fix(pets): add extended fields to createPetSchema/updatePetSchema (GRO-2172)

createPetSchema in src/routes/pets.ts was missing temperamentScore,
temperamentFlags, medicalAlerts, and preferredCuts. Migrations 0034/0036
and seed data populate them, but POST/PATCH silently dropped the fields
because Zod validation rejected them. GET worked because seed bypassed
the schema. This is the regression originally reported as GRO-1472 and
blocks the GRO-1178 extended-profile feature rollout (api/#39).

Mirrors the field shape that already lives in apps/api/src/routes/pets.ts
(legacy duplicate) and the test expectations in
apps/api/src/__tests__/petsExtendedFields.test.ts:

- temperamentScore: int 1–5
- temperamentFlags: string[] (max 20, item max 100)
- medicalAlerts: { type, description, severity: low|medium|high }[] (max 50)
- preferredCuts: string[] (max 20, item max 200)

updatePetSchema inherits from createPetSchema.partial().omit({ clientId })
so no separate change is needed there.

POST/PATCH handlers now forward medicalAlerts through to the insert/update
with a localized cast — the @groombook/types MedicalAlert includes a
server-generated id that is not part of the API request shape, and the
jsonb column is schemaless at runtime.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/db/src/seed.ts

@@ -668,108 +668,6 @@ async function seedUatStaffAccounts(db: ReturnType<typeof drizzle>) {
       console.log(`✓ Created UAT pet '${pet.name}' with extended fields`);
     }
   }
-
-  // ── GRO-2100: deterministic uat-groomer ↔ pet linkage ───────────────────────
-  // The UAT groomer (`uat-groomer@groombook.dev`, staffId 00000000-0000-0000-0000-000000000004)
-  // needs at least one linked pet/appointment or GRO-1987 TC-UAT-2/3 cannot run
-  // (the pet profile-summary endpoint returns 404 instead of 200/403).
-  //
-  // We deterministically link the UAT groomer to the UAT customer's first pet
-  // ("UAT Pup Alpha") and leave the second pet ("UAT Pup Beta") UNLINKED so
-  // TC-UAT-2 (200) and TC-UAT-3 (403) can both hardcode the stable petIds.
-  await seedUatGroomerLinkage(db, uatCustomerClientId);
-}
-
-/**
- * GRO-2100: create a deterministic completed appointment linking the UAT groomer
- * to "UAT Pup Alpha" (c0000001-0000-0000-0000-000000000002). "UAT Pup Beta"
- * (c0000001-0000-0000-0000-000000000003) is intentionally left UNLINKED so
- * GRO-1987 TC-UAT-3 can verify the 403 forbidden response.
- *
- * Idempotent: the deterministic appointment id (`a0000001-…-0001`) is the
- * upsert key, so re-running the seed on every reset-demo-data CronJob
- * (hourly per apps/overlays/uat/reset-cronjob.yaml) is safe.
- */
-async function seedUatGroomerLinkage(
-  db: ReturnType<typeof drizzle>,
-  customerClientId: string,
-): Promise<void> {
-  const uatGroomerEmail = "uat-groomer@groombook.dev";
-  const LINKED_PET_ID = "c0000001-0000-0000-0000-000000000002"; // UAT Pup Alpha
-  const APPT_ID = "a0000001-0000-0000-0000-000000000001";
-
-  // Only run if the UAT groomer staff record actually exists — dev/test seeds
-  // that don't set SEED_UAT_STAFF_OIDC_SUB should not crash.
-  const [uatGroomerStaff] = await db
-    .select({ id: schema.staff.id })
-    .from(schema.staff)
-    .where(eq(schema.staff.email, uatGroomerEmail))
-    .limit(1);
-  if (!uatGroomerStaff) {
-    return;
-  }
-
-  // Skip if this exact appointment already exists (idempotent on re-seed).
-  const [existing] = await db
-    .select({ id: schema.appointments.id })
-    .from(schema.appointments)
-    .where(eq(schema.appointments.id, APPT_ID))
-    .limit(1);
-  if (existing) {
-    console.log(`✓ GRO-2100: uat-groomer linkage appointment already exists — skipping`);
-    return;
-  }
-
-  // The "Bath & Brush" service id is stable across the reset; falls back to
-  // any active service if it has not been seeded yet (e.g. seedKnownUsers
-  // runs in isolation).
-  const BATH_AND_BRUSH_ID = "b0000001-0000-0000-0000-000000000001";
-  const [bathService] = await db
-    .select({ id: schema.services.id })
-    .from(schema.services)
-    .where(eq(schema.services.id, BATH_AND_BRUSH_ID))
-    .limit(1);
-
-  let serviceId: string;
-  if (bathService) {
-    serviceId = bathService.id;
-  } else {
-    const [fallback] = await db
-      .select({ id: schema.services.id })
-      .from(schema.services)
-      .where(eq(schema.services.active, true))
-      .limit(1);
-    if (!fallback) {
-      console.warn(`⚠ GRO-2100: no active services found — skipping uat-groomer linkage`);
-      return;
-    }
-    serviceId = fallback.id;
-  }
-
-  // Schedule the completed appointment 7 days ago so the profile-summary's
-  // "recentGroomingHistory" window (last 10) reliably includes it.
-  const startTime = new Date();
-  startTime.setDate(startTime.getDate() - 7);
-  startTime.setHours(10, 0, 0, 0);
-  const endTime = new Date(startTime.getTime() + 45 * 60 * 1000);
-
-  await db.insert(schema.appointments).values({
-    id: APPT_ID,
-    clientId: customerClientId,
-    petId: LINKED_PET_ID,
-    serviceId,
-    staffId: uatGroomerStaff.id,
-    batherStaffId: null,
-    status: "completed",
-    startTime,
-    endTime,
-    notes: "GRO-2100: deterministic uat-groomer linkage for TC-UAT-2/3.",
-    priceCents: null,
-    confirmationStatus: "confirmed",
-  });
-  console.log(
-    `✓ GRO-2100: linked uat-groomer (${uatGroomerStaff.id}) → UAT Pup Alpha (${LINKED_PET_ID}) via appointment ${APPT_ID}`,
-  );
 }
 
 // ── Known-users-only seed (prod/demo) ───────────────────────────────────────

src/routes/pets.ts

@@ -57,6 +57,23 @@ const createPetSchema = z.object({
   customFields: z.record(z.string(), z.string()).optional(),
   petSizeCategory: z.enum(["small", "medium", "large", "extra_large"]).optional(),
   coatType: z.enum(["short", "medium", "long", "double", "wire", "silky", "curly", "hairless"]).optional(),
+  // Extended pet profile fields (api/#39, GRO-1178).
+  // GRO-2172: these were missing from the schema, causing POST/PATCH to
+  // silently drop them even though migrations 0034/0036 and seed data
+  // populate them. GRO-1472 was the original UAT regression.
+  temperamentScore: z.number().int().min(1).max(5).optional(),
+  temperamentFlags: z.array(z.string().max(100)).max(20).optional(),
+  medicalAlerts: z
+    .array(
+      z.object({
+        type: z.string().max(100),
+        description: z.string().max(1000),
+        severity: z.enum(["low", "medium", "high"]),
+      })
+    )
+    .max(50)
+    .optional(),
+  preferredCuts: z.array(z.string().max(200)).max(20).optional(),
 });
 
 const updatePetSchema = createPetSchema.partial().omit({ clientId: true });
@@ -333,7 +350,8 @@ petsRouter.get("/:id/profile-summary", async (c) => {
 
 petsRouter.post("/", zValidator("json", createPetSchema), async (c) => {
   const db = getDb();
-  const { weightKg, dateOfBirth, customFields, ...rest } = c.req.valid("json");
+  const { weightKg, dateOfBirth, customFields, medicalAlerts, ...rest } =
+    c.req.valid("json");
   const [row] = await db
     .insert(pets)
     .values({
@@ -341,6 +359,10 @@ petsRouter.post("/", zValidator("json", createPetSchema), async (c) => {
       weightKg: weightKg?.toString(),
       dateOfBirth: dateOfBirth ? new Date(dateOfBirth) : undefined,
       customFields: customFields ?? {},
+      // GRO-2172: medicalAlerts shape from the API request is
+      // { type, description, severity } — the @groombook/types MedicalAlert
+      // has an optional server-generated `id`, so cast for the jsonb column.
+      medicalAlerts: medicalAlerts as never,
     })
     .returning();
   return c.json(row, 201);
@@ -351,7 +373,8 @@ petsRouter.patch(
   zValidator("json", updatePetSchema),
   async (c) => {
     const db = getDb();
-    const { weightKg, dateOfBirth, customFields, ...rest } = c.req.valid("json");
+    const { weightKg, dateOfBirth, customFields, medicalAlerts, ...rest } =
+      c.req.valid("json");
     const [row] = await db
       .update(pets)
       .set({
@@ -359,6 +382,7 @@ petsRouter.patch(
         weightKg: weightKg?.toString(),
         dateOfBirth: dateOfBirth ? new Date(dateOfBirth) : undefined,
         ...(customFields !== undefined ? { customFields } : {}),
+        medicalAlerts: medicalAlerts as never,
         updatedAt: new Date(),
       })
       .where(eq(pets.id, c.req.param("id")))