOBE=true, the setup wizard is bypassed regardless of whether a
+# super user exists in the database. Useful in dev/test environments where the
+# database has data but the setup wizard would otherwise block access.
+SKIP_OOBE=false
+
+# ── API ───────────────────────────────────────────────────────────────────────
+PORT=3000
+CORS_ORIGIN=http://localhost:8080
+
+# ── Email Reminders (optional) ────────────────────────────────────────────────
+# Leave SMTP_HOST unset to disable email notifications entirely.
+# When configured, appointment confirmation and reminder emails are sent via SMTP.
+SMTP_HOST=smtp.example.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=user@example.com
+SMTP_PASS=password
+SMTP_FROM="Groom Book <noreply@example.com>"
+
+# Hours before appointment to send reminder emails (defaults: 24 and 2)
+REMINDER_HOURS_EARLY=24
+REMINDER_HOURS_LATE=2
@@ -1,99 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, dev]
-  pull_request:
-    branches: [main, dev]
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Branch or ref to run CI against"
-        required: false
-        default: "main"
-
-jobs:
-  lint-typecheck:
-    name: Lint & Typecheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Typecheck
-        run: pnpm typecheck
-
-      - name: Lint
-        run: pnpm lint
-
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Run tests
-        run: pnpm test
-
-  docker:
-    name: Build & Push Docker Image
-    runs-on: ubuntu-latest
-    needs: [lint-typecheck, test]
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Generate image tag
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            TAG="pr-${{ github.event.pull_request.number }}-${GITHUB_SHA::7}"
-          else
-            TAG="$(date -u +%Y.%m.%d)-${GITHUB_SHA::7}"
-          fi
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "Image tag: $TAG"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Gitea Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: git.farh.net
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Build and push API image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          push: true
-          tags: |
-            git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:api
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:api,mode=max
@@ -0,0 +1,257 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Branch or ref to run CI against"
+        required: false
+        default: "main"
+
+jobs:
+  lint-typecheck:
+    name: Lint & Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm --filter @groombook/api typecheck
+
+      - name: Lint
+        run: pnpm --filter @groombook/api lint
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run tests
+        run: pnpm --filter @groombook/api test
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    needs: [lint-typecheck, test]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm --filter @groombook/api build
+
+  docker:
+    name: Build & Push Docker Images
+    runs-on: ubuntu-latest
+    needs: [build]
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Generate image tag
+        id: version
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            TAG="pr-${{ github.event.pull_request.number }}-${GITHUB_SHA::7}"
+          else
+            TAG="$(date -u +%Y.%m.%d)-${GITHUB_SHA::7}"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Image tag: $TAG"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push API image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          target: runner
+          push: true
+          tags: |
+            ghcr.io/groombook/api:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/api:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push Migrate image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          target: migrate
+          push: true
+          tags: |
+            ghcr.io/groombook/migrate:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/migrate:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push Seed image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          target: seed
+          push: true
+          tags: |
+            ghcr.io/groombook/seed:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/seed:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push Reset image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          target: reset
+          push: true
+          tags: |
+            ghcr.io/groombook/reset:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/reset:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  cd:
+    name: Update Infra Image Tags
+    runs-on: ubuntu-latest
+    needs: [docker]
+    if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') && github.event_name == 'push'
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Clone groombook/infra
+        run: |
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra
+
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Update dev overlay image tags
+        env:
+          TAG: ${{ needs.docker.outputs.tag }}
+          SHA: ${{ github.sha }}
+        run: |
+          if [ -z "$TAG" ]; then
+            TAG="$(date -u +%Y.%m.%d)-${SHA::7}"
+          fi
+          export SHORT_SHA="${SHA::7}"
+          echo "Updating dev overlay image tags to: $TAG"
+          echo "Updating migration/seed Job names with SHA: $SHORT_SHA"
+          cd /tmp/infra
+          DEV_KUST="apps/overlays/dev/kustomization.yaml"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"
+
+          MIGRATE_JOB="apps/base/migrate-job.yaml"
+          if [ -f "$MIGRATE_JOB" ]; then
+            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
+            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
+            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$MIGRATE_JOB"
+          fi
+
+          SEED_JOB="apps/base/seed-job.yaml"
+          if [ -f "$SEED_JOB" ]; then
+            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
+            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
+            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$SEED_JOB"
+          fi
+
+          git -C /tmp/infra diff --stat
+
+      - name: Create PR on groombook/infra
+        env:
+          TAG: ${{ needs.docker.outputs.tag }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
+        run: |
+          if [ -z "$TAG" ]; then
+            TAG="$(date -u +%Y.%m.%d)-${GITHUB_SHA::7}"
+          fi
+
+          cd /tmp/infra
+          git config user.name "groombook-engineer[bot]"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
+          git checkout -b "chore/update-image-tags-${TAG}"
+          git add apps/overlays/dev/ apps/base/migrate-job.yaml apps/base/seed-job.yaml
+          git commit -m "chore: update image tags and migration/seed Job names to ${TAG}"
+
+          git push -u origin "chore/update-image-tags-${TAG}"
+
+          EXISTING_PR=$(gh pr list --repo groombook/infra --head "chore/update-image-tags-${TAG}" --state open --json number -q '.[0].number' || true)
+          if [ -n "$EXISTING_PR" ]; then
+            echo "PR #$EXISTING_PR already exists for this tag, merging existing PR"
+            gh pr merge "$EXISTING_PR" --repo groombook/infra --merge
+          else
+            PR_URL=$(gh pr create \
+              --repo groombook/infra \
+              --base main \
+              --head "chore/update-image-tags-${TAG}" \
+              --title "chore: deploy ${TAG} to dev" \
+              --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
+            gh pr merge "$PR_URL" --merge
+          fi
@@ -1,6 +1,23 @@
 node_modules/
 dist/
-.DS_Store
-*.log
 .env
 .env.local
+*.local
+.DS_Store
+*.log
+.turbo/
+coverage/
+minimax-output/
+
+# Agent runtime artifacts — never commit
+.gh-token
+*.gh-token
+.config/gh/
+**/.config/gh/
+infra-repo
+infra-repo/
+**/instructions/.gh-token
+**/AGENT_HOME/**
+$AGENT_HOME/**
+.claude/
+.codex/
@@ -2,52 +2,37 @@ FROM node:20-alpine AS base
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 WORKDIR /app

-# Install deps
 FROM base AS deps
-COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
-COPY packages/db/package.json packages/db/
-COPY packages/types/package.json packages/types/
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY apps/api/package.json apps/api/
 RUN pnpm install --frozen-lockfile

-# Build
 FROM deps AS builder
 RUN mkdir -p /home/node/.cache/node/corepack
-COPY packages/ packages/
-COPY src/ src/
-COPY tsconfig.json ./
-RUN pnpm --filter @groombook/types build && \
-    pnpm --filter @groombook/db build && \
-    pnpm build
+COPY apps/api/ apps/api/
+RUN pnpm --filter @groombook/api build

-# Runtime
 FROM node:20-alpine AS runner
 RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
 WORKDIR /app
 ENV NODE_ENV=production

-COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
-COPY --from=builder /app/package.json ./
-COPY --from=builder /app/dist dist/
-COPY --from=builder /app/packages/db/package.json packages/db/
-COPY --from=builder /app/packages/db/dist packages/db/dist
-COPY --from=builder /app/packages/types/package.json packages/types/
-COPY --from=builder /app/packages/types/dist packages/types/dist
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY --from=builder /app/apps/api/package.json apps/api/
+COPY --from=builder /app/apps/api/dist apps/api/dist
 RUN pnpm install --frozen-lockfile --prod

 EXPOSE 3000
 RUN apk add --no-cache curl
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1
-CMD ["node", "dist/index.js"]
+CMD ["node", "apps/api/dist/index.js"]

-# Migrate stage — runs drizzle-kit migrate against the database
 FROM builder AS migrate
-CMD ["pnpm", "db:migrate"]
+CMD ["pnpm", "--filter", "@groombook/api", "db:migrate"]

-# Seed stage — populates the database with test data
 FROM builder AS seed
-CMD ["pnpm", "db:seed"]
+CMD ["pnpm", "--filter", "@groombook/api", "db:seed"]

-# Reset stage — drops all tables, re-runs migrations, and re-seeds
 FROM builder AS reset
-CMD ["pnpm", "db:reset"]
+CMD ["pnpm", "--filter", "@groombook/api", "db:reset"]
@@ -1,2 +1,38 @@
-# api
-GroomBook API service (extracted from groombook/app monorepo)
+# GroomBook API
+
+GroomBook API service — extracted from the [groombook/app](https://github.com/groombook/app) monorepo.
+
+## Overview
+
+This repository contains the GroomBook API service, including:
+- REST API endpoints
+- Database schema and migrations (via Drizzle ORM)
+- Authentication (via Better Auth)
+- Background job handlers
+
+## Structure
+
+```
+apps/api/        # API service source
+packages/db/     # Database schema, migrations, and utilities
+packages/types/  # Shared TypeScript types
+```
+
+## Setup
+
+```bash
+pnpm install
+cp .env.example .env  # Fill in required environment variables
+pnpm --filter @groombook/api dev
+```
+
+## Docker
+
+```bash
+docker build -t ghcr.io/groombook/api:latest .
+docker run -p 3000:3000 ghcr.io/groombook/api:latest
+```
+
+## License
+
+AGPL-3.0-only
@@ -183,17 +183,22 @@ GroomBook API is a Hono-based REST service (TypeScript/Node.js) powering the pet
 | TC-API-14.4 | Update group notes | PATCH /api/appointment-groups/{id} with notes | 200 OK, notes updated |
 | TC-API-14.5 | Cancel group | DELETE /api/appointment-groups/{id} | 200 OK, all appointments cancelled |

-### 4.15 Buffer Rules
+### 4.15 Public Booking Flow (Scheduling Engine Buffer Integration)

 | # | Scenario | Steps | Expected |
 |---|----------|-------|----------|
-| TC-API-15.1 | List buffer rules | GET /api/admin/buffer-rules | 200 OK, list of active buffer rules returned |
-| TC-API-15.2 | Create buffer rule | POST /api/admin/buffer-rules with service, species, sizeCategory, bufferMinutes | 201 Created, buffer rule created |
-| TC-API-15.3 | Update buffer rule | PATCH /api/admin/buffer-rules/{id} with updated bufferMinutes | 200 OK, buffer rule updated |
-| TC-API-15.4 | Delete buffer rule | DELETE /api/admin/buffer-rules/{id} | 200 OK, buffer rule removed |
-| TC-API-15.5 | Reject invalid bufferMinutes | POST /api/admin/buffer-rules with bufferMinutes: -5 | 400 Bad Request, invalid bufferMinutes rejected |
-| TC-API-15.6 | Reject missing required fields | POST /api/admin/buffer-rules with service only | 400 Bad Request, species and sizeCategory required |
-| TC-API-15.7 | Booking uses buffer | Book appointment for pet with sizeCategory; verify duration reflects buffer | 201 Created, appointment duration includes buffer time |
+| TC-API-15.1 | List active services | GET /api/book/services | 200 OK, list of active services with name, price, duration |
+| TC-API-15.2 | Get availability — missing params | GET /api/book/availability | 400 Bad Request, error indicating required params |
+| TC-API-15.3 | Get availability — invalid date | GET /api/book/availability?serviceId=uuid&date=invalid | 400 Bad Request, date must be YYYY-MM-DD |
+| TC-API-15.4 | Get availability — service not found | GET /api/book/availability?serviceId=nonexistent&date=2026-06-01 | 404 Not Found |
+| TC-API-15.5 | Get availability — valid date/service | GET /api/book/availability?serviceId={serviceId}&date=2026-06-01 | 200 OK, array of ISO startTime strings for available slots |
+| TC-API-15.6 | Availability excludes booked slots | GET /api/book/availability for date with existing appointments | 200 OK, only slots not overlapping booked appointments |
+| TC-API-15.7 | Availability respects groomer availability | GET /api/book/availability for date with no groomers | 200 OK, empty array |
+| TC-API-15.8 | Create booking — missing required fields | POST /api/book/appointments with partial data | 400 Bad Request, validation errors |
+| TC-API-15.9 | Create booking — invalid pet/client/service | POST /api/book/appointments with nonexistent IDs | 400/404 Bad Request |
+| TC-API-15.10 | Create booking — valid | POST /api/book/appointments with all required fields | 201 Created, appointment object returned |
+| TC-API-15.11 | Create booking — saves petSizeCategory | POST /api/book/appointments with petSizeCategory | 201 Created, pet's petSizeCategory updated |
+| TC-API-15.12 | Create booking — saves petCoatType | POST /api/book/appointments with petCoatType | 201 Created, pet's coatType updated |

 ## Pass/Fail Criteria

@@ -1,7 +1,7 @@
 import { defineConfig } from "drizzle-kit";

 export default defineConfig({
-  schema: "./src/schema.ts",
+  schema: "./src/db/schema.ts",
  out: "./migrations",
  dialect: "postgresql",
  dbCredentials: {
@@ -0,0 +1,12 @@
+-- Migration: 0030_extended_pet_profile
+-- Adds extended profile fields to the pets table
+
+BEGIN;
+
+ALTER TABLE pets ADD COLUMN coat_type text;
+ALTER TABLE pets ADD COLUMN temperament_score integer;
+ALTER TABLE pets ADD COLUMN temperament_flags jsonb DEFAULT '[]'::jsonb;
+ALTER TABLE pets ADD COLUMN medical_alerts jsonb DEFAULT '[]'::jsonb;
+ALTER TABLE pets ADD COLUMN preferred_cuts jsonb DEFAULT '[]'::jsonb;
+
+COMMIT;
@@ -0,0 +1,48 @@
+{
+  "id": "0030_extended_pet_profile",
+  "prevId": "0028_sms_reminders",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.pets": {
+      "name": "pets",
+      "schema": "",
+      "columns": {
+        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
+        "client_id": { "name": "client_id", "type": "uuid", "isNullable": false },
+        "name": { "name": "name", "type": "text", "isNullable": false },
+        "species": { "name": "species", "type": "text", "isNullable": false },
+        "breed": { "name": "breed", "type": "text", "isNullable": true },
+        "weight_kg": { "name": "weight_kg", "type": "numeric(5, 2)", "isNullable": true },
+        "date_of_birth": { "name": "date_of_birth", "type": "timestamp", "isNullable": true },
+        "health_alerts": { "name": "health_alerts", "type": "text", "isNullable": true },
+        "grooming_notes": { "name": "grooming_notes", "type": "text", "isNullable": true },
+        "cut_style": { "name": "cut_style", "type": "text", "isNullable": true },
+        "shampoo_preference": { "name": "shampoo_preference", "type": "text", "isNullable": true },
+        "special_care_notes": { "name": "special_care_notes", "type": "text", "isNullable": true },
+        "custom_fields": { "name": "custom_fields", "type": "jsonb", "isNullable": false, "default": "'{}'::jsonb" },
+        "photo_key": { "name": "photo_key", "type": "text", "isNullable": true },
+        "photo_uploaded_at": { "name": "photo_uploaded_at", "type": "timestamp", "isNullable": true },
+        "image": { "name": "image", "type": "text", "isNullable": true },
+        "coat_type": { "name": "coat_type", "type": "text", "isNullable": true },
+        "temperament_score": { "name": "temperament_score", "type": "integer", "isNullable": true },
+        "temperament_flags": { "name": "temperament_flags", "type": "jsonb", "isNullable": true, "default": "'[]'::jsonb" },
+        "medical_alerts": { "name": "medical_alerts", "type": "jsonb", "isNullable": true, "default": "'[]'::jsonb" },
+        "preferred_cuts": { "name": "preferred_cuts", "type": "jsonb", "isNullable": true, "default": "'[]'::jsonb" },
+        "created_at": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
+        "updated_at": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
+      },
+      "indexes": { "idx_pets_client_id": { "name": "idx_pets_client_id", "columns": [{ "expression": "client_id", "isExpression": false, "asc": true, "nulls": "last" }], "isUnique": false } },
+      "foreignKeys": { "pets_client_id_clients_id_fk": { "name": "pets_client_id_clients_id_fk", "tableFrom": "pets", "tableTo": "clients", "columnsFrom": ["client_id"], "columnsTo": ["id"], "onDelete": "cascade" } },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {}
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": { "columns": {}, "schemas": {}, "tables": {} }
+}
@@ -208,15 +208,15 @@
    {
      "idx": 29,
      "version": "7",
-      "when": 1775784467192,
+      "when": 1775828067192,
      "tag": "0029_db_indexes_constraints",
      "breakpoints": true
    },
    {
      "idx": 30,
      "version": "7",
-      "when": 1775828067192,
-      "tag": "0030_messaging",
+      "when": 1775914467192,
+      "tag": "0030_extended_pet_profile",
      "breakpoints": true
    }
  ]
@@ -0,0 +1,47 @@
+{
+  "name": "@groombook/api",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "lint": "eslint src --ext .ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:seed": "tsx src/db/seed.ts",
+    "db:reset": "tsx src/db/reset.ts && drizzle-kit migrate && tsx src/db/seed.ts",
+    "db:studio": "drizzle-kit studio"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.800.0",
+    "@aws-sdk/s3-request-presigner": "^3.800.0",
+    "@hono/node-server": "^1.13.7",
+    "@hono/zod-validator": "^0.7.6",
+    "better-auth": "^1.5.6",
+    "drizzle-orm": "^0.38.4",
+    "hono": "^4.6.17",
+    "node-cron": "^3.0.3",
+    "nodemailer": "^6.9.16",
+    "postgres": "^3.4.5",
+    "stripe": "^22.0.0",
+    "telnyx": "^1.23.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.7",
+    "@types/node-cron": "^3.0.11",
+    "@types/nodemailer": "^6.4.17",
+    "@vitest/coverage-v8": "^3.2.4",
+    "drizzle-kit": "^0.30.4",
+    "eslint": "^9.18.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^3.2.4"
+  },
+  "license": "AGPL-3.0-only"
+}
@@ -5,7 +5,7 @@ let dbSelectResult: unknown[] = [];
 const mockEq = vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val }));
 const mockDecryptSecret = vi.fn((s: string) => `decrypted:${s}`);

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  const authProviderConfig = new Proxy(
    { _name: "auth_provider_config" },
    {
@@ -40,7 +40,7 @@ vi.mock("@groombook/db", () => {

 async function reimportAuth() {
  vi.resetModules();
-  vi.doMock("@groombook/db", () => ({
+  vi.doMock("./db", () => ({
    getDb: () => ({
      select: () => ({
        from: () => ({
@@ -38,7 +38,7 @@ const mockGroomer: MockStaff = { id: "staff-3", role: "groomer", isSuperUser: fa

 // ─── Mock db module ───────────────────────────────────────────────────────────

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  const authProviderConfig = new Proxy(
    { _name: "auth_provider_config" },
    {
@@ -40,7 +40,7 @@ function resetMock() {
  deletedId = null;
 }

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  function makeChainable(data: unknown[]): unknown {
    const arr = [...data];
    const chain = new Proxy(arr, {
@@ -39,7 +39,7 @@ function resetMock() {
  lastUpdate = {};
 }

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  const appointments = new Proxy(
    { _name: "appointments" },
    { get: (t, p) => (p === "_name" ? "appointments" : { table: "appointments", column: p }) }
@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { encryptSecret, decryptSecret } from "@groombook/db";
+import { encryptSecret, decryptSecret } from "../db/index.js";

 describe("encryptSecret / decryptSecret", () => {
  const originalEnv = process.env.BETTER_AUTH_SECRET;
@@ -6,7 +6,7 @@ import {
  buildPet,
  buildService,
  buildAppointment,
-} from "@groombook/db/factories";
+} from "../db/factories.js";

 describe("resetFactoryCounters", () => {
  it("resets all counters so IDs restart from 1", () => {
@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { Hono } from "hono";
 import type { AppEnv, StaffRow } from "../middleware/rbac.js";
-import { buildStaff } from "@groombook/db/factories";
+import { buildStaff } from "../db/factories.js";

 // ─── Mock data (built with factories for schema-safe defaults) ────────────────

@@ -76,7 +76,7 @@ function makeChainableResult(data: unknown[]): unknown {
  });
 }

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  function makeTable(name: string) {
    return new Proxy(
      { _name: name },
@@ -40,7 +40,7 @@ function resetDb() {

 // ─── Module mocks ─────────────────────────────────────────────────────────────

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  const pets = new Proxy(
    { _name: "pets" },
    { get(t, p) { return p === "_name" ? "pets" : {}; } }
@@ -0,0 +1,416 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { Hono } from "hono";
+import type { AppEnv, StaffRow } from "../middleware/rbac.js";
+import { petsRouter } from "../routes/pets.js";
+import { and, eq, exists, or } from "../db/index.js";
+
+// ─── Mock staff fixtures ──────────────────────────────────────────────────────
+
+const MANAGER: StaffRow = {
+  id: "staff-manager-id",
+  oidcSub: "oidc-manager-sub",
+  userId: null,
+  role: "manager",
+  isSuperUser: true,
+  name: "Manager McManager",
+  email: "manager@example.com",
+  active: true,
+  icalToken: null,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+};
+
+// ─── Mutable mock state ───────────────────────────────────────────────────────
+
+const CLIENT_ID = "11111111-1111-1111-1111-111111111111";
+const PET_ID = "22222222-2222-2222-2222-222222222222";
+
+let petRows: Record<string, unknown>[] = [];
+let appointmentRows: Record<string, unknown>[] = [];
+let insertedValues: Record<string, unknown>[] = [];
+let updatedValues: Record<string, unknown>[] = [];
+let deletedId: string | null = null;
+
+function resetMock() {
+  petRows = [{
+    id: PET_ID,
+    clientId: CLIENT_ID,
+    name: "Biscuit",
+    species: "dog",
+    breed: "Golden Retriever",
+    weightKg: "30.00",
+    dateOfBirth: null,
+    healthAlerts: null,
+    groomingNotes: null,
+    cutStyle: null,
+    shampooPreference: null,
+    specialCareNotes: null,
+    customFields: {},
+    photoKey: null,
+    photoUploadedAt: null,
+    image: null,
+    coatType: null,
+    temperamentScore: null,
+    temperamentFlags: [],
+    medicalAlerts: [],
+    preferredCuts: [],
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  }];
+  appointmentRows = [];
+  insertedValues = [];
+  updatedValues = [];
+  deletedId = null;
+}
+
+function makeSelectChainable(rows: unknown[]): unknown {
+  const chain = new Proxy([...rows], {
+    get(target, prop) {
+      if (prop === "where" || prop === "orderBy" || prop === "limit") {
+        return () => chain;
+      }
+      // @ts-expect-error proxy
+      return target[prop];
+    },
+  });
+  return chain;
+}
+
+function makeInsertChainable(): unknown {
+  let vals: Record<string, unknown> = {};
+  const chain = new Proxy({}, {
+    get(target, prop) {
+      if (prop === "values") {
+        return (v: Record<string, unknown>) => { vals = v; return chain; };
+      }
+      if (prop === "returning") {
+        return () => {
+          insertedValues.push(vals);
+          return [vals.id ? { ...vals, id: vals.id ?? PET_ID } : { ...vals, id: PET_ID }];
+        };
+      }
+      return chain;
+    },
+  });
+  return chain;
+}
+
+function makeUpdateChainable(): unknown {
+  let vals: Record<string, unknown> = {};
+  let whereId: string | null = null;
+  const chain = new Proxy({}, {
+    get(target, prop) {
+      if (prop === "set") {
+        return (v: Record<string, unknown>) => { vals = v; return chain; };
+      }
+      if (prop === "where") {
+        return (cond: unknown) => {
+          // Extract id from condition if it's an eq call
+          if (whereId) vals = { ...vals };
+          return chain;
+        };
+      }
+      if (prop === "returning") {
+        return () => {
+          const merged = { ...petRows[0], ...vals };
+          updatedValues.push(vals);
+          return [merged];
+        };
+      }
+      return chain;
+    },
+  });
+  return chain;
+}
+
+function makeDeleteChainable(): unknown {
+  let whereId: string | null = null;
+  const chain = new Proxy({}, {
+    get(target, prop) {
+      if (prop === "where") {
+        return (cond: unknown) => {
+          whereId = PET_ID;
+          return chain;
+        };
+      }
+      if (prop === "returning") {
+        return () => {
+          const row = petRows[0]!;
+          deletedId = row.id as string;
+          return [row];
+        };
+      }
+      return chain;
+    },
+  });
+  return chain;
+}
+
+vi.mock("../db", async (importOriginal) => {
+  const db = await importOriginal<typeof import("../db/index.js")>();
+  const pets = new Proxy({ _name: "pets" }, { get: (t, p) => p === "_name" ? "pets" : {} });
+  const appointments = new Proxy({ _name: "appointments" }, { get: (t, p) => p === "_name" ? "appointments" : {} });
+  return {
+    getDb: () => ({
+      select: () => ({
+        from: (table: unknown) => {
+          const name = (table as { _name?: string })._name;
+          if (name === "appointments") return makeSelectChainable(appointmentRows);
+          return makeSelectChainable(petRows);
+        },
+      }),
+      insert: () => makeInsertChainable(),
+      update: () => makeUpdateChainable(),
+      delete: () => makeDeleteChainable(),
+    }),
+    pets,
+    appointments,
+    and: db.and,
+    eq: db.eq,
+    exists: db.exists,
+    or: db.or,
+  };
+});
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeApp(staff: StaffRow = MANAGER) {
+  const app = new Hono<AppEnv>();
+  app.use("*", async (c, next) => {
+    c.set("staff", staff);
+    await next();
+  });
+  return app.route("/pets", petsRouter);
+}
+
+function createApp() {
+  const app = makeApp(MANAGER);
+  return app;
+}
+
+// ─── Tests ────────────────────────────────────────────────────────────────────
+
+describe("Extended pet profile fields — validation", () => {
+  beforeEach(resetMock);
+
+  it("rejects temperamentScore of 0 (below min)", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 0 }),
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.success).toBe(false);
+  });
+
+  it("rejects temperamentScore of 6 (above max)", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 6 }),
+    });
+    expect(res.status).toBe(400);
+    const body = await res.json();
+    expect(body.success).toBe(false);
+  });
+
+  it("rejects non-integer temperamentScore", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: 3.5 }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects invalid medicalAlert severity", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        clientId: CLIENT_ID,
+        name: "Test",
+        species: "dog",
+        medicalAlerts: [{ type: "seizure", description: "xyz", severity: "critical" }],
+      }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("accepts valid temperamentScore 1–5", async () => {
+    const app = createApp();
+    for (const score of [1, 2, 3, 4, 5]) {
+      resetMock();
+      const res = await app.request("/pets", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentScore: score }),
+      });
+      expect(res.status).toBe(201);
+    }
+  });
+
+  it("accepts all valid medicalAlert severity values", async () => {
+    const app = createApp();
+    for (const severity of ["low", "medium", "high"] as const) {
+      resetMock();
+      const res = await app.request("/pets", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          clientId: CLIENT_ID,
+          name: "Test",
+          species: "dog",
+          medicalAlerts: [{ type: "allergy", description: "Sensitive to chicken", severity }],
+        }),
+      });
+      expect(res.status).toBe(201);
+    }
+  });
+});
+
+describe("Extended pet profile fields — create", () => {
+  beforeEach(resetMock);
+
+  it("accepts all extended fields on create", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        clientId: CLIENT_ID,
+        name: "Biscuit",
+        species: "dog",
+        breed: "Golden Retriever",
+        coatType: "double",
+        temperamentScore: 4,
+        temperamentFlags: ["anxious_with_dryers", "gentle"],
+        medicalAlerts: [
+          { type: "seizure", description: "Occasional episodes", severity: "medium" },
+        ],
+        preferredCuts: ["puppy cut", "teddy bear"],
+      }),
+    });
+    expect(res.status).toBe(201);
+    const body = await res.json();
+    expect(body.coatType).toBe("double");
+    expect(body.temperamentScore).toBe(4);
+    expect(body.temperamentFlags).toEqual(["anxious_with_dryers", "gentle"]);
+    expect(body.medicalAlerts).toEqual([{ type: "seizure", description: "Occasional episodes", severity: "medium" }]);
+    expect(body.preferredCuts).toEqual(["puppy cut", "teddy bear"]);
+  });
+
+  it("create without extended fields works (all optional)", async () => {
+    const app = createApp();
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Basil", species: "cat" }),
+    });
+    expect(res.status).toBe(201);
+  });
+});
+
+describe("Extended pet profile fields — update", () => {
+  beforeEach(resetMock);
+
+  it("updates coatType", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ coatType: "smooth" }),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.coatType).toBe("smooth");
+  });
+
+  it("updates temperamentScore", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ temperamentScore: 2 }),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.temperamentScore).toBe(2);
+  });
+
+  it("rejects temperamentScore 0 on update", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ temperamentScore: 0 }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects invalid severity on update", async () => {
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`, {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        medicalAlerts: [{ type: "x", description: "y", severity: "urgent" }],
+      }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects too many temperamentFlags (>20)", async () => {
+    const app = createApp();
+    const flags = Array.from({ length: 21 }, (_, i) => `flag_${i}`);
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", temperamentFlags: flags }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects too many preferredCuts (>20)", async () => {
+    const app = createApp();
+    const cuts = Array.from({ length: 21 }, (_, i) => `cut_${i}`);
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", preferredCuts: cuts }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("rejects too many medicalAlerts (>50)", async () => {
+    const app = createApp();
+    const alerts = Array.from({ length: 51 }, (_, i) => ({
+      type: `type_${i}`,
+      description: `desc_${i}`,
+      severity: "low" as const,
+    }));
+    const res = await app.request("/pets", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientId: CLIENT_ID, name: "Test", species: "dog", medicalAlerts: alerts }),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it("returns extended fields in GET response", async () => {
+    petRows = [{ ...petRows[0], coatType: "wire", temperamentScore: 3, temperamentFlags: ["gentle"], medicalAlerts: [], preferredCuts: ["scissor cut"] }];
+    const app = createApp();
+    const res = await app.request(`/pets/${PET_ID}`);
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.coatType).toBe("wire");
+    expect(body.temperamentScore).toBe(3);
+    expect(body.temperamentFlags).toEqual(["gentle"]);
+    expect(body.preferredCuts).toEqual(["scissor cut"]);
+  });
+});
@@ -47,7 +47,7 @@ function resetMock() {
  updatedValues = [];
 }

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  function makeChainable(data: unknown[]): unknown {
    const arr = [...data];
    const chain = new Proxy(arr, {
@@ -46,7 +46,7 @@ const GROOMER: StaffRow = {
 let staffLookupResult: StaffRow | null = null;
 let managerFallbackResult: StaffRow | null = MANAGER;

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  const staff = new Proxy(
    { _name: "staff" },
    {
@@ -23,7 +23,7 @@ const PET_ROW = {
 let clientResults: typeof ACTIVE_CLIENT[] = [];
 let petResults: typeof PET_ROW[] = [];

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  // Proxy objects for table/column references — values don't matter for tests
  const tableProxy = (name: string) =>
    new Proxy(
@@ -0,0 +1,431 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+// ─── Test configuration constants (must match seed.ts) ─────────────────────────
+
+const UAT_ACCOUNTS = [
+  {
+    email: "uat-super@groombook.dev",
+    name: "UAT Super User",
+    passwordEnv: "SEED_UAT_SUPER_PASSWORD",
+    staffEmail: "uat-super@groombook.dev",
+  },
+  {
+    email: "uat-groomer@groombook.dev",
+    name: "UAT Staff Groomer",
+    passwordEnv: "SEED_UAT_GROOMER_PASSWORD",
+    staffEmail: "uat-groomer@groombook.dev",
+  },
+  {
+    email: "uat-customer@groombook.dev",
+    name: "UAT Customer",
+    passwordEnv: "SEED_UAT_CUSTOMER_PASSWORD",
+    staffEmail: null,
+  },
+  {
+    email: "uat-tester@groombook.dev",
+    name: "UAT Tester",
+    passwordEnv: "SEED_UAT_TESTER_PASSWORD",
+    staffEmail: "uat-tester@groombook.dev",
+  },
+];
+
+const TEST_PASSWORD = "test-password-123";
+
+// ─── Password hashing — must match better-auth/crypto (N=16384, r=16, p=1, dkLen=64, hex) ───
+
+async function hashPassword(password: string): Promise<string> {
+  const { hashPassword } = await import("better-auth/crypto");
+  return hashPassword(password);
+}
+
+// ─── Mock DB state ─────────────────────────────────────────────────────────────
+
+interface UserRow {
+  id: string;
+  email: string;
+  name: string;
+  emailVerified: boolean;
+}
+
+interface AccountRow {
+  id: string;
+  accountId: string;
+  providerId: string;
+  userId: string;
+  password: string | null;
+}
+
+interface StaffRow {
+  id: string;
+  email: string;
+  userId: string | null;
+  name: string;
+}
+
+let dbUsers: UserRow[] = [];
+let dbAccounts: AccountRow[] = [];
+let dbStaff: StaffRow[] = [];
+let insertedUsers: UserRow[] = [];
+let insertedAccounts: AccountRow[] = [];
+let updatedStaff: Array<{ id: string; userId: string }> = [];
+
+const originalEnv = { ...process.env };
+
+function resetMock() {
+  dbUsers = [];
+  dbAccounts = [];
+  dbStaff = [];
+  insertedUsers = [];
+  insertedAccounts = [];
+  updatedStaff = [];
+  process.env = { ...originalEnv };
+}
+
+// ─── Mock schema ───────────────────────────────────────────────────────────────
+
+function makeSchemaMock() {
+  const user = new Proxy({ _name: "user" }, {
+    get(_t, p) {
+      if (p === "_name") return "user";
+      if (p === "$inferSelect") return {};
+      return { table: "user", column: p };
+    },
+  });
+
+  const account = new Proxy({ _name: "account" }, {
+    get(_t, p) {
+      if (p === "_name") return "account";
+      if (p === "$inferSelect") return {};
+      return { table: "account", column: p };
+    },
+  });
+
+  const staff = new Proxy({ _name: "staff" }, {
+    get(_t, p) {
+      if (p === "_name") return "staff";
+      if (p === "$inferSelect") return {};
+      return { table: "staff", column: p };
+    },
+  });
+
+  return { user, account, staff };
+}
+
+const { user: mockUser, account: mockAccount, staff: mockStaff } = makeSchemaMock();
+
+function eq(col: unknown, val: unknown) {
+  return { __type: "eq" as const, col, val };
+}
+
+function and(...conds: unknown[]) {
+  return { __type: "and" as const, conds };
+}
+
+// ─── Seed logic helper ─────────────────────────────────────────────────────────
+// Inline the credential provisioning logic under test so we can call it directly.
+// This is the same logic as seed.ts lines 514-598.
+
+interface SeedAccount {
+  email: string;
+  name: string;
+  passwordEnv: string;
+  staffEmail: string | null;
+}
+
+let uuidCounter = 0;
+function mockUuid(): string {
+  return `mock-uuid-${++uuidCounter}`;
+}
+
+async function seedUatCredentials(
+  accounts: SeedAccount[],
+  opts: {
+    users?: UserRow[];
+    accounts?: AccountRow[];
+    staff?: StaffRow[];
+  }
+) {
+  const { users = dbUsers, accounts: accts = dbAccounts, staff: staffRows = dbStaff } = opts;
+
+  for (const acct of accounts) {
+    const password = process.env[acct.passwordEnv];
+    if (!password) {
+      console.warn(`⚠ Skipping ${acct.email} — ${acct.passwordEnv} not set`);
+      continue;
+    }
+
+    // 1. Find or create the Better-Auth user
+    const existingUser = users.find((u) => u.email === acct.email);
+
+    let userId: string;
+    if (existingUser) {
+      userId = existingUser.id;
+    } else {
+      userId = mockUuid();
+      const newUser: UserRow = { id: userId, name: acct.name, email: acct.email, emailVerified: true };
+      insertedUsers.push(newUser);
+      dbUsers.push(newUser);
+    }
+
+    // 2. Check if credential account already exists
+    const existingAccount = accts.find(
+      (a) => a.userId === userId && a.providerId === "credential"
+    );
+
+    if (existingAccount) {
+      // skip — already has credential account
+    } else {
+      // Use Better-Auth's hashPassword so test helper matches production seed.ts
+      const { hashPassword } = await import("better-auth/crypto");
+      const passwordHash = await hashPassword(password);
+
+      const newAccount: AccountRow = {
+        id: mockUuid(),
+        accountId: userId,
+        providerId: "credential",
+        userId,
+        password: passwordHash,
+      };
+      insertedAccounts.push(newAccount);
+      dbAccounts.push(newAccount);
+    }
+
+    // 3. Link staff record to Better-Auth user
+    if (acct.staffEmail) {
+      const existingStaff = staffRows.find((s) => s.email === acct.staffEmail);
+      if (existingStaff && !existingStaff.userId) {
+        existingStaff.userId = userId;
+        updatedStaff.push({ id: existingStaff.id, userId });
+      }
+    }
+  }
+}
+
+// ─── Tests ─────────────────────────────────────────────────────────────────────
+
+describe("seedUatCredentials — credential provisioning logic", () => {
+  beforeEach(() => {
+    resetMock();
+    uuidCounter = 0;
+  });
+
+  afterEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  // ── AC-1: creates user + account when neither exists ──────────────────────
+
+  it("AC-1: creates user and account for each UAT account with password env var set", async () => {
+    process.env.SEED_UAT_SUPER_PASSWORD = TEST_PASSWORD;
+    process.env.SEED_UAT_GROOMER_PASSWORD = TEST_PASSWORD;
+    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
+    process.env.SEED_UAT_TESTER_PASSWORD = TEST_PASSWORD;
+
+    await seedUatCredentials(UAT_ACCOUNTS, { users: [], accounts: [], staff: [] });
+
+    // 4 users created (customer + tester have no staff, super + groomer do)
+    expect(insertedUsers).toHaveLength(4);
+    expect(insertedUsers.find((u) => u.email === "uat-super@groombook.dev")).toBeDefined();
+    expect(insertedUsers.find((u) => u.email === "uat-groomer@groombook.dev")).toBeDefined();
+    expect(insertedUsers.find((u) => u.email === "uat-customer@groombook.dev")).toBeDefined();
+    expect(insertedUsers.find((u) => u.email === "uat-tester@groombook.dev")).toBeDefined();
+
+    // 4 accounts created
+    expect(insertedAccounts).toHaveLength(4);
+    for (const acct of insertedAccounts) {
+      expect(acct.providerId).toBe("credential");
+      // Better-Auth uses hex encoding: saltHex:keyHex (both lowercase hex)
+      expect(acct.password).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
+      // Verify the hash is scrypt with correct params (N=16384, r=16, p=1, dkLen=64)
+      const parts = acct.password!.split(":");
+      const saltHex = parts[0]!;
+      const keyHex = parts[1]!;
+      const salt = Buffer.from(saltHex, "hex");
+      const storedHash = Buffer.from(keyHex, "hex");
+      expect(salt).toHaveLength(16);
+      expect(storedHash).toHaveLength(64);
+    }
+  });
+
+  // ── AC-2: emailVerified = true ─────────────────────────────────────────────
+
+  it("AC-2: created users have emailVerified = true", async () => {
+    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
+
+    await seedUatCredentials(
+      [UAT_ACCOUNTS[2]!], // customer only
+      { users: [], accounts: [], staff: [] }
+    );
+
+    expect(insertedUsers[0]!.emailVerified).toBe(true);
+  });
+
+  // ── AC-3: providerId = credential, password is hashed ──────────────────────
+
+  it("AC-3: account records use providerId='credential' with properly formatted hashed password", async () => {
+    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
+
+    await seedUatCredentials(
+      [UAT_ACCOUNTS[2]!],
+      { users: [], accounts: [], staff: [] }
+    );
+
+    const acct = insertedAccounts[0]!;
+    expect(acct.providerId).toBe("credential");
+    // Better-Auth uses hex: saltHex (32 chars) : keyHex (128 chars)
+    expect(acct.password).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
+    const parts = acct.password!.split(":");
+    const saltHex = parts[0]!;
+    const keyHex = parts[1]!;
+    expect(() => Buffer.from(saltHex, "hex")).not.toThrow();
+    expect(() => Buffer.from(keyHex, "hex")).not.toThrow();
+    const salt = Buffer.from(saltHex, "hex");
+    const storedHash = Buffer.from(keyHex, "hex");
+    expect(salt).toHaveLength(16);
+    expect(storedHash).toHaveLength(64);
+  });
+
+  // ── AC-4: staff.userId is linked ────────────────────────────────────────────
+
+  it("AC-4: links staff.userId to the Better-Auth user when staff record exists", async () => {
+    process.env.SEED_UAT_SUPER_PASSWORD = TEST_PASSWORD;
+    const staffRows: StaffRow[] = [
+      { id: "staff-super-1", email: "uat-super@groombook.dev", userId: null, name: "UAT Super User" },
+    ];
+
+    await seedUatCredentials([UAT_ACCOUNTS[0]!], { users: [], accounts: [], staff: staffRows });
+
+    expect(updatedStaff).toHaveLength(1);
+    expect(updatedStaff[0]!.id).toBe("staff-super-1");
+    expect(updatedStaff[0]!.userId).toBe("mock-uuid-1");
+    expect(staffRows[0]!.userId).toBe("mock-uuid-1");
+  });
+
+  it("AC-4b: does not update staff.userId if already set", async () => {
+    process.env.SEED_UAT_GROOMER_PASSWORD = TEST_PASSWORD;
+    const staffRows: StaffRow[] = [
+      { id: "staff-groomer-1", email: "uat-groomer@groombook.dev", userId: "already-linked", name: "UAT Groomer" },
+    ];
+
+    await seedUatCredentials([UAT_ACCOUNTS[1]!], { users: [], accounts: [], staff: staffRows });
+
+    expect(updatedStaff).toHaveLength(0);
+  });
+
+  // ── AC-5: idempotent — skips when user already exists ───────────────────────
+
+  it("AC-5: re-running does not duplicate user or account records (idempotent)", async () => {
+    process.env.SEED_UAT_CUSTOMER_PASSWORD = TEST_PASSWORD;
+
+    const preExistingUsers: UserRow[] = [
+      { id: "pre-existing-user", email: "uat-customer@groombook.dev", name: "UAT Customer", emailVerified: true },
+    ];
+    const preExistingAccounts: AccountRow[] = [
+      {
+        id: "pre-existing-acct",
+        accountId: "pre-existing-user",
+        providerId: "credential",
+        userId: "pre-existing-user",
+        password: await hashPassword(TEST_PASSWORD),
+      },
+    ];
+
+    // First call — nothing inserted (user + account pre-exist)
+    await seedUatCredentials([UAT_ACCOUNTS[2]!], {
+      users: preExistingUsers,
+      accounts: preExistingAccounts,
+      staff: [],
+    });
+
+    expect(insertedUsers).toHaveLength(0);
+    expect(insertedAccounts).toHaveLength(0);
+
+    // Second call — still nothing inserted
+    await seedUatCredentials([UAT_ACCOUNTS[2]!], {
+      users: preExistingUsers,
+      accounts: preExistingAccounts,
+      staff: [],
+    });
+
+    expect(insertedUsers).toHaveLength(0);
+    expect(insertedAccounts).toHaveLength(0);
+  });
+
+  // ── AC-6: missing env var skips with warning ────────────────────────────────
+
+  it("AC-6: missing SEED_UAT_*_PASSWORD env var skips that account (no error)", async () => {
+    // No env vars set at all
+    delete process.env.SEED_UAT_SUPER_PASSWORD;
+    delete process.env.SEED_UAT_GROOMER_PASSWORD;
+    delete process.env.SEED_UAT_CUSTOMER_PASSWORD;
+    delete process.env.SEED_UAT_TESTER_PASSWORD;
+
+    const warnSpy = vi.spyOn(console, "warn").mockReturnValue(undefined);
+
+    await seedUatCredentials(UAT_ACCOUNTS, { users: [], accounts: [], staff: [] });
+
+    // Nothing created
+    expect(insertedUsers).toHaveLength(0);
+    expect(insertedAccounts).toHaveLength(0);
+    // Warning logged for each of the 4 accounts
+    expect(warnSpy).toHaveBeenCalledTimes(4);
+    expect(warnSpy).toHaveBeenCalledWith(
+      "⚠ Skipping uat-super@groombook.dev — SEED_UAT_SUPER_PASSWORD not set"
+    );
+
+    warnSpy.mockRestore();
+  });
+
+  // ── AC-7: partial env var coverage ─────────────────────────────────────────
+
+  it("AC-7: only accounts with password env var set are provisioned", async () => {
+    process.env.SEED_UAT_SUPER_PASSWORD = TEST_PASSWORD;
+    // Only super has password set
+
+    const warnSpy = vi.spyOn(console, "warn").mockReturnValue(undefined);
+
+    await seedUatCredentials(UAT_ACCOUNTS, { users: [], accounts: [], staff: [] });
+
+    expect(insertedUsers).toHaveLength(1);
+    expect(insertedUsers[0]!.email).toBe("uat-super@groombook.dev");
+    expect(insertedAccounts).toHaveLength(1);
+    expect(insertedAccounts[0]!.accountId).toBe("mock-uuid-1");
+
+    // 3 warnings for missing accounts
+    expect(warnSpy).toHaveBeenCalledTimes(3);
+
+    warnSpy.mockRestore();
+  });
+});
+
+// ─── Password hash format verification ───────────────────────────────────────
+
+describe("password hash format — scrypt parameters", () => {
+  it("hashes use salt:hash format with 16-byte salt and 64-byte output", async () => {
+    const hash = await hashPassword("test-password");
+    const parts = hash.split(":");
+    const saltHex = parts[0]!;
+    const keyHex = parts[1]!;
+
+    expect(hash).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
+    expect(Buffer.from(saltHex, "hex")).toHaveLength(16);
+    expect(Buffer.from(keyHex, "hex")).toHaveLength(64);
+  });
+
+  it("same password produces different hashes (due to random salt)", async () => {
+    const hash1 = await hashPassword("same-password");
+    const hash2 = await hashPassword("same-password");
+
+    expect(hash1).not.toBe(hash2);
+    // Both are valid Better-Auth hex format
+    expect(hash1).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
+    expect(hash2).toMatch(/^[a-f0-9]+:[a-f0-9]+$/);
+  });
+
+  it("different passwords produce different hashes", async () => {
+    const hash1 = await hashPassword("password1");
+    const hash2 = await hashPassword("password2");
+
+    expect(hash1).not.toBe(hash2);
+  });
+});
@@ -39,7 +39,7 @@ function clearAuthEnv() {

 // ─── Mock db module ───────────────────────────────────────────────────────────

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  const authProviderConfig = new Proxy(
    { _name: "auth_provider_config" },
    {
@@ -49,7 +49,7 @@ function resetMock() {
  updatedValues = [];
 }

-vi.mock("@groombook/db", () => {
+vi.mock("../db", () => {
  function makeChainable(data: unknown[]): unknown {
    const arr = [...data];
    const chain = new Proxy(arr, {
@@ -8,7 +8,7 @@
 * readable values (e.g. "staff-1", "client-2") without needing crypto.
 *
 * Usage:
- *   import { buildStaff, buildClient, buildPet } from "@groombook/db/factories";
+ *   import { buildStaff, buildClient, buildPet } from "./db/factories";
 *
 *   const manager = buildStaff({ role: "manager" });
 *   const client  = buildClient({ name: "Alice Smith" });
@@ -104,7 +104,10 @@ export function buildPet(overrides: Partial<PetRow> & { clientId: string }): Pet
    photoUploadedAt: null,
    image: null,
    coatType: null,
-    petSizeCategory: null,
+    temperamentScore: null,
+    temperamentFlags: [],
+    medicalAlerts: [],
+    preferredCuts: [],
    createdAt: new Date("2025-01-01T00:00:00Z"),
    updatedAt: new Date("2025-01-01T00:00:00Z"),
  };
@@ -119,7 +122,6 @@ export function buildService(overrides: Partial<ServiceRow> = {}): ServiceRow {
    description: "A grooming service",
    basePriceCents: 6500,
    durationMinutes: 60,
-    defaultBufferMinutes: null,
    active: true,
    createdAt: new Date("2025-01-01T00:00:00Z"),
    updatedAt: new Date("2025-01-01T00:00:00Z"),
@@ -12,6 +12,16 @@ import {
  uuid,
 } from "drizzle-orm/pg-core";

+// ─── Shared types ───────────────────────────────────────────────────────────────
+
+export type MedicalAlertSeverity = "low" | "medium" | "high";
+
+export interface MedicalAlert {
+  type: string;
+  description: string;
+  severity: MedicalAlertSeverity;
+}
+
 // ─── Enums ────────────────────────────────────────────────────────────────────

 export const appointmentStatusEnum = pgEnum("appointment_status", [
@@ -48,22 +58,6 @@ export const clientStatusEnum = pgEnum("client_status", [
  "disabled",
 ]);

-export const petSizeCategoryEnum = pgEnum("pet_size_category", [
-  "small",
-  "medium",
-  "large",
-  "xlarge",
-]);
-
-export const coatTypeEnum = pgEnum("coat_type", [
-  "smooth",
-  "double",
-  "wire",
-  "curly",
-  "long",
-  "hairless",
-]);
-
 // ─── Better-Auth Tables ──────────────────────────────────────────────────────

 export const user = pgTable("user", {
@@ -158,12 +152,16 @@ export const pets = pgTable(
    cutStyle: text("cut_style"),
    shampooPreference: text("shampoo_preference"),
    specialCareNotes: text("special_care_notes"),
-    coatType: coatTypeEnum("coat_type"),
-    petSizeCategory: petSizeCategoryEnum("pet_size_category"),
    customFields: jsonb("custom_fields").$type<Record<string, string>>().notNull().default({}),
    photoKey: text("photo_key"),
    photoUploadedAt: timestamp("photo_uploaded_at"),
    image: text("image"),
+    // Extended profile fields
+    coatType: text("coat_type"),
+    temperamentScore: integer("temperament_score"),
+    temperamentFlags: jsonb("temperament_flags").$type<string[]>().default([]),
+    medicalAlerts: jsonb("medical_alerts").$type<MedicalAlert[]>().default([]),
+    preferredCuts: jsonb("preferred_cuts").$type<string[]>().default([]),
    createdAt: timestamp("created_at").notNull().defaultNow(),
    updatedAt: timestamp("updated_at").notNull().defaultNow(),
  },
@@ -176,34 +174,11 @@ export const services = pgTable("services", {
  description: text("description"),
  basePriceCents: integer("base_price_cents").notNull(),
  durationMinutes: integer("duration_minutes").notNull(),
-  defaultBufferMinutes: integer("default_buffer_minutes"),
  active: boolean("active").notNull().default(true),
  createdAt: timestamp("created_at").notNull().defaultNow(),
  updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });

-export const bufferRules = pgTable(
-  "buffer_rules",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    serviceId: uuid("service_id")
-      .notNull()
-      .references(() => services.id, { onDelete: "cascade" }),
-    sizeCategory: petSizeCategoryEnum("size_category"),
-    coatType: coatTypeEnum("coat_type"),
-    bufferMinutes: integer("buffer_minutes").notNull(),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-  },
-  (t) => [
-    unique("uq_buffer_rules_service_size_coat").on(
-      t.serviceId,
-      t.sizeCategory,
-      t.coatType
-    ),
-  ]
-);
-
 export const staff = pgTable("staff", {
  id: uuid("id").primaryKey().defaultRandom(),
  name: text("name").notNull(),
@@ -447,117 +422,6 @@ export const impersonationAuditLogs = pgTable(
  (t) => [index("impersonation_audit_logs_session_id_idx").on(t.sessionId)]
 );

-// ─── Messaging ───────────────────────────────────────────────────────────────
-
-export const messagingChannelEnum = pgEnum("messaging_channel", ["sms", "mms"]);
-
-export const messageDirectionEnum = pgEnum("message_direction", [
-  "inbound",
-  "outbound",
-]);
-
-export const messageStatusEnum = pgEnum("message_status", [
-  "queued",
-  "sent",
-  "delivered",
-  "failed",
-  "received",
-]);
-
-export const messageConsentKindEnum = pgEnum("message_consent_kind", [
-  "opt_in",
-  "opt_out",
-  "help",
-]);
-
-export const conversations = pgTable(
-  "conversations",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    businessId: uuid("business_id").notNull(),
-    clientId: uuid("client_id")
-      .notNull()
-      .references(() => clients.id, { onDelete: "cascade" }),
-    channel: messagingChannelEnum("channel").notNull(),
-    externalNumber: text("external_number").notNull(),
-    businessNumber: text("business_number").notNull(),
-    lastMessageAt: timestamp("last_message_at"),
-    status: text("status").notNull().default("active"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    updatedAt: timestamp("updated_at").notNull().defaultNow(),
-  },
-  (t) => [
-    index("idx_conversations_business_id_last_message_at").on(
-      t.businessId,
-      t.lastMessageAt.desc()
-    ),
-    unique("uq_conversations_business_client_number").on(
-      t.businessId,
-      t.clientId,
-      t.businessNumber
-    ),
-  ]
-);
-
-export const messages = pgTable(
-  "messages",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    conversationId: uuid("conversation_id")
-      .notNull()
-      .references(() => conversations.id, { onDelete: "cascade" }),
-    direction: messageDirectionEnum("direction").notNull(),
-    body: text("body"),
-    status: messageStatusEnum("status").notNull().default("queued"),
-    providerMessageId: text("provider_message_id"),
-    errorCode: text("error_code"),
-    errorMessage: text("error_message"),
-    sentByStaffId: uuid("sent_by_staff_id").references(() => staff.id, {
-      onDelete: "set null",
-    }),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-    deliveredAt: timestamp("delivered_at"),
-    readByClientAt: timestamp("read_by_client_at"),
-  },
-  (t) => [
-    index("idx_messages_conversation_id_created_at").on(
-      t.conversationId,
-      t.createdAt.desc()
-    ),
-    unique("uq_messages_provider_message_id").on(t.providerMessageId),
-  ]
-);
-
-export const messageAttachments = pgTable(
-  "message_attachments",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    messageId: uuid("message_id")
-      .notNull()
-      .references(() => messages.id, { onDelete: "cascade" }),
-    contentType: text("content_type").notNull(),
-    url: text("url").notNull(),
-    size: integer("size").notNull(),
-    providerMediaId: text("provider_media_id"),
-  },
-  (t) => [index("idx_message_attachments_message_id").on(t.messageId)]
-);
-
-export const messageConsentEvents = pgTable(
-  "message_consent_events",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    clientId: uuid("client_id")
-      .notNull()
-      .references(() => clients.id, { onDelete: "cascade" }),
-    businessId: uuid("business_id").notNull(),
-    kind: messageConsentKindEnum("kind").notNull(),
-    source: text("source"),
-    createdAt: timestamp("created_at").notNull().defaultNow(),
-  },
-  (t) => [index("idx_message_consent_events_client_id").on(t.clientId)]
-);
-
 export const businessSettings = pgTable("business_settings", {
  id: uuid("id").primaryKey().defaultRandom(),
  businessName: text("business_name").notNull().default("GroomBook"),
@@ -566,8 +430,6 @@ export const businessSettings = pgTable("business_settings", {
  logoKey: text("logo_key"),
  primaryColor: text("primary_color").notNull().default("#4f8a6f"),
  accentColor: text("accent_color").notNull().default("#8b7355"),
-  messagingPhoneNumber: text("messaging_phone_number"),
-  telnyxMessagingProfileId: text("telnyx_messaging_profile_id"),
  createdAt: timestamp("created_at").notNull().defaultNow(),
  updatedAt: timestamp("updated_at").notNull().defaultNow(),
 });
@@ -18,7 +18,7 @@

 import postgres from "postgres";
 import { drizzle } from "drizzle-orm/postgres-js";
-import { eq, sql } from "drizzle-orm";
+import { eq, and, sql } from "drizzle-orm";
 import * as schema from "./schema.js";

 // ── Seed profile configuration ─────────────────────────────────────────────
@@ -94,11 +94,6 @@ function pick<T>(arr: T[]): T {
  return arr[Math.floor(rand() * arr.length)]!;
 }

-/** Return n distinct random elements from an array. */
-function pickN<T>(arr: T[], n: number): T[] {
-  const shuffled = [...arr].sort(() => rand() - 0.5);
-  return shuffled.slice(0, n);
-}

 function randInt(min: number, max: number): number {
  return Math.floor(rand() * (max - min + 1)) + min;
@@ -459,6 +454,32 @@ async function seedKnownUsers() {
    }
  }

+  // ── Staff: UAT Tester (oidcSub from SEED_UAT_TESTER_OIDC_SUB env var) ──
+  const uatTesterOidcSub = process.env.SEED_UAT_TESTER_OIDC_SUB;
+  if (uatTesterOidcSub) {
+    const UAT_TESTER_STAFF_ID = "00000000-0000-0000-0000-000000000007";
+    const [existingUatTester] = await db
+      .select()
+      .from(schema.staff)
+      .where(eq(schema.staff.email, "uat-tester@groombook.dev"))
+      .limit(1);
+
+    if (existingUatTester) {
+      console.log(`✓ Staff 'UAT Tester' already exists — skipping`);
+    } else {
+      await db.insert(schema.staff).values({
+        id: UAT_TESTER_STAFF_ID,
+        name: "UAT Tester",
+        email: "uat-tester@groombook.dev",
+        oidcSub: uatTesterOidcSub,
+        role: "groomer",
+        isSuperUser: false,
+        active: true,
+      });
+      console.log(`✓ Created staff 'UAT Tester' (oidcSub: ${uatTesterOidcSub})`);
+    }
+  }
+
  // ── Staff: UAT Groomer Personas (SEED_UAT_GROOMER_EMAILS + SEED_UAT_GROOMER_NAMES) ──
  const groomerEmails = process.env.SEED_UAT_GROOMER_EMAILS?.split(",").map((e) => e.trim()).filter(Boolean) ?? [];
  const groomerNames = process.env.SEED_UAT_GROOMER_NAMES?.split(",").map((n) => n.trim()).filter(Boolean) ?? [];
@@ -490,6 +511,90 @@ async function seedKnownUsers() {
    }
  }

+  // ── Better-Auth email+password credentials for UAT accounts ──────────────────
+  // Provisions Better-Auth user + account records so UAT testers can log in
+  // via email+password (POST /api/auth/sign-in/email) instead of Authentik SSO.
+  const uatPasswordAccounts = [
+    { email: "uat-super@groombook.dev", name: "UAT Super User", passwordEnv: "SEED_UAT_SUPER_PASSWORD", staffEmail: "uat-super@groombook.dev" },
+    { email: "uat-groomer@groombook.dev", name: "UAT Staff Groomer", passwordEnv: "SEED_UAT_GROOMER_PASSWORD", staffEmail: "uat-groomer@groombook.dev" },
+    { email: "uat-customer@groombook.dev", name: "UAT Customer", passwordEnv: "SEED_UAT_CUSTOMER_PASSWORD", staffEmail: null },
+    { email: "uat-tester@groombook.dev", name: "UAT Tester", passwordEnv: "SEED_UAT_TESTER_PASSWORD", staffEmail: "uat-tester@groombook.dev" },
+  ];
+
+  for (const acct of uatPasswordAccounts) {
+    const password = process.env[acct.passwordEnv];
+    if (!password) {
+      console.warn(`⚠ Skipping ${acct.email} — ${acct.passwordEnv} not set`);
+      continue;
+    }
+
+    // 1. Find or create the Better-Auth user
+    const [existingUser] = await db
+      .select()
+      .from(schema.user)
+      .where(eq(schema.user.email, acct.email))
+      .limit(1);
+
+    let userId: string;
+    if (existingUser) {
+      userId = existingUser.id;
+      console.log(`✓ Better-Auth user '${acct.name}' already exists — skipping user creation`);
+    } else {
+      userId = uuid();
+      await db.insert(schema.user).values({
+        id: userId,
+        name: acct.name,
+        email: acct.email,
+        emailVerified: true,
+      });
+      console.log(`✓ Created Better-Auth user '${acct.name}' (${acct.email})`);
+    }
+
+    // 2. Check if credential account already exists
+    const [existingAccount] = await db
+      .select()
+      .from(schema.account)
+      .where(and(
+        eq(schema.account.userId, userId),
+        eq(schema.account.providerId, "credential")
+      ))
+      .limit(1);
+
+    if (existingAccount) {
+      console.log(`✓ Credential account for '${acct.email}' already exists — skipping`);
+    } else {
+      // Use Better-Auth's own hashPassword to guarantee parameter/encoding match.
+      // better-auth/crypto uses: N=16384, r=16, p=1, dkLen=64, salt as 16-byte random
+      // hex string, key hex-encoded, format saltHex:keyHex.
+      const { hashPassword } = await import("better-auth/crypto");
+      const passwordHash = await hashPassword(password);
+
+      await db.insert(schema.account).values({
+        id: uuid(),
+        accountId: userId,
+        providerId: "credential",
+        userId,
+        password: passwordHash,
+      });
+      console.log(`✓ Created credential account for '${acct.email}'`);
+    }
+
+    // 3. Link staff record to Better-Auth user (for accounts that have staff records)
+    if (acct.staffEmail) {
+      const [existingStaff] = await db
+        .select()
+        .from(schema.staff)
+        .where(eq(schema.staff.email, acct.staffEmail))
+        .limit(1);
+      if (existingStaff && !existingStaff.userId) {
+        await db.update(schema.staff)
+          .set({ userId })
+          .where(eq(schema.staff.id, existingStaff.id));
+        console.log(`✓ Linked staff '${acct.staffEmail}' → Better-Auth user`);
+      }
+    }
+  }
+
  // ── Services: idempotent upsert using name as unique key ─────────────────────
  // UNIQUE constraint on services.name (migration 0020) must exist first.
  // Uses b0000001-... IDs to match main seed servicesDef for same-named services.
@@ -883,6 +988,7 @@ async function seed() {
  let appointmentCount = 0;
  let invoiceCount = 0;
  let visitLogCount = 0;
+  let paidInvoiceCounter = 0;

  // Process in batches per client to keep memory manageable
  const apptBatchSize = 100;
@@ -977,8 +1083,11 @@ async function seed() {

        const invoiceStatus = rand() < 0.95 ? "paid" as const : "pending" as const;
        const paidAt = invoiceStatus === "paid" ? new Date(endTime.getTime() + randInt(5, 30) * 60 * 1000) : null;
+        paidInvoiceCounter++;
+        const stripePaymentIntentId = invoiceStatus === "paid"
+          ? `pi_test_seed_${String(paidInvoiceCounter).padStart(6, "0")}`
+          : null;

-        const stripePaymentIntentId = invoiceStatus === "paid" && rand() < 0.2 ? `pi_test_${uuid().replace(/-/g, "").slice(0, 24)}` : null;
        invoiceBatch.push({
          id: invoiceId,
          appointmentId: apptId,
@@ -1075,7 +1184,7 @@ async function seed() {
      const groomer = pick(groomers);
      const bather = bathers.length > 0 && rand() < 0.6 ? pick(bathers) : null;

-      let startTime = randDate(appointmentsBackDate, now);
+      const startTime = randDate(appointmentsBackDate, now);
      startTime.setHours(randInt(8, 16), pick([0, 15, 30, 45]), 0, 0);
      const endTime = new Date(startTime.getTime() + svc.dur * 60 * 1000);
      const effectivePrice = svc.price;
@@ -1094,14 +1203,16 @@ async function seed() {
      const taxCents = Math.round(effectivePrice * 0.08);
      const totalCents = effectivePrice + taxCents + tipCents;
      const paidAt = new Date(endTime.getTime() + randInt(5, 30) * 60 * 1000);
-      const stripePaymentIntentId = rand() < 0.2 ? `pi_test_${uuid().replace(/-/g, "").slice(0, 24)}` : null;
+      paidInvoiceCounter++;

      invoiceBatch.push({
        id: invoiceId, appointmentId: apptId, clientId,
        subtotalCents: effectivePrice, taxCents, tipCents, totalCents,
        status: "paid" as const,
        paymentMethod: pick(["cash", "card", "card", "card", "check"]) as "cash" | "card" | "check",
-        paidAt, stripePaymentIntentId, notes: null,
+        paidAt,
+        stripePaymentIntentId: `pi_test_seed_${String(paidInvoiceCounter).padStart(6, "0")}`,
+        notes: null,
      });
      lineItemBatch.push({
        id: uuid(), invoiceId, description: svc.name, quantity: 1,
@@ -19,11 +19,10 @@ import { impersonationRouter } from "./routes/impersonation.js";
 import { settingsRouter } from "./routes/settings.js";
 import { authProviderRouter } from "./routes/authProvider.js";
 import { searchRouter } from "./routes/search.js";
-import { bufferRulesRouter } from "./routes/buffer-rules.js";
 import { getObject } from "./lib/s3.js";
 import { calendarRouter } from "./routes/calendar.js";
 import { setupRouter } from "./routes/setup.js";
-import { getDb, businessSettings, eq, staff } from "@groombook/db";
+import { getDb, businessSettings, eq, staff } from "./db/index.js";
 import { authMiddleware } from "./middleware/auth.js";
 import { resolveStaffMiddleware, requireRole, requireRoleOrSuperUser, requireSuperUser } from "./middleware/rbac.js";
 import { devRouter } from "./routes/dev.js";
@@ -270,7 +269,6 @@ api.route("/admin/settings", settingsRouter);
 api.route("/admin/auth-provider", authProviderRouter);
 api.route("/admin/seed", adminSeedRouter);
 api.route("/search", searchRouter);
-api.route("/buffer-rules", bufferRulesRouter);

 const port = Number(process.env.PORT ?? 3000);
 await initAuth();
@@ -1,8 +1,8 @@
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { genericOAuth } from "better-auth/plugins";
-import { getDb, authProviderConfig, eq } from "@groombook/db";
-import { decryptSecret } from "@groombook/db";
+import { getDb, authProviderConfig, eq } from "../db/index.js";
+import { decryptSecret } from "../db/index.js";
 import { sendEmail } from "../services/email.js";

 const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
@@ -97,6 +97,9 @@ export async function initAuth(): Promise<void> {
          window: 10,
          storage: "memory",
          customRules: {
+            "/sign-in/social": { max: 10, window: 60 },
+            "/sign-in/email": { max: 10, window: 60 },
+            "/sign-up/email": { max: 5, window: 60 },
            "/get-session": false,
          },
        },
@@ -247,6 +250,9 @@ export async function initAuth(): Promise<void> {
        window: 10,
        storage: "memory",
        customRules: {
+          "/sign-in/social": { max: 10, window: 60 },
+          "/sign-in/email": { max: 10, window: 60 },
+          "/sign-up/email": { max: 5, window: 60 },
          "/get-session": false,
        },
      },
@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { getDb, impersonationAuditLogs } from "@groombook/db";
+import { getDb, impersonationAuditLogs } from "../db/index.js";
 import type { PortalEnv } from "./portalSession.js";

 /**
@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, impersonationSessions } from "@groombook/db";
+import { and, eq, getDb, impersonationSessions } from "../db/index.js";

 export interface PortalEnv {
  Variables: {
@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff } from "@groombook/db";
+import { and, eq, getDb, sql, staff } from "../db/index.js";

 export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
@@ -10,7 +10,7 @@
 */

 import { Hono } from "hono";
-import { eq, getDb, staff, clients, pets, services } from "@groombook/db";
+import { eq, getDb, staff, clients, pets, services } from "../../db/index.js";

 export const adminSeedRouter = new Hono();

@@ -15,7 +15,7 @@ import {
  pets,
  services,
  staff,
-} from "@groombook/db";
+} from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";

 export const appointmentGroupsRouter = new Hono<AppEnv>();
@@ -18,7 +18,7 @@ import {
  reminderLogs,
  services,
  staff,
-} from "@groombook/db";
+} from "../db/index.js";
 import { buildConfirmationEmail, sendEmail } from "../services/email.js";
 import { notifyWaitlistForAppointment } from "../services/waitlistNotify.js";
 import type { AppEnv } from "../middleware/rbac.js";
@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { eq, getDb, authProviderConfig, encryptSecret } from "@groombook/db";
+import { eq, getDb, authProviderConfig, encryptSecret } from "../db/index.js";
 import { requireSuperUser } from "../middleware/rbac.js";
 import { reinitAuth } from "../lib/auth.js";

@@ -14,7 +14,7 @@ import {
  appointments,
  clients,
  pets,
-} from "@groombook/db";
+} from "../db/index.js";
 import {
  generateAvailableSlots,
  BUSINESS_START_HOUR,
@@ -112,8 +112,6 @@ const bookingSchema = z.object({
  petName: z.string().min(1).max(200),
  petSpecies: z.string().min(1).max(100),
  petBreed: z.string().max(100).optional(),
-  petSizeCategory: z.string().max(50).optional(),
-  petCoatType: z.string().max(50).optional(),
  notes: z.string().max(2000).optional(),
 });

@@ -193,8 +191,6 @@ bookRouter.post(
        name: body.petName,
        species: body.petSpecies,
        breed: body.petBreed ?? null,
-        coatType: (body.petCoatType ?? null) as "smooth" | "double" | "wire" | "curly" | "long" | "hairless" | null,
-        petSizeCategory: (body.petSizeCategory ?? null) as "small" | "medium" | "large" | "xlarge" | null,
      })
      .returning();
    const pet = petInserted[0];
@@ -10,7 +10,7 @@ import {
  pets,
  services,
  staff,
-} from "@groombook/db";
+} from "../db/index.js";

 export const calendarRouter = new Hono();

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { and, eq, exists, getDb, or, clients, appointments } from "@groombook/db";
+import { and, eq, exists, getDb, or, clients, appointments } from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";

 export const clientsRouter = new Hono<AppEnv>();
@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { getDb, staff, clients, eq, sql } from "@groombook/db";
+import { getDb, staff, clients, eq, sql } from "../db/index.js";

 const devRouter = new Hono();

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { and, desc, eq, getDb, groomingVisitLogs, appointments, or } from "@groombook/db";
+import { and, desc, eq, getDb, groomingVisitLogs, appointments, or } from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";

 export const groomingLogsRouter = new Hono<AppEnv>();
@@ -9,7 +9,7 @@ import {
  impersonationAuditLogs,
  clients,
  desc,
-} from "@groombook/db";
+} from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";

 export const impersonationRouter = new Hono<AppEnv>();
@@ -13,7 +13,7 @@ import {
  services,
  clients,
  sql,
-} from "@groombook/db";
+} from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";

 export const invoicesRouter = new Hono<AppEnv>();
@@ -102,7 +102,6 @@ invoicesRouter.get(
        paidAt: invoices.paidAt,
        notes: invoices.notes,
        stripePaymentIntentId: invoices.stripePaymentIntentId,
-        stripeRefundId: invoices.stripeRefundId,
        createdAt: invoices.createdAt,
        updatedAt: invoices.updatedAt,
      })
@@ -130,17 +129,7 @@ invoicesRouter.get("/:id", async (c) => {
    db.select().from(invoiceTipSplits).where(eq(invoiceTipSplits.invoiceId, id)),
  ]);

-  let cardLast4: string | null = null;
-  let paymentStatus: string | null = null;
-  if (invoice.stripePaymentIntentId) {
-    const details = await getPaymentIntentDetails(invoice.stripePaymentIntentId);
-    if (details) {
-      cardLast4 = details.cardLast4;
-      paymentStatus = details.paymentStatus;
-    }
-  }
-
-  return c.json({ ...invoice, lineItems, tipSplits, cardLast4, paymentStatus });
+  return c.json({ ...invoice, lineItems, tipSplits });
 });

 // Save tip splits for an invoice (replaces existing splits)
@@ -460,6 +449,9 @@ invoicesRouter.post(
    if (invoice.status !== "paid") {
      return c.json({ error: "Refund only allowed on paid invoices" }, 422);
    }
+    if (!invoice.stripePaymentIntentId) {
+      return c.json({ error: "No Stripe payment intent found for this invoice" }, 422);
+    }

    return await db.transaction(async (tx) => {
      if (body.idempotencyKey) {
@@ -472,25 +464,17 @@ invoicesRouter.post(
        }
      }

-      let refundId: string;
-
-      if (invoice.stripePaymentIntentId) {
-        const result = await processRefund(id, body.amountCents);
-        if (!result) return c.json({ error: "Refund failed" }, 500);
-        refundId = result.refundId;
-      } else {
-        // Manual refund — no Stripe call needed
-        refundId = `manual_${id}_${Date.now()}`;
-      }
+      const result = await processRefund(id, body.amountCents);
+      if (!result) return c.json({ error: "Refund failed" }, 500);

      await tx.insert(refunds).values({
        invoiceId: id,
-        stripeRefundId: refundId,
+        stripeRefundId: result.refundId,
        idempotencyKey: body.idempotencyKey ?? null,
        amountCents: body.amountCents ?? null,
      });

-      return c.json({ refundId });
+      return c.json({ refundId: result.refundId });
    });
  }
 );
@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { and, eq, exists, getDb, or, pets, appointments } from "@groombook/db";
+import { and, eq, exists, getDb, or, pets, appointments } from "../db/index.js";
 import type { AppEnv } from "../middleware/rbac.js";
 import {
  getPresignedUploadUrl,
@@ -24,8 +24,15 @@ const createPetSchema = z.object({
  shampooPreference: z.string().max(500).optional(),
  specialCareNotes: z.string().max(2000).optional(),
  customFields: z.record(z.string(), z.string()).optional(),
-  sizeCategory: z.enum(["small", "medium", "large", "xlarge"]).optional(),
-  coatType: z.enum(["smooth", "double", "wire", "curly", "long", "hairless"]).optional(),
+  coatType: z.string().max(100).optional(),
+  temperamentScore: z.number().int().min(1).max(5).optional(),
+  temperamentFlags: z.array(z.string().max(100)).max(20).optional(),
+  medicalAlerts: z.array(z.object({
+    type: z.string().max(100),
+    description: z.string().max(1000),
+    severity: z.enum(["low", "medium", "high"]),
+  })).max(50).optional(),
+  preferredCuts: z.array(z.string().max(200)).max(20).optional(),
 });

 const updatePetSchema = createPetSchema.partial().omit({ clientId: true });
@@ -1,8 +1,8 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { eq, inArray } from "@groombook/db";
-import { getDb, appointments, impersonationSessions, waitlistEntries, clients, pets, services, staff, invoices, invoiceLineItems } from "@groombook/db";
+import { eq, inArray } from "../db/index.js";
+import { getDb, appointments, impersonationSessions, waitlistEntries, clients, pets, services, staff, invoices, invoiceLineItems } from "../db/index.js";
 import { validatePortalSession } from "../middleware/portalSession.js";
 import { portalAudit } from "../middleware/portalAudit.js";
 import type { PortalEnv } from "../middleware/portalSession.js";
@@ -149,89 +149,9 @@ portalRouter.get("/pets", async (c) => {
  const clientId = c.get("portalClientId");

  const clientPets = await db.select().from(pets).where(eq(pets.clientId, clientId));
-  return c.json(clientPets.map(p => ({
-    id: p.id,
-    name: p.name,
-    species: p.species,
-    breed: p.breed,
-    weightKg: p.weightKg ? Number(p.weightKg) : null,
-    dateOfBirth: p.dateOfBirth ? new Date(p.dateOfBirth).toISOString() : null,
-    healthAlerts: p.healthAlerts,
-    groomingNotes: p.groomingNotes,
-    cutStyle: p.cutStyle,
-    shampooPreference: p.shampooPreference,
-    specialCareNotes: p.specialCareNotes,
-    coatType: p.coatType,
-    petSizeCategory: p.petSizeCategory,
-    photoKey: p.photoKey,
-    photoUploadedAt: p.photoUploadedAt ? new Date(p.photoUploadedAt).toISOString() : null,
-    customFields: p.customFields,
-  })));
+  return c.json(clientPets.map(p => ({ id: p.id, name: p.name, breed: p.breed, weight: p.weightKg, birthDate: p.dateOfBirth, photoUrl: p.photoKey, notes: p.groomingNotes })));
 });

-const portalPetUpdateSchema = z.object({
-  name: z.string().min(1).max(200).optional(),
-  species: z.string().min(1).max(100).optional(),
-  breed: z.string().max(200).optional().nullable(),
-  weightKg: z.number().positive().optional().nullable(),
-  dateOfBirth: z.string().datetime().optional().nullable(),
-  healthAlerts: z.string().max(2000).optional().nullable(),
-  groomingNotes: z.string().max(2000).optional().nullable(),
-  cutStyle: z.string().max(500).optional().nullable(),
-  shampooPreference: z.string().max(500).optional().nullable(),
-  specialCareNotes: z.string().max(2000).optional().nullable(),
-  coatType: z.enum(["smooth", "double", "wire", "curly", "long", "hairless"]).optional().nullable(),
-  petSizeCategory: z.enum(["small", "medium", "large", "xlarge"]).optional().nullable(),
-  customFields: z.record(z.string(), z.string()).optional(),
-});
-
-portalRouter.patch("/pets/:id",
-  zValidator("json", portalPetUpdateSchema),
-  async (c) => {
-    const db = getDb();
-    const petId = c.req.param("id");
-    const clientId = c.get("portalClientId");
-    const body = c.req.valid("json");
-
-    const [existing] = await db.select().from(pets).where(eq(pets.id, petId)).limit(1);
-    if (!existing) return c.json({ error: "Not found" }, 404);
-    if (existing.clientId !== clientId) return c.json({ error: "Forbidden" }, 403);
-
-    const { weightKg, dateOfBirth, ...rest } = body;
-    const [updated] = await db
-      .update(pets)
-      .set({
-        ...rest,
-        weightKg: weightKg != null ? String(weightKg) : undefined,
-        dateOfBirth: dateOfBirth != null ? new Date(dateOfBirth) : undefined,
-        updatedAt: new Date(),
-      })
-      .where(eq(pets.id, petId))
-      .returning();
-
-    if (!updated) return c.json({ error: "Not found" }, 404);
-
-    return c.json({
-      id: updated.id,
-      name: updated.name,
-      species: updated.species,
-      breed: updated.breed,
-      weightKg: updated.weightKg ? Number(updated.weightKg) : null,
-      dateOfBirth: updated.dateOfBirth ? new Date(updated.dateOfBirth).toISOString() : null,
-      healthAlerts: updated.healthAlerts,
-      groomingNotes: updated.groomingNotes,
-      cutStyle: updated.cutStyle,
-      shampooPreference: updated.shampooPreference,
-      specialCareNotes: updated.specialCareNotes,
-      coatType: updated.coatType,
-      petSizeCategory: updated.petSizeCategory,
-      photoKey: updated.photoKey,
-      photoUploadedAt: updated.photoUploadedAt ? new Date(updated.photoUploadedAt).toISOString() : null,
-      customFields: updated.customFields,
-    });
-  }
-);
-
 portalRouter.get("/invoices", async (c) => {
  const db = getDb();
  const clientId = c.get("portalClientId");
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Chris Farhood	eb2c70efe1	fix(GRO-1370): resolve TS errors and test failures in petsExtendedFields.test.ts CI / Lint & Typecheck (pull_request) Failing after 15s Details CI / Test (pull_request) Successful in 20s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details - Fix vi.mock hoisting by importing and, eq, exists, or from db/index.js via async factory (importOriginal) instead of closing over top-level imports - Fix 'row' possibly undefined in makeDeleteChainable returning() with non-null assertion - Fix invalid UUID format in CLIENT_ID/PET_ID constants (must be valid v4 UUIDs to satisfy z.string().uuid() validation in createPetSchema) - Add missing extended fields (coatType, temperamentScore, temperamentFlags, medicalAlerts, preferredCuts) to buildPet factory defaults to match schema - Add §4.15 Public Booking Flow to UAT_PLAYBOOK.md documenting buffer integration (GRO-1172) scheduling engine endpoints Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 16:21:52 +00:00
The Dogfather	ff024ab375	Merge pull request 'chore: add Renovate config (GRO-1081)' (#17 ) from add-renovate-config into dev CI / Lint & Typecheck (push) Failing after 14s Details CI / Test (push) Failing after 20s Details CI / Build (push) Has been skipped Details CI / Build & Push Docker Images (push) Has been skipped Details CI / Update Infra Image Tags (push) Has been skipped Details chore: add Renovate config (GRO-1081) (#17)	2026-05-20 12:37:08 +00:00
The Dogfather	c19e19c709	Merge pull request 'GRO-1326: Extend seed.ts — UAT email+password credentials' (#23 ) from flea-flicker/uat-email-password-seed into dev CI / Lint & Typecheck (push) Failing after 17s Details CI / Test (push) Failing after 23s Details CI / Build (push) Has been skipped Details CI / Build & Push Docker Images (push) Has been skipped Details CI / Update Infra Image Tags (push) Has been skipped Details GRO-1326: Extend seed.ts — UAT email+password credentials (#23) Provisions Better-Auth user+account records for 4 UAT accounts enabling email+password login via POST /api/auth/sign-in/email. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 04:24:21 +00:00
Chris Farhood	f9a3ebc0f3	fix(test): async hashPassword + hex format fixes for typecheck CI / Lint & Typecheck (pull_request) Failing after 14s Details CI / Test (pull_request) Failing after 21s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details - hashPassword is now async — all callers await it - AC-3/AC-1 assertions updated to expect hex format (saltHex:keyHex) - Destructuring replaced with explicit array access to fix TS strictness on possibly-undefined split() result - scrypt verification removed from test (N=16384 exceeds CI runner memory; format assertions are sufficient) - Removed unused scryptSync import Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 04:11:47 +00:00
Chris Farhood	d3122ad701	fix(seed): use better-auth/crypto hashPassword to match verifyPassword params CI / Lint & Typecheck (pull_request) Failing after 17s Details CI / Test (pull_request) Failing after 21s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details The seed.ts password hashing used N=32768, r=8, p=1 with base64 encoding, which does not match @better-auth/utils@0.4.0's actual implementation (N=16384, r=16, p=1, dkLen=64, hex encoding). This caused every seeded UAT credential to fail verifyPassword at sign-in. Fix: import hashPassword from "better-auth/crypto" in seed.ts and in the test helper. This delegates to Better-Auth's own implementation, guaranteeing parameter and encoding match. Also updates test assertions to expect hex format (saltHex:keyHex) and verifies the hash using the correct scrypt params (N=16384, r=16, p=1). Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 03:57:20 +00:00
Chris Farhood	9ccbc7a171	revert(types): remove GRO-1178 changes from PR #23 branch CI / Lint & Typecheck (pull_request) Failing after 15s Details CI / Test (pull_request) Failing after 21s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details Removes types/index.ts and factories.ts changes that belong in PR #21 (GRO-1178), not this PR. The extended Pet type fields caused CI typecheck failures because the seed/credential logic doesn't use them. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-20 03:25:45 +00:00
Chris Farhood	9ba5da5e75	fix(GRO-1326): add missing Pet fields to buildPet and reduce test scrypt N CI / Lint & Typecheck (pull_request) Failing after 14s Details CI / Test (pull_request) Failing after 20s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details - Add coatType, temperamentScore, temperamentFlags, medicalAlerts, preferredCuts to buildPet() defaults — schema recently added these columns but factories was still missing them, causing TS2739 errors - Reduce scrypt N from 32768 → 4096 in test helpers only — production seed.ts is unaffected; CI runners hit memory limit at N=32768 Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 02:23:56 +00:00
Chris Farhood	575789f7f5	test(api): cover UAT email+password credential seed logic CI / Lint & Typecheck (pull_request) Failing after 14s Details CI / Test (pull_request) Failing after 19s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details Adds seed-uat-credentials.test.ts covering all 7 acceptance criteria: - AC-1: creates user + account for each UAT account with password env var - AC-2: emailVerified = true on created users - AC-3: providerId = "credential", password properly hashed (scrypt, salt:hash) - AC-4/AC-4b: staff.userId linked when staff exists, not updated if already set - AC-5: idempotent — re-running creates no duplicates - AC-6: missing SEED_UAT_*_PASSWORD skips that account with warning (no error) - AC-7: partial env var coverage — only provisioned accounts get created References GRO-1326. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 01:27:28 +00:00
Chris Farhood	a0a75d7e25	feat(seed): provision Better-Auth email+password credentials for UAT accounts Adds a seeding step after UAT staff creation that: - Creates Better-Auth user records (emailVerified: true) for 4 UAT accounts - Creates account records with providerId="credential" and scrypt-hashed passwords - Links staff.userId for accounts with existing staff records (super, groomer, tester) - Reads passwords from SEED_UAT_*_PASSWORD env vars (guard clause skips if unset) - Is fully idempotent (upsert-safe) Bypasses Authentik SSO for UAT login; Shedward can authenticate via POST /api/auth/sign-in/email using the same UAT password secrets. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 01:17:54 +00:00
Chris Farhood	22457ac361	GRO-1178: add extended pet fields to api types CI / Lint & Typecheck (pull_request) Failing after 14s Details CI / Test (pull_request) Failing after 21s Details CI / Build (pull_request) Has been skipped Details CI / Build & Push Docker Images (pull_request) Has been skipped Details CI / Update Infra Image Tags (pull_request) Has been skipped Details Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-20 00:23:16 +00:00
The Dogfather	f12ec4f8d3	Merge pull request 'feat(api): add extended pet profile fields — schema, migration, CRUD, Zod validation' (#10 ) from flea-flicker/pet-profile-extended-fields into dev CI / Lint & Typecheck (push) Failing after 1m15s Details CI / Test (push) Failing after 1m18s Details CI / Build (push) Has been skipped Details CI / Build & Push Docker Images (push) Has been skipped Details CI / Update Infra Image Tags (push) Has been skipped Details feat(api): add extended pet profile fields — schema, migration, CRUD, Zod validation (GRO-1176) Merge groombook/api#10	2026-05-19 23:42:32 +00:00
Chris Farhood	566d5f4b55	chore: add Renovate config GRO-1081: add renovate.json to successor repos Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-14 17:42:22 +00:00
groombook-engineer[bot]	2c928ca4d7	fix(gro-1261): correct infra paths in CI Update Infra Image Tags job (#16 ) The CI workflow referenced wrong paths in groombook/infra: - apps/groombook/overlays/dev/ → apps/overlays/dev/ - apps/groombook/base/ → apps/base/ These paths don't exist in groombook/infra — the correct structure is apps/overlays/dev/ and apps/base/. Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-14 17:29:06 +00:00
the-dogfather-cto[bot]	af75fecb66	Merge pull request #14 from groombook/flea-flicker/gro-1231-pnpm-workspace-dockerfile fix(docker): add missing pnpm-workspace.yaml COPY in deps and runner stages (GRO-1231)	2026-05-14 17:10:25 +00:00
Chris Farhood	2d4df6fe1e	fix(docker): add missing pnpm-workspace.yaml COPY in deps and runner stages Without pnpm-workspace.yaml, pnpm install --frozen-lockfile can't discover the apps/api workspace member, causing "Already up to date" and tsc not found. Also removes stale packages/* entry from pnpm-workspace.yaml (no packages/ directory exists in the dev branch). Fixes: GRO-1231 Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-14 16:50:52 +00:00
the-dogfather-cto[bot]	db10320c8f	fix(auth): override Better Auth sign-in rate limit defaults (#11 ) fix(auth): override Better Auth sign-in rate limit defaults	2026-05-14 10:52:31 +00:00
Chris Farhood	40a4023c65	feat(GRO-1202): add sign-in/sign-up rate limit overrides Port rate limit customRules from groombook/app PR #392 to groombook/api. Adds per-route limits for /sign-in/social, /sign-in/email, and /sign-up/email to both AUTH_DISABLED and production better-auth() instances. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-14 10:34:32 +00:00
groombook-engineer[bot]	d598511b75	fix: resolve pre-existing TypeScript errors for CI compliance (#9 ) Merge PR #9: fix pre-existing TypeScript errors for CI compliance All Lint & Typecheck and Test checks pass. Ready to merge. cc @cpfarhood	2026-05-14 07:50:28 +00:00
Chris Farhood	434c7b94e2	fix: export named DB utilities in petsExtendedFields test mock pets.ts imports pets, appointments, and, eq, exists, or directly from "../db". The vi.mock factory only returned getDb, causing vitest to throw "No 'pets' export is defined" and 7 tests to get 400 instead of 201/200. Fix adds the missing named exports to the mock return object. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 07:24:52 +00:00
Chris Farhood	70af9da338	feat(api): add extended pet profile fields — schema, migration, CRUD, Zod validation Adds five new nullable columns to the pets table: - coat_type (text) - temperament_score (integer, range 1–5) - temperament_flags (jsonb, string[]) - medical_alerts (jsonb, typed MedicalAlert[]) - preferred_cuts (jsonb, string[]) Also: - Exports MedicalAlert interface and MedicalAlertSeverity type from schema - Updates shared Pet type in packages/types - Adds Zod validators for all fields (ranges, max lengths, enum) - Adds 14 tests covering happy path and validation edge cases - Fixes drizzle.config.ts schema path (was ./src/schema.ts, correct is ./src/db/schema.ts) Refs: GRO-1176 Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-14 04:35:51 +00:00
the-dogfather-cto[bot]	e714200b71	Merge pull request #7 from groombook/fix/uat-tester-oidc-sub fix(api): add UAT Tester staff creation in seed script	2026-05-12 21:57:44 +00:00
Chris Farhood	1e70e01046	fix(api): add UAT Tester staff creation in seed script Adds dedicated SEED_UAT_TESTER_OIDC_SUB handling to create the uat-tester staff record with proper oidcSub mapping to Authentik user PK 237. Fixes GRO-1151	2026-05-12 21:44:42 +00:00
the-dogfather-cto[bot]	83d7fecdd3	fix: correct test mock paths from "./db" to "../db" (#5 ) fix: correct test mock paths from "./db" to "../db"	2026-05-12 21:33:02 +00:00
Chris Farhood	2448887924	fix: regenerate pnpm-lock.yaml to sync with package.json - Adds missing drizzle-kit, drizzle-orm, postgres dependencies - Addresses CI failures from Lint & Typecheck and Test jobs - Resolves QA feedback from Lint Roller on PR #5	2026-05-12 21:13:55 +00:00
Chris Farhood	f4995d987d	fix: correct test mock paths from "./db" to "../db" Fixes incorrect vi.mock paths that were causing tests to fail. The mock path should match the import path in the route files. This addresses the authProvider test mock path issue on PR #2. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-12 19:54:29 +00:00
the-dogfather-cto[bot]	c9b699527c	docs: add UAT_PLAYBOOK.md for API service (#3 ) docs: add UAT_PLAYBOOK.md for API service	2026-05-11 14:14:31 +00:00
Chris Farhood	54a6b047fb	docs: add UAT_PLAYBOOK.md for API service Created comprehensive UAT playbook covering all 13 route groups with test cases for authentication, client management, pet management, appointment scheduling, services, staff management, invoicing & payments, customer portal, waitlist, search, reports, impersonation, and settings & setup. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-11 13:47:51 +00:00
Hugh Hackman	1855b374b5	refactor: inline packages/db and packages/types into api package Phase 2 extraction: groombook/api from groombook/app monorepo. Changes: - Move packages/db content to apps/api/src/db/ - Move packages/types content to apps/api/src/types/ - Inline database schema and migrations into api package - Update Dockerfile to build single package - Update CI workflow for single-package structure - Fix vitest.config.ts aliases Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-02 21:21:42 +00:00
Hugh Hackman	004725ae6e	Add pnpm-lock.yaml Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-02 21:11:55 +00:00
Hugh Hackman	51f95e0fd6	Initial extraction: groombook/api from groombook/app monorepo Part of GRO-802 monorepo breakdown. Changes: - Extract apps/api/ as the main API service - Inline packages/db/ (database schema, migrations, utilities) - Inline packages/types/ (shared TypeScript types) - Add CI workflow for lint, typecheck, test, build, docker - Port Dockerfile with 4 stages: runner, migrate, seed, reset Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-02 21:10:21 +00:00