feat(GRO-609): admin refund handling and payment stats dashboard

- Add refund button to invoice detail modal (paid Stripe invoices only)
- Full refund (default) and partial refund via confirmation dialog
- Call POST /api/invoices/:id/refund on confirmation
- Display Stripe payment info (card last4, brand, payment status)
- Show refund status when invoice has been refunded
- Add payment stats section to InvoicesPage (revenue, outstanding, refunds, method breakdown)
- Add GET /api/invoices/:id/stripe-payment endpoint for card details
- Add GET /api/invoices/stats endpoint for monthly payment stats
- Extend Invoice type with Stripe fields (stripePaymentIntentId, stripeRefundId)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.dockerignore

@@ -7,3 +7,5 @@ apps/web/dist
 apps/api/dist
 packages/db/dist
 packages/types/dist
+.turbo
+screenshots/

.github/workflows/ci.yml

@@ -20,6 +20,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
 
       - uses: actions/setup-node@v4
         with:
@@ -42,6 +44,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
 
       - uses: actions/setup-node@v4
         with:
@@ -62,6 +66,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
 
       - uses: actions/setup-node@v4
         with:
@@ -101,6 +107,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
 
       - uses: actions/setup-node@v4
         with:
@@ -238,7 +246,6 @@ jobs:
           echo "Deploying images tagged $TAG to groombook-dev..."
 
           # Run migration with PR image
-          kubectl delete job migrate-schema -n groombook-dev --ignore-not-found
           kubectl delete job "migrate-pr-$PR_NUM" -n groombook-dev --ignore-not-found
           cat <<EOF | kubectl apply -n groombook-dev -f -
           apiVersion: batch/v1
@@ -303,6 +310,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: pnpm/action-setup@v4
+        with:
+          version: '9.15.4'
 
       - uses: actions/setup-node@v4
         with:
@@ -409,11 +418,17 @@ jobs:
 
           git push -u origin "chore/update-image-tags-${TAG}"
 
-          # Create PR and merge immediately (no required checks on groombook/infra)
-          PR_URL=$(gh pr create \
-            --repo groombook/infra \
-            --base main \
-            --head "chore/update-image-tags-${TAG}" \
-            --title "chore: deploy ${TAG} to dev" \
-            --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
-          gh pr merge "$PR_URL" --merge
+          # Check if PR already exists for this branch
+          EXISTING_PR=$(gh pr list --repo groombook/infra --head "chore/update-image-tags-${TAG}" --state open --json number -q '.[0].number' || true)
+          if [ -n "$EXISTING_PR" ]; then
+            echo "PR #$EXISTING_PR already exists for this tag, merging existing PR"
+            gh pr merge "$EXISTING_PR" --repo groombook/infra --merge
+          else
+            PR_URL=$(gh pr create \
+              --repo groombook/infra \
+              --base main \
+              --head "chore/update-image-tags-${TAG}" \
+              --title "chore: deploy ${TAG} to dev" \
+              --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
+            gh pr merge "$PR_URL" --merge
+          fi

.github/workflows/promote-prod.yml

@@ -14,7 +14,29 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      packages: read
     steps:
+      - name: Validate tag format
+        run: |
+          TAG="${{ inputs.tag }}"
+          if ! echo "$TAG" | grep -qE '^[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[a-f0-9]{7}$'; then
+            echo "::error::Invalid tag format: '$TAG'. Expected format: YYYY.MM.DD-sha7 (e.g. 2026.03.28-f1b85bf)"
+            exit 1
+          fi
+          echo "Tag format valid: $TAG"
+
+      - name: Verify image exists in GHCR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ inputs.tag }}"
+          # Check that the API image exists — if API was pushed, web/migrate were too
+          if ! gh api "/orgs/groombook/packages/container/api/versions" --jq ".[].metadata.container.tags[]" 2>/dev/null | grep -qF "$TAG"; then
+            echo "::error::Image ghcr.io/groombook/api:$TAG not found in GHCR. Verify the tag was built and pushed."
+            exit 1
+          fi
+          echo "Image verified: ghcr.io/groombook/api:$TAG exists"
+
       - name: Generate infra repo token
         id: infra-token
         uses: tibdex/github-app-token@v2

apps/api/Dockerfile

@@ -12,6 +12,7 @@ RUN pnpm install --frozen-lockfile
 
 # Build
 FROM deps AS builder
+RUN mkdir -p /home/node/.cache/node/corepack
 COPY packages/ packages/
 COPY apps/api/ apps/api/
 RUN pnpm --filter @groombook/types build && \
@@ -34,6 +35,9 @@ COPY --from=builder /app/packages/types/dist packages/types/dist
 RUN pnpm install --frozen-lockfile --prod
 
 EXPOSE 3000
+RUN apk add --no-cache curl
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:3000/health || exit 1
 CMD ["node", "apps/api/dist/index.js"]
 
 # Migrate stage — runs drizzle-kit migrate against the database
@@ -46,4 +50,4 @@ CMD ["pnpm", "db:seed"]
 
 # Reset stage — drops all tables, re-runs migrations, and re-seeds
 FROM builder AS reset
-CMD ["pnpm", "db:reset"]
+CMD ["pnpm", "db:reset"]

apps/api/package.json

@@ -23,7 +23,7 @@
     "node-cron": "^3.0.3",
     "nodemailer": "^6.9.16",
     "stripe": "^22.0.0",
-    "telnyx": "^6.41.0",
+
     "zod": "^4.3.6"
   },
   "devDependencies": {

apps/api/src/index.ts

@@ -28,6 +28,7 @@ import { resolveStaffMiddleware, requireRole, requireRoleOrSuperUser, requireSup
 import { devRouter } from "./routes/dev.js";
 import { adminSeedRouter } from "./routes/admin/seed.js";
 import { startReminderScheduler } from "./services/reminders.js";
+import { webhooksRouter } from "./routes/stripe-webhooks.js";
 
 const app = new Hono();
 
@@ -50,6 +51,9 @@ app.route("/api/book", bookRouter);
 // Public portal routes — client-facing, authenticated via impersonation session header
 app.route("/api/portal", portalRouter);
 
+// Public Stripe webhook endpoint — signature-verified, no auth required
+app.route("/api/webhooks/stripe", webhooksRouter);
+
 // Dev/demo routes — config is always public, users endpoint is guarded internally
 app.route("/api/dev", devRouter);
 

apps/api/src/routes/admin/sms.ts

@@ -1,51 +0,0 @@
-import { Hono } from "hono";
-import { getDb, businessSettings, reminderLogs, eq, sql, and, gte, lt } from "@groombook/db";
-import { requireRole } from "../middleware/rbac.js";
-import { createSmsProvider } from "../services/sms.js";
-
-export const adminSmsRouter = new Hono();
-
-adminSmsRouter.get("/status", requireManager(), async (c) => {
-  const db = getDb();
-
-  const [settings] = await db.select().from(businessSettings).limit(1);
-
-  const provider = createSmsProvider();
-  const smsEnabled = process.env.SMS_ENABLED === "true";
-  const providerName = process.env.SMS_PROVIDER ?? "none";
-  const fromNumber = process.env.TELNYX_FROM_NUMBER ?? null;
-  const connectionStatus = provider ? "connected" : "disconnected";
-
-  const now = new Date();
-  const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
-
-  const statsRows = await db
-    .select({
-      status: reminderLogs.deliveryStatus,
-      count: sql<number>`count(*)::int`,
-    })
-    .from(reminderLogs)
-    .where(
-      and(
-        eq(reminderLogs.channel, "sms"),
-        gte(reminderLogs.sentAt, startOfMonth)
-      )
-    )
-    .groupBy(reminderLogs.deliveryStatus);
-
-  const totals = { sent: 0, delivered: 0, failed: 0 };
-  for (const row of statsRows) {
-    if (row.status === "delivered") totals.delivered = row.count;
-    else if (row.status === "failed") totals.failed = row.count;
-    else totals.sent += row.count;
-  }
-
-  return c.json({
-    providerName,
-    fromNumber,
-    connectionStatus,
-    smsEnabled,
-    businessSmsEnabled: settings?.smsEnabled ?? false,
-    stats: totals,
-  });
-});

apps/api/src/routes/appointmentGroups.ts

@@ -16,8 +16,9 @@ import {
   services,
   staff,
 } from "@groombook/db";
+import type { AppEnv } from "../middleware/rbac.js";
 
-export const appointmentGroupsRouter = new Hono();
+export const appointmentGroupsRouter = new Hono<AppEnv>();
 
 // ─── Schemas ──────────────────────────────────────────────────────────────────
 
@@ -49,6 +50,8 @@ appointmentGroupsRouter.get("/", async (c) => {
   const clientId = c.req.query("clientId");
   const from = c.req.query("from");
   const to = c.req.query("to");
+  const staffRow = c.get("staff");
+  const isGroomer = staffRow?.role === "groomer";
 
   const groupConditions = clientId
     ? [eq(appointmentGroups.clientId, clientId)]
@@ -88,6 +91,16 @@ appointmentGroupsRouter.get("/", async (c) => {
     }))
     .filter((g) => !from || g.appointments.length > 0);
 
+  if (isGroomer) {
+    return c.json(
+      result.filter((g) =>
+        g.appointments.some(
+          (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
+        )
+      )
+    );
+  }
+
   return c.json(result);
 });
 
@@ -96,6 +109,8 @@ appointmentGroupsRouter.get("/", async (c) => {
 appointmentGroupsRouter.get("/:id", async (c) => {
   const db = getDb();
   const id = c.req.param("id");
+  const staffRow = c.get("staff");
+  const isGroomer = staffRow?.role === "groomer";
 
   const [group] = await db
     .select()
@@ -111,6 +126,7 @@ appointmentGroupsRouter.get("/:id", async (c) => {
       serviceId: appointments.serviceId,
       serviceName: services.name,
       staffId: appointments.staffId,
+      batherStaffId: appointments.batherStaffId,
       staffName: staff.name,
       status: appointments.status,
       startTime: appointments.startTime,
@@ -125,6 +141,15 @@ appointmentGroupsRouter.get("/:id", async (c) => {
     .where(eq(appointments.groupId, id))
     .orderBy(appointments.startTime);
 
+  if (
+    isGroomer &&
+    !groupAppts.some(
+      (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
+    )
+  ) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
+
   const [client] = await db
     .select({ name: clients.name, email: clients.email })
     .from(clients)
@@ -140,6 +165,13 @@ appointmentGroupsRouter.post(
   zValidator("json", createGroupSchema),
   async (c) => {
     const db = getDb();
+    const staffRow = c.get("staff");
+    if (staffRow?.role === "groomer") {
+      return c.json(
+        { error: "Forbidden: groomers cannot create group bookings" },
+        403
+      );
+    }
     const body = c.req.valid("json");
     const startTime = new Date(body.startTime);
 
@@ -244,6 +276,28 @@ appointmentGroupsRouter.patch(
     const db = getDb();
     const id = c.req.param("id");
     const body = c.req.valid("json");
+    const staffRow = c.get("staff");
+    const isGroomer = staffRow?.role === "groomer";
+
+    const [group] = await db
+      .select({ id: appointmentGroups.id })
+      .from(appointmentGroups)
+      .where(eq(appointmentGroups.id, id));
+    if (!group) return c.json({ error: "Not found" }, 404);
+
+    if (isGroomer) {
+      const groupAppts = await db
+        .select({ staffId: appointments.staffId, batherStaffId: appointments.batherStaffId })
+        .from(appointments)
+        .where(eq(appointments.groupId, id));
+      if (
+        !groupAppts.some(
+          (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
+        )
+      ) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+    }
 
     const [updated] = await db
       .update(appointmentGroups)
@@ -261,6 +315,8 @@ appointmentGroupsRouter.patch(
 appointmentGroupsRouter.delete("/:id", async (c) => {
   const db = getDb();
   const id = c.req.param("id");
+  const staffRow = c.get("staff");
+  const isGroomer = staffRow?.role === "groomer";
 
   const [group] = await db
     .select({ id: appointmentGroups.id })
@@ -268,6 +324,20 @@ appointmentGroupsRouter.delete("/:id", async (c) => {
     .where(eq(appointmentGroups.id, id));
   if (!group) return c.json({ error: "Not found" }, 404);
 
+  if (isGroomer) {
+    const groupAppts = await db
+      .select({ staffId: appointments.staffId, batherStaffId: appointments.batherStaffId })
+      .from(appointments)
+      .where(eq(appointments.groupId, id));
+    if (
+      !groupAppts.some(
+        (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
+      )
+    ) {
+      return c.json({ error: "Forbidden" }, 403);
+    }
+  }
+
   await db
     .update(appointments)
     .set({ status: "cancelled", updatedAt: new Date() })

apps/api/src/routes/appointments.ts

@@ -163,6 +163,28 @@ appointmentsRouter.post(
           }
         }
 
+        if (apptFields.batherStaffId) {
+          const bathConflicts = await tx
+            .select({ id: appointments.id })
+            .from(appointments)
+            .where(
+              and(
+                or(
+                  eq(appointments.staffId, apptFields.batherStaffId),
+                  eq(appointments.batherStaffId, apptFields.batherStaffId)
+                ),
+                lt(appointments.startTime, end),
+                gte(appointments.endTime, start),
+                ne(appointments.status, "cancelled"),
+                ne(appointments.status, "no_show"),
+              )
+            )
+            .limit(1);
+          if (bathConflicts.length > 0) {
+            throw Object.assign(new Error("conflict"), { statusCode: 409 });
+          }
+        }
+
         if (!recurrence) {
           // Single appointment
           const [inserted] = await tx
@@ -398,7 +420,8 @@ appointmentsRouter.patch(
     const needsConflictCheck =
       updateFields.startTime !== undefined ||
       updateFields.endTime !== undefined ||
-      updateFields.staffId !== undefined;
+      updateFields.staffId !== undefined ||
+      updateFields.batherStaffId !== undefined;
 
     const update: Record<string, unknown> = {
       ...updateFields,
@@ -434,6 +457,11 @@ appointmentsRouter.patch(
             updateFields.staffId !== undefined
               ? updateFields.staffId
               : current.staffId;
+          // Use provided batherStaffId (may be null to unassign); fall back to existing
+          const batherStaffId =
+            updateFields.batherStaffId !== undefined
+              ? updateFields.batherStaffId
+              : current.batherStaffId;
 
           if (end <= start) {
             throw Object.assign(new Error("end before start"), {
@@ -461,6 +489,29 @@ appointmentsRouter.patch(
             }
           }
 
+          if (batherStaffId) {
+            const bathConflicts = await tx
+              .select({ id: appointments.id })
+              .from(appointments)
+              .where(
+                and(
+                  or(
+                    eq(appointments.staffId, batherStaffId),
+                    eq(appointments.batherStaffId, batherStaffId)
+                  ),
+                  lt(appointments.startTime, end),
+                  gte(appointments.endTime, start),
+                  ne(appointments.status, "cancelled"),
+                  ne(appointments.status, "no_show"),
+                  ne(appointments.id, id),
+                )
+              )
+              .limit(1);
+            if (bathConflicts.length > 0) {
+              throw Object.assign(new Error("conflict"), { statusCode: 409 });
+            }
+          }
+
           const [updated] = await tx
             .update(appointments)
             .set(update)

apps/api/src/routes/clients.ts

@@ -4,35 +4,12 @@ import { z } from "zod/v3";
 import { and, eq, exists, getDb, or, clients, appointments } from "@groombook/db";
 import type { AppEnv } from "../middleware/rbac.js";
 
-function normalizeE164(phone: string): string | null {
-  const digits = phone.replace(/\D/g, "");
-  if (digits.length === 10) return `+1${digits}`;
-  if (digits.length === 11 && digits.startsWith("1")) return `+${digits}`;
-  if (digits.length > 11 && digits.startsWith("1")) return `+${digits.slice(0, 11)}`;
-  return null;
-}
-
-function e164String() {
-  return z.string().transform((v, ctx) => {
-    if (!v) return v as unknown as undefined;
-    const normalized = normalizeE164(v);
-    if (!normalized) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: "Invalid phone number. Must be a valid E.164 number (e.g. +12125551234).",
-      });
-      return z.NEVER;
-    }
-    return normalized;
-  });
-}
-
 export const clientsRouter = new Hono<AppEnv>();
 
 const createClientSchema = z.object({
   name: z.string().min(1).max(200),
   email: z.string().email().optional(),
-  phone: e164String().optional(),
+  phone: z.string().max(50).optional(),
   address: z.string().max(500).optional(),
   notes: z.string().max(2000).optional(),
 });

apps/api/src/routes/groomingLogs.ts

@@ -1,9 +1,10 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { desc, eq, getDb, groomingVisitLogs } from "@groombook/db";
+import { and, desc, eq, getDb, groomingVisitLogs, appointments, or } from "@groombook/db";
+import type { AppEnv } from "../middleware/rbac.js";
 
-export const groomingLogsRouter = new Hono();
+export const groomingLogsRouter = new Hono<AppEnv>();
 
 const createLogSchema = z.object({
   petId: z.string().uuid(),
@@ -20,6 +21,26 @@ groomingLogsRouter.get("/", async (c) => {
   const db = getDb();
   const petId = c.req.query("petId");
   if (!petId) return c.json({ error: "petId is required" }, 400);
+  const staffRow = c.get("staff");
+  const isGroomer = staffRow?.role === "groomer";
+
+  if (isGroomer) {
+    const [appt] = await db
+      .select({ id: appointments.id })
+      .from(appointments)
+      .where(
+        and(
+          eq(appointments.petId, petId),
+          or(
+            eq(appointments.staffId, staffRow.id),
+            eq(appointments.batherStaffId, staffRow.id)
+          )
+        )
+      )
+      .limit(1);
+    if (!appt) return c.json({ error: "Forbidden" }, 403);
+  }
+
   const rows = await db
     .select()
     .from(groomingVisitLogs)
@@ -33,11 +54,50 @@ groomingLogsRouter.post(
   zValidator("json", createLogSchema),
   async (c) => {
     const db = getDb();
-    const { groomedAt, ...rest } = c.req.valid("json");
+    const { groomedAt, petId, appointmentId, ...rest } = c.req.valid("json");
+    const staffRow = c.get("staff");
+    const isGroomer = staffRow?.role === "groomer";
+
+    if (isGroomer) {
+      if (appointmentId) {
+        const [appt] = await db
+          .select({ id: appointments.id })
+          .from(appointments)
+          .where(
+            and(
+              eq(appointments.id, appointmentId),
+              or(
+                eq(appointments.staffId, staffRow.id),
+                eq(appointments.batherStaffId, staffRow.id)
+              )
+            )
+          )
+          .limit(1);
+        if (!appt) return c.json({ error: "Forbidden" }, 403);
+      } else {
+        const [appt] = await db
+          .select({ id: appointments.id })
+          .from(appointments)
+          .where(
+            and(
+              eq(appointments.petId, petId),
+              or(
+                eq(appointments.staffId, staffRow.id),
+                eq(appointments.batherStaffId, staffRow.id)
+              )
+            )
+          )
+          .limit(1);
+        if (!appt) return c.json({ error: "Forbidden" }, 403);
+      }
+    }
+
     const [row] = await db
       .insert(groomingVisitLogs)
       .values({
         ...rest,
+        petId,
+        appointmentId: appointmentId ?? null,
         groomedAt: groomedAt ? new Date(groomedAt) : new Date(),
       })
       .returning();
@@ -47,10 +107,37 @@ groomingLogsRouter.post(
 
 groomingLogsRouter.delete("/:id", async (c) => {
   const db = getDb();
-  const [row] = await db
+  const id = c.req.param("id");
+  const staffRow = c.get("staff");
+  const isGroomer = staffRow?.role === "groomer";
+
+  const [log] = await db
+    .select()
+    .from(groomingVisitLogs)
+    .where(eq(groomingVisitLogs.id, id))
+    .limit(1);
+  if (!log) return c.json({ error: "Not found" }, 404);
+
+  if (isGroomer) {
+    const [appt] = await db
+      .select({ id: appointments.id })
+      .from(appointments)
+      .where(
+        and(
+          eq(appointments.petId, log.petId),
+          or(
+            eq(appointments.staffId, staffRow.id),
+            eq(appointments.batherStaffId, staffRow.id)
+          )
+        )
+      )
+      .limit(1);
+    if (!appt) return c.json({ error: "Forbidden" }, 403);
+  }
+
+  await db
     .delete(groomingVisitLogs)
-    .where(eq(groomingVisitLogs.id, c.req.param("id")))
+    .where(eq(groomingVisitLogs.id, id))
     .returning();
-  if (!row) return c.json({ error: "Not found" }, 404);
   return c.json({ ok: true });
 });

apps/api/src/routes/invoices.ts

@@ -4,6 +4,7 @@ import { z } from "zod/v3";
 import {
   and,
   eq,
+  gte,
   getDb,
   invoices,
   invoiceLineItems,
@@ -13,8 +14,9 @@ import {
   clients,
   sql,
 } from "@groombook/db";
+import type { AppEnv } from "../middleware/rbac.js";
 
-export const invoicesRouter = new Hono();
+export const invoicesRouter = new Hono<AppEnv>();
 
 const createInvoiceSchema = z.object({
   appointmentId: z.string().uuid().optional(),
@@ -376,3 +378,106 @@ invoicesRouter.post(
     return c.json({ refundId: result.refundId });
   }
 );
+
+// ─── Stripe Payment Info ───────────────────────────────────────────────────────
+
+import { getStripeClient } from "../services/payment.js";
+
+invoicesRouter.get("/:id/stripe-payment", async (c) => {
+  const db = getDb();
+  const id = c.req.param("id");
+
+  const [invoice] = await db.select().from(invoices).where(eq(invoices.id, id));
+  if (!invoice) return c.json({ error: "Not found" }, 404);
+
+  if (!invoice.stripePaymentIntentId) {
+    return c.json({ error: "No Stripe payment found for this invoice" }, 404);
+  }
+
+  const stripe = getStripeClient();
+  if (!stripe) return c.json({ error: "Stripe not configured" }, 503);
+
+  try {
+    const paymentIntent = await stripe.paymentIntents.retrieve(invoice.stripePaymentIntentId);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const cardDetails = (paymentIntent as any).payment_details?.card;
+    const refundStatus = invoice.stripeRefundId
+      ? await stripe.refunds.retrieve(invoice.stripeRefundId).then((r) => r.status).catch(() => null)
+      : null;
+
+    return c.json({
+      paymentIntentId: invoice.stripePaymentIntentId,
+      amountPaidCents: paymentIntent.amount_received,
+      status: paymentIntent.status,
+      cardLast4: cardDetails?.last4 ?? null,
+      cardBrand: cardDetails?.brand ?? null,
+      refundId: invoice.stripeRefundId,
+      refundStatus,
+    });
+  } catch {
+    return c.json({ error: "Failed to retrieve Stripe payment info" }, 500);
+  }
+});
+
+// ─── Payment Stats ─────────────────────────────────────────────────────────────
+
+invoicesRouter.get("/stats", async (c) => {
+  const db = getDb();
+  const now = new Date();
+  const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
+
+  const thisMonthInvoices = await db
+    .select()
+    .from(invoices)
+    .where(
+      and(
+        gte(invoices.createdAt, startOfMonth),
+        eq(invoices.status, "paid")
+      )
+    );
+
+  const revenueCents = thisMonthInvoices.reduce((sum, inv) => sum + inv.totalCents, 0);
+
+  const pendingInvoices = await db
+    .select({ totalCents: invoices.totalCents })
+    .from(invoices)
+    .where(eq(invoices.status, "pending"));
+
+  const outstandingCents = pendingInvoices.reduce((sum, inv) => sum + inv.totalCents, 0);
+
+  const refundedInvoices = await db
+    .select()
+    .from(invoices)
+    .where(
+      and(
+        gte(invoices.createdAt, startOfMonth),
+        sql`${invoices.stripeRefundId} IS NOT NULL`
+      )
+    );
+
+  const refundsCents = refundedInvoices.reduce((sum, inv) => sum + inv.totalCents, 0);
+
+  const paymentMethodBreakdown = await db
+    .select({
+      paymentMethod: invoices.paymentMethod,
+      count: sql<number>`count(*)`,
+      totalCents: sql<number>`sum(${invoices.totalCents})`,
+    })
+    .from(invoices)
+    .where(
+      and(
+        gte(invoices.createdAt, startOfMonth),
+        sql`${invoices.paymentMethod} IS NOT NULL`
+      )
+    )
+    .groupBy(invoices.paymentMethod);
+
+  return c.json({
+    revenueCents,
+    outstandingCents,
+    refundsCents,
+    revenueCount: thisMonthInvoices.length,
+    refundCount: refundedInvoices.length,
+    paymentMethodBreakdown,
+  });
+});

apps/api/src/routes/portal.ts

@@ -35,6 +35,12 @@ portalRouter.get("/me", async (c) => {
   return c.json({ id: client.id, name: client.name, email: client.email, phone: client.phone });
 });
 
+portalRouter.get("/config", async (c) => {
+  return c.json({
+    stripePublishableKey: process.env.STRIPE_PUBLISHABLE_KEY ?? "",
+  });
+});
+
 portalRouter.get("/services", async (c) => {
   const db = getDb();
   const allServices = await db.select().from(services).where(eq(services.active, true));
@@ -123,7 +129,7 @@ portalRouter.get("/invoices", async (c) => {
     id: inv.id,
     status: inv.status,
     totalCents: inv.totalCents,
-    createdAt: inv.createdAt,
+    date: inv.createdAt,
     lineItems: (itemsByInvoice[inv.id] || []).map(li => ({ id: li.id, description: li.description, quantity: li.quantity, unitPriceCents: li.unitPriceCents, totalCents: li.totalCents })),
   })));
 });
@@ -453,49 +459,12 @@ portalRouter.delete("/waitlist/:id", async (c) => {
 import {
   createPaymentIntent,
   listPaymentMethods,
-  attachPaymentMethod,
   detachPaymentMethod,
   createSetupIntent,
   getOrCreateStripeCustomer,
+  getStripeClient,
 } from "../services/payment.js";
 
-const payInvoiceSchema = z.object({
-  invoiceId: z.string().uuid(),
-});
-
-portalRouter.post(
-  "/invoices/:id/pay",
-  zValidator("json", payInvoiceSchema),
-  async (c) => {
-    const db = getDb();
-    const invoiceId = c.req.param("id");
-    const sessionId = c.req.header("X-Impersonation-Session-Id");
-    const clientId = await getClientIdFromSession(sessionId);
-    if (!clientId) return c.json({ error: "Unauthorized" }, 401);
-
-    const [invoice] = await db
-      .select()
-      .from(invoices)
-      .where(eq(invoices.id, invoiceId))
-      .limit(1);
-
-    if (!invoice) return c.json({ error: "Not found" }, 404);
-    if (invoice.clientId !== clientId) return c.json({ error: "Forbidden" }, 403);
-    if (invoice.status === "draft" || invoice.status === "void") {
-      return c.json({ error: "Cannot pay a draft or void invoice" }, 422);
-    }
-    if (invoice.status === "paid") {
-      return c.json({ error: "Invoice is already paid" }, 422);
-    }
-
-    const stripePublishableKey = process.env.STRIPE_PUBLISHABLE_KEY ?? "";
-    const result = await createPaymentIntent(invoiceId, clientId);
-    if (!result) return c.json({ error: "Payment service unavailable" }, 503);
-
-    return c.json({ clientSecret: result.clientSecret, publishableKey: stripePublishableKey });
-  }
-);
-
 const payMultipleSchema = z.object({
   invoiceIds: z.array(z.string().uuid()).min(1),
 });
@@ -530,6 +499,7 @@ portalRouter.post(
     }
 
     const firstInvoice = invoiceRows[0];
+    if (!firstInvoice) return c.json({ error: "No invoices found" }, 400);
     const allSameClient = invoiceRows.every(inv => inv.clientId === firstInvoice.clientId);
     if (!allSameClient) {
       return c.json({ error: "All invoices must belong to the same client" }, 422);
@@ -574,19 +544,23 @@ portalRouter.delete("/payment-methods/:id", async (c) => {
   if (!clientId) return c.json({ error: "Unauthorized" }, 401);
 
   const paymentMethodId = c.req.param("id");
+
+  const stripeCustomerId = await getOrCreateStripeCustomer(clientId);
+  if (!stripeCustomerId) return c.json({ error: "No payment method found" }, 404);
+
+  const stripe = getStripeClient();
+  if (!stripe) return c.json({ error: "Payment service unavailable" }, 503);
+
+  const paymentMethod = await stripe.paymentMethods.retrieve(paymentMethodId);
+  if (!paymentMethod || paymentMethod.customer !== stripeCustomerId) {
+    return c.json({ error: "Payment method not found" }, 404);
+  }
+
   const ok = await detachPaymentMethod(paymentMethodId);
   if (!ok) return c.json({ error: "Failed to detach payment method" }, 500);
   return c.json({ ok: true });
 });
 
-// ─── Config endpoint ─────────────────────────────────────────────────────────
-
-portalRouter.get("/config", (c) => {
-  return c.json({
-    stripePublishableKey: process.env.STRIPE_PUBLISHABLE_KEY ?? "",
-  });
-});
-
 // ─── Dev-mode session creation ──────────────────────────────────────────────
 // Allows the dev login selector to vend an impersonation session for a client
 // without requiring manager auth. Only available when AUTH_DISABLED=true.

apps/api/src/routes/reports.ts

@@ -286,6 +286,10 @@ reportsRouter.get("/clients", async (c) => {
   ninetyDaysAgo.setUTCDate(ninetyDaysAgo.getUTCDate() - 90);
   const ninetyDaysAgoISO = ninetyDaysAgo.toISOString();
 
+  const page = Math.max(1, parseInt(c.req.query("page") ?? "1", 10) || 1);
+  const limit = Math.min(100, Math.max(1, parseInt(c.req.query("limit") ?? "20", 10) || 20));
+  const offset = (page - 1) * limit;
+
   const churnRisk = await db
     .select({
       clientId: clients.id,
@@ -298,15 +302,34 @@ reportsRouter.get("/clients", async (c) => {
     .having(
       sql`MAX(${appointments.startTime}) < ${ninetyDaysAgoISO}::timestamptz OR MAX(${appointments.startTime}) IS NULL`
     )
-    .orderBy(sql`MAX(${appointments.startTime}) ASC NULLS FIRST`);
+    .orderBy(sql`MAX(${appointments.startTime}) ASC NULLS FIRST`)
+    .limit(limit)
+    .offset(offset);
+
+  const [churnCountRow] = await db
+    .select({ total: sql<number>`count(*)::int` })
+    .from(
+      db
+        .select({ id: clients.id })
+        .from(clients)
+        .leftJoin(appointments, eq(appointments.clientId, clients.id))
+        .groupBy(clients.id)
+        .having(
+          sql`MAX(${appointments.startTime}) < ${ninetyDaysAgoISO}::timestamptz OR MAX(${appointments.startTime}) IS NULL`
+        )
+        .as("churn_count")
+    );
+  const churnRiskTotal = churnCountRow?.total ?? 0;
 
   return c.json({
     from: from.toISOString(),
     to: to.toISOString(),
     newClients,
     activeInPeriodCount: activeInPeriod.length,
-    churnRisk: churnRisk.slice(0, 20), // top 20 at-risk clients
-    churnRiskTotal: churnRisk.length,
+    churnRisk,
+    churnRiskTotal,
+    page,
+    limit,
   });
 });
 

apps/api/src/routes/stripe-webhooks.ts

@@ -0,0 +1,112 @@
+import { Hono } from "hono";
+import Stripe from "stripe";
+import { eq, getDb, invoices } from "@groombook/db";
+import { getStripeClient } from "../services/payment.js";
+
+export const webhooksRouter = new Hono();
+
+webhooksRouter.post("/stripe", async (c) => {
+  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
+  if (!webhookSecret) {
+    return c.json({ error: "Webhook secret not configured" }, 503);
+  }
+
+  const signature = c.req.header("stripe-signature");
+  if (!signature) {
+    return c.json({ error: "Missing signature" }, 401);
+  }
+
+  let rawBody: string;
+  try {
+    rawBody = await c.req.text();
+  } catch {
+    return c.json({ error: "Could not read body" }, 400);
+  }
+
+  const stripe = getStripeClient();
+  if (!stripe) {
+    return c.json({ error: "Stripe not configured" }, 503);
+  }
+
+  let event: Stripe.Event;
+  try {
+    event = stripe.webhooks.constructEvent(rawBody, signature, webhookSecret);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Invalid signature";
+    return c.json({ error: message }, 401);
+  }
+
+  const db = getDb();
+
+  if (event.type === "payment_intent.succeeded") {
+    const pi = event.data.object as Stripe.PaymentIntent;
+    if (pi.metadata?.groombook_invoice_ids) {
+      const invoiceIds = pi.metadata.groombook_invoice_ids.split(",");
+      for (const invoiceId of invoiceIds) {
+        if (!invoiceId) continue;
+        const [inv] = await db
+          .select()
+          .from(invoices)
+          .where(eq(invoices.id, invoiceId))
+          .limit(1);
+        if (!inv) continue;
+        if (inv.stripePaymentIntentId && inv.stripePaymentIntentId !== pi.id) continue;
+        await db
+          .update(invoices)
+          .set({
+            status: "paid",
+            paymentMethod: "card",
+            paidAt: new Date(),
+            stripePaymentIntentId: pi.id,
+            updatedAt: new Date(),
+          })
+          .where(eq(invoices.id, invoiceId));
+      }
+    }
+  } else if (event.type === "payment_intent.payment_failed") {
+    const pi = event.data.object as Stripe.PaymentIntent;
+    if (pi.metadata?.groombook_invoice_ids) {
+      const invoiceIds = pi.metadata.groombook_invoice_ids.split(",");
+      for (const invoiceId of invoiceIds) {
+        if (!invoiceId) continue;
+        await db
+          .update(invoices)
+          .set({
+            paymentFailureReason: pi.last_payment_error?.message ?? "Payment failed",
+            updatedAt: new Date(),
+          })
+          .where(eq(invoices.id, invoiceId));
+      }
+    }
+  } else if (event.type === "charge.refunded") {
+    const charge = event.data.object as Stripe.Charge;
+    if (typeof charge.payment_intent === "string" && charge.payment_intent) {
+      const [inv] = await db
+        .select({ id: invoices.id })
+        .from(invoices)
+        .where(eq(invoices.stripePaymentIntentId, charge.payment_intent))
+        .limit(1);
+      if (inv) {
+        const refundId =
+          typeof charge.refunded === "boolean" && charge.refunded
+            ? `ch_${charge.id}_refund`
+            : null;
+        await db
+          .update(invoices)
+          .set({
+            status: "void",
+            stripeRefundId: refundId,
+            updatedAt: new Date(),
+          })
+          .where(eq(invoices.id, inv.id));
+      }
+    }
+  } else if (event.type === "charge.dispute.created") {
+    const dispute = event.data.object as Stripe.Dispute;
+    console.error(
+      `[Stripe Webhook] Dispute created for payment intent: ${dispute.payment_intent}`
+    );
+  }
+
+  return c.json({ received: true });
+});

apps/api/src/routes/webhooks.ts

@@ -1,137 +0,0 @@
-import { Hono } from "hono";
-import {
-  and,
-  eq,
-  getDb,
-  clients,
-  reminderLogs,
-  smsSend,
-} from "@groombook/db";
-import { TelnyxProvider } from "../services/sms.js";
-
-export const webhooksRouter = new Hono();
-
-const telnyxProvider = new TelnyxProvider();
-
-const STOP_KEYWORDS = new Set(["STOP", "STOPALL", "UNSUBSCRIBE", "CANCEL", "END", "QUIT"]);
-const START_KEYWORDS = new Set(["START", "YES", "UNSTOP"]);
-
-webhooksRouter.post("/sms/inbound", async (c) => {
-  if (!telnyxProvider.validateWebhookSignature(c.req.raw)) {
-    return c.json({ error: "Invalid signature" }, 401);
-  }
-
-  let body: Record<string, unknown>;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid JSON" }, 400);
-  }
-
-  const event = (body.data as Record<string, unknown>)?.event_type ?? body.event_type;
-  const payload = (body.data as Record<string, unknown>) ?? body;
-
-  if (event === "message.received") {
-    const fromField = payload.from;
-    const from = typeof fromField === "object" && fromField !== null
-      ? (fromField as Record<string, unknown>).phone_number as string ?? (fromField as Record<string, unknown>).toString()
-      : String(fromField ?? "");
-    const text = String(payload.text ?? payload.body ?? "").trim().toUpperCase();
-
-    if (!from || !text) {
-      return c.json({ error: "Missing from or text" }, 400);
-    }
-
-    const db = getDb();
-
-    const [client] = await db
-      .select({ id: clients.id, smsOptIn: clients.smsOptIn })
-      .from(clients)
-      .where(eq(clients.phone, from))
-      .limit(1);
-
-    if (!client) {
-      return c.json({ received: true });
-    }
-
-    if (STOP_KEYWORDS.has(text)) {
-      await db
-        .update(clients)
-        .set({
-          smsOptIn: false,
-          smsOptOutDate: new Date(),
-          updatedAt: new Date(),
-        })
-        .where(eq(clients.id, client.id));
-      return c.json({ received: true });
-    }
-
-    if (START_KEYWORDS.has(text)) {
-      await db
-        .update(clients)
-        .set({
-          smsOptIn: true,
-          smsConsentDate: new Date(),
-          updatedAt: new Date(),
-        })
-        .where(eq(clients.id, client.id));
-      return c.json({ received: true });
-    }
-
-    if (text === "HELP") {
-      const supportUrl = process.env.SUPPORT_URL ?? "https://groombook.app/support";
-      await smsSend(from, `GroomBook appointment reminders. Reply STOP to opt out. For help, visit ${supportUrl}.`);
-      return c.json({ received: true });
-    }
-
-    return c.json({ received: true });
-  }
-
-  if (event === "message.finalized" || event === "message.status") {
-    const status = String(payload.status ?? "");
-    const toField = payload.to;
-    const toNumber = typeof toField === "object" && toField !== null
-      ? (toField as Record<string, unknown>).phone_number as string ?? (toField as Record<string, unknown>).toString()
-      : String(toField ?? "");
-
-    if (!status || !toNumber) {
-      return c.json({ received: true });
-    }
-
-    const validDelivery = ["delivered", "sent", "failed", "sending", "queued"];
-    if (!validDelivery.includes(status)) {
-      return c.json({ received: true });
-    }
-
-    const db = getDb();
-
-    const [client] = await db
-      .select({ id: clients.id })
-      .from(clients)
-      .where(eq(clients.phone, toNumber))
-      .limit(1);
-
-    if (client) {
-      const [log] = await db
-        .select({ id: reminderLogs.id })
-        .from(reminderLogs)
-        .where(
-          and(
-            eq(reminderLogs.channel, "sms")
-          )
-        )
-        .limit(1);
-
-      if (log) {
-        await db
-          .update(reminderLogs)
-          .set({ deliveryStatus: status })
-          .where(eq(reminderLogs.id, log.id));
-      }
-    }
-
-    return c.json({ received: true });
-  }
-
-  return c.json({ received: true });
-});

apps/api/src/services/payment.ts

@@ -1,9 +1,9 @@
 import Stripe from "stripe";
-import { getDb, clients, eq, invoices } from "@groombook/db";
+import { getDb, clients, eq, inArray, invoices } from "@groombook/db";
 
 let _stripe: Stripe | null | undefined;
 
-function getStripeClient(): Stripe | null {
+export function getStripeClient(): Stripe | null {
   if (_stripe === undefined) {
     const secretKey = process.env.STRIPE_SECRET_KEY;
     if (!secretKey) return null;
@@ -43,11 +43,13 @@ export async function createPaymentIntent(
 
   const db = getDb();
   const invoiceIds = Array.isArray(invoiceIdOrIds) ? invoiceIdOrIds : [invoiceIdOrIds];
+  const firstInvoiceId = invoiceIds[0];
+  if (!firstInvoiceId) return null;
 
   const invoiceRows = await db
     .select()
     .from(invoices)
-    .where(eq(invoices.id, invoiceIds[0]));
+    .where(eq(invoices.id, firstInvoiceId));
 
   const [invoice] = invoiceRows;
   if (!invoice) return null;
@@ -57,8 +59,8 @@ export async function createPaymentIntent(
     const allInvoices = await db
       .select({ totalCents: invoices.totalCents })
       .from(invoices)
-      .where(eq(invoices.id, invoiceIds[0]));
-    totalCents = allInvoices.reduce((sum, inv) => sum + inv.totalCents, totalCents);
+      .where(inArray(invoices.id, invoiceIds));
+    totalCents = allInvoices.reduce((sum, inv) => sum + inv.totalCents, 0);
   }
 
   const stripeCustomerId = await getOrCreateStripeCustomer(clientId);
@@ -82,10 +84,10 @@ export async function createPaymentIntent(
       .where(eq(invoices.id, invId));
   }
 
-  return {
-    clientSecret: paymentIntent.client_secret!,
-    paymentIntentId: paymentIntent.id,
-  };
+  const clientSecret = paymentIntent.client_secret;
+  if (!clientSecret) return null;
+
+  return { clientSecret, paymentIntentId: paymentIntent.id };
 }
 
 export async function processRefund(

apps/api/src/services/reminders.ts

@@ -18,10 +18,9 @@ import {
   buildReminderEmail,
   sendEmail,
 } from "./email.js";
-import { smsSend } from "./sms.js";
 
-// TCPA-required opt-out text appended to every SMS reminder
-const TCPA_OPT_OUT = "Reply STOP to opt out. Msg & data rates may apply.";
+// How many hours before the appointment to send each reminder.
+// Override via env: REMINDER_HOURS_EARLY (default 24) and REMINDER_HOURS_LATE (default 2).
 function getReminderWindows(): { label: string; hours: number }[] {
   const early = Number(process.env.REMINDER_HOURS_EARLY ?? 24);
   const late = Number(process.env.REMINDER_HOURS_LATE ?? 2);
@@ -66,39 +65,23 @@ export async function runReminderCheck(): Promise<void> {
       );
 
     for (const appt of upcoming) {
-      const [emailLog] = await db
+      // Check if reminder already sent (unique constraint prevents double-send)
+      const existing = await db
         .select({ id: reminderLogs.id })
         .from(reminderLogs)
         .where(
           and(
             eq(reminderLogs.appointmentId, appt.id),
-            eq(reminderLogs.reminderType, window.label),
-            eq(reminderLogs.channel, "email")
+            eq(reminderLogs.reminderType, window.label)
           )
         )
         .limit(1);
 
-      const [smsLog] = await db
-        .select({ id: reminderLogs.id })
-        .from(reminderLogs)
-        .where(
-          and(
-            eq(reminderLogs.appointmentId, appt.id),
-            eq(reminderLogs.reminderType, window.label),
-            eq(reminderLogs.channel, "sms")
-          )
-        )
-        .limit(1);
+      if (existing.length > 0) continue; // already sent
 
       // Fetch related records for the email
       const [client] = await db
-        .select({
-          name: clients.name,
-          email: clients.email,
-          emailOptOut: clients.emailOptOut,
-          smsOptIn: clients.smsOptIn,
-          phoneE164: clients.phoneE164,
-        })
+        .select({ name: clients.name, email: clients.email, emailOptOut: clients.emailOptOut })
         .from(clients)
         .where(eq(clients.id, appt.clientId))
         .limit(1);
@@ -129,6 +112,8 @@ export async function runReminderCheck(): Promise<void> {
 
       if (!pet || !service) continue;
 
+      // Ensure the appointment has a confirmation token before sending the reminder.
+      // Generate one if it doesn't have one yet (e.g. pre-existing appointments).
       let confirmationToken = appt.confirmationToken;
       if (!confirmationToken) {
         confirmationToken = randomBytes(32).toString("hex");
@@ -138,53 +123,27 @@ export async function runReminderCheck(): Promise<void> {
           .where(eq(appointments.id, appt.id));
       }
 
-      if (!emailLog) {
-        const sent = await sendEmail(
-          buildReminderEmail(
-            client.email,
-            {
-              clientName: client.name,
-              petName: pet.name,
-              serviceName: service.name,
-              groomerName,
-              startTime: appt.startTime,
-            },
-            window.hours,
-            confirmationToken
-          )
-        );
+      const sent = await sendEmail(
+        buildReminderEmail(
+          client.email,
+          {
+            clientName: client.name,
+            petName: pet.name,
+            serviceName: service.name,
+            groomerName,
+            startTime: appt.startTime,
+          },
+          window.hours,
+          confirmationToken
+        )
+      );
 
-        if (sent) {
-          await db
-            .insert(reminderLogs)
-            .values({ appointmentId: appt.id, reminderType: window.label, channel: "email" })
-            .onConflictDoNothing();
-        }
-      }
-
-      if (!smsLog && client.smsOptIn && client.phoneE164) {
-        const apiUrl = process.env.API_URL ?? "http://localhost:3000";
-        const confirmUrl = `${apiUrl}/api/book/confirm/${confirmationToken}`;
-        const cancelUrl = `${apiUrl}/api/book/cancel/${confirmationToken}`;
-        const when = window.hours >= 24 ? "tomorrow" : `in ${window.hours} hours`;
-        const smsBody = [
-          `Hi ${client.name}, just a reminder: ${pet.name}'s grooming appointment is ${when}.`,
-          `Service: ${service.name}${groomerName ? ` with ${groomerName}` : ""}`,
-          `Confirm: ${confirmUrl}`,
-          `Cancel: ${cancelUrl}`,
-          TCPA_OPT_OUT,
-        ].join(". ");
-        try {
-          const smsOk = await smsSend(client.phoneE164, smsBody);
-          if (smsOk) {
-            await db
-              .insert(reminderLogs)
-              .values({ appointmentId: appt.id, reminderType: window.label, channel: "sms" })
-              .onConflictDoNothing();
-          }
-        } catch (err) {
-          console.error("[reminders] SMS send failed:", err);
-        }
+      if (sent) {
+        // Record send — ignore conflicts (race condition between instances)
+        await db
+          .insert(reminderLogs)
+          .values({ appointmentId: appt.id, reminderType: window.label })
+          .onConflictDoNothing();
       }
     }
   }

apps/api/src/services/sms.ts

@@ -1,140 +0,0 @@
-import { Telnyx } from "telnyx";
-
-export interface SmsProvider {
-  sendSms(to: string, body: string, mediaUrls?: string[]): Promise<{ messageId: string; status: string }>;
-  validateWebhookSignature(req: Request): boolean;
-}
-
-interface TelnyxSmsResult {
-  message_id: string;
-  status: string;
-}
-
-function createTelnyxClient(): Telnyx | null {
-  const apiKey = process.env.TELNYX_API_KEY;
-  if (!apiKey) return null;
-  return new Telnyx(apiKey);
-}
-
-let _client: Telnyx | null | undefined;
-
-function getClient(): Telnyx | null {
-  if (_client === undefined) _client = createTelnyxClient();
-  return _client;
-}
-
-function getFromNumber(): string | null {
-  return process.env.TELNYX_FROM_NUMBER ?? null;
-}
-
-function isE164(phone: string): boolean {
-  return /^\+[1-9]\d{7,14}$/.test(phone);
-}
-
-export async function sendSms(
-  to: string,
-  body: string,
-  mediaUrls?: string[]
-): Promise<{ messageId: string; status: string }> {
-  const client = getClient();
-  if (!client) throw new Error("Telnyx client not initialized. Set TELNYX_API_KEY.");
-
-  const from = getFromNumber();
-  if (!from) throw new Error("TELNYX_FROM_NUMBER is not set");
-
-  if (!isE164(to)) throw new Error(`Invalid recipient phone format: ${to}. Expected E.164.`);
-  if (!isE164(from)) throw new Error(`Invalid sender phone format: ${from}. Expected E.164.`);
-
-  const payload: Record<string, unknown> = {
-    from,
-    to,
-    body,
-  };
-
-  if (mediaUrls && mediaUrls.length > 0) {
-    payload.media_urls = mediaUrls;
-  }
-
-  const result = await client.messages.create(payload as Record<string, string | string[]>);
-  const smsResult = result.data as unknown as TelnyxSmsResult;
-  return {
-    messageId: smsResult.message_id,
-    status: smsResult.status,
-  };
-}
-
-export class TelnyxProvider implements SmsProvider {
-  async sendSms(
-    to: string,
-    body: string,
-    mediaUrls?: string[]
-  ): Promise<{ messageId: string; status: string }> {
-    return sendSms(to, body, mediaUrls);
-  }
-
-  validateWebhookSignature(req: Request): boolean {
-    const secret = process.env.TELNYX_WEBHOOK_SECRET;
-    if (!secret) return false;
-
-    const signature = req.headers.get("telnyx-signature");
-    if (!signature) return false;
-
-    const payload = JSON.stringify(req.body);
-
-    try {
-      const { createHmac } = await import("crypto");
-      const hmac = createHmac("sha256", secret);
-      const expected = `sha256=${hmac.update(payload).digest("hex")}`;
-
-      const sigBuf = Buffer.from(signature);
-      const expBuf = Buffer.from(expected);
-
-      if (sigBuf.length !== expBuf.length) return false;
-
-      let diff = 0;
-      for (let i = 0; i < sigBuf.length; i++) {
-        diff |= sigBuf[i] ^ expBuf[i];
-      }
-      return diff === 0;
-    } catch {
-      return false;
-    }
-  }
-}
-
-let _provider: SmsProvider | null | undefined;
-
-export function createSmsProvider(): SmsProvider | null {
-  if (_provider === undefined) {
-    if (process.env.SMS_ENABLED !== "true") {
-      _provider = null;
-      return null;
-    }
-    switch (process.env.SMS_PROVIDER) {
-      case "telnyx": {
-        const client = getClient();
-        if (!client) {
-          _provider = null;
-          return null;
-        }
-        _provider = new TelnyxProvider();
-        break;
-      }
-      default:
-        _provider = null;
-    }
-  }
-  return _provider;
-}
-
-export async function smsSend(
-  to: string,
-  body: string,
-  mediaUrls?: string[]
-): Promise<boolean> {
-  const provider = createSmsProvider();
-  if (!provider) return false;
-
-  await provider.sendSms(to, body, mediaUrls);
-  return true;
-}

apps/web/Dockerfile

@@ -20,3 +20,5 @@ FROM nginx:alpine AS runner
 COPY apps/web/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /app/apps/web/dist /usr/share/nginx/html
 EXPOSE 80
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD curl -f http://localhost:80/ || exit 1

apps/web/nginx.conf

@@ -3,10 +3,22 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Security headers
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
     # Cache static assets
     location ~* \.(js|css|png|svg|ico|woff2)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
     }
 
     # Proxy API calls to the API service

apps/web/src/pages/Invoices.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import type { Invoice, Client, Appointment, Service, Staff, InvoiceTipSplit } from "@groombook/types";
+import type { Invoice, Client, Appointment, Service, Staff, InvoiceTipSplit, StripePaymentInfo, PaymentStats } from "@groombook/types";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -173,6 +173,23 @@ function InvoiceDetailModal({
   const [error, setError] = useState<string | null>(null);
   const [tipStr, setTipStr] = useState((invoice.tipCents / 100).toFixed(2));
   const [paymentMethod, setPaymentMethod] = useState<string>(invoice.paymentMethod ?? "cash");
+  const [stripeInfo, setStripeInfo] = useState<StripePaymentInfo | null>(null);
+  const [stripeLoading, setStripeLoading] = useState(false);
+  const [showRefundDialog, setShowRefundDialog] = useState(false);
+  const [refundType, setRefundType] = useState<"full" | "partial">("full");
+  const [refundAmountStr, setRefundAmountStr] = useState("");
+  const [refunding, setRefunding] = useState(false);
+
+  useEffect(() => {
+    if (invoice.status === "paid" && invoice.stripePaymentIntentId) {
+      setStripeLoading(true);
+      fetch(`/api/invoices/${invoice.id}/stripe-payment`)
+        .then((r) => r.json())
+        .then((data: StripePaymentInfo) => setStripeInfo(data))
+        .catch(() => { /* non-blocking */ })
+        .finally(() => setStripeLoading(false));
+    }
+  }, [invoice.id, invoice.status, invoice.stripePaymentIntentId]);
 
   // Tip split state: array of {staffId, staffName, pct}
   const linkedAppt = invoice.appointmentId
@@ -271,6 +288,31 @@ function InvoiceDetailModal({
     }
   }
 
+  async function submitRefund() {
+    setRefunding(true);
+    setError(null);
+    const amountCents = refundType === "partial"
+      ? Math.round(parseFloat(refundAmountStr) * 100)
+      : undefined;
+    try {
+      const res = await fetch(`/api/invoices/${invoice.id}/refund`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ amountCents }),
+      });
+      if (!res.ok) {
+        const err = (await res.json()) as { error?: string };
+        throw new Error(err.error ?? `HTTP ${res.status}`);
+      }
+      setShowRefundDialog(false);
+      onUpdated();
+    } catch (e: unknown) {
+      setError(e instanceof Error ? e.message : "Refund failed");
+    } finally {
+      setRefunding(false);
+    }
+  }
+
   if (loading) return <Modal onClose={onClose}><p style={{ padding: "1rem" }}>Loading…</p></Modal>;
 
   const tipCentsCalc = Math.round(parseFloat(tipStr) * 100) || 0;
@@ -330,6 +372,18 @@ function InvoiceDetailModal({
         />
         {invoice.paidAt && <SummaryRow label="Paid on" value={fmtDate(invoice.paidAt)} />}
         {invoice.paymentMethod && <SummaryRow label="Payment" value={invoice.paymentMethod} />}
+        {stripeLoading && <SummaryRow label="Stripe" value="Loading…" />}
+        {stripeInfo && (
+          <>
+            {stripeInfo.cardLast4 && (
+              <SummaryRow label="Card" value={`${stripeInfo.cardBrand ?? "Card"} •••• ${stripeInfo.cardLast4}`} />
+            )}
+            <SummaryRow label="Stripe status" value={stripeInfo.status} />
+            {invoice.stripeRefundId && stripeInfo.refundStatus && (
+              <SummaryRow label="Refund status" value={stripeInfo.refundStatus === "succeeded" ? "Refunded" : stripeInfo.refundStatus} />
+            )}
+          </>
+        )}
       </div>
 
       {/* ── Tip Distribution ── */}
@@ -447,10 +501,101 @@ function InvoiceDetailModal({
         </div>
       )}
       {(invoice.status === "paid" || invoice.status === "void") && (
-        <div style={{ marginTop: "1rem", display: "flex", justifyContent: "flex-end" }}>
+        <div style={{ marginTop: "1rem", display: "flex", justifyContent: "flex-end", gap: "0.5rem" }}>
+          {invoice.status === "paid" && invoice.stripePaymentIntentId && !invoice.stripeRefundId && (
+            <button
+              onClick={() => {
+                setRefundType("full");
+                setRefundAmountStr("");
+                setShowRefundDialog(true);
+              }}
+              style={{ ...btnStyle, color: "#dc2626", borderColor: "#dc2626" }}
+            >
+              Refund
+            </button>
+          )}
           <button onClick={onClose} style={btnStyle}>Close</button>
         </div>
       )}
+
+      {showRefundDialog && (
+        <div style={{
+          position: "fixed", inset: 0, background: "rgba(0,0,0,0.45)",
+          display: "flex", alignItems: "center", justifyContent: "center", zIndex: 110,
+        }}
+          onClick={(e) => { if (e.target === e.currentTarget) setShowRefundDialog(false); }}
+        >
+          <div style={{
+            background: "#fff", borderRadius: 8, padding: "1.5rem",
+            maxWidth: 400, width: "calc(100% - 2rem)",
+            boxShadow: "0 20px 60px rgba(0,0,0,0.3)",
+          }}>
+            <h3 style={{ margin: "0 0 1rem" }}>Process Refund</h3>
+            <p style={{ fontSize: 14, color: "#6b7280", marginBottom: "1rem" }}>
+              Invoice total: {fmtMoney(invoice.totalCents)}
+            </p>
+            <div style={{ marginBottom: "1rem" }}>
+              <label style={{ display: "block", fontWeight: 600, marginBottom: "0.25rem", fontSize: 13 }}>
+                Refund type
+              </label>
+              <div style={{ display: "flex", gap: "0.5rem" }}>
+                <button
+                  onClick={() => setRefundType("full")}
+                  style={{
+                    ...btnStyle,
+                    backgroundColor: refundType === "full" ? "var(--color-primary)" : "#fff",
+                    color: refundType === "full" ? "#fff" : "#374151",
+                    borderColor: refundType === "full" ? "var(--color-primary)" : "#d1d5db",
+                  }}
+                >
+                  Full refund
+                </button>
+                <button
+                  onClick={() => { setRefundType("partial"); setRefundAmountStr((invoice.totalCents / 100).toFixed(2)); }}
+                  style={{
+                    ...btnStyle,
+                    backgroundColor: refundType === "partial" ? "var(--color-primary)" : "#fff",
+                    color: refundType === "partial" ? "#fff" : "#374151",
+                    borderColor: refundType === "partial" ? "var(--color-primary)" : "#d1d5db",
+                  }}
+                >
+                  Partial refund
+                </button>
+              </div>
+            </div>
+            {refundType === "partial" && (
+              <div style={{ marginBottom: "1rem" }}>
+                <label style={{ display: "block", fontWeight: 600, marginBottom: "0.25rem", fontSize: 13 }}>
+                  Refund amount
+                </label>
+                <div style={{ display: "flex", alignItems: "center", gap: "0.5rem" }}>
+                  <span style={{ color: "#6b7280" }}>$</span>
+                  <input
+                    type="number"
+                    min="0.01"
+                    max={(invoice.totalCents / 100).toFixed(2)}
+                    step="0.01"
+                    value={refundAmountStr}
+                    onChange={(e) => setRefundAmountStr(e.target.value)}
+                    style={{ ...inputStyle, width: 100 }}
+                  />
+                </div>
+              </div>
+            )}
+            {error && <p style={{ color: "red", margin: "0.5rem 0" }}>{error}</p>}
+            <div style={{ display: "flex", gap: "0.5rem", justifyContent: "flex-end" }}>
+              <button onClick={() => setShowRefundDialog(false)} style={btnStyle}>Cancel</button>
+              <button
+                onClick={submitRefund}
+                disabled={refunding || (refundType === "partial" && (!refundAmountStr || parseFloat(refundAmountStr) <= 0))}
+                style={{ ...btnStyle, backgroundColor: "#dc2626", color: "#fff", borderColor: "#dc2626" }}
+              >
+                {refunding ? "Refunding…" : "Refund"}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
     </Modal>
   );
 }
@@ -492,6 +637,8 @@ export function InvoicesPage() {
   const [createLoading, setCreateLoading] = useState(false);
   const [detailData, setDetailData] = useState<{ staff: Staff[]; appointments: Appointment[] } | null>(null);
   const [detailLoading, setDetailLoading] = useState(false);
+  const [stats, setStats] = useState<PaymentStats | null>(null);
+  const [statsLoading, setStatsLoading] = useState(true);
 
   const LIMIT = 50;
 
@@ -513,6 +660,15 @@ export function InvoicesPage() {
       .finally(() => setLoading(false));
   }, [statusFilter]);
 
+  useEffect(() => {
+    setStatsLoading(true);
+    fetch("/api/invoices/stats")
+      .then((r) => r.json())
+      .then((data: PaymentStats) => setStats(data))
+      .catch(() => { /* non-blocking */ })
+      .finally(() => setStatsLoading(false));
+  }, []);
+
   function loadCreateData() {
     if (createData) return Promise.resolve();
     setCreateLoading(true);
@@ -573,6 +729,36 @@ export function InvoicesPage() {
         </button>
       </div>
 
+      {!statsLoading && stats && (
+        <div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fit, minmax(160px, 1fr))", gap: "0.75rem", marginBottom: "1rem" }}>
+          <div style={{ background: "#fff", borderRadius: 8, border: "1px solid #e5e7eb", padding: "0.875rem 1rem" }}>
+            <div style={{ fontSize: 12, color: "#6b7280", fontWeight: 500, marginBottom: "0.25rem" }}>Revenue this month</div>
+            <div style={{ fontSize: 20, fontWeight: 700, color: "#065f46" }}>{fmtMoney(stats.revenueCents)}</div>
+            <div style={{ fontSize: 12, color: "#9ca3af" }}>{stats.revenueCount} paid</div>
+          </div>
+          <div style={{ background: "#fff", borderRadius: 8, border: "1px solid #e5e7eb", padding: "0.875rem 1rem" }}>
+            <div style={{ fontSize: 12, color: "#6b7280", fontWeight: 500, marginBottom: "0.25rem" }}>Outstanding</div>
+            <div style={{ fontSize: 20, fontWeight: 700, color: "#92400e" }}>{fmtMoney(stats.outstandingCents)}</div>
+          </div>
+          <div style={{ background: "#fff", borderRadius: 8, border: "1px solid #e5e7eb", padding: "0.875rem 1rem" }}>
+            <div style={{ fontSize: 12, color: "#6b7280", fontWeight: 500, marginBottom: "0.25rem" }}>Refunds this month</div>
+            <div style={{ fontSize: 20, fontWeight: 700, color: "#991b1b" }}>{fmtMoney(stats.refundsCents)}</div>
+            <div style={{ fontSize: 12, color: "#9ca3af" }}>{stats.refundCount} refunds</div>
+          </div>
+          {stats.paymentMethodBreakdown.length > 0 && (
+            <div style={{ background: "#fff", borderRadius: 8, border: "1px solid #e5e7eb", padding: "0.875rem 1rem" }}>
+              <div style={{ fontSize: 12, color: "#6b7280", fontWeight: 500, marginBottom: "0.25rem" }}>By payment method</div>
+              {stats.paymentMethodBreakdown.map((b) => (
+                <div key={b.paymentMethod} style={{ fontSize: 13, display: "flex", justifyContent: "space-between", marginTop: "0.2rem" }}>
+                  <span style={{ textTransform: "capitalize" }}>{b.paymentMethod}</span>
+                  <span style={{ fontWeight: 600 }}>{fmtMoney(b.totalCents)}</span>
+                </div>
+              ))}
+            </div>
+          )}
+        </div>
+      )}
+
       {invoiceList.length === 0 ? (
         <p style={{ color: "#6b7280" }}>
           No invoices yet. Create one from a completed appointment.

apps/web/src/portal/CustomerPortal.tsx

@@ -226,7 +226,6 @@ export function CustomerPortal() {
       )}
 
       {showReschedule && rescheduleAppointment && (
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         <RescheduleFlow
           appointment={rescheduleAppointment as any}
           onClose={() => { setShowReschedule(false); setRescheduleAppointment(null); }}

apps/web/src/portal/sections/BillingPayments.tsx

@@ -1,5 +1,5 @@
 import { useState, useEffect } from "react";
-import { loadStripe, type Stripe } from "@stripe/stripe-js";
+import { loadStripe } from "@stripe/stripe-js";
 import { Elements, PaymentElement, useStripe, useElements } from "@stripe/react-stripe-js";
 import { CreditCard, DollarSign, Package, Zap } from "lucide-react";
 
@@ -27,7 +27,7 @@ interface BillingPaymentsProps {
 function BillingPaymentsInner({ sessionId, readOnly }: BillingPaymentsProps) {
   const [invoices, setInvoices] = useState<Invoice[]>([]);
   const [paymentMethods, setPaymentMethods] = useState<PaymentMethod[]>([]);
-  const [packages, setPackages] = useState<{ name: string; remaining: number }[]>([]);
+  const [packages] = useState<{ name: string; remaining: number }[]>([]);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [tab, setTab] = useState<"invoices" | "payment" | "packages">("invoices");
@@ -398,7 +398,10 @@ function PaymentModal({ sessionId, pending, onClose, onSuccess }: PaymentModalPr
       const { error: stripeError } = await stripe.confirmPayment({
         elements,
         clientSecret,
-        confirmParams: saveCard ? { setup_future_usage: "off_session" } : undefined,
+        confirmParams: saveCard
+          ? { setup_future_usage: "off_session" }
+          : undefined,
+        redirect: "if_required",
       });
 
       if (stripeError) {

generate_dogs.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-
-API_HOST="https://api.minimax.io"
-API_KEY="$MINIMAX_API_KEY"
-OUTPUT_DIR="minimax-output"
-
-mkdir -p "$OUTPUT_DIR"
-
-# Diverse dog image prompts
-declare -a PROMPTS=(
-  "A beautiful red Irish Setter with long flowing silky coat, standing proudly in golden hour sunlight, professional pet portrait photography, warm tones"
-  "A fluffy white Pomeranian puppy with thick fluffy coat, sitting alert with bright expression, studio white background, cute grooming"
-  "A black Schnauzer with distinctive full beard and mustache, freshly groomed with neat styling, professional grooming salon setting"
-  "A cream and white Cavalier King Charles Spaniel with silky coat, gentle sad eyes, soft warm indoor lighting, elegant pose"
-  "A brown and white Basset Hound with long droopy ears, lying down in relaxed pose, natural outdoor setting, peaceful expression"
-  "A black and tan miniature Dachshund with glossy coat, alert standing pose, warm studio lighting, detailed paws visible"
-  "A white fluffy Bichon Frise after professional grooming with rounded topknot, happy bouncy expression, bright cheerful background"
-  "A muscular fawn Boxer dog, athletic build, standing confidently outdoors in park, energetic expression, natural lighting"
-  "A blue merle Shetland Sheepdog with alert ears and fluffy coat, running happily, green grass field background, vibrant"
-  "A buff colored Cocker Spaniel with beautiful silky coat, friendly gentle expression, warm natural window lighting, indoor"
-)
-
-declare -a FILENAMES=(
-  "dog-setter-red-sunlit.png"
-  "dog-pomeranian-white-studio.png"
-  "dog-schnauzer-black-groomed.png"
-  "dog-cavalier-cream-gentle.png"
-  "dog-basset-brown-white.png"
-  "dog-dachshund-black-tan.png"
-  "dog-bichon-white-groomed.png"
-  "dog-boxer-fawn-athletic.png"
-  "dog-sheepdog-merle-running.png"
-  "dog-cocker-buff-friendly.png"
-)
-
-echo "Generating ${#PROMPTS[@]} diverse dog images..."
-
-for i in "${!PROMPTS[@]}"; do
-  PROMPT="${PROMPTS[$i]}"
-  FILENAME="${FILENAMES[$i]}"
-  
-  echo -n "[$((i+1))/${#PROMPTS[@]}] $FILENAME... "
-  
-  RESPONSE=$(curl -s -X POST "${API_HOST}/v1/image_generation" \
-    -H "Authorization: Bearer ${API_KEY}" \
-    -H "Content-Type: application/json" \
-    -d "{\"model\":\"image-01\",\"prompt\":\"${PROMPT}\",\"image_count\":1}")
-  
-  # Extract image URL from response
-  IMAGE_URL=$(echo "$RESPONSE" | grep -o '"image_urls":\["\([^"]*\)' | cut -d'"' -f4)
-  
-  if [ -n "$IMAGE_URL" ]; then
-    curl -s "$IMAGE_URL" -o "$OUTPUT_DIR/$FILENAME" 2>/dev/null
-    if [ -f "$OUTPUT_DIR/$FILENAME" ] && [ -s "$OUTPUT_DIR/$FILENAME" ]; then
-      echo "✓"
-    else
-      echo "✗ (download failed)"
-    fi
-  else
-    echo "✗ (no URL)"
-  fi
-done
-
-echo "Done! Generated images in $OUTPUT_DIR/"
-ls -lh "$OUTPUT_DIR"/dog-*.png 2>/dev/null | wc -l

generate_pet_images.sh

@@ -1,80 +0,0 @@
-#!/bin/bash
-
-# Use the configured MiniMax API host
-API_HOST="${MINIMAX_API_HOST:-https://api.minimax.io}"
-API_KEY="$MINIMAX_API_KEY"
-
-# Test endpoint - check which one works
-echo "Testing API endpoints..."
-echo "API_HOST: $API_HOST"
-echo "API_KEY: ${API_KEY:0:15}..."
-
-# Array of diverse dog images to generate
-declare -a PROMPTS=(
-  "A beautiful red Irish Setter with flowing silky coat, standing proudly in a sunny garden, warm natural lighting, professional pet photography"
-  "A fluffy white Pomeranian with thick coat, sitting alert, bright studio background, cute expression"
-  "A black Schnauzer with distinctive beard, freshly groomed, professional salon setting, dignified pose"
-  "A cream-colored Cavalier King Charles Spaniel, silky coat, gentle expression, soft warm lighting"
-  "A brown and white Basset Hound, long ears, relaxed sitting pose, natural outdoor background"
-  "A black and tan Dachshund, elongated body, alert posture, warm studio lighting"
-  "A white Bichon Frise, fluffy groomed coat, happy expression, bright cheerful background"
-  "A fawn Boxer with muscular build, athletic posture, outdoor park setting, energetic expression"
-  "A merle Shetland Sheepdog, alert ears, running pose, green garden background"
-  "A buff-colored Cocker Spaniel, silky coat, friendly expression, warm natural light"
-)
-
-declare -a FILENAMES=(
-  "dog-setter-red-sunny.png"
-  "dog-pomeranian-white-alert.png"
-  "dog-schnauzer-groomed.png"
-  "dog-cavalier-cream.png"
-  "dog-basset-hound-outdoor.png"
-  "dog-dachshund-alert.png"
-  "dog-bichon-frise-happy.png"
-  "dog-boxer-athletic.png"
-  "dog-sheepdog-merle.png"
-  "dog-cocker-spaniel-buff.png"
-)
-
-mkdir -p minimax-output
-
-echo "Generating ${#PROMPTS[@]} diverse dog images..."
-
-for i in "${!PROMPTS[@]}"; do
-  PROMPT="${PROMPTS[$i]}"
-  FILENAME="${FILENAMES[$i]}"
-  
-  echo "[$((i+1))/${#PROMPTS[@]}] Generating: $FILENAME"
-  
-  # Make API request
-  RESPONSE=$(curl -s -X POST "${API_HOST}/v1/image_generation" \
-    -H "Authorization: Bearer ${API_KEY}" \
-    -H "Content-Type: application/json" \
-    -d "{
-      \"model\": \"image-01\",
-      \"prompt\": \"${PROMPT}\",
-      \"image_count\": 1
-    }")
-  
-  # Check if response contains image data
-  if echo "$RESPONSE" | grep -q "data\|image_url\|file_content"; then
-    echo "  ✓ Response received"
-    
-    # Try to extract and save image data
-    # Different APIs format responses differently
-    IMAGE_DATA=$(echo "$RESPONSE" | grep -o '"file_content":"[^"]*' | head -1 | cut -d'"' -f4)
-    
-    if [ -n "$IMAGE_DATA" ]; then
-      echo "$IMAGE_DATA" | base64 -d > "minimax-output/$FILENAME"
-      echo "  ✓ Image saved to minimax-output/$FILENAME"
-    else
-      echo "  ✗ Could not extract image data"
-    fi
-  else
-    echo "  ✗ API response: ${RESPONSE:0:100}"
-  fi
-  
-  sleep 1
-done
-
-echo "Image generation complete!"

generate_puggles.py

@@ -1,78 +0,0 @@
-#!/usr/bin/env python3
-import base64
-import requests
-import os
-import json
-
-api_key = os.environ.get("MINIMAX_API_KEY")
-if not api_key:
-    raise ValueError("MINIMAX_API_KEY environment variable not set")
-
-url = "https://api.minimax.io/v1/image_generation"
-headers = {"Authorization": f"Bearer {api_key}"}
-
-# Ensure output directory exists
-os.makedirs("minimax-output", exist_ok=True)
-
-prompts = [
-    {
-        "filename": "dog-puggle-fawn-playful.png",
-        "prompt": "Adorable fawn Puggle puppy with playful expression, compact muscular build, professional pet photography, studio lighting, photorealistic"
-    },
-    {
-        "filename": "dog-puggle-black-sitting.png",
-        "prompt": "Black and tan Puggle with alert sitting posture, pointed beagle-like ears, gentle eyes, professional studio lighting, photorealistic"
-    },
-    {
-        "filename": "dog-puggle-cream-groomed.png",
-        "prompt": "Cream Puggle freshly groomed with fluffy coat, happy expression, lying down comfortably, natural daylight, photorealistic"
-    },
-    {
-        "filename": "dog-puggle-tricolor-outdoor.png",
-        "prompt": "Tricolor Puggle in outdoor garden setting, alert playful pose, natural sunlight, professional pet photography, photorealistic"
-    },
-    {
-        "filename": "dog-puggle-fawn-grooming.png",
-        "prompt": "Fawn Puggle at grooming salon, gentle expression, compact muscular build with beagle-like features, professional grooming setup, warm lighting, photorealistic"
-    }
-]
-
-print(f"Generating {len(prompts)} Puggle images...")
-
-for item in prompts:
-    filename = item["filename"]
-    prompt = item["prompt"]
-
-    print(f"\nGenerating {filename}...")
-
-    payload = {
-        "model": "image-01",
-        "prompt": prompt,
-        "aspect_ratio": "1:1",
-        "response_format": "base64",
-    }
-
-    try:
-        response = requests.post(url, headers=headers, json=payload, timeout=60)
-        response.raise_for_status()
-
-        data = response.json()
-        if "data" in data and "image_base64" in data["data"]:
-            images = data["data"]["image_base64"]
-
-            # Save the first (and usually only) image
-            output_path = f"minimax-output/{filename}"
-            with open(output_path, "wb") as f:
-                f.write(base64.b64decode(images[0]))
-
-            file_size = os.path.getsize(output_path)
-            print(f"✓ Saved {filename} ({file_size} bytes)")
-        else:
-            print(f"✗ Unexpected response format: {json.dumps(data, indent=2)}")
-    except requests.exceptions.RequestException as e:
-        print(f"✗ Error generating {filename}: {e}")
-    except Exception as e:
-        print(f"✗ Unexpected error for {filename}: {e}")
-
-print("\n✓ Image generation complete!")
-print("Files saved to minimax-output/")

packages/db/migrations/0026_boring_storm.sql

@@ -1,9 +0,0 @@
-ALTER TABLE "reminder_logs" DROP CONSTRAINT "reminder_logs_appointment_id_reminder_type_unique";--> statement-breakpoint
-ALTER TABLE "business_settings" ADD COLUMN "logo_key" text;--> statement-breakpoint
-ALTER TABLE "clients" ADD COLUMN "sms_opt_in" boolean DEFAULT false NOT NULL;--> statement-breakpoint
-ALTER TABLE "clients" ADD COLUMN "sms_consent_date" timestamp;--> statement-breakpoint
-ALTER TABLE "clients" ADD COLUMN "sms_opt_out_date" timestamp;--> statement-breakpoint
-ALTER TABLE "clients" ADD COLUMN "sms_consent_text" text;--> statement-breakpoint
-ALTER TABLE "pets" ADD COLUMN "image" text;--> statement-breakpoint
-ALTER TABLE "reminder_logs" ADD COLUMN "channel" text DEFAULT 'email' NOT NULL;--> statement-breakpoint
-ALTER TABLE "reminder_logs" ADD CONSTRAINT "reminder_logs_appointment_id_reminder_type_channel_unique" UNIQUE("appointment_id","reminder_type","channel");

packages/db/migrations/0026_stripe_payment.sql

@@ -0,0 +1,6 @@
+ALTER TABLE "clients" ADD COLUMN "stripe_customer_id" text;
+ALTER TABLE "clients" ADD CONSTRAINT "idx_clients_stripe_customer_id" UNIQUE("stripe_customer_id");
+ALTER TABLE "invoices" ADD COLUMN "stripe_payment_intent_id" text;
+ALTER TABLE "invoices" ADD COLUMN "stripe_refund_id" text;
+ALTER TABLE "invoices" ADD COLUMN "payment_failure_reason" text;
+ALTER TABLE "invoices" ADD CONSTRAINT "idx_invoices_stripe_payment_intent_id" UNIQUE("stripe_payment_intent_id");

packages/db/migrations/0027_stripe_identifiers.sql

@@ -1,6 +0,0 @@
-ALTER TABLE "clients" ADD COLUMN "stripe_customer_id" text;--> statement-breakpoint
-ALTER TABLE "clients" ADD CONSTRAINT "idx_clients_stripe_customer_id" UNIQUE("stripe_customer_id");--> statement-breakpoint
-ALTER TABLE "invoices" ADD COLUMN "stripe_payment_intent_id" text;--> statement-breakpoint
-ALTER TABLE "invoices" ADD COLUMN "stripe_refund_id" text;--> statement-breakpoint
-ALTER TABLE "invoices" ADD COLUMN "payment_failure_reason" text;--> statement-breakpoint
-ALTER TABLE "invoices" ADD CONSTRAINT "idx_invoices_stripe_payment_intent_id" UNIQUE("stripe_payment_intent_id");

packages/db/migrations/0028_sms_enabled.sql

@@ -1 +0,0 @@
-ALTER TABLE "business_settings" ADD COLUMN "sms_enabled" boolean NOT NULL DEFAULT false;

packages/db/migrations/meta/0027_snapshot.json

@@ -1,103 +0,0 @@
-{
-  "id": "0027_stripe_identifiers",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "authProviderConfig": {
-      "name": "auth_provider_config",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "providerId": { "name": "provider_id", "type": "text", "isNullable": false },
-        "displayName": { "name": "display_name", "type": "text", "isNullable": false },
-        "issuerUrl": { "name": "issuer_url", "type": "text", "isNullable": false },
-        "internalBaseUrl": { "name": "internal_base_url", "type": "text", "isNullable": true },
-        "clientId": { "name": "client_id", "type": "text", "isNullable": false },
-        "clientSecret": { "name": "client_secret", "type": "text", "isNullable": false },
-        "scopes": { "name": "scopes", "type": "text", "isNullable": false, "default": "'openid profile email'" },
-        "enabled": { "name": "enabled", "type": "boolean", "isNullable": false, "default": "true" },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {}
-    },
-    "businessSettings": {
-      "name": "business_settings",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "businessName": { "name": "business_name", "type": "text", "isNullable": false, "default": "'GroomBook'" },
-        "logoBase64": { "name": "logo_base64", "type": "text", "isNullable": true },
-        "logoMimeType": { "name": "logo_mime_type", "type": "text", "isNullable": true },
-        "logoKey": { "name": "logo_key", "type": "text", "isNullable": true },
-        "primaryColor": { "name": "primary_color", "type": "text", "isNullable": false, "default": "'#4f8a6f'" },
-        "accentColor": { "name": "accent_color", "type": "text", "isNullable": false, "default": "'#8b7355'" },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {}
-    },
-    "clients": {
-      "name": "clients",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "name": { "name": "name", "type": "text", "isNullable": false },
-        "email": { "name": "email", "type": "text", "isNullable": true },
-        "phone": { "name": "phone", "type": "text", "isNullable": true },
-        "address": { "name": "address", "type": "text", "isNullable": true },
-        "notes": { "name": "notes", "type": "text", "isNullable": true },
-        "emailOptOut": { "name": "email_opt_out", "type": "boolean", "isNullable": false, "default": "false" },
-        "smsOptIn": { "name": "sms_opt_in", "type": "boolean", "isNullable": false, "default": "false" },
-        "smsConsentDate": { "name": "sms_consent_date", "type": "timestamp", "isNullable": true },
-        "smsOptOutDate": { "name": "sms_opt_out_date", "type": "timestamp", "isNullable": true },
-        "smsConsentText": { "name": "sms_consent_text", "type": "text", "isNullable": true },
-        "stripeCustomerId": { "name": "stripe_customer_id", "type": "text", "isNullable": true },
-        "status": { "name": "status", "type": "client_status", "isNullable": false, "default": "'active'" },
-        "disabledAt": { "name": "disabled_at", "type": "timestamp", "isNullable": true },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": {},
-      "foreignKeys": {},
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": { "idx_clients_stripe_customer_id": { "columns": ["stripe_customer_id"] } }
-    },
-    "invoices": {
-      "name": "invoices",
-      "columns": {
-        "id": { "name": "id", "type": "uuid", "primaryKey": true, "default": "gen_random_uuid()", "isNullable": false },
-        "appointmentId": { "name": "appointment_id", "type": "uuid", "isNullable": true },
-        "clientId": { "name": "client_id", "type": "uuid", "isNullable": false },
-        "subtotalCents": { "name": "subtotal_cents", "type": "integer", "isNullable": false },
-        "taxCents": { "name": "tax_cents", "type": "integer", "isNullable": false, "default": "0" },
-        "tipCents": { "name": "tip_cents", "type": "integer", "isNullable": false, "default": "0" },
-        "totalCents": { "name": "total_cents", "type": "integer", "isNullable": false },
-        "status": { "name": "status", "type": "invoice_status", "isNullable": false, "default": "'draft'" },
-        "paymentMethod": { "name": "payment_method", "type": "payment_method", "isNullable": true },
-        "paidAt": { "name": "paid_at", "type": "timestamp", "isNullable": true },
-        "stripePaymentIntentId": { "name": "stripe_payment_intent_id", "type": "text", "isNullable": true },
-        "stripeRefundId": { "name": "stripe_refund_id", "type": "text", "isNullable": true },
-        "paymentFailureReason": { "name": "payment_failure_reason", "type": "text", "isNullable": true },
-        "notes": { "name": "notes", "type": "text", "isNullable": true },
-        "createdAt": { "name": "created_at", "type": "timestamp", "isNullable": false, "default": "now()" },
-        "updatedAt": { "name": "updated_at", "type": "timestamp", "isNullable": false, "default": "now()" }
-      },
-      "indexes": { "idx_invoices_client_id": { "columns": ["client_id"] }, "idx_invoices_status": { "columns": ["status"] }, "idx_invoices_created_at": { "columns": ["created_at"] } },
-      "foreignKeys": { "invoices_appointment_id_fkey": { "columns": ["appointmentId"], "reference": { "table": "appointments", "columns": ["id"] } }, "invoices_client_id_fkey": { "columns": ["clientId"], "reference": { "table": "clients", "columns": ["id"] } } },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": { "idx_invoices_stripe_payment_intent_id": { "columns": ["stripe_payment_intent_id"] } }
-    }
-  },
-  "enums": {
-    "appointment_status": { "name": "appointment_status", "values": ["scheduled", "confirmed", "in_progress", "completed", "cancelled", "no_show"] },
-    "client_status": { "name": "client_status", "values": ["active", "disabled"] },
-    "impersonation_session_status": { "name": "impersonation_session_status", "values": ["active", "ended", "expired"] },
-    "invoice_status": { "name": "invoice_status", "values": ["draft", "pending", "paid", "void"] },
-    "payment_method": { "name": "payment_method", "values": ["cash", "card", "check", "other"] },
-    "staff_role": { "name": "staff_role", "values": ["groomer", "receptionist", "manager"] },
-    "waitlist_status": { "name": "waitlist_status", "values": ["active", "notified", "expired", "cancelled"] }
-  },
-  "nativeEnums": {}
-}

packages/db/migrations/meta/_journal.json

@@ -187,8 +187,8 @@
     {
       "idx": 26,
       "version": "7",
-      "when": 1776035812477,
-      "tag": "0026_boring_storm",
+      "when": 1775568867192,
+      "tag": "0026_stripe_payment",
       "breakpoints": true
     }
   ]

packages/db/src/factories.ts

@@ -71,10 +71,7 @@ export function buildClient(overrides: Partial<ClientRow> = {}): ClientRow {
     address: "1 Main St, Springfield, CA 90000",
     notes: null,
     emailOptOut: false,
-    smsOptIn: false,
-    smsConsentDate: null,
-    smsOptOutDate: null,
-    smsConsentText: null,
+    stripeCustomerId: null,
     status: "active",
     disabledAt: null,
     createdAt: new Date("2025-01-01T00:00:00Z"),

packages/db/src/schema.ts

@@ -110,10 +110,7 @@ export const clients = pgTable("clients", {
   address: text("address"),
   notes: text("notes"),
   emailOptOut: boolean("email_opt_out").notNull().default(false),
-  smsOptIn: boolean("sms_opt_in").notNull().default(false),
-  smsConsentDate: timestamp("sms_consent_date"),
-  smsOptOutDate: timestamp("sms_opt_out_date"),
-  smsConsentText: text("sms_consent_text"),
+  stripeCustomerId: text("stripe_customer_id"),
   status: clientStatusEnum("status").notNull().default("active"),
   disabledAt: timestamp("disabled_at"),
   createdAt: timestamp("created_at").notNull().defaultNow(),
@@ -254,6 +251,9 @@ export const invoices = pgTable(
     status: invoiceStatusEnum("status").notNull().default("draft"),
     paymentMethod: paymentMethodEnum("payment_method"),
     paidAt: timestamp("paid_at"),
+    stripePaymentIntentId: text("stripe_payment_intent_id"),
+    stripeRefundId: text("stripe_refund_id"),
+    paymentFailureReason: text("payment_failure_reason"),
     notes: text("notes"),
     createdAt: timestamp("created_at").notNull().defaultNow(),
     updatedAt: timestamp("updated_at").notNull().defaultNow(),
@@ -262,6 +262,7 @@ export const invoices = pgTable(
     index("idx_invoices_client_id").on(t.clientId),
     index("idx_invoices_status").on(t.status),
     index("idx_invoices_created_at").on(t.createdAt),
+    index("idx_invoices_stripe_payment_intent_id").on(t.stripePaymentIntentId),
   ]
 );
 
@@ -308,11 +309,11 @@ export const reminderLogs = pgTable(
     appointmentId: uuid("appointment_id")
       .notNull()
       .references(() => appointments.id, { onDelete: "cascade" }),
+    // "confirmation" | "24h" | "2h"
     reminderType: text("reminder_type").notNull(),
-    channel: text("channel").notNull().default("email"),
     sentAt: timestamp("sent_at").notNull().defaultNow(),
   },
-  (t) => [unique().on(t.appointmentId, t.reminderType, t.channel)]
+  (t) => [unique().on(t.appointmentId, t.reminderType)]
 );
 
 // ─── Impersonation ──────────────────────────────────────────────────────────

packages/db/src/seed.ts

@@ -567,7 +567,7 @@ async function seed() {
 
   // ── Staff ──
   const managerStaff = Array.from({ length: cfg.staffCount.manager }, (_, i) =>
-    ({ id: uuid(), name: `Manager ${i + 1}`, email: `manager${i + 1}@groombook.dev`, role: "manager" as const, isSuperUser: false })
+    ({ id: uuid(), name: `Manager ${i + 1}`, email: `manager${i + 1}@groombook.dev`, role: "manager" as const, isSuperUser: profile === "uat" && i === 0 })
   );
   const receptionistStaff = Array.from({ length: cfg.staffCount.receptionist }, (_, i) =>
     ({ id: uuid(), name: `Receptionist ${i + 1}`, email: `receptionist${i + 1}@groombook.dev`, role: "receptionist" as const, isSuperUser: false })

packages/types/src/index.ts

@@ -153,10 +153,38 @@ export interface Invoice {
   notes: string | null;
   createdAt: string;
   updatedAt: string;
+  stripePaymentIntentId?: string | null;
+  stripeRefundId?: string | null;
+  paymentFailureReason?: string | null;
   lineItems?: InvoiceLineItem[];
   tipSplits?: InvoiceTipSplit[];
 }
 
+export interface StripePaymentInfo {
+  paymentIntentId: string;
+  amountPaidCents: number;
+  status: string;
+  cardLast4: string | null;
+  cardBrand: string | null;
+  refundId: string | null;
+  refundStatus: string | null;
+}
+
+export interface PaymentMethodBreakdown {
+  paymentMethod: PaymentMethod;
+  count: number;
+  totalCents: number;
+}
+
+export interface PaymentStats {
+  revenueCents: number;
+  outstandingCents: number;
+  refundsCents: number;
+  revenueCount: number;
+  refundCount: number;
+  paymentMethodBreakdown: PaymentMethodBreakdown[];
+}
+
 // ─── Impersonation ──────────────────────────────────────────────────────────
 
 export type ImpersonationSessionStatus = "active" | "ended" | "expired";

pnpm-lock.yaml

@@ -43,9 +43,6 @@ importers:
       stripe:
         specifier: ^22.0.0
         version: 22.0.1(@types/node@22.19.15)
-      telnyx:
-        specifier: ^6.41.0
-        version: 6.41.0(ws@8.19.0)
       zod:
         specifier: ^4.3.6
         version: 4.3.6
@@ -2115,9 +2112,6 @@ packages:
     resolution: {integrity: sha512-O/IEdcCUKkubz60tFbGA7ceITTAJsty+lBjNoorP4Z6XRqaFb/OjQjZODophEcuq68nKm6/0r+6/lLQ+XVpk8g==}
     engines: {node: '>=18.0.0'}
 
-  '@stablelib/base64@1.0.1':
-    resolution: {integrity: sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==}
-
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
@@ -3099,9 +3093,6 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-sha256@1.3.0:
-    resolution: {integrity: sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==}
-
   fast-uri@3.1.0:
     resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
 
@@ -4109,9 +4100,6 @@ packages:
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
-  standardwebhooks@1.0.0:
-    resolution: {integrity: sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==}
-
   std-env@3.10.0:
     resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
 
@@ -4200,14 +4188,6 @@ packages:
     resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
     engines: {node: '>=6'}
 
-  telnyx@6.41.0:
-    resolution: {integrity: sha512-93eKksI6HnLYp8e4DGlpC3SkBAfagblE+uug0FNDLT/+mix3PP0RveoQ/YZeRdxDhjMcoXVgeusJsgFP6PvUdw==}
-    peerDependencies:
-      ws: ^8.18.0
-    peerDependenciesMeta:
-      ws:
-        optional: true
-
   temp-dir@2.0.0:
     resolution: {integrity: sha512-aoBAniQmmwtcKp/7BzsH8Cxzv8OL736p7v1ihGb5e9DJ9kTwGWHrQrVB5+lfVDzfGrdRzXch+ig7LHaY1JTOrg==}
     engines: {node: '>=8'}
@@ -6730,8 +6710,6 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@stablelib/base64@1.0.1': {}
-
   '@standard-schema/spec@1.1.0': {}
 
   '@standard-schema/utils@0.3.0': {}
@@ -7777,8 +7755,6 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-sha256@1.3.0: {}
-
   fast-uri@3.1.0: {}
 
   fast-xml-builder@1.1.4:
@@ -8780,11 +8756,6 @@ snapshots:
 
   stackback@0.0.2: {}
 
-  standardwebhooks@1.0.0:
-    dependencies:
-      '@stablelib/base64': 1.0.1
-      fast-sha256: 1.3.0
-
   std-env@3.10.0: {}
 
   stop-iteration-iterator@1.1.0:
@@ -8887,12 +8858,6 @@ snapshots:
 
   tapable@2.3.0: {}
 
-  telnyx@6.41.0(ws@8.19.0):
-    dependencies:
-      standardwebhooks: 1.0.0
-    optionalDependencies:
-      ws: 8.19.0
-
   temp-dir@2.0.0: {}
 
   tempy@0.6.0: