fix(gro-527): update infra submodule to SEED_PROFILE wiring

Updates infra submodule to e8bd354 which wires SEED_PROFILE env var into seed-job patches for dev/uat/prod overlays. Co-Authored-By: Paperclip <noreply@paperclip.ing>
feat(GRO-537): add UAT Super User and Staff Groomer to seed script
2026-04-10 15:22:49 +00:00 · 2026-04-10 15:16:01 +00:00 · 2026-04-10 01:26:57 +00:00 · 2026-04-10 01:21:58 +00:00
125 changed files with 1468 additions and 4897 deletions
@@ -7,5 +7,3 @@ apps/web/dist
 apps/api/dist
 packages/db/dist
 packages/types/dist
-.turbo
-screenshots/
@@ -11,12 +11,6 @@ AUTH_DISABLED=false
 OIDC_ISSUER=https://authentik.example.com
 OIDC_AUDIENCE=groombook

-# ── Setup Wizard ─────────────────────────────────────────────────────────────
-# When SKIP_OOBE=true, the setup wizard is bypassed regardless of whether a
-# super user exists in the database. Useful in dev/test environments where the
-# database has data but the setup wizard would otherwise block access.
-SKIP_OOBE=false
-
 # ── API ───────────────────────────────────────────────────────────────────────
 PORT=3000
 CORS_ORIGIN=http://localhost:8080
@@ -1,54 +0,0 @@
-name: Release Helm Chart
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'charts/**'
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout groombook
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Checkout groombook.dev (Helm chart host)
-        uses: actions/checkout@v4
-        with:
-          repository: groombook/groombook.dev
-          path: gitea-pages
-          token: ${{ gitea.token }}
-
-      - name: Install Helm
-        uses: azure/setup-helm@v4
-
-      - name: Update Helm dependencies
-        run: helm dependency update charts/groombook
-
-      - name: Package chart
-        run: |
-          mkdir -p gitea-pages/charts
-          helm package charts/groombook -d gitea-pages/charts
-
-      - name: Update repo index
-        run: |
-          # TODO: update URL once Gitea Pages hosting is confirmed
-          CHART_URL="${HELM_CHART_URL:-https://groombook.farh.net/charts}"
-          if [ -f gitea-pages/charts/index.yaml ]; then
-            helm repo index gitea-pages/charts --merge gitea-pages/charts/index.yaml --url "$CHART_URL"
-          else
-            helm repo index gitea-pages/charts --url "$CHART_URL"
-          fi
-
-      - name: Push to groombook.dev
-        run: |
-          cd gitea-pages
-          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
-          git add charts/
-          git diff --staged --quiet && echo 'No chart changes' && exit 0
-          git commit -m "Update Helm chart repository"
-          git push
@@ -1,108 +0,0 @@
-name: Promote to Production
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Image tag to promote (e.g. 2026.03.28-f1b85bf)"
-        required: true
-        type: string
-
-jobs:
-  promote:
-    name: Promote to Production
-    runs-on: ubuntu-latest
-    steps:
-      - name: Validate tag format
-        run: |
-          TAG="${{ inputs.tag }}"
-          if ! echo "$TAG" | grep -qE '^[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[a-f0-9]{7}$'; then
-            echo "::error::Invalid tag format: '$TAG'. Expected format: YYYY.MM.DD-sha7 (e.g. 2026.03.28-f1b85bf)"
-            exit 1
-          fi
-          echo "Tag format valid: $TAG"
-
-      - name: Verify image exists in Gitea Container Registry
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
-        run: |
-          TAG="${{ inputs.tag }}"
-          if ! curl -sf \
-            -H "Authorization: token $GITEA_TOKEN" \
-            "https://git.farh.net/api/v1/packages/groombook?type=container&limit=50" \
-            | jq -e --arg t "$TAG" '[.[] | select(.name == "api" and .version == $t)] | length > 0' > /dev/null 2>&1; then
-            echo "::warning::Could not verify git.farh.net/groombook/api:$TAG via package API — verify manually if needed."
-          else
-            echo "Image verified: git.farh.net/groombook/api:$TAG exists"
-          fi
-
-      - name: Clone groombook/infra
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
-        run: |
-          git clone https://oauth2:$GITEA_TOKEN@git.farh.net/groombook/infra.git /tmp/infra
-
-      - name: Install yq
-        run: |
-          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
-          sudo chmod +x /usr/local/bin/yq
-
-      - name: Update prod overlay image tags and base Job names
-        env:
-          TAG: ${{ inputs.tag }}
-        run: |
-          cd /tmp/infra
-          PROD_KUST="apps/groombook/overlays/prod/kustomization.yaml"
-
-          SHORT_SHA="${TAG##*-}"
-          export SHORT_SHA
-          export TAG
-
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/api")).newTag = env(TAG)' "$PROD_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/web")).newTag = env(TAG)' "$PROD_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/migrate")).newTag = env(TAG)' "$PROD_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/seed")).newTag = env(TAG)' "$PROD_KUST"
-
-          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
-          if [ -f "$MIGRATE_JOB" ]; then
-            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
-            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
-          fi
-
-          SEED_JOB="apps/groombook/base/seed-job.yaml"
-          if [ -f "$SEED_JOB" ]; then
-            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
-            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
-          fi
-
-          git -C /tmp/infra diff --stat
-
-      - name: Create PR on groombook/infra
-        env:
-          TAG: ${{ inputs.tag }}
-          GITEA_TOKEN: ${{ gitea.token }}
-        run: |
-          cd /tmp/infra
-          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
-          git checkout -b "release/promote-prod-${TAG}"
-          git add apps/groombook/overlays/prod/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
-          git commit -m "release: promote ${TAG} to production"
-          git push -u origin "release/promote-prod-${TAG}"
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls" \
-            -d "{\"head\":\"release/promote-prod-${TAG}\",\"base\":\"main\",\"title\":\"release: promote ${TAG} to production\",\"body\":\"Promote image tag ${TAG} to production after UAT sign-off. cc @cpfarhood\"}"
-
-      - name: Notify on failure
-        if: failure()
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/app/issues/$RUN_ID/comments" \
-            -d '{"body": "## Production Promotion Failed\n\nThe `promote-prod` workflow failed. Check the workflow run logs for details."}'
@@ -2,9 +2,9 @@ name: CI

 on:
  push:
-    branches: [main, dev]
+    branches: [main]
  pull_request:
-    branches: [main, dev]
+    branches: [main]
  workflow_dispatch:
    inputs:
      ref:
@@ -20,8 +20,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'

      - uses: actions/setup-node@v4
        with:
@@ -44,8 +42,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'

      - uses: actions/setup-node@v4
        with:
@@ -66,8 +62,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'

      - uses: actions/setup-node@v4
        with:
@@ -107,8 +101,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'

      - uses: actions/setup-node@v4
        with:
@@ -127,12 +119,18 @@ jobs:
    needs: [build, e2e]
    outputs:
      tag: ${{ steps.version.outputs.tag }}
+    permissions:
+      contents: read
+      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Generate image tag
        id: version
        run: |
+          # Always include short SHA so each build is immutable and cache-from can never
+          # cross-contaminate between commits. For PRs the format is pr-N-sha7; for main
+          # it is YYYY.MM.DD-sha7.
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            TAG="pr-${{ github.event.pull_request.number }}-${GITHUB_SHA::7}"
          else
@@ -144,12 +142,12 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

-      - name: Log in to Gitea Container Registry
+      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
-          registry: git.farh.net
-          username: ${{ gitea.actor }}
-          password: ${{ gitea.token }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push API image
        uses: docker/build-push-action@v6
@@ -159,10 +157,10 @@ jobs:
          target: runner
          push: true
          tags: |
-            git.farh.net/groombook/api:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/api:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:api
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:api,mode=max
+            ghcr.io/groombook/api:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/api:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Migrate image
        uses: docker/build-push-action@v6
@@ -172,10 +170,10 @@ jobs:
          target: migrate
          push: true
          tags: |
-            git.farh.net/groombook/migrate:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/migrate:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:migrate
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:migrate,mode=max
+            ghcr.io/groombook/migrate:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/migrate:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Seed image
        uses: docker/build-push-action@v6
@@ -185,10 +183,10 @@ jobs:
          target: seed
          push: true
          tags: |
-            git.farh.net/groombook/seed:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/seed:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:seed
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:seed,mode=max
+            ghcr.io/groombook/seed:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/seed:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Reset image
        uses: docker/build-push-action@v6
@@ -198,10 +196,10 @@ jobs:
          target: reset
          push: true
          tags: |
-            git.farh.net/groombook/reset:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/reset:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:reset
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:reset,mode=max
+            ghcr.io/groombook/reset:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/reset:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

      - name: Build and push Web image
        uses: docker/build-push-action@v6
@@ -210,16 +208,19 @@ jobs:
          file: apps/web/Dockerfile
          push: true
          tags: |
-            git.farh.net/groombook/web:${{ steps.version.outputs.tag }}
-            ${{ github.ref == 'refs/heads/main' && 'git.farh.net/groombook/web:latest' || '' }}
-          cache-from: type=registry,ref=git.farh.net/groombook/cache:web
-          cache-to: type=registry,ref=git.farh.net/groombook/cache:web,mode=max
+            ghcr.io/groombook/web:${{ steps.version.outputs.tag }}
+            ${{ github.ref == 'refs/heads/main' && 'ghcr.io/groombook/web:latest' || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

  deploy-dev:
    name: Deploy PR to groombook-dev
-    runs-on: ubuntu-latest
+    runs-on: runners-groombook
    needs: [docker]
    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
    steps:
      - name: Install kubectl
        run: |
@@ -236,6 +237,8 @@ jobs:
          TAG="pr-$PR_NUM-${SHA::7}"
          echo "Deploying images tagged $TAG to groombook-dev..."

+          # Run migration with PR image
+          kubectl delete job migrate-schema -n groombook-dev --ignore-not-found
          kubectl delete job "migrate-pr-$PR_NUM" -n groombook-dev --ignore-not-found
          cat <<EOF | kubectl apply -n groombook-dev -f -
          apiVersion: batch/v1
@@ -250,7 +253,7 @@ jobs:
                restartPolicy: Never
                containers:
                - name: migrate
-                  image: git.farh.net/groombook/migrate:$TAG
+                  image: ghcr.io/groombook/migrate:$TAG
                  env:
                  - name: DATABASE_URL
                    valueFrom:
@@ -261,25 +264,35 @@ jobs:
          kubectl wait --for=condition=complete "job/migrate-pr-$PR_NUM" \
            -n groombook-dev --timeout=120s

-          kubectl set image deployment/api api=git.farh.net/groombook/api:$TAG -n groombook-dev
-          kubectl set image deployment/web web=git.farh.net/groombook/web:$TAG -n groombook-dev
+          # Update deployments
+          kubectl set image deployment/api api=ghcr.io/groombook/api:$TAG -n groombook-dev
+          kubectl set image deployment/web web=ghcr.io/groombook/web:$TAG -n groombook-dev

+          # Wait for rollout
          kubectl rollout status deployment/api -n groombook-dev --timeout=300s
          kubectl rollout status deployment/web -n groombook-dev --timeout=300s

          echo "Deployment complete."

      - name: Comment on PR
-        env:
-          PR_NUM: ${{ github.event.pull_request.number }}
-          GITEA_TOKEN: ${{ gitea.token }}
-        run: |
-          TAG="pr-${PR_NUM}"
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/app/issues/$PR_NUM/comments" \
-            -d "{\"body\": \"## Deployed to groombook-dev\n\n**Images:** \`${TAG}\`\n**URL:** https://dev.groombook.farh.net\n\nReady for UAT validation.\"}"
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.issue.number;
+            const tag = `pr-${pr}`;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr,
+              body: [
+                '## Deployed to groombook-dev',
+                '',
+                `**Images:** \`${tag}\``,
+                '**URL:** https://dev.groombook.farh.net',
+                '',
+                'Ready for UAT validation.'
+              ].join('\n')
+            });

  web-e2e:
    name: Web E2E (Dev)
@@ -290,8 +303,6 @@ jobs:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
-        with:
-          version: '9.15.4'

      - uses: actions/setup-node@v4
        with:
@@ -320,13 +331,21 @@ jobs:
    name: Update Infra Image Tags
    runs-on: ubuntu-latest
    needs: [docker]
-    if: (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') && github.event_name == 'push'
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+      pull-requests: write
    steps:
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Clone groombook/infra
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
        run: |
-          git clone https://oauth2:$GITEA_TOKEN@git.farh.net/groombook/infra.git /tmp/infra
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra

      - name: Install yq
        run: |
@@ -343,25 +362,30 @@ jobs:
          fi
          export SHORT_SHA="${SHA::7}"
          echo "Updating dev overlay image tags to: $TAG"
+          echo "Updating migration/seed Job names with SHA: $SHORT_SHA"
          cd /tmp/infra
          DEV_KUST="apps/groombook/overlays/dev/kustomization.yaml"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/api")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/web")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$DEV_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/reset")).newTag = env(TAG)' "$DEV_KUST"

+          # Update migrate Job name to include short SHA (immutable template fix)
          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
          if [ -f "$MIGRATE_JOB" ]; then
            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
+            # Ensure ttlSecondsAfterFinished is set for automatic cleanup
            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$MIGRATE_JOB"
          fi

+          # Update seed Job name to include short SHA (immutable template fix)
          SEED_JOB="apps/groombook/base/seed-job.yaml"
          if [ -f "$SEED_JOB" ]; then
            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
+            # Ensure ttlSecondsAfterFinished is set for automatic cleanup
            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$SEED_JOB"
          fi

@@ -370,40 +394,26 @@ jobs:
      - name: Create PR on groombook/infra
        env:
          TAG: ${{ needs.docker.outputs.tag }}
-          GITEA_TOKEN: ${{ gitea.token }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
        run: |
          if [ -z "$TAG" ]; then
            TAG="$(date -u +%Y.%m.%d)-${GITHUB_SHA::7}"
          fi
+
          cd /tmp/infra
          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
          git checkout -b "chore/update-image-tags-${TAG}"
          git add apps/groombook/overlays/dev/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
          git commit -m "chore: update image tags and migration/seed Job names to ${TAG}"
+
          git push -u origin "chore/update-image-tags-${TAG}"

-          EXISTING_PR=$(curl -s \
-            -H "Authorization: token $GITEA_TOKEN" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls?state=open&limit=50" \
-            | jq -r ".[] | select(.head.label == \"chore/update-image-tags-${TAG}\") | .number" | head -1)
-          if [ -n "$EXISTING_PR" ]; then
-            echo "PR #$EXISTING_PR already exists, merging"
-            curl -s -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "https://git.farh.net/api/v1/repos/groombook/infra/pulls/$EXISTING_PR/merge" \
-              -d '{"Do":"merge"}'
-          else
-            PR_NUM=$(curl -s -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "https://git.farh.net/api/v1/repos/groombook/infra/pulls" \
-              -d "{\"head\":\"chore/update-image-tags-${TAG}\",\"base\":\"main\",\"title\":\"chore: deploy ${TAG} to dev\",\"body\":\"[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge\"}" \
-              | jq '.number')
-            curl -s -X POST \
-              -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              "https://git.farh.net/api/v1/repos/groombook/infra/pulls/$PR_NUM/merge" \
-              -d '{"Do":"merge"}'
-          fi
+          # Create PR and merge immediately (no required checks on groombook/infra)
+          PR_URL=$(gh pr create \
+            --repo groombook/infra \
+            --base main \
+            --head "chore/update-image-tags-${TAG}" \
+            --title "chore: deploy ${TAG} to dev" \
+            --body "[GRO-178](/GRO/issues/GRO-178) — automated image tag update from main merge")
+          gh pr merge "$PR_URL" --merge
@@ -0,0 +1,54 @@
+name: Release Helm Chart
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'charts/**'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout groombook
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Checkout groombook.github.io
+        uses: actions/checkout@v4
+        with:
+          repository: groombook/groombook.github.io
+          path: gh-pages
+          token: ${{ secrets.CHART_REPO_TOKEN }}
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+
+      - name: Update Helm dependencies
+        run: helm dependency update charts/groombook
+
+      - name: Package chart
+        run: |
+          mkdir -p gh-pages/charts
+          helm package charts/groombook -d gh-pages/charts
+
+      - name: Update repo index
+        run: |
+          if [ -f gh-pages/charts/index.yaml ]; then
+            helm repo index gh-pages/charts --merge gh-pages/charts/index.yaml --url https://groombook.github.io/charts
+          else
+            helm repo index gh-pages/charts --url https://groombook.github.io/charts
+          fi
+
+      - name: Push to groombook.github.io
+        run: |
+          cd gh-pages
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add charts/
+          git diff --staged --quiet && echo 'No chart changes' && exit 0
+          git commit -m "Update Helm chart repository"
+          git push
@@ -0,0 +1,95 @@
+name: Promote to Production
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag to promote (e.g. 2026.03.28-f1b85bf)"
+        required: true
+        type: string
+
+jobs:
+  promote:
+    name: Promote to Production
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Clone groombook/infra
+        run: |
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra
+
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Update prod overlay image tags and base Job names
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          cd /tmp/infra
+          PROD_KUST="apps/groombook/overlays/prod/kustomization.yaml"
+
+          SHORT_SHA="${TAG##*-}"
+          export SHORT_SHA
+          export TAG
+
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$PROD_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$PROD_KUST"
+
+          # Update migrate Job name to include short SHA (immutable template fix)
+          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
+          if [ -f "$MIGRATE_JOB" ]; then
+            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
+            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
+          fi
+
+          # Update seed Job name to include short SHA (immutable template fix)
+          SEED_JOB="apps/groombook/base/seed-job.yaml"
+          if [ -f "$SEED_JOB" ]; then
+            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
+            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
+          fi
+
+          git -C /tmp/infra diff --stat
+
+      - name: Create PR on groombook/infra
+        env:
+          TAG: ${{ inputs.tag }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
+        run: |
+          cd /tmp/infra
+          git config user.name "groombook-engineer[bot]"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
+          git checkout -b "release/promote-prod-${TAG}"
+          git add apps/groombook/overlays/prod/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
+          git commit -m "release: promote ${TAG} to production"
+          git push -u origin "release/promote-prod-${TAG}"
+          gh pr create \
+            --repo groombook/infra \
+            --base main \
+            --head "release/promote-prod-${TAG}" \
+            --title "release: promote ${TAG} to production" \
+            --body "Promote image tag ${TAG} to production after UAT sign-off. cc @cpfarhood"
+
+      - name: Notify on failure
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: '## Production Promotion Failed\n\nThe `promote-prod` workflow failed. Check the workflow run logs for details.'
+            });
@@ -12,12 +12,20 @@ jobs:
  promote-to-uat:
    name: Promote to groombook-uat
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
    steps:
+      - name: Generate infra repo token
+        id: infra-token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ vars.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
      - name: Clone groombook/infra
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
        run: |
-          git clone https://oauth2:$GITEA_TOKEN@git.farh.net/groombook/infra.git /tmp/infra
+          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra

      - name: Install yq
        run: |
@@ -41,17 +49,19 @@ jobs:
          export SHORT_SHA
          export TAG

-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/api")).newTag = env(TAG)' "$UAT_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/web")).newTag = env(TAG)' "$UAT_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/migrate")).newTag = env(TAG)' "$UAT_KUST"
-          yq -i '(.images[] | select(.name == "git.farh.net/groombook/seed")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$UAT_KUST"
+          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$UAT_KUST"

+          # Update migrate Job name to include short SHA (immutable template fix)
          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
          if [ -f "$MIGRATE_JOB" ]; then
            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
          fi

+          # Update seed Job name to include short SHA (immutable template fix)
          SEED_JOB="apps/groombook/base/seed-job.yaml"
          if [ -f "$SEED_JOB" ]; then
            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
@@ -63,36 +73,34 @@ jobs:
      - name: Create PR on groombook/infra
        env:
          TAG: ${{ inputs.image_tag }}
-          GITEA_TOKEN: ${{ gitea.token }}
+          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
        run: |
          cd /tmp/infra
          git config user.name "groombook-engineer[bot]"
-          git config user.email "groombook-engineer[bot]@git.farh.net"
+          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
          git checkout -b "chore/update-uat-image-tags-${TAG}"
          git add apps/groombook/overlays/uat/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
          git commit -m "chore: promote ${TAG} to UAT"
+
          git push -u origin "chore/update-uat-image-tags-${TAG}"

-          PR_NUM=$(curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls" \
-            -d "{\"head\":\"chore/update-uat-image-tags-${TAG}\",\"base\":\"main\",\"title\":\"chore: promote ${TAG} to UAT\",\"body\":\"[GRO-429](/GRO/issues/GRO-429) — UAT promotion triggered by CTO\"}" \
-            | jq '.number')
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/infra/pulls/$PR_NUM/merge" \
-            -d '{"Do":"merge"}'
+          # Create PR and merge immediately (no required checks on groombook/infra)
+          PR_URL=$(gh pr create \
+            --repo groombook/infra \
+            --base main \
+            --head "chore/update-uat-image-tags-${TAG}" \
+            --title "chore: promote ${TAG} to UAT" \
+            --body "[GRO-429](/GRO/issues/GRO-429) — UAT promotion triggered by CTO")
+          gh pr merge "$PR_URL" --merge

      - name: Notify on failure
        if: failure()
-        env:
-          GITEA_TOKEN: ${{ gitea.token }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          curl -s -X POST \
-            -H "Authorization: token $GITEA_TOKEN" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/groombook/app/issues/$RUN_ID/comments" \
-            -d '{"body": "## UAT Promotion Failed\n\nThe `promote-to-uat` workflow failed. Check the workflow run logs for details.\n\nCommon issues:\n- UAT overlay not found (ensure GRO-427 is complete)\n- GITEA_TOKEN permissions"}'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: '## UAT Promotion Failed\n\nThe `promote-to-uat` workflow failed. Check the workflow run logs for details.\n\nCommon issues:\n- UAT overlay not found (ensure GRO-427 is complete)\n- Infra repo access token expired'
+            });
@@ -8,16 +8,3 @@ dist/
 .turbo/
 coverage/
 minimax-output/
-
-# Agent runtime artifacts — never commit
-.gh-token
-*.gh-token
-.config/gh/
-**/.config/gh/
-infra-repo
-infra-repo/
-**/instructions/.gh-token
-**/AGENT_HOME/**
-$AGENT_HOME/**
-.claude/
-.codex/
@@ -1,90 +0,0 @@
-# Contributing to GroomBook
-
-## Branch Strategy
-
-GroomBook uses a three-branch GitOps model:
-
-| Branch | Environment | Purpose |
-|--------|-------------|---------|
-| `dev` | Development | Active development target — all feature/fix PRs target this branch |
-| `uat` | UAT / Staging | Promoted from `dev` by the CTO for acceptance testing |
-| `main` | Production | Promoted from `uat` by the CEO; triggers production deployment |
-
-**Never open a PR directly to `uat` or `main`.** All work flows through `dev` first.
-
-## Developer Workflow
-
-1. **Branch from `dev`** — create a feature or fix branch:
-   ```bash
-   git checkout dev
-   git pull origin dev
-   git checkout -b feat/my-feature
-   ```
-
-2. **Open a PR targeting `dev`** — include the issue identifier in the title and cc @cpfarhood:
-   ```bash
-   gh pr create --base dev --title "feat: description (GRO-NNN)" \
-     --body $'Closes GRO-NNN\n\ncc @cpfarhood'
-   ```
-
-3. **Pipeline gates before merge to `dev`:**
-   - QA (Lint Roller) reviews first — code quality, test coverage, CI pass
-   - CTO (The Dogfather) reviews second — architecture and final approval
-   - Both must approve; 2 approving reviews required by branch protection
-
-## Promotion Flow
-
-### Dev → UAT
-
-After merging to `dev`, the CTO opens a PR from `dev` → `uat`:
-
-```bash
-gh pr create --base uat --head dev \
-  --title "chore: promote dev to uat (YYYY.MM.DD)" \
-  --body $'Promoting dev to UAT for regression and security review.\n\ncc @cpfarhood'
-```
-
-Gates:
- Shedward Scissorhands runs regression/acceptance tests
- Barkley Trimsworth performs security review
- CTO approves and merges (1 approving review required)
-
-### UAT → Main (Production)
-
-After UAT passes, the CTO opens a PR from `uat` → `main` and assigns it to the CEO:
-
-```bash
-gh pr create --base main --head uat \
-  --title "chore: promote uat to main (YYYY.MM.DD)" \
-  --body $'Promoting UAT to production.\n\ncc @cpfarhood'
-```
-
-Gates:
- CEO (Scrubs McBarkley) reviews for business alignment and merges
- 1 approving review required; triggers auto-deploy to Production
-
-## Branch Protection Summary
-
-| Branch | Required Approvals | Who approves |
-|--------|--------------------|-------------|
-| `dev` | 2 | QA (Lint Roller) + CTO (The Dogfather) |
-| `uat` | 1 | CTO (The Dogfather) |
-| `main` | 1 | CEO (Scrubs McBarkley) |
-
-Force-pushes and branch deletions are disabled on all three branches.
-
-## Commit Style
-
-Use [Conventional Commits](https://www.conventionalcommits.org/):
- `feat:` — new feature
- `fix:` — bug fix
- `chore:` — maintenance (dependency updates, build config, promotions)
- `docs:` — documentation only
- `ci:` — CI/CD changes
- `refactor:` — code restructure without behaviour change
-
-Reference the Paperclip issue in the commit body: `Refs GRO-NNN`.
-
-## Questions?
-
-Open a Paperclip issue in the GRO project or ask in the team channel.
@@ -12,7 +12,6 @@ RUN pnpm install --frozen-lockfile

 # Build
 FROM deps AS builder
-RUN mkdir -p /home/node/.cache/node/corepack
 COPY packages/ packages/
 COPY apps/api/ apps/api/
 RUN pnpm --filter @groombook/types build && \
@@ -35,9 +34,6 @@ COPY --from=builder /app/packages/types/dist packages/types/dist
 RUN pnpm install --frozen-lockfile --prod

 EXPOSE 3000
-RUN apk add --no-cache curl
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD curl -f http://localhost:3000/health || exit 1
 CMD ["node", "apps/api/dist/index.js"]

 # Migrate stage — runs drizzle-kit migrate against the database
@@ -50,4 +46,4 @@ CMD ["pnpm", "db:seed"]

 # Reset stage — drops all tables, re-runs migrations, and re-seeds
 FROM builder AS reset
-CMD ["pnpm", "db:reset"]
+CMD ["pnpm", "db:reset"]
@@ -22,9 +22,6 @@
    "hono": "^4.6.17",
    "node-cron": "^3.0.3",
    "nodemailer": "^6.9.16",
-    "stripe": "^22.0.0",
-    "telnyx": "^1.23.0",
-
    "zod": "^4.3.6"
  },
  "devDependencies": {
@@ -27,14 +27,12 @@ const DISABLED_CLIENT = {
 // ─── Queue-based mock DB ──────────────────────────────────────────────────────

 let selectRows: Record<string, unknown>[] = [];
-let appointmentRows: Record<string, unknown>[] = [];
 let insertedValues: Record<string, unknown>[] = [];
 let updatedValues: Record<string, unknown>[] = [];
 let deletedId: string | null = null;

 function resetMock() {
  selectRows = [];
-  appointmentRows = [];
  insertedValues = [];
  updatedValues = [];
  deletedId = null;
@@ -60,19 +58,10 @@ vi.mock("@groombook/db", () => {
    { get: (t, p) => (p === "_name" ? "clients" : { table: "clients", column: p }) }
  );

-  const appointments = new Proxy(
-    { _name: "appointments" },
-    { get: (t, p) => (p === "_name" ? "appointments" : { table: "appointments", column: p }) }
-  );
-
  return {
    getDb: () => ({
      select: () => ({
-        from: (table: unknown) => {
-          const tableName = (table as { _name?: string })._name;
-          const rows = tableName === "appointments" ? appointmentRows : selectRows;
-          return makeChainable(rows);
-        },
+        from: () => makeChainable(selectRows),
      }),
      insert: () => ({
        values: (vals: Record<string, unknown>) => {
@@ -106,10 +95,8 @@ vi.mock("@groombook/db", () => {
      }),
    }),
    clients,
-    appointments,
    eq: vi.fn(),
    and: vi.fn(),
-    or: vi.fn(),
  };
 });

@@ -195,11 +182,10 @@ describe("POST /clients", () => {
    expect(insertedValues[0]!.name).toBe("Charlie");
  });

-  it("creates a client with name and email", async () => {
-    const res = await jsonRequest("POST", "/clients", { name: "Dana", email: "dana@example.com" });
+  it("creates a client with only required name field", async () => {
+    const res = await jsonRequest("POST", "/clients", { name: "Dana" });
    expect(res.status).toBe(201);
    expect(insertedValues[0]!.name).toBe("Dana");
-    expect(insertedValues[0]!.email).toBe("dana@example.com");
  });

  it("rejects empty name", async () => {
@@ -68,7 +68,6 @@ vi.mock("@groombook/db", () => {
    }),
    appointments,
    eq: () => ({}),
-    and: (..._clauses: unknown[]) => ({}),
  };
 });

@@ -78,7 +78,6 @@ vi.mock("@groombook/db", () => {
    }),
    staff,
    eq: vi.fn((_col: unknown, _val: unknown) => ({ col: _col, val: _val })),
-    and: vi.fn((..._clauses: unknown[]) => ({})),
  };
 });

@@ -363,7 +362,7 @@ describe("requireRoleOrSuperUser", () => {
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
-    expect(body.error).toMatch(/role.*not permitted/i);
+    expect(body.error).toMatch(/super user privileges required/i);
  });

  it("blocks a non-super-user groomer from manager-only routes", async () => {
@@ -371,7 +370,7 @@ describe("requireRoleOrSuperUser", () => {
    const res = await app.request("/test");
    expect(res.status).toBe(403);
    const body = await res.json();
-    expect(body.error).toMatch(/role.*not permitted/i);
+    expect(body.error).toMatch(/super user privileges required/i);
  });

  it("allows a manager with multiple allowed roles", async () => {
@@ -418,48 +418,6 @@ describe("GET /setup/status — OOBE bootstrap logic", () => {
    expect(body.showAuthProviderStep).toBe(false); // DB config already exists
    expect(body.authConfigExists).toBe(true);
  });
-
-  it("SKIP_OOBE=true bypasses setup check regardless of DB state", async () => {
-    dbStaffRows = []; // no super user
-    dbAuthConfigRows = [];
-    process.env.SKIP_OOBE = "true";
-
-    const app = makeApp();
-    const { status, body } = await getStatus(app);
-
-    expect(status).toBe(200);
-    expect(body.needsSetup).toBe(false);
-    expect(body.showAuthProviderStep).toBe(false);
-    expect(body.authConfigExists).toBe(false);
-    expect(body.authEnvVarsSet).toBe(false);
-    expect(body.skipped).toBe(true);
-  });
-
-  it("SKIP_OOBE=1 also bypasses setup check", async () => {
-    dbStaffRows = [];
-    dbAuthConfigRows = [];
-    process.env.SKIP_OOBE = "1";
-
-    const app = makeApp();
-    const { status, body } = await getStatus(app);
-
-    expect(status).toBe(200);
-    expect(body.needsSetup).toBe(false);
-    expect(body.skipped).toBe(true);
-  });
-
-  it("SKIP_OOBE=yes also bypasses setup check", async () => {
-    dbStaffRows = [];
-    dbAuthConfigRows = [];
-    process.env.SKIP_OOBE = "yes";
-
-    const app = makeApp();
-    const { status, body } = await getStatus(app);
-
-    expect(status).toBe(200);
-    expect(body.needsSetup).toBe(false);
-    expect(body.skipped).toBe(true);
-  });
 });

 describe("POST /setup/auth-provider — OOBE bootstrap", () => {
@@ -2,7 +2,7 @@ import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { logger } from "hono/logger";
 import { cors } from "hono/cors";
-import { getAuth, initAuth, getActiveProviders } from "./lib/auth.js";
+import { getAuth, initAuth } from "./lib/auth.js";
 import { clientsRouter } from "./routes/clients.js";
 import { petsRouter } from "./routes/pets.js";
 import { servicesRouter } from "./routes/services.js";
@@ -19,7 +19,7 @@ import { impersonationRouter } from "./routes/impersonation.js";
 import { settingsRouter } from "./routes/settings.js";
 import { authProviderRouter } from "./routes/authProvider.js";
 import { searchRouter } from "./routes/search.js";
-import { getObject } from "./lib/s3.js";
+import { getPresignedGetUrl } from "./lib/s3.js";
 import { calendarRouter } from "./routes/calendar.js";
 import { setupRouter } from "./routes/setup.js";
 import { getDb, businessSettings, eq, staff } from "@groombook/db";
@@ -28,31 +28,15 @@ import { resolveStaffMiddleware, requireRole, requireRoleOrSuperUser, requireSup
 import { devRouter } from "./routes/dev.js";
 import { adminSeedRouter } from "./routes/admin/seed.js";
 import { startReminderScheduler } from "./services/reminders.js";
-import { webhooksRouter } from "./routes/stripe-webhooks.js";

 const app = new Hono();

 // Global middleware
-const TRUSTED_ORIGINS = (process.env.CORS_ORIGIN ?? "http://localhost:5173")
-  .split(",")
-  .map((o) => o.trim());
-
-const ALLOWED_ORIGIN = process.env.CORS_ORIGIN ?? "http://localhost:5173";
-
 app.use("*", logger());
 app.use(
  "/api/*",
  cors({
-    origin: (origin, ctx) => {
-      if (!origin) {
-        return ALLOWED_ORIGIN;
-      }
-      if (TRUSTED_ORIGINS.includes(origin)) {
-        return origin;
-      }
-      ctx.status(403);
-      return null;
-    },
+    origin: process.env.CORS_ORIGIN ?? "http://localhost:5173",
    credentials: true,
  })
 );
@@ -66,105 +50,31 @@ app.route("/api/book", bookRouter);
 // Public portal routes — client-facing, authenticated via impersonation session header
 app.route("/api/portal", portalRouter);

-// Public Stripe webhook endpoint — signature-verified, no auth required
-app.route("/api/webhooks/stripe", webhooksRouter);
-
 // Dev/demo routes — config is always public, users endpoint is guarded internally
 app.route("/api/dev", devRouter);

-// Magic bytes for allowed image types
-const ALLOWED_IMAGE_TYPES: Record<string, Uint8Array> = {
-  "image/png": new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
-  "image/jpeg": new Uint8Array([0xff, 0xd8, 0xff]),
-  "image/gif": new Uint8Array([0x47, 0x49, 0x46, 0x38]),
-  "image/webp": new Uint8Array([0x52, 0x49, 0x46, 0x46]), // followed by size then WEBP
-};
-
-/**
- * Validates that the given base64 content matches the declared MIME type
- * by checking magic bytes. Returns null if valid, or the field to clear if not.
- */
-function validateLogoMagicBytes(
-  logoBase64: string | null,
-  logoMimeType: string | null
-): "logoBase64" | "logoMimeType" | null {
-  if (!logoBase64 || !logoMimeType) return null;
-
-  const expectedMagic = ALLOWED_IMAGE_TYPES[logoMimeType];
-  if (!expectedMagic) return "logoMimeType"; // unknown MIME type — reject
-
-  try {
-    const binary = Buffer.from(logoBase64, "base64");
-    // WebP needs a special check (RIFF....WEBP at offset 0, size at offset 4)
-    if (logoMimeType === "image/webp") {
-      if (binary.length < 12) return "logoBase64";
-      const webpMagic = binary.slice(0, 4);
-      const webpSig = binary.slice(8, 12);
-      if (
-        webpMagic[0] !== 0x52 ||
-        webpMagic[1] !== 0x49 ||
-        webpMagic[2] !== 0x46 ||
-        webpMagic[3] !== 0x46 ||
-        webpSig[0] !== 0x57 ||
-        webpSig[1] !== 0x45 ||
-        webpSig[2] !== 0x42 ||
-        webpSig[3] !== 0x50
-      ) {
-        return "logoBase64";
-      }
-      return null;
-    }
-
-    // All other types: check prefix
-    if (binary.length < expectedMagic.length) return "logoBase64";
-    for (let i = 0; i < expectedMagic.length; i++) {
-      if (binary[i] !== expectedMagic[i]) return "logoBase64";
-    }
-    return null;
-  } catch {
-    return "logoBase64";
-  }
-}
-
-// Public logo proxy — no auth required, streams logo from S3 so browser never sees raw S3 URL
-app.get("/api/branding/logo", async (c) => {
-  const db = getDb();
-  const [row] = await db.select().from(businessSettings).limit(1);
-  if (!row) return c.json({ error: "Settings not found" }, 404);
-  if (!row.logoKey) return c.json({ error: "No logo on file" }, 404);
-
-  const { body, contentType } = await getObject(row.logoKey);
-  return new Response(Buffer.from(body), {
-    status: 200,
-    headers: {
-      "Content-Type": contentType,
-      "Cache-Control": "public, max-age=86400",
-    },
-  });
-});
-
 // Public branding endpoint — no auth required, returns business name/colors/logo
 app.get("/api/branding", async (c) => {
  const db = getDb();
  const [row] = await db.select().from(businessSettings).limit(1);
  const settings = row ?? { businessName: "GroomBook", primaryColor: "#4f8a6f", accentColor: "#8b7355", logoBase64: null, logoMimeType: null, logoKey: null };

-  // Return the public proxy path so browser never sees a raw S3 URL
-  const logoUrl = settings.logoKey ? "/api/branding/logo" : null;
-
-  // Defensive: validate magic bytes to prevent MIME type confusion attacks
-  // via the legacy base64 logo fields
-  const badField = validateLogoMagicBytes(settings.logoBase64 ?? null, settings.logoMimeType ?? null);
-  const safeLogoBase64 = badField === "logoBase64" ? null : settings.logoBase64;
-  const safeLogoMimeType = badField === "logoMimeType" ? null : settings.logoMimeType;
+  let logoUrl: string | null = null;
+  if (settings.logoKey) {
+    try {
+      logoUrl = await getPresignedGetUrl(settings.logoKey);
+    } catch {
+      // If S3 URL generation fails, fall back to legacy base64
+    }
+  }

  return c.json({
    businessName: settings.businessName,
    primaryColor: settings.primaryColor,
    accentColor: settings.accentColor,
    logoUrl,
-    logoBase64: safeLogoBase64,
-    logoMimeType: safeLogoMimeType,
+    logoBase64: settings.logoBase64,
+    logoMimeType: settings.logoMimeType,
  });
 });

@@ -182,11 +92,6 @@ app.get("/api/setup/status", async (c) => {
  return c.json({ needsSetup: !superUser });
 });

-// Public auth providers endpoint — no auth required, tells frontend which login options are available
-app.get("/api/auth/providers", async (c) => {
-  return c.json({ providers: getActiveProviders() });
-});
-
 // Protected API routes
 const api = app.basePath("/api");
 api.use("*", authMiddleware);
@@ -195,13 +100,7 @@ api.use("*", resolveStaffMiddleware);
 // Better-Auth handler — mounted as sub-app to handle all /api/auth/* routes
 // authMiddleware and resolveStaffMiddleware both skip /api/auth/ paths
 const authRouter = new Hono();
-authRouter.all("/*", (c) => {
-  try {
-    return getAuth().handler(c.req.raw);
-  } catch {
-    return c.json({ error: "Authentication not configured" }, 503);
-  }
-});
+authRouter.all("/*", (c) => getAuth().handler(c.req.raw));
 api.route("/auth", authRouter);

 // ── Role guards ────────────────────────────────────────────────────────────────
@@ -213,7 +112,7 @@ api.on(["POST", "PATCH", "DELETE"], "/staff/*", requireRoleOrSuperUser("manager"
 api.use("/admin/*", requireRoleOrSuperUser("manager"));
 api.use("/admin/settings/*", requireSuperUser());
 api.use("/reports/*", requireRole("manager"));
-api.use("/invoices/*", requireRole("manager", "groomer"));
+api.use("/invoices/*", requireRole("manager"));
 api.use("/impersonation/*", requireRole("manager"));

 // Manager + Receptionist only (groomers have no access): appointment-groups, grooming-logs, waitlist
@@ -273,24 +172,9 @@ api.route("/search", searchRouter);
 const port = Number(process.env.PORT ?? 3000);
 await initAuth();
 console.log(`API server listening on port ${port}`);
-const server = serve({ fetch: app.fetch, port });
+serve({ fetch: app.fetch, port });

 // Start background reminder scheduler (runs every minute to check for upcoming appointments)
 startReminderScheduler();

-function shutdown() {
-  console.log("Shutting down gracefully...");
-  server.close(() => {
-    console.log("HTTP server closed");
-    process.exit(0);
-  });
-  setTimeout(() => {
-    console.error("Forced shutdown after timeout");
-    process.exit(1);
-  }, 10_000);
-}
-
-process.on("SIGTERM", shutdown);
-process.on("SIGINT", shutdown);
-
 export default app;
@@ -3,7 +3,6 @@ import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { genericOAuth } from "better-auth/plugins";
 import { getDb, authProviderConfig, eq } from "@groombook/db";
 import { decryptSecret } from "@groombook/db";
-import { sendEmail } from "../services/email.js";

 const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
 const BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://localhost:3000";
@@ -28,21 +27,6 @@ export function getAuthPromise() {
  return authInitPromise;
 }

-/** Returns which OAuth/social providers are configured via env vars. */
-export function getActiveProviders(): string[] {
-  const providers: string[] = [];
-  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
-    providers.push("google");
-  }
-  if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET) {
-    providers.push("github");
-  }
-  if (process.env.OIDC_ISSUER && process.env.OIDC_CLIENT_ID && process.env.OIDC_CLIENT_SECRET) {
-    providers.push("authentik");
-  }
-  return providers;
-}
-
 /**
 * Re-initializes the Better-Auth instance after auth config changes.
 *
@@ -89,17 +73,8 @@ export async function initAuth(): Promise<void> {
      console.warn("[auth] AUTH_DISABLED=true — building placeholder auth instance");
      authInstance = betterAuth({
        database: drizzleAdapter(getDb(), { provider: "pg" }),
-        secret: BETTER_AUTH_SECRET!,
+        secret: BETTER_AUTH_SECRET ?? "placeholder-secret-do-not-use-in-prod",
        baseURL: BETTER_AUTH_URL,
-        rateLimit: {
-          enabled: true,
-          max: 100,
-          window: 10,
-          storage: "memory",
-          customRules: {
-            "/get-session": false,
-          },
-        },
        plugins: [
          genericOAuth({
            config: [
@@ -177,63 +152,6 @@ export async function initAuth(): Promise<void> {
      console.log("[auth] Using env var config (no DB config found)");
    }

-    const hasGoogle = !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
-    const hasGitHub = !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET);
-
-    const issuerUrlObj = new URL(providerConfig.issuerUrl);
-    const issuerHostname = issuerUrlObj.hostname;
-
-    const discoveryUrlStr = `${providerConfig.issuerUrl}/.well-known/openid-configuration`;
-    let oidcConfig: Record<string, string> = {};
-    try {
-      const discoveryRes = await fetch(discoveryUrlStr);
-      if (discoveryRes.ok) {
-        const discovery = await discoveryRes.json() as {
-          authorization_endpoint?: string;
-          token_endpoint?: string;
-          userinfo_endpoint?: string;
-        };
-        const replaceHost = (url: string, newHost: string) => {
-          try {
-            const parsed = new URL(url);
-            const newParsed = new URL(newHost);
-            return `${newParsed.origin}${parsed.pathname}${parsed.search}`;
-          } catch {
-            return url;
-          }
-        };
-        const authzUrl = discovery.authorization_endpoint;
-        const tokenUrl = discovery.token_endpoint;
-        const userInfoUrl = discovery.userinfo_endpoint;
-        if (authzUrl && tokenUrl && userInfoUrl) {
-          const authzUrlObj = new URL(authzUrl);
-          // Only validate authorizationUrl hostname against issuer — token/userinfo
-          // may legitimately use internal hostnames (OIDC_INTERNAL_BASE) for server-to-server calls.
-          if (authzUrlObj.hostname !== issuerHostname) {
-            throw new Error(
-              `[FATAL] OIDC discovery URL hostname mismatch: expected '${issuerHostname}' but got '${authzUrlObj.hostname}'. This may indicate a man-in-the-middle attack.`
-            );
-          }
-          oidcConfig = {
-            authorizationUrl: authzUrl,
-            tokenUrl: providerConfig.internalBaseUrl
-              ? replaceHost(tokenUrl, providerConfig.internalBaseUrl)
-              : tokenUrl,
-            userInfoUrl: providerConfig.internalBaseUrl
-              ? replaceHost(userInfoUrl, providerConfig.internalBaseUrl)
-              : userInfoUrl,
-          };
-          console.log("[auth] OIDC discovery successful, provider:", providerConfig.providerId);
-        } else {
-          console.warn("[auth] OIDC discovery missing required endpoints, using discoveryUrl only");
-        }
-      } else {
-        console.warn(`[auth] OIDC discovery failed (${discoveryRes.status}), using discoveryUrl only`);
-      }
-    } catch (err) {
-      console.warn(`[auth] OIDC discovery fetch failed: ${err}, using discoveryUrl only`);
-    }
-
    // Build Better-Auth instance using resolved config
    authInstance = betterAuth({
      database: drizzleAdapter(db, {
@@ -241,31 +159,6 @@ export async function initAuth(): Promise<void> {
      }),
      secret: BETTER_AUTH_SECRET,
      baseURL: BETTER_AUTH_URL,
-      rateLimit: {
-        enabled: true,
-        max: 100,
-        window: 10,
-        storage: "memory",
-        customRules: {
-          "/get-session": false,
-        },
-      },
-      account: {
-        storeStateStrategy: "cookie" as const,
-      },
-      emailAndPassword: {
-        enabled: true,
-        emailVerification: {
-          sendVerificationEmail: async ({ user, url }: { user: { email: string }; url: string }) => {
-            await sendEmail({
-              to: user.email,
-              subject: "Verify your GroomBook email",
-              text: `Click the link to verify your email: ${url}`,
-              html: `<p>Click the link to verify your email:</p><a href="${url}">${url}</a>`,
-            });
-          },
-        },
-      },
      plugins: [
        genericOAuth({
          config: [
@@ -273,27 +166,20 @@ export async function initAuth(): Promise<void> {
              providerId: providerConfig.providerId,
              clientId: providerConfig.clientId,
              clientSecret: providerConfig.clientSecret,
-              discoveryUrl: discoveryUrlStr,
-              ...(Object.keys(oidcConfig).length > 0 ? oidcConfig : {}),
+              ...(providerConfig.internalBaseUrl
+                ? {
+                    authorizationUrl: `${new URL(providerConfig.issuerUrl).origin}/application/o/authorize/`,
+                    tokenUrl: `${providerConfig.internalBaseUrl}/application/o/token/`,
+                    userInfoUrl: `${providerConfig.internalBaseUrl}/application/o/userinfo/`,
+                  }
+                : {
+                    discoveryUrl: `${providerConfig.issuerUrl}/.well-known/openid-configuration`,
+                  }),
              scopes: providerConfig.scopes.split(" ").filter(Boolean),
            },
          ],
        }),
-      ],
-      socialProviders: {
-        ...(hasGoogle ? {
-          google: {
-            clientId: process.env.GOOGLE_CLIENT_ID!,
-            clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
-          },
-        } : {}),
-        ...(hasGitHub ? {
-          github: {
-            clientId: process.env.GITHUB_CLIENT_ID!,
-            clientSecret: process.env.GITHUB_CLIENT_SECRET!,
-          },
-        } : {}),
-      },
+            ],
      session: {
        expiresIn: 60 * 60 * 24 * 7, // 7 days
        updateAge: 60 * 60 * 24, // 1 day
@@ -67,41 +67,3 @@ export async function deleteObject(key: string): Promise<void> {
    })
  );
 }
-
-/** Read an object from S3 and return its body buffer and content type. */
-export async function getObject(key: string): Promise<{ body: Buffer; contentType: string }> {
-  const client = getS3Client();
-  const response = await client.send(
-    new GetObjectCommand({
-      Bucket: getBucket(),
-      Key: key,
-    })
-  );
-  const chunks: Uint8Array[] = [];
-  // response.Body is a Readable stream; collect chunks into a buffer
-  for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {
-    chunks.push(chunk);
-  }
-  const body = Buffer.concat(chunks);
-  const contentType = response.ContentType ?? "application/octet-stream";
-  return { body, contentType };
-}
-
-/** Upload an object directly to S3 (server-side only, not a pre-signed URL). */
-export async function putObject(
-  key: string,
-  body: Buffer | Uint8Array | string,
-  contentType: string,
-  contentLength: number
-): Promise<void> {
-  const client = getS3Client();
-  await client.send(
-    new PutObjectCommand({
-      Bucket: getBucket(),
-      Key: key,
-      Body: body,
-      ContentType: contentType,
-      ContentLength: contentLength,
-    })
-  );
-}
@@ -23,6 +23,7 @@ if (process.env.AUTH_DISABLED === "true") {
 }

 export const authMiddleware: MiddlewareHandler = async (c, next) => {
+  // Better-Auth's own routes handle their own auth (OAuth callbacks, session mgmt)
  if (c.req.path.startsWith("/api/auth/")) {
    await next();
    return;
@@ -36,14 +37,7 @@ export const authMiddleware: MiddlewareHandler = async (c, next) => {
    return;
  }

-  let auth;
-  try {
-    auth = getAuth();
-  } catch {
-    return c.json({ error: "Authentication not configured" }, 503);
-  }
-
-  const session = await auth.api.getSession({
+  const session = await getAuth().api.getSession({
    headers: c.req.raw.headers,
  });

@@ -1,45 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import { getDb, impersonationAuditLogs } from "@groombook/db";
-import type { PortalEnv } from "./portalSession.js";
-
-/**
- * Server-side audit logging middleware for portal routes.
- * Applied after validatePortalSession in the middleware chain.
- *
- * After the route handler completes (await next()), inserts an audit log entry
- * into impersonationAuditLogs:
- *   - sessionId: from c.get("portalSessionId")
- *   - action: "{METHOD} {routePath}" (e.g., "GET /portal/appointments")
- *   - pageVisited: c.req.path
- *   - metadata: { method, statusCode: c.res.status }
- *
- * Log entries are written for both success and error responses.
- * Does NOT throw if audit logging fails — errors are logged but the user's
- * request is not affected.
- */
-export const portalAudit: MiddlewareHandler<PortalEnv> = async (c, next) => {
-  await next();
-
-  const sessionId = c.get("portalSessionId");
-  if (!sessionId) return;
-
-  const method = c.req.method;
-  const routePath = c.req.path;
-  const pageVisited = c.req.path;
-  const statusCode = c.res.status;
-
-  try {
-    const db = getDb();
-    await db
-      .insert(impersonationAuditLogs)
-      .values({
-        sessionId,
-        action: `${method} ${routePath}`,
-        pageVisited,
-        metadata: { method, statusCode },
-      })
-      .returning();
-  } catch (err) {
-    console.error("[portalAudit] Failed to write audit log:", err);
-  }
-};
@@ -1,40 +0,0 @@
-import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, impersonationSessions } from "@groombook/db";
-
-export interface PortalEnv {
-  Variables: {
-    portalClientId: string;
-    portalSessionId: string;
-  };
-}
-
-/**
- * Validates the X-Impersonation-Session-Id header against the impersonationSessions table.
- * Must be applied to all portal routes.
- *
- * Reads x-session-id from request headers, queries impersonationSessions for a row where
- * id = sessionId AND status = 'active', and checks session.expiresAt > new Date().
- * Returns 401 if session is invalid/missing/expired.
- * On success, sets c.set("portalClientId", session.clientId) and c.set("portalSessionId", session.id).
- */
-export const validatePortalSession: MiddlewareHandler<PortalEnv> = async (c, next) => {
-  const sessionId = c.req.header("X-Impersonation-Session-Id");
-  if (!sessionId) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  const db = getDb();
-  const [session] = await db
-    .select()
-    .from(impersonationSessions)
-    .where(and(eq(impersonationSessions.id, sessionId), eq(impersonationSessions.status, "active")))
-    .limit(1);
-
-  if (!session || session.expiresAt <= new Date()) {
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-
-  c.set("portalClientId", session.clientId);
-  c.set("portalSessionId", session.id);
-  await next();
-};
@@ -1,5 +1,5 @@
 import type { MiddlewareHandler } from "hono";
-import { and, eq, getDb, sql, staff } from "@groombook/db";
+import { and, eq, getDb, isNull, staff } from "@groombook/db";

 export type StaffRole = "groomer" | "receptionist" | "manager";
 export type StaffRow = typeof staff.$inferSelect;
@@ -89,31 +89,33 @@ export const resolveStaffMiddleware: MiddlewareHandler<AppEnv> = async (
    .select()
    .from(staff)
    .where(eq(staff.oidcSub, jwt.sub));
-  if (fallbackRow) {
-    c.set("staff", fallbackRow);
-    await next();
-    return;
-  }
-  // Auto-link by email: staff record exists with matching email but no userId
-  if (jwt.email) {
-    const [byEmail] = await db
-      .select()
-      .from(staff)
-      .where(and(eq(staff.email, jwt.email), sql`${staff.userId} IS NULL`));
-    if (byEmail) {
-      await db
-        .update(staff)
-        .set({ userId: jwt.sub, updatedAt: new Date() })
-        .where(eq(staff.id, byEmail.id));
-      c.set("staff", { ...byEmail, userId: jwt.sub });
-      await next();
-      return;
+  if (!fallbackRow) {
+    // Auto-link: staff record exists with matching email but no userId — link it now
+    if (jwt.email) {
+      const [linkedStaff] = await db
+        .select()
+        .from(staff)
+        .where(and(eq(staff.email, jwt.email), isNull(staff.userId)));
+      if (linkedStaff) {
+        await db
+          .update(staff)
+          .set({ userId: jwt.sub })
+          .where(eq(staff.id, linkedStaff.id));
+        console.log(
+          `[rbac] Auto-linked staff ${linkedStaff.id} to Better-Auth user ${jwt.sub} via email ${jwt.email}`
+        );
+        c.set("staff", linkedStaff);
+        await next();
+        return;
+      }
    }
+    return c.json(
+      { error: "Forbidden: no staff record found for authenticated user" },
+      403
+    );
  }
-  return c.json(
-    { error: "Forbidden: no staff record found for authenticated user" },
-    403
-  );
+  c.set("staff", fallbackRow);
+  await next();
 };

 /**
@@ -166,9 +168,9 @@ export function requireRoleOrSuperUser(
    }
    return c.json(
      {
-        error: hasAllowedRole
-          ? "Forbidden: super user privileges required"
-          : `Forbidden: role '${staffRow.role}' is not permitted`,
+        error: staffRow.isSuperUser
+          ? `Forbidden: role '${staffRow.role}' is not permitted`
+          : "Forbidden: super user privileges required",
      },
      403
    );
@@ -16,9 +16,8 @@ import {
  services,
  staff,
 } from "@groombook/db";
-import type { AppEnv } from "../middleware/rbac.js";

-export const appointmentGroupsRouter = new Hono<AppEnv>();
+export const appointmentGroupsRouter = new Hono();

 // ─── Schemas ──────────────────────────────────────────────────────────────────

@@ -50,8 +49,6 @@ appointmentGroupsRouter.get("/", async (c) => {
  const clientId = c.req.query("clientId");
  const from = c.req.query("from");
  const to = c.req.query("to");
-  const staffRow = c.get("staff");
-  const isGroomer = staffRow?.role === "groomer";

  const groupConditions = clientId
    ? [eq(appointmentGroups.clientId, clientId)]
@@ -91,16 +88,6 @@ appointmentGroupsRouter.get("/", async (c) => {
    }))
    .filter((g) => !from || g.appointments.length > 0);

-  if (isGroomer) {
-    return c.json(
-      result.filter((g) =>
-        g.appointments.some(
-          (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
-        )
-      )
-    );
-  }
-
  return c.json(result);
 });

@@ -109,8 +96,6 @@ appointmentGroupsRouter.get("/", async (c) => {
 appointmentGroupsRouter.get("/:id", async (c) => {
  const db = getDb();
  const id = c.req.param("id");
-  const staffRow = c.get("staff");
-  const isGroomer = staffRow?.role === "groomer";

  const [group] = await db
    .select()
@@ -126,7 +111,6 @@ appointmentGroupsRouter.get("/:id", async (c) => {
      serviceId: appointments.serviceId,
      serviceName: services.name,
      staffId: appointments.staffId,
-      batherStaffId: appointments.batherStaffId,
      staffName: staff.name,
      status: appointments.status,
      startTime: appointments.startTime,
@@ -141,15 +125,6 @@ appointmentGroupsRouter.get("/:id", async (c) => {
    .where(eq(appointments.groupId, id))
    .orderBy(appointments.startTime);

-  if (
-    isGroomer &&
-    !groupAppts.some(
-      (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
-    )
-  ) {
-    return c.json({ error: "Forbidden" }, 403);
-  }
-
  const [client] = await db
    .select({ name: clients.name, email: clients.email })
    .from(clients)
@@ -165,13 +140,6 @@ appointmentGroupsRouter.post(
  zValidator("json", createGroupSchema),
  async (c) => {
    const db = getDb();
-    const staffRow = c.get("staff");
-    if (staffRow?.role === "groomer") {
-      return c.json(
-        { error: "Forbidden: groomers cannot create group bookings" },
-        403
-      );
-    }
    const body = c.req.valid("json");
    const startTime = new Date(body.startTime);

@@ -276,28 +244,6 @@ appointmentGroupsRouter.patch(
    const db = getDb();
    const id = c.req.param("id");
    const body = c.req.valid("json");
-    const staffRow = c.get("staff");
-    const isGroomer = staffRow?.role === "groomer";
-
-    const [group] = await db
-      .select({ id: appointmentGroups.id })
-      .from(appointmentGroups)
-      .where(eq(appointmentGroups.id, id));
-    if (!group) return c.json({ error: "Not found" }, 404);
-
-    if (isGroomer) {
-      const groupAppts = await db
-        .select({ staffId: appointments.staffId, batherStaffId: appointments.batherStaffId })
-        .from(appointments)
-        .where(eq(appointments.groupId, id));
-      if (
-        !groupAppts.some(
-          (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
-        )
-      ) {
-        return c.json({ error: "Forbidden" }, 403);
-      }
-    }

    const [updated] = await db
      .update(appointmentGroups)
@@ -315,8 +261,6 @@ appointmentGroupsRouter.patch(
 appointmentGroupsRouter.delete("/:id", async (c) => {
  const db = getDb();
  const id = c.req.param("id");
-  const staffRow = c.get("staff");
-  const isGroomer = staffRow?.role === "groomer";

  const [group] = await db
    .select({ id: appointmentGroups.id })
@@ -324,20 +268,6 @@ appointmentGroupsRouter.delete("/:id", async (c) => {
    .where(eq(appointmentGroups.id, id));
  if (!group) return c.json({ error: "Not found" }, 404);

-  if (isGroomer) {
-    const groupAppts = await db
-      .select({ staffId: appointments.staffId, batherStaffId: appointments.batherStaffId })
-      .from(appointments)
-      .where(eq(appointments.groupId, id));
-    if (
-      !groupAppts.some(
-        (a) => a.staffId === staffRow.id || a.batherStaffId === staffRow.id
-      )
-    ) {
-      return c.json({ error: "Forbidden" }, 403);
-    }
-  }
-
  await db
    .update(appointments)
    .set({ status: "cancelled", updatedAt: new Date() })
@@ -23,27 +23,6 @@ import { buildConfirmationEmail, sendEmail } from "../services/email.js";
 import { notifyWaitlistForAppointment } from "../services/waitlistNotify.js";
 import type { AppEnv } from "../middleware/rbac.js";

-async function withRetry<T>(
-  fn: () => Promise<T>,
-  maxRetries: number,
-  delayMs: number,
-  context: string
-): Promise<void> {
-  let lastError: unknown;
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    try {
-      await fn();
-      return;
-    } catch (err) {
-      lastError = err;
-      if (attempt < maxRetries) {
-        await new Promise((resolve) => setTimeout(resolve, delayMs));
-      }
-    }
-  }
-  console.error(`[appointments] ${context}: ${lastError}`);
-}
-
 export const appointmentsRouter = new Hono<AppEnv>();

 const createAppointmentSchema = z.object({
@@ -62,10 +41,6 @@ const createAppointmentSchema = z.object({
      frequencyWeeks: z.number().int().min(1).max(52),
      count: z.number().int().min(2).max(52),
    })
-    .refine(
-      (r) => r.frequencyWeeks * r.count <= 52,
-      { message: "Recurrence series must not exceed 1 year" }
-    )
    .optional(),
 });

@@ -188,28 +163,6 @@ appointmentsRouter.post(
          }
        }

-        if (apptFields.batherStaffId) {
-          const bathConflicts = await tx
-            .select({ id: appointments.id })
-            .from(appointments)
-            .where(
-              and(
-                or(
-                  eq(appointments.staffId, apptFields.batherStaffId),
-                  eq(appointments.batherStaffId, apptFields.batherStaffId)
-                ),
-                lt(appointments.startTime, end),
-                gte(appointments.endTime, start),
-                ne(appointments.status, "cancelled"),
-                ne(appointments.status, "no_show"),
-              )
-            )
-            .limit(1);
-          if (bathConflicts.length > 0) {
-            throw Object.assign(new Error("conflict"), { statusCode: 409 });
-          }
-        }
-
        if (!recurrence) {
          // Single appointment
          const [inserted] = await tx
@@ -233,54 +186,11 @@ appointmentsRouter.post(
          recurrence.frequencyWeeks * 7 * 24 * 60 * 60 * 1000;

        let first: typeof appointments.$inferSelect | undefined;
-        const conflictingInstances: number[] = [];
        for (let i = 0; i < recurrence.count; i++) {
          const instanceStart = new Date(start.getTime() + i * intervalMs);
          const instanceEnd = new Date(
            instanceStart.getTime() + durationMs
          );
-
-          if (apptFields.staffId) {
-            const conflicts = await tx
-              .select({ id: appointments.id })
-              .from(appointments)
-              .where(
-                and(
-                  eq(appointments.staffId, apptFields.staffId),
-                  lt(appointments.startTime, instanceEnd),
-                  gte(appointments.endTime, instanceStart),
-                  ne(appointments.status, "cancelled"),
-                  ne(appointments.status, "no_show"),
-                )
-              )
-              .limit(1);
-            if (conflicts.length > 0) {
-              conflictingInstances.push(i);
-            }
-          }
-
-          if (apptFields.batherStaffId) {
-            const conflicts = await tx
-              .select({ id: appointments.id })
-              .from(appointments)
-              .where(
-                and(
-                  or(
-                    eq(appointments.staffId, apptFields.batherStaffId),
-                    eq(appointments.batherStaffId, apptFields.batherStaffId)
-                  ),
-                  lt(appointments.startTime, instanceEnd),
-                  gte(appointments.endTime, instanceStart),
-                  ne(appointments.status, "cancelled"),
-                  ne(appointments.status, "no_show"),
-                )
-              )
-              .limit(1);
-            if (conflicts.length > 0) {
-              conflictingInstances.push(i);
-            }
-          }
-
          const [inserted] = await tx
            .insert(appointments)
            .values({
@@ -291,19 +201,9 @@ appointmentsRouter.post(
              seriesIndex: i,
            })
            .returning();
-          if (!inserted) throw new Error(`Insert failed for occurrence ${i}`);
          if (i === 0) first = inserted;
        }

-        if (conflictingInstances.length > 0) {
-          throw Object.assign(
-            new Error(
-              `Conflicts detected at occurrence(s): ${conflictingInstances.join(", ")}`
-            ),
-            { statusCode: 409 }
-          );
-        }
-
        if (!first) throw new Error("No appointments created");
        return first;
      });
@@ -321,12 +221,9 @@ appointmentsRouter.post(
    }

    // Send confirmation email (fire-and-forget — never fails the request)
-    withRetry(
-      () => sendConfirmationEmail(db, firstRow),
-      2,
-      1000,
-      `Failed to send confirmation email for appointment ${firstRow.id}`
-    );
+    sendConfirmationEmail(db, firstRow).catch((err) => {
+      console.error("[appointments] Failed to send confirmation email:", err);
+    });

    return c.json(firstRow, 201);
  }
@@ -338,35 +235,44 @@ async function sendConfirmationEmail(
  db: ReturnType<typeof getDb>,
  appt: typeof appointments.$inferSelect
 ): Promise<void> {
-  const [row] = await db
-    .select({
-      clientName: clients.name,
-      clientEmail: clients.email,
-      clientEmailOptOut: clients.emailOptOut,
-      petName: pets.name,
-      serviceName: services.name,
-      groomerName: staff.name,
-    })
-    .from(appointments)
-    .innerJoin(clients, eq(clients.id, appointments.clientId))
-    .innerJoin(pets, eq(pets.id, appointments.petId))
-    .innerJoin(services, eq(services.id, appointments.serviceId))
-    .leftJoin(staff, eq(staff.id, appointments.staffId))
-    .where(eq(appointments.id, appt.id))
+  const [client] = await db
+    .select({ name: clients.name, email: clients.email, emailOptOut: clients.emailOptOut })
+    .from(clients)
+    .where(eq(clients.id, appt.clientId))
    .limit(1);

-  if (!row) return;
-  const { clientName, clientEmail, clientEmailOptOut, petName, serviceName, groomerName } = row;
+  if (!client || !client.email || client.emailOptOut) return;

-  if (!clientEmail || clientEmailOptOut) return;
-  if (!petName || !serviceName) return;
+  const [pet] = await db
+    .select({ name: pets.name })
+    .from(pets)
+    .where(eq(pets.id, appt.petId))
+    .limit(1);
+
+  const [service] = await db
+    .select({ name: services.name })
+    .from(services)
+    .where(eq(services.id, appt.serviceId))
+    .limit(1);
+
+  let groomerName: string | null = null;
+  if (appt.staffId) {
+    const [groomer] = await db
+      .select({ name: staff.name })
+      .from(staff)
+      .where(eq(staff.id, appt.staffId))
+      .limit(1);
+    groomerName = groomer?.name ?? null;
+  }
+
+  if (!pet || !service) return;

  const sent = await sendEmail(
-    buildConfirmationEmail(clientEmail, {
-      clientName,
-      petName,
-      serviceName,
-      groomerName: groomerName ?? null,
+    buildConfirmationEmail(client.email, {
+      clientName: client.name,
+      petName: pet.name,
+      serviceName: service.name,
+      groomerName,
      startTime: appt.startTime,
    })
  );
@@ -446,76 +352,6 @@ appointmentsRouter.patch(

          let firstUpdated: typeof appointments.$inferSelect | undefined;
          for (const appt of affected) {
-            const newStart =
-              startDeltaMs !== 0
-                ? new Date(appt.startTime.getTime() + startDeltaMs)
-                : appt.startTime;
-            const newEnd =
-              endDeltaMs !== 0
-                ? new Date(appt.endTime.getTime() + endDeltaMs)
-                : appt.endTime;
-            const newStaffId =
-              updateFields.staffId !== undefined
-                ? updateFields.staffId
-                : appt.staffId;
-            const newBatherStaffId =
-              updateFields.batherStaffId !== undefined
-                ? updateFields.batherStaffId
-                : appt.batherStaffId;
-
-            if (
-              newStaffId &&
-              (startDeltaMs !== 0 ||
-                endDeltaMs !== 0 ||
-                updateFields.staffId !== undefined)
-            ) {
-              const conflicts = await tx
-                .select({ id: appointments.id })
-                .from(appointments)
-                .where(
-                  and(
-                    eq(appointments.staffId, newStaffId),
-                    lt(appointments.startTime, newEnd),
-                    gte(appointments.endTime, newStart),
-                    ne(appointments.status, "cancelled"),
-                    ne(appointments.status, "no_show"),
-                    ne(appointments.id, appt.id),
-                  )
-                )
-                .limit(1);
-              if (conflicts.length > 0) {
-                throw Object.assign(new Error("conflict"), { statusCode: 409 });
-              }
-            }
-
-            if (
-              newBatherStaffId &&
-              (startDeltaMs !== 0 ||
-                endDeltaMs !== 0 ||
-                updateFields.batherStaffId !== undefined)
-            ) {
-              const conflicts = await tx
-                .select({ id: appointments.id })
-                .from(appointments)
-                .where(
-                  and(
-                    or(
-                      eq(appointments.staffId, newBatherStaffId),
-                      eq(appointments.batherStaffId, newBatherStaffId)
-                    ),
-                    lt(appointments.startTime, newEnd),
-                    gte(appointments.endTime, newStart),
-                    ne(appointments.status, "cancelled"),
-                    ne(appointments.status, "no_show"),
-                    ne(appointments.id, appt.id),
-                  )
-                )
-                .limit(1);
-              if (conflicts.length > 0) {
-                throw Object.assign(new Error("conflict"), { statusCode: 409 });
-              }
-            }
-
            const apptUpdate: Record<string, unknown> = {
              updatedAt: new Date(),
            };
@@ -551,13 +387,6 @@ appointmentsRouter.patch(
        if (statusCode === 404) return c.json({ error: "Not found" }, 404);
        if (statusCode === 422)
          return c.json({ error: "endTime must be after startTime" }, 422);
-        if (statusCode === 409)
-          return c.json(
-            {
-              error: "Staff member has a conflicting appointment at this time",
-            },
-            409
-          );
        throw err;
      }

@@ -569,8 +398,7 @@ appointmentsRouter.patch(
    const needsConflictCheck =
      updateFields.startTime !== undefined ||
      updateFields.endTime !== undefined ||
-      updateFields.staffId !== undefined ||
-      updateFields.batherStaffId !== undefined;
+      updateFields.staffId !== undefined;

    const update: Record<string, unknown> = {
      ...updateFields,
@@ -606,11 +434,6 @@ appointmentsRouter.patch(
            updateFields.staffId !== undefined
              ? updateFields.staffId
              : current.staffId;
-          // Use provided batherStaffId (may be null to unassign); fall back to existing
-          const batherStaffId =
-            updateFields.batherStaffId !== undefined
-              ? updateFields.batherStaffId
-              : current.batherStaffId;

          if (end <= start) {
            throw Object.assign(new Error("end before start"), {
@@ -638,29 +461,6 @@ appointmentsRouter.patch(
            }
          }

-          if (batherStaffId) {
-            const bathConflicts = await tx
-              .select({ id: appointments.id })
-              .from(appointments)
-              .where(
-                and(
-                  or(
-                    eq(appointments.staffId, batherStaffId),
-                    eq(appointments.batherStaffId, batherStaffId)
-                  ),
-                  lt(appointments.startTime, end),
-                  gte(appointments.endTime, start),
-                  ne(appointments.status, "cancelled"),
-                  ne(appointments.status, "no_show"),
-                  ne(appointments.id, id),
-                )
-              )
-              .limit(1);
-            if (bathConflicts.length > 0) {
-              throw Object.assign(new Error("conflict"), { statusCode: 409 });
-            }
-          }
-
          const [updated] = await tx
            .update(appointments)
            .set(update)
@@ -735,12 +535,9 @@ appointmentsRouter.delete("/:id", async (c) => {

    const apptDate = current.startTime.toISOString().slice(0, 10);
    const apptTime = current.startTime.toLocaleTimeString("en-US", { hour: "2-digit", minute: "2-digit", hour12: true });
-    withRetry(
-      () => notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId),
-      2,
-      1000,
-      `Failed to notify waitlist for appointment ${id}`
-    );
+    notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId).catch((err) => {
+      console.error("[appointments] Failed to notify waitlist:", err);
+    });

    return c.json({ ok: true });
  }
@@ -763,12 +560,9 @@ appointmentsRouter.delete("/:id", async (c) => {
    .returning();
  if (!row) return c.json({ error: "Not found" }, 404);

-  withRetry(
-    () => notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId),
-    2,
-    1000,
-    `Failed to notify waitlist for appointment ${id}`
-  );
+  notifyWaitlistForAppointment(id, apptDate, apptTime, current.serviceId).catch((err) => {
+    console.error("[appointments] Failed to notify waitlist:", err);
+  });

  return c.json({ ok: true });
 });
@@ -102,10 +102,7 @@ bookRouter.get("/availability", async (c) => {

 const bookingSchema = z.object({
  serviceId: z.string().uuid(),
-  startTime: z.string().datetime().refine(
-    (dt) => new Date(dt) > new Date(),
-    { message: "Appointment must be in the future" }
-  ),
+  startTime: z.string().datetime(),
  clientName: z.string().min(1).max(200),
  clientEmail: z.string().email(),
  clientPhone: z.string().max(50).optional(),
@@ -268,36 +265,29 @@ bookRouter.get("/confirm/:token", async (c) => {
    return c.redirect(`${BASE_URL()}/booking/error`);
  }

+  // Reject if appointment is in the past
  if (appt.startTime < new Date()) {
    return c.redirect(`${BASE_URL()}/booking/error`);
  }

+  // Idempotent confirm: if already confirmed, redirect to success
  if (appt.confirmationStatus === "confirmed") {
    return c.redirect(`${BASE_URL()}/booking/confirmed`);
  }

+  // Reject if already cancelled
  if (appt.confirmationStatus === "cancelled") {
    return c.redirect(`${BASE_URL()}/booking/error`);
  }

-  const updated = await db
+  await db
    .update(appointments)
    .set({
      confirmationStatus: "confirmed",
      confirmedAt: new Date(),
      updatedAt: new Date(),
    })
-    .where(
-      and(
-        eq(appointments.confirmationToken, token),
-        eq(appointments.confirmationStatus, "pending")
-      )
-    )
-    .returning();
-
-  if (updated.length === 0) {
-    return c.redirect(`${BASE_URL()}/booking/error`);
-  }
+    .where(eq(appointments.id, appt.id));

  return c.redirect(`${BASE_URL()}/booking/confirmed`);
 });
@@ -319,15 +309,19 @@ bookRouter.get("/cancel/:token", async (c) => {
    return c.redirect(`${BASE_URL()}/booking/error`);
  }

+  // Reject if appointment is in the past
  if (appt.startTime < new Date()) {
    return c.redirect(`${BASE_URL()}/booking/error`);
  }

+  // Reject if already cancelled (token was nullified — this path won't normally hit,
+  // but guard against edge cases where token lookup still works)
  if (appt.confirmationStatus === "cancelled") {
    return c.redirect(`${BASE_URL()}/booking/error`);
  }

-  const updated = await db
+  // Single-use cancellation: nullify token after use
+  await db
    .update(appointments)
    .set({
      confirmationStatus: "cancelled",
@@ -335,17 +329,7 @@ bookRouter.get("/cancel/:token", async (c) => {
      confirmationToken: null,
      updatedAt: new Date(),
    })
-    .where(
-      and(
-        eq(appointments.confirmationToken, token),
-        eq(appointments.confirmationStatus, "pending")
-      )
-    )
-    .returning();
-
-  if (updated.length === 0) {
-    return c.redirect(`${BASE_URL()}/booking/error`);
-  }
+    .where(eq(appointments.id, appt.id));

  return c.redirect(`${BASE_URL()}/booking/cancelled`);
 });
@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import {
  and,
  eq,
@@ -84,18 +84,7 @@ calendarRouter.get("/:staffId.ics", async (c) => {
    .where(eq(staff.id, staffId))
    .limit(1);

-  if (!staffMember || !staffMember.icalToken) {
-    return c.text("Unauthorized", 401);
-  }
-
-  const storedToken = staffMember.icalToken;
-  const incomingToken = token;
-  const storedBuf = Buffer.from(storedToken, "utf8");
-  const incomingBuf = Buffer.from(incomingToken, "utf8");
-  if (
-    storedBuf.length !== incomingBuf.length ||
-    !timingSafeEqual(storedBuf, incomingBuf)
-  ) {
+  if (!staffMember || staffMember.icalToken !== token) {
    return c.text("Unauthorized", 401);
  }

@@ -8,12 +8,10 @@ export const clientsRouter = new Hono<AppEnv>();

 const createClientSchema = z.object({
  name: z.string().min(1).max(200),
-  email: z.string().email(),
+  email: z.string().email().optional(),
  phone: z.string().max(50).optional(),
  address: z.string().max(500).optional(),
  notes: z.string().max(2000).optional(),
-  smsOptIn: z.boolean().optional(),
-  smsConsentText: z.string().max(1000).optional(),
 });


@@ -97,7 +95,6 @@ clientsRouter.post("/", zValidator("json", createClientSchema), async (c) => {
 // Update a client (including status changes)
 const patchClientSchema = createClientSchema.partial().extend({
  status: z.enum(["active", "disabled"]).optional(),
-  smsOptOut: z.boolean().optional(),
 });

 clientsRouter.patch(
@@ -110,19 +107,13 @@ clientsRouter.patch(

    const setValues: Record<string, unknown> = { ...body, updatedAt: now };

+    // When disabling, set disabledAt; when re-enabling, clear it
    if (body.status === "disabled") {
      setValues.disabledAt = now;
    } else if (body.status === "active") {
      setValues.disabledAt = null;
    }

-    if (body.smsOptOut === true) {
-      setValues.smsOptIn = false;
-      setValues.smsOptOutDate = now;
-      delete setValues.smsOptOut;
-    }
-    delete setValues.smsOptOut;
-
    const [row] = await db
      .update(clients)
      .set(setValues)
@@ -144,24 +135,9 @@ clientsRouter.delete("/:id", async (c) => {
  }

  const db = getDb();
-  const clientId = c.req.param("id");
-
-  const [existingAppt] = await db
-    .select({ id: appointments.id })
-    .from(appointments)
-    .where(eq(appointments.clientId, clientId))
-    .limit(1);
-
-  if (existingAppt) {
-    return c.json(
-      { error: "Cannot delete client with existing appointments. Cancel or reassign appointments first." },
-      409
-    );
-  }
-
  const [row] = await db
    .delete(clients)
-    .where(eq(clients.id, clientId))
+    .where(eq(clients.id, c.req.param("id")))
    .returning();
  if (!row) return c.json({ error: "Not found" }, 404);
  return c.json({ ok: true });
@@ -1,10 +1,9 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { and, desc, eq, getDb, groomingVisitLogs, appointments, or } from "@groombook/db";
-import type { AppEnv } from "../middleware/rbac.js";
+import { desc, eq, getDb, groomingVisitLogs } from "@groombook/db";

-export const groomingLogsRouter = new Hono<AppEnv>();
+export const groomingLogsRouter = new Hono();

 const createLogSchema = z.object({
  petId: z.string().uuid(),
@@ -21,26 +20,6 @@ groomingLogsRouter.get("/", async (c) => {
  const db = getDb();
  const petId = c.req.query("petId");
  if (!petId) return c.json({ error: "petId is required" }, 400);
-  const staffRow = c.get("staff");
-  const isGroomer = staffRow?.role === "groomer";
-
-  if (isGroomer) {
-    const [appt] = await db
-      .select({ id: appointments.id })
-      .from(appointments)
-      .where(
-        and(
-          eq(appointments.petId, petId),
-          or(
-            eq(appointments.staffId, staffRow.id),
-            eq(appointments.batherStaffId, staffRow.id)
-          )
-        )
-      )
-      .limit(1);
-    if (!appt) return c.json({ error: "Forbidden" }, 403);
-  }
-
  const rows = await db
    .select()
    .from(groomingVisitLogs)
@@ -54,50 +33,11 @@ groomingLogsRouter.post(
  zValidator("json", createLogSchema),
  async (c) => {
    const db = getDb();
-    const { groomedAt, petId, appointmentId, ...rest } = c.req.valid("json");
-    const staffRow = c.get("staff");
-    const isGroomer = staffRow?.role === "groomer";
-
-    if (isGroomer) {
-      if (appointmentId) {
-        const [appt] = await db
-          .select({ id: appointments.id })
-          .from(appointments)
-          .where(
-            and(
-              eq(appointments.id, appointmentId),
-              or(
-                eq(appointments.staffId, staffRow.id),
-                eq(appointments.batherStaffId, staffRow.id)
-              )
-            )
-          )
-          .limit(1);
-        if (!appt) return c.json({ error: "Forbidden" }, 403);
-      } else {
-        const [appt] = await db
-          .select({ id: appointments.id })
-          .from(appointments)
-          .where(
-            and(
-              eq(appointments.petId, petId),
-              or(
-                eq(appointments.staffId, staffRow.id),
-                eq(appointments.batherStaffId, staffRow.id)
-              )
-            )
-          )
-          .limit(1);
-        if (!appt) return c.json({ error: "Forbidden" }, 403);
-      }
-    }
-
+    const { groomedAt, ...rest } = c.req.valid("json");
    const [row] = await db
      .insert(groomingVisitLogs)
      .values({
        ...rest,
-        petId,
-        appointmentId: appointmentId ?? null,
        groomedAt: groomedAt ? new Date(groomedAt) : new Date(),
      })
      .returning();
@@ -107,37 +47,10 @@ groomingLogsRouter.post(

 groomingLogsRouter.delete("/:id", async (c) => {
  const db = getDb();
-  const id = c.req.param("id");
-  const staffRow = c.get("staff");
-  const isGroomer = staffRow?.role === "groomer";
-
-  const [log] = await db
-    .select()
-    .from(groomingVisitLogs)
-    .where(eq(groomingVisitLogs.id, id))
-    .limit(1);
-  if (!log) return c.json({ error: "Not found" }, 404);
-
-  if (isGroomer) {
-    const [appt] = await db
-      .select({ id: appointments.id })
-      .from(appointments)
-      .where(
-        and(
-          eq(appointments.petId, log.petId),
-          or(
-            eq(appointments.staffId, staffRow.id),
-            eq(appointments.batherStaffId, staffRow.id)
-          )
-        )
-      )
-      .limit(1);
-    if (!appt) return c.json({ error: "Forbidden" }, 403);
-  }
-
-  await db
+  const [row] = await db
    .delete(groomingVisitLogs)
-    .where(eq(groomingVisitLogs.id, id))
+    .where(eq(groomingVisitLogs.id, c.req.param("id")))
    .returning();
+  if (!row) return c.json({ error: "Not found" }, 404);
  return c.json({ ok: true });
 });
@@ -8,23 +8,13 @@ import {
  invoices,
  invoiceLineItems,
  invoiceTipSplits,
-  refunds,
  appointments,
  services,
  clients,
  sql,
 } from "@groombook/db";
-import type { AppEnv } from "../middleware/rbac.js";

-export const invoicesRouter = new Hono<AppEnv>();
-
-// Convert Zod validation errors from 422 to 400
-invoicesRouter.onError((err, c) => {
-  if (err instanceof z.ZodError) {
-    return c.json({ error: "Validation failed", issues: err.issues }, 400);
-  }
-  throw err;
-});
+export const invoicesRouter = new Hono();

 const createInvoiceSchema = z.object({
  appointmentId: z.string().uuid().optional(),
@@ -50,73 +40,56 @@ const updateInvoiceSchema = z.object({
  taxCents: z.number().int().nonnegative().optional(),
  tipCents: z.number().int().nonnegative().optional(),
  notes: z.string().max(2000).nullable().optional(),
-  tipSplits: z.array(
-    z.object({
-      staffId: z.string().uuid().nullable(),
-      staffName: z.string().min(1).max(200),
-      sharePct: z.number().min(0).max(100),
-    })
-  ).optional(),
 });

 // List invoices
-const listInvoicesQuerySchema = z.object({
-  clientId: z.string().uuid().optional(),
-  appointmentId: z.string().uuid().optional(),
-  status: z.enum(["draft", "pending", "paid", "void"]).optional(),
-  limit: z.coerce.number().int().min(1).max(200).default(50),
-  offset: z.coerce.number().int().min(0).default(0),
+invoicesRouter.get("/", async (c) => {
+  const db = getDb();
+  const clientId = c.req.query("clientId");
+  const appointmentId = c.req.query("appointmentId");
+  const status = c.req.query("status");
+  const limit = Math.min(parseInt(c.req.query("limit") || "50", 10), 200);
+  const offset = parseInt(c.req.query("offset") || "0", 10);
+
+  const conditions = [];
+  if (clientId) conditions.push(eq(invoices.clientId, clientId));
+  if (appointmentId) conditions.push(eq(invoices.appointmentId, appointmentId));
+  if (status) conditions.push(eq(invoices.status, status as "draft" | "pending" | "paid" | "void"));
+
+  const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
+
+  const [totalResult] = await db
+    .select({ count: sql<number>`count(*)` })
+    .from(invoices)
+    .where(whereClause);
+
+  const rows = await db
+    .select({
+      id: invoices.id,
+      appointmentId: invoices.appointmentId,
+      clientId: invoices.clientId,
+      clientName: clients.name,
+      subtotalCents: invoices.subtotalCents,
+      taxCents: invoices.taxCents,
+      tipCents: invoices.tipCents,
+      totalCents: invoices.totalCents,
+      status: invoices.status,
+      paymentMethod: invoices.paymentMethod,
+      paidAt: invoices.paidAt,
+      notes: invoices.notes,
+      createdAt: invoices.createdAt,
+      updatedAt: invoices.updatedAt,
+    })
+    .from(invoices)
+    .leftJoin(clients, eq(invoices.clientId, clients.id))
+    .where(whereClause)
+    .orderBy(invoices.createdAt)
+    .limit(limit)
+    .offset(offset);
+
+  return c.json({ data: rows, total: totalResult?.count ?? 0 });
 });

-invoicesRouter.get(
-  "/",
-  zValidator("query", listInvoicesQuerySchema),
-  async (c) => {
-    const db = getDb();
-    const { clientId, appointmentId, status, limit, offset } = c.req.valid("query");
-
-    const conditions = [];
-    if (clientId) conditions.push(eq(invoices.clientId, clientId));
-    if (appointmentId) conditions.push(eq(invoices.appointmentId, appointmentId));
-    if (status) conditions.push(eq(invoices.status, status as "draft" | "pending" | "paid" | "void"));
-
-    const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
-
-    const [totalResult] = await db
-      .select({ count: sql<number>`count(*)` })
-      .from(invoices)
-      .where(whereClause);
-
-    const rows = await db
-      .select({
-        id: invoices.id,
-        appointmentId: invoices.appointmentId,
-        clientId: invoices.clientId,
-        clientName: clients.name,
-        subtotalCents: invoices.subtotalCents,
-        taxCents: invoices.taxCents,
-        tipCents: invoices.tipCents,
-        totalCents: invoices.totalCents,
-        status: invoices.status,
-        paymentMethod: invoices.paymentMethod,
-        paidAt: invoices.paidAt,
-        notes: invoices.notes,
-        stripePaymentIntentId: invoices.stripePaymentIntentId,
-        stripeRefundId: invoices.stripeRefundId,
-        createdAt: invoices.createdAt,
-        updatedAt: invoices.updatedAt,
-      })
-      .from(invoices)
-      .leftJoin(clients, eq(invoices.clientId, clients.id))
-      .where(whereClause)
-      .orderBy(invoices.createdAt)
-      .limit(limit)
-      .offset(offset);
-
-    return c.json({ data: rows, total: totalResult?.count ?? 0 });
-  }
-);
-
 // Get single invoice with line items and tip splits
 invoicesRouter.get("/:id", async (c) => {
  const db = getDb();
@@ -130,17 +103,7 @@ invoicesRouter.get("/:id", async (c) => {
    db.select().from(invoiceTipSplits).where(eq(invoiceTipSplits.invoiceId, id)),
  ]);

-  let cardLast4: string | null = null;
-  let paymentStatus: string | null = null;
-  if (invoice.stripePaymentIntentId) {
-    const details = await getPaymentIntentDetails(invoice.stripePaymentIntentId);
-    if (details) {
-      cardLast4 = details.cardLast4;
-      paymentStatus = details.paymentStatus;
-    }
-  }
-
-  return c.json({ ...invoice, lineItems, tipSplits, cardLast4, paymentStatus });
+  return c.json({ ...invoice, lineItems, tipSplits });
 });

 // Save tip splits for an invoice (replaces existing splits)
@@ -153,8 +116,8 @@ const tipSplitSchema = z.object({
    })
  ).min(1).refine(
    (splits) => {
-      const totalBps = splits.reduce((sum, s) => sum + Math.round(s.sharePct * 100), 0);
-      return totalBps === 10000;
+      const total = splits.reduce((sum, s) => sum + s.sharePct, 0);
+      return Math.abs(total - 100) < 0.01;
    },
    { message: "Split percentages must sum to 100" }
  ),
@@ -198,13 +161,12 @@ invoicesRouter.post(
      }
    });

-    const [updatedInvoice] = await db.select().from(invoices).where(eq(invoices.id, id));
-    const [lineItems, tipSplits] = await Promise.all([
-      db.select().from(invoiceLineItems).where(eq(invoiceLineItems.invoiceId, id)),
-      db.select().from(invoiceTipSplits).where(eq(invoiceTipSplits.invoiceId, id)),
-    ]);
+    const splits = await db
+      .select()
+      .from(invoiceTipSplits)
+      .where(eq(invoiceTipSplits.invoiceId, id));

-    return c.json({ ...updatedInvoice, lineItems, tipSplits }, 201);
+    return c.json(splits, 201);
  }
 );

@@ -329,13 +291,6 @@ invoicesRouter.post("/from-appointment/:appointmentId", async (c) => {
  return c.json({ ...invoice, lineItems: [lineItem] }, 201);
 });

-const ALLOWED_TRANSITIONS: Record<string, string[]> = {
-  draft: ["pending", "void"],
-  pending: ["draft", "paid", "void"],
-  paid: ["void"],
-  void: [],
-};
-
 // Update invoice
 invoicesRouter.patch(
  "/:id",
@@ -351,33 +306,11 @@ invoicesRouter.patch(
      .where(eq(invoices.id, id));
    if (!current) return c.json({ error: "Not found" }, 404);

-    if (body.status !== undefined) {
-      const allowed = ALLOWED_TRANSITIONS[current.status] ?? [];
-      if (!allowed.includes(body.status)) {
-        return c.json(
-          { error: `Invalid status transition from ${current.status} to ${body.status}` },
-          422
-        );
-      }
+    if (current.status === "void") {
+      return c.json({ error: "Cannot modify a voided invoice" }, 422);
    }

-    const tipCents = body.tipCents ?? current.tipCents;
-
-    // Validate tip splits when marking invoice as paid
-    if (body.status === "paid" && tipCents > 0 && body.tipSplits !== undefined) {
-      if (body.tipSplits.length === 0) {
-        return c.json({ error: "Tip splits are required when tip amount is greater than zero" }, 400);
-      }
-      const totalPct = body.tipSplits.reduce((sum, s) => sum + s.sharePct, 0);
-      if (Math.abs(totalPct - 100) > 0.01) {
-        return c.json({ error: "Tip split percentages must sum to 100%" }, 400);
-      }
-    }
-
-    // Destructure tipSplits out — it belongs to a separate table, not the invoices column
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    const { tipSplits: _tipSplits, ...updateBody } = body as Record<string, unknown>;
-    const update: Record<string, unknown> = { ...updateBody, updatedAt: new Date() };
+    const update: Record<string, unknown> = { ...body, updatedAt: new Date() };

    // Auto-set paidAt when marking as paid
    if (body.status === "paid" && !body.paidAt && !current.paidAt) {
@@ -391,181 +324,17 @@ invoicesRouter.patch(
      update.totalCents = current.subtotalCents + newTaxCents + newTipCents;
    }

-    // Wrap tip split persistence and invoice update in a single atomic transaction
-    const [updated, lineItems] = await db.transaction(async (tx) => {
-      if (body.status === "paid" && tipCents > 0 && body.tipSplits !== undefined) {
-        await tx.delete(invoiceTipSplits).where(eq(invoiceTipSplits.invoiceId, id));
-        const splits = body.tipSplits;
-        if (splits.length > 0) {
-          let remaining = tipCents;
-          const rows = splits.map((s, i) => {
-            const isLast = i === splits.length - 1;
-            const shareCents = isLast ? remaining : Math.round((s.sharePct / 100) * tipCents);
-            if (!isLast) remaining -= shareCents;
-            return {
-              invoiceId: id,
-              staffId: s.staffId,
-              staffName: s.staffName,
-              sharePct: s.sharePct.toFixed(2),
-              shareCents,
-            };
-          });
-          await tx.insert(invoiceTipSplits).values(rows);
-        }
-      }
+    const [updated] = await db
+      .update(invoices)
+      .set(update)
+      .where(eq(invoices.id, id))
+      .returning();

-      const [updatedInvoice] = await tx
-        .update(invoices)
-        .set(update)
-        .where(eq(invoices.id, id))
-        .returning();
-
-      const lineItems = await tx
-        .select()
-        .from(invoiceLineItems)
-        .where(eq(invoiceLineItems.invoiceId, id));
-
-      return [updatedInvoice, lineItems];
-    });
+    const lineItems = await db
+      .select()
+      .from(invoiceLineItems)
+      .where(eq(invoiceLineItems.invoiceId, id));

    return c.json({ ...updated, lineItems });
  }
 );
-
-// ─── Refund ───────────────────────────────────────────────────────────────────
-
-import { processRefund, getPaymentIntentDetails } from "../services/payment.js";
-
-const refundSchema = z.object({
-  amountCents: z.number().int().nonnegative().optional(),
-  idempotencyKey: z.string().max(255).optional(),
-});
-
-invoicesRouter.post(
-  "/:id/refund",
-  zValidator("json", refundSchema),
-  async (c) => {
-    const db = getDb();
-    const staff = c.get("staff");
-    if (!staff) return c.json({ error: "Forbidden" }, 403);
-    if (staff.role !== "manager" && !staff.isSuperUser) {
-      return c.json({ error: "Manager role required" }, 403);
-    }
-
-    const id = c.req.param("id");
-    const body = c.req.valid("json");
-
-    const [invoice] = await db.select().from(invoices).where(eq(invoices.id, id));
-    if (!invoice) return c.json({ error: "Not found" }, 404);
-    if (invoice.status !== "paid") {
-      return c.json({ error: "Refund only allowed on paid invoices" }, 422);
-    }
-
-    return await db.transaction(async (tx) => {
-      if (body.idempotencyKey) {
-        const [existing] = await tx
-          .select()
-          .from(refunds)
-          .where(eq(refunds.idempotencyKey, body.idempotencyKey));
-        if (existing) {
-          return c.json({ refundId: existing.stripeRefundId });
-        }
-      }
-
-      let refundId: string;
-
-      if (invoice.stripePaymentIntentId) {
-        const result = await processRefund(id, body.amountCents);
-        if (!result) return c.json({ error: "Refund failed" }, 500);
-        refundId = result.refundId;
-      } else {
-        // Manual refund — no Stripe call needed
-        refundId = `manual_${id}_${Date.now()}`;
-      }
-
-      await tx.insert(refunds).values({
-        invoiceId: id,
-        stripeRefundId: refundId,
-        idempotencyKey: body.idempotencyKey ?? null,
-        amountCents: body.amountCents ?? null,
-      });
-
-      return c.json({ refundId });
-    });
-  }
-);
-
-// Payment stats for admin dashboard
-invoicesRouter.get("/stats/summary", async (c) => {
-  try {
-    const db = getDb();
-    const now = new Date();
-    const startOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
-
-    const [revenueResult] = await db
-      .select({ total: sql<number>`coalesce(sum(total_cents), 0)` })
-      .from(invoices)
-      .where(and(eq(invoices.status, "paid"), sql`${invoices.paidAt} >= ${startOfMonth}`));
-
-    const [outstandingResult] = await db
-      .select({ total: sql<number>`coalesce(sum(total_cents), 0)` })
-      .from(invoices)
-      .where(eq(invoices.status, "pending"));
-
-    const [refundsResult] = await db
-      .select({ total: sql<number>`coalesce(sum(amount_cents), 0)` })
-      .from(refunds)
-      .where(sql`${refunds.createdAt} >= ${startOfMonth}`);
-
-    const methodBreakdown = await db
-      .select({
-        method: invoices.paymentMethod,
-        total: sql<number>`count(*)`,
-      })
-      .from(invoices)
-      .where(and(eq(invoices.status, "paid"), sql`${invoices.paidAt} >= ${startOfMonth}`))
-      .groupBy(invoices.paymentMethod);
-
-    return c.json({
-      revenueThisMonth: revenueResult?.total ?? 0,
-      outstanding: outstandingResult?.total ?? 0,
-      refundsThisMonth: refundsResult?.total ?? 0,
-      methodBreakdown,
-    });
-  } catch (err) {
-    console.error("stats/summary error:", err);
-    return c.json({
-      revenueThisMonth: 0,
-      outstanding: 0,
-      refundsThisMonth: 0,
-      methodBreakdown: [],
-    });
-  }
-});
-
-// Get Stripe payment details for an invoice (card last4, payment status, refund status)
-invoicesRouter.get("/:id/stripe-details", async (c) => {
-  const db = getDb();
-  const id = c.req.param("id");
-
-  const [invoice] = await db.select().from(invoices).where(eq(invoices.id, id));
-  if (!invoice) return c.json({ error: "Not found" }, 404);
-
-  let cardLast4: string | null = null;
-  let paymentStatus: string | null = null;
-
-  if (invoice.stripePaymentIntentId) {
-    const details = await getPaymentIntentDetails(invoice.stripePaymentIntentId);
-    if (details) {
-      cardLast4 = details.cardLast4;
-      paymentStatus = details.paymentStatus;
-    }
-  }
-
-  return c.json({
-    stripePaymentIntentId: invoice.stripePaymentIntentId,
-    stripeRefundId: invoice.stripeRefundId,
-    cardLast4,
-    paymentStatus,
-  });
-});
@@ -213,11 +213,7 @@ petsRouter.post(

    // Delete the previous photo from storage to avoid orphaned objects
    if (pet.photoKey) {
-      try {
-        await deleteObject(pet.photoKey);
-      } catch (err) {
-        console.warn(`Failed to delete previous photo ${pet.photoKey}, orphaned object may remain:`, err);
-      }
+      await deleteObject(pet.photoKey);
    }

    const [row] = await db
@@ -244,11 +240,7 @@ petsRouter.delete("/:petId/photo", async (c) => {
  if (!pet) return c.json({ error: "Pet not found" }, 404);
  if (!pet.photoKey) return c.json({ error: "No photo on file" }, 404);

-  try {
-    await deleteObject(pet.photoKey);
-  } catch (err) {
-    console.warn(`Failed to delete photo ${pet.photoKey} from S3, orphaned object may remain:`, err);
-  }
+  await deleteObject(pet.photoKey);
  await db
    .update(pets)
    .set({ photoKey: null, photoUploadedAt: null, updatedAt: new Date() })
@@ -1,84 +1,33 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
-import { eq, inArray } from "@groombook/db";
+import { and, eq, inArray } from "@groombook/db";
 import { getDb, appointments, impersonationSessions, waitlistEntries, clients, pets, services, staff, invoices, invoiceLineItems } from "@groombook/db";
-import { validatePortalSession } from "../middleware/portalSession.js";
-import { portalAudit } from "../middleware/portalAudit.js";
-import type { PortalEnv } from "../middleware/portalSession.js";
+import type { AppEnv } from "../middleware/rbac.js";

-export const portalRouter = new Hono<PortalEnv>();
+export const portalRouter = new Hono<AppEnv>();

-// Dev-mode session creation — must be registered BEFORE the /* middleware so it is
-// NOT subject to validatePortalSession/portalAudit (GRO-778 fix). This endpoint creates
-// the impersonation session and has no X-Impersonation-Session-Id header yet.
-const devSessionSchema = z.object({
-  clientId: z.string().uuid(),
-});
+// ─── Session helper ───────────────────────────────────────────────────────────

-portalRouter.post(
-  "/dev-session",
-  zValidator("json", devSessionSchema),
-  async (c) => {
-    if (process.env.AUTH_DISABLED !== "true") {
-      return c.json({ error: "Not available when auth is enabled" }, 403);
-    }
-
-    const db = getDb();
-    const body = c.req.valid("json");
-
-    const [client] = await db
-      .select()
-      .from(clients)
-      .where(eq(clients.id, body.clientId))
-      .limit(1);
-    if (!client) {
-      return c.json({ error: "Client not found" }, 404);
-    }
-
-    const DEMO_STAFF_ID = "00000000-0000-0000-0000-000000000001";
-
-    let staffId = DEMO_STAFF_ID;
-    const [demoStaff] = await db
-      .select({ id: staff.id })
-      .from(staff)
-      .where(eq(staff.id, DEMO_STAFF_ID))
-      .limit(1);
-
-    if (!demoStaff) {
-      const [firstStaff] = await db
-        .select({ id: staff.id })
-        .from(staff)
-        .where(eq(staff.active, true))
-        .limit(1);
-      if (!firstStaff) {
-        return c.json({ error: "No staff records found. Run the database seed." }, 500);
-      }
-      staffId = firstStaff.id;
-    }
-
-    const [session] = await db
-      .insert(impersonationSessions)
-      .values({
-        staffId,
-        clientId: body.clientId,
-        reason: "dev-mode-client-portal",
-        expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
-      })
-      .returning();
-
-    return c.json(session, 201);
-  }
-);
-
-// Apply middleware to all portal routes
-portalRouter.use("/*", validatePortalSession, portalAudit);
+async function getClientIdFromSession(sessionId: string | null | undefined): Promise<string | null> {
+  if (!sessionId) return null;
+  const db = getDb();
+  const [session] = await db
+    .select()
+    .from(impersonationSessions)
+    .where(and(eq(impersonationSessions.id, sessionId), eq(impersonationSessions.status, "active")))
+    .limit(1);
+  if (!session || session.expiresAt <= new Date()) return null;
+  return session.clientId;
+}

 // ─── GET routes ──────────────────────────────────────────────────────────────

 portalRouter.get("/me", async (c) => {
  const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);

  const [client] = await db.select().from(clients).where(eq(clients.id, clientId)).limit(1);
  if (!client) return c.json({ error: "Not found" }, 404);
@@ -86,12 +35,6 @@ portalRouter.get("/me", async (c) => {
  return c.json({ id: client.id, name: client.name, email: client.email, phone: client.phone });
 });

-portalRouter.get("/config", async (c) => {
-  return c.json({
-    stripePublishableKey: process.env.STRIPE_PUBLISHABLE_KEY ?? "",
-  });
-});
-
 portalRouter.get("/services", async (c) => {
  const db = getDb();
  const allServices = await db.select().from(services).where(eq(services.active, true));
@@ -100,8 +43,11 @@ portalRouter.get("/services", async (c) => {

 portalRouter.get("/appointments", async (c) => {
  const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);

+  const now = new Date();
  const allAppts = await db
    .select({
      id: appointments.id,
@@ -141,20 +87,27 @@ portalRouter.get("/appointments", async (c) => {
    staff: a.staffId ? { id: staffMap[a.staffId]?.id, name: staffMap[a.staffId]?.name } : null,
  }));

-  return c.json({ appointments: appts });
+  const upcoming = appts.filter(a => a.startTime > now && a.status !== "cancelled");
+  const past = appts.filter(a => a.startTime <= now || a.status === "cancelled");
+
+  return c.json({ upcoming, past });
 });

 portalRouter.get("/pets", async (c) => {
  const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);

  const clientPets = await db.select().from(pets).where(eq(pets.clientId, clientId));
-  return c.json(clientPets.map(p => ({ id: p.id, name: p.name, breed: p.breed, weight: p.weightKg, birthDate: p.dateOfBirth, photoUrl: p.photoKey, notes: p.groomingNotes })));
+  return c.json(clientPets.map(p => ({ id: p.id, name: p.name, breed: p.breed, weightKg: p.weightKg, dateOfBirth: p.dateOfBirth, photoKey: p.photoKey, groomingNotes: p.groomingNotes })));
 });

 portalRouter.get("/invoices", async (c) => {
  const db = getDb();
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) return c.json({ error: "Unauthorized" }, 401);

  const clientInvoices = await db.select().from(invoices).where(eq(invoices.clientId, clientId));
  const invoiceIds = clientInvoices.map(i => i.id);
@@ -170,7 +123,7 @@ portalRouter.get("/invoices", async (c) => {
    id: inv.id,
    status: inv.status,
    totalCents: inv.totalCents,
-    date: inv.createdAt,
+    createdAt: inv.createdAt,
    lineItems: (itemsByInvoice[inv.id] || []).map(li => ({ id: li.id, description: li.description, quantity: li.quantity, unitPriceCents: li.unitPriceCents, totalCents: li.totalCents })),
  })));
 });
@@ -189,7 +142,12 @@ portalRouter.patch(
    const db = getDb();
    const id = c.req.param("id");
    const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+    const clientId = await getClientIdFromSession(sessionId);
+    if (!clientId) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }

    const [appt] = await db
      .select()
@@ -232,7 +190,12 @@ portalRouter.patch(
 portalRouter.post("/appointments/:id/confirm", async (c) => {
  const db = getDb();
  const id = c.req.param("id");
-  const clientId = c.get("portalClientId");
+
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }

  const [appt] = await db
    .select()
@@ -281,7 +244,12 @@ portalRouter.post("/appointments/:id/confirm", async (c) => {
 portalRouter.post("/appointments/:id/cancel", async (c) => {
  const db = getDb();
  const id = c.req.param("id");
-  const clientId = c.get("portalClientId");
+
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+  const clientId = await getClientIdFromSession(sessionId);
+  if (!clientId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }

  const [appt] = await db
    .select()
@@ -345,7 +313,28 @@ portalRouter.post(
  async (c) => {
    const db = getDb();
    const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+
+    let clientId: string | null = null;
+    if (sessionId) {
+      const [session] = await db
+        .select()
+        .from(impersonationSessions)
+        .where(
+          and(
+            eq(impersonationSessions.id, sessionId),
+            eq(impersonationSessions.status, "active")
+          )
+        )
+        .limit(1);
+      if (session && session.expiresAt > new Date()) {
+        clientId = session.clientId;
+      }
+    }
+
+    if (!clientId) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }

    const [entry] = await db
      .insert(waitlistEntries)
@@ -369,7 +358,26 @@ portalRouter.patch(
    const db = getDb();
    const id = c.req.param("id");
    const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");
+    const sessionId = c.req.header("X-Impersonation-Session-Id");
+
+    if (!sessionId) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
+    const [session] = await db
+      .select()
+      .from(impersonationSessions)
+      .where(
+        and(
+          eq(impersonationSessions.id, sessionId),
+          eq(impersonationSessions.status, "active")
+        )
+      )
+      .limit(1);
+
+    if (!session || session.expiresAt <= new Date()) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }

    const [existing] = await db
      .select()
@@ -378,7 +386,7 @@ portalRouter.patch(
      .limit(1);

    if (!existing) return c.json({ error: "Not found" }, 404);
-    if (existing.clientId !== clientId) {
+    if (existing.clientId !== session.clientId) {
      return c.json({ error: "Forbidden" }, 403);
    }

@@ -400,7 +408,26 @@ portalRouter.patch(
 portalRouter.delete("/waitlist/:id", async (c) => {
  const db = getDb();
  const id = c.req.param("id");
-  const clientId = c.get("portalClientId");
+  const sessionId = c.req.header("X-Impersonation-Session-Id");
+
+  if (!sessionId) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+
+  const [session] = await db
+    .select()
+    .from(impersonationSessions)
+    .where(
+      and(
+        eq(impersonationSessions.id, sessionId),
+        eq(impersonationSessions.status, "active")
+      )
+    )
+    .limit(1);
+
+  if (!session || session.expiresAt <= new Date()) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }

  const [entry] = await db
    .select()
@@ -409,7 +436,7 @@ portalRouter.delete("/waitlist/:id", async (c) => {
    .limit(1);

  if (!entry) return c.json({ error: "Not found" }, 404);
-  if (entry.clientId !== clientId) {
+  if (entry.clientId !== session.clientId) {
    return c.json({ error: "Forbidden" }, 403);
  }

@@ -421,101 +448,71 @@ portalRouter.delete("/waitlist/:id", async (c) => {
  return c.json({ ok: true });
 });

-// ─── Payment routes ───────────────────────────────────────────────────────────
+// ─── Dev-mode session creation ──────────────────────────────────────────────
+// Allows the dev login selector to vend an impersonation session for a client
+// without requiring manager auth. Only available when AUTH_DISABLED=true.

-import {
-  createPaymentIntent,
-  listPaymentMethods,
-  detachPaymentMethod,
-  createSetupIntent,
-  getOrCreateStripeCustomer,
-  getStripeClient,
-} from "../services/payment.js";
-
-const payMultipleSchema = z.object({
-  invoiceIds: z.array(z.string().uuid()).min(1),
+const devSessionSchema = z.object({
+  clientId: z.string().uuid(),
 });

 portalRouter.post(
-  "/invoices/pay-multiple",
-  zValidator("json", payMultipleSchema),
+  "/dev-session",
+  zValidator("json", devSessionSchema),
  async (c) => {
+    if (process.env.AUTH_DISABLED !== "true") {
+      return c.json({ error: "Not available when auth is enabled" }, 403);
+    }
+
    const db = getDb();
    const body = c.req.valid("json");
-    const clientId = c.get("portalClientId");

-    const invoiceRows = await db
+    // Verify client exists
+    const [client] = await db
      .select()
-      .from(invoices)
-      .where(inArray(invoices.id, body.invoiceIds));
-
-    if (invoiceRows.length !== body.invoiceIds.length) {
-      return c.json({ error: "One or more invoices not found" }, 404);
+      .from(clients)
+      .where(eq(clients.id, body.clientId))
+      .limit(1);
+    if (!client) {
+      return c.json({ error: "Client not found" }, 404);
    }

-    for (const inv of invoiceRows) {
-      if (inv.clientId !== clientId) return c.json({ error: "Forbidden" }, 403);
-      if (inv.status === "draft" || inv.status === "void") {
-        return c.json({ error: `Invoice ${inv.id} cannot be paid (draft or void)` }, 422);
-      }
-      if (inv.status === "paid") {
-        return c.json({ error: `Invoice ${inv.id} is already paid` }, 422);
+    // Find a staff record to associate with the dev impersonation session.
+    // Use the demo-manager if it exists (created by seed with known ID),
+    // otherwise fall back to the first active staff record.
+    // This avoids hardcoding a UUID that may not exist in all environments.
+    const DEMO_STAFF_ID = "00000000-0000-0000-0000-000000000001";
+
+    let staffId = DEMO_STAFF_ID;
+    const [demoStaff] = await db
+      .select({ id: staff.id })
+      .from(staff)
+      .where(eq(staff.id, DEMO_STAFF_ID))
+      .limit(1);
+
+    if (!demoStaff) {
+      // Fall back to any active staff member
+      const [firstStaff] = await db
+        .select({ id: staff.id })
+        .from(staff)
+        .where(eq(staff.active, true))
+        .limit(1);
+      if (!firstStaff) {
+        return c.json({ error: "No staff records found. Run the database seed." }, 500);
      }
+      staffId = firstStaff.id;
    }

-    const firstInvoice = invoiceRows[0];
-    if (!firstInvoice) return c.json({ error: "No invoices found" }, 400);
-    const allSameClient = invoiceRows.every(inv => inv.clientId === firstInvoice.clientId);
-    if (!allSameClient) {
-      return c.json({ error: "All invoices must belong to the same client" }, 422);
-    }
+    const [session] = await db
+      .insert(impersonationSessions)
+      .values({
+        staffId,
+        clientId: body.clientId,
+        reason: "dev-mode-client-portal",
+        expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
+      })
+      .returning();

-    const stripePublishableKey = process.env.STRIPE_PUBLISHABLE_KEY ?? "";
-    const result = await createPaymentIntent(body.invoiceIds, clientId);
-    if (!result) return c.json({ error: "Payment service unavailable" }, 503);
-
-    return c.json({ clientSecret: result.clientSecret, publishableKey: stripePublishableKey });
+    return c.json(session, 201);
  }
-);
-
-portalRouter.get("/payment-methods", async (c) => {
-  const clientId = c.get("portalClientId");
-
-  const methods = await listPaymentMethods(clientId);
-  if (methods === null) return c.json({ error: "Payment service unavailable" }, 503);
-  return c.json(methods);
-});
-
-portalRouter.post("/payment-methods", async (c) => {
-  const clientId = c.get("portalClientId");
-
-  const stripePublishableKey = process.env.STRIPE_PUBLISHABLE_KEY ?? "";
-  const customerId = await getOrCreateStripeCustomer(clientId);
-  if (!customerId) return c.json({ error: "Could not create customer" }, 500);
-
-  const result = await createSetupIntent(customerId);
-  if (!result) return c.json({ error: "Payment service unavailable" }, 503);
-
-  return c.json({ clientSecret: result.clientSecret, publishableKey: stripePublishableKey });
-});
-
-portalRouter.delete("/payment-methods/:id", async (c) => {
-  const clientId = c.get("portalClientId");
-
-  const paymentMethodId = c.req.param("id");
-
-  const stripeCustomerId = await getOrCreateStripeCustomer(clientId);
-  if (!stripeCustomerId) return c.json({ error: "No payment method found" }, 404);
-
-  const stripe = getStripeClient();
-  if (!stripe) return c.json({ error: "Payment service unavailable" }, 503);
-
-  const paymentMethod = await stripe.paymentMethods.retrieve(paymentMethodId);
-  if (!paymentMethod || paymentMethod.customer !== stripeCustomerId) {
-    return c.json({ error: "Payment method not found" }, 404);
-  }
-
-  const ok = await detachPaymentMethod(paymentMethodId);
-  if (!ok) return c.json({ error: "Failed to detach payment method" }, 500);
-  return c.json({ ok: true });
-});
+);
@@ -286,10 +286,6 @@ reportsRouter.get("/clients", async (c) => {
  ninetyDaysAgo.setUTCDate(ninetyDaysAgo.getUTCDate() - 90);
  const ninetyDaysAgoISO = ninetyDaysAgo.toISOString();

-  const page = Math.max(1, parseInt(c.req.query("page") ?? "1", 10) || 1);
-  const limit = Math.min(100, Math.max(1, parseInt(c.req.query("limit") ?? "20", 10) || 20));
-  const offset = (page - 1) * limit;
-
  const churnRisk = await db
    .select({
      clientId: clients.id,
@@ -302,34 +298,15 @@ reportsRouter.get("/clients", async (c) => {
    .having(
      sql`MAX(${appointments.startTime}) < ${ninetyDaysAgoISO}::timestamptz OR MAX(${appointments.startTime}) IS NULL`
    )
-    .orderBy(sql`MAX(${appointments.startTime}) ASC NULLS FIRST`)
-    .limit(limit)
-    .offset(offset);
-
-  const [churnCountRow] = await db
-    .select({ total: sql<number>`count(*)::int` })
-    .from(
-      db
-        .select({ id: clients.id })
-        .from(clients)
-        .leftJoin(appointments, eq(appointments.clientId, clients.id))
-        .groupBy(clients.id)
-        .having(
-          sql`MAX(${appointments.startTime}) < ${ninetyDaysAgoISO}::timestamptz OR MAX(${appointments.startTime}) IS NULL`
-        )
-        .as("churn_count")
-    );
-  const churnRiskTotal = churnCountRow?.total ?? 0;
+    .orderBy(sql`MAX(${appointments.startTime}) ASC NULLS FIRST`);

  return c.json({
    from: from.toISOString(),
    to: to.toISOString(),
    newClients,
    activeInPeriodCount: activeInPeriod.length,
-    churnRisk,
-    churnRiskTotal,
-    page,
-    limit,
+    churnRisk: churnRisk.slice(0, 20), // top 20 at-risk clients
+    churnRiskTotal: churnRisk.length,
  });
 });

@@ -9,7 +9,7 @@ const createServiceSchema = z.object({
  name: z.string().min(1).max(200),
  description: z.string().max(2000).optional(),
  basePriceCents: z.number().int().positive(),
-  durationMinutes: z.number().int().positive().max(480),
+  durationMinutes: z.number().int().positive(),
  active: z.boolean().default(true),
 });

@@ -2,7 +2,7 @@ import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { z } from "zod/v3";
 import { eq, getDb, businessSettings } from "@groombook/db";
-import { getPresignedUploadUrl, deleteObject, putObject, getObject } from "../lib/s3.js";
+import { getPresignedUploadUrl, getPresignedGetUrl, deleteObject } from "../lib/s3.js";
 import { requireSuperUser } from "../middleware/rbac.js";

 export const settingsRouter = new Hono();
@@ -100,77 +100,6 @@ settingsRouter.post(
  }
 );

-/**
- * POST /api/admin/settings/logo/upload
- * Proxy upload through the API server to avoid mixed-content issues with
- * pre-signed URLs that use the internal HTTP endpoint. The file is uploaded
- * directly to S3 from the server using the internal endpoint.
- */
-settingsRouter.post("/logo/upload", requireSuperUser(), async (c) => {
-  const db = getDb();
-
-  // Parse multipart form data (file field)
-  const body = await c.req.parseBody({ all: true });
-  const file = body["file"];
-
-  if (!file || !(file instanceof File)) {
-    return c.json({ error: "No file provided" }, 400);
-  }
-
-  const contentType = file.type;
-  if (!ALLOWED_LOGO_TYPES.has(contentType)) {
-    return c.json(
-      {
-        error:
-          "contentType must be one of: image/png, image/svg+xml, image/jpeg, image/webp",
-      },
-      400
-    );
-  }
-
-  const fileSizeBytes = file.size;
-  if (fileSizeBytes > MAX_LOGO_SIZE) {
-    return c.json({ error: "File must not exceed 512 KB" }, 400);
-  }
-
-  const rows = await db.select().from(businessSettings).limit(1);
-  if (!rows[0]) {
-    return c.json({ error: "Settings not found" }, 404);
-  }
-  const settingsId = rows[0].id;
-
-  const ext = contentType.split("/")[1] ?? "png";
-  const key = `logos/${settingsId}/${Date.now()}.${ext}`;
-
-  // Read file into buffer and upload directly to S3 (bypasses pre-signed URL)
-  const arrayBuffer = await file.arrayBuffer();
-  const buffer = Buffer.from(arrayBuffer);
-  await putObject(key, buffer, contentType, fileSizeBytes);
-
-  // Delete previous S3 object if any
-  if (rows[0].logoKey) {
-    await deleteObject(rows[0].logoKey);
-  }
-
-  // Update database with new logo key
-  const [updated] = await db
-    .update(businessSettings)
-    .set({
-      logoKey: key,
-      logoBase64: null,
-      logoMimeType: null,
-      updatedAt: new Date(),
-    })
-    .where(eq(businessSettings.id, settingsId))
-    .returning();
-
-  if (!updated) {
-    return c.json({ error: "Settings not found" }, 404);
-  }
-
-  return c.json({ ok: true, logoKey: updated.logoKey });
-});
-
 /**
 * POST /api/admin/settings/logo/confirm
 * Called after the client has successfully uploaded to the presigned URL.
@@ -215,8 +144,7 @@ settingsRouter.post(

 /**
 * GET /api/admin/settings/logo
- * Proxies the logo from S3 so the browser never sees an S3 URL.
- * Returns the image bytes with proper Content-Type.
+ * Returns a presigned GET URL for the logo.
 */
 settingsRouter.get("/logo", async (c) => {
  const db = getDb();
@@ -225,14 +153,8 @@ settingsRouter.get("/logo", async (c) => {
  if (!row) return c.json({ error: "Settings not found" }, 404);
  if (!row.logoKey) return c.json({ error: "No logo on file" }, 404);

-  const { body, contentType } = await getObject(row.logoKey);
-  return new Response(Buffer.from(body), {
-    status: 200,
-    headers: {
-      "Content-Type": contentType,
-      "Cache-Control": "public, max-age=86400",
-    },
-  });
+  const url = await getPresignedGetUrl(row.logoKey);
+  return c.json({ url, logoKey: row.logoKey });
 });

 /**
@@ -4,40 +4,11 @@ import { z } from "zod/v3";
 import { and, eq, getDb, sql, staff, businessSettings, authProviderConfig, encryptSecret } from "@groombook/db";
 import type { AppEnv } from "../middleware/rbac.js";

-const RATE_LIMIT_WINDOW_MS = 60_000;
-const RATE_LIMIT_MAX = 10;
-const rateLimitMap = new Map<string, { count: number; resetAt: number }>();
-
-function rateLimitByIp(ip: string): { allowed: boolean; remaining: number } {
-  const entry = rateLimitMap.get(ip);
-  const now = Date.now();
-  if (!entry || now > entry.resetAt) {
-    rateLimitMap.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
-    return { allowed: true, remaining: RATE_LIMIT_MAX - 1 };
-  }
-  if (entry.count >= RATE_LIMIT_MAX) {
-    return { allowed: false, remaining: 0 };
-  }
-  entry.count++;
-  return { allowed: true, remaining: RATE_LIMIT_MAX - entry.count };
-}
-
 export const setupRouter = new Hono<AppEnv>();

 // GET /api/setup/status — public (no auth), returns whether setup is needed
 // and whether the auth provider bootstrap step should be shown
 setupRouter.get("/status", async (c) => {
-  const skipOobe = ["true", "1", "yes"].includes((process.env.SKIP_OOBE || "").toLowerCase());
-  if (skipOobe) {
-    return c.json({
-      needsSetup: false,
-      showAuthProviderStep: false,
-      authConfigExists: false,
-      authEnvVarsSet: false,
-      skipped: true,
-    });
-  }
-
  const db = getDb();

  // Check if any super user exists
@@ -203,74 +174,52 @@ const authProviderTestSchema = z.object({
 * After setup completes, this endpoint permanently returns 403.
 */
 setupRouter.post("/auth-provider", async (c) => {
-  const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-  const { allowed, remaining } = rateLimitByIp(ip);
-  c.res.headers.set("x-rate-limit-remaining", String(remaining));
-  if (!allowed) {
-    return c.json({ error: "Too many requests. Please try again later." }, 429);
-  }
-
  const db = getDb();

-  let row: typeof authProviderConfig.$inferSelect;
-  try {
-    row = await db.transaction(async (tx) => {
-      const [superUser] = await tx
-        .select({ id: staff.id })
-        .from(staff)
-        .where(eq(staff.isSuperUser, true))
-        .limit(1);
+  // Guard: only allow during fresh install (no super user yet)
+  const [superUser] = await db
+    .select({ id: staff.id })
+    .from(staff)
+    .where(eq(staff.isSuperUser, true))
+    .limit(1);

-      if (superUser) {
-        throw Object.assign(new Error("setup-complete"), { code: 403 });
-      }
+  if (superUser) {
+    // Setup already completed — lock this endpoint permanently
+    return c.json({ error: "Setup has already been completed. This endpoint is no longer available." }, 403);
+  }

-      const [existingConfig] = await tx
-        .select({ id: authProviderConfig.id })
-        .from(authProviderConfig)
-        .where(eq(authProviderConfig.enabled, true))
-        .limit(1);
+  // Guard: ensure no DB config already exists (should be redundant with status check but defensive)
+  const [existingConfig] = await db
+    .select({ id: authProviderConfig.id })
+    .from(authProviderConfig)
+    .where(eq(authProviderConfig.enabled, true))
+    .limit(1);

-      if (existingConfig) {
-        throw Object.assign(new Error("config-exists"), { code: 409 });
-      }
+  if (existingConfig) {
+    return c.json({ error: "Auth provider is already configured." }, 409);
+  }

-      const body = authProviderBootstrapSchema.parse(await c.req.json());
+  const body = authProviderBootstrapSchema.parse(await c.req.json());

-      const encryptedSecret = encryptSecret(body.clientSecret);
+  // Encrypt clientSecret before storing
+  const encryptedSecret = encryptSecret(body.clientSecret);

-      const [configRow] = await tx
-        .insert(authProviderConfig)
-        .values({
-          providerId: body.providerId,
-          displayName: body.displayName,
-          issuerUrl: body.issuerUrl,
-          internalBaseUrl: body.internalBaseUrl ?? null,
-          clientId: body.clientId,
-          clientSecret: encryptedSecret,
-          scopes: body.scopes,
-          enabled: true,
-        })
-        .returning();
+  const [row] = await db
+    .insert(authProviderConfig)
+    .values({
+      providerId: body.providerId,
+      displayName: body.displayName,
+      issuerUrl: body.issuerUrl,
+      internalBaseUrl: body.internalBaseUrl ?? null,
+      clientId: body.clientId,
+      clientSecret: encryptedSecret,
+      scopes: body.scopes,
+      enabled: true,
+    })
+    .returning();

-      if (!configRow) {
-        throw Object.assign(new Error("insert-failed"), { code: 500 });
-      }
-
-      return configRow;
-    });
-  } catch (err: unknown) {
-    const e = err as Error & { code?: number };
-    if (e.message === "setup-complete") {
-      return c.json({ error: "Setup has already been completed. This endpoint is no longer available." }, e.code as 403);
-    }
-    if (e.message === "config-exists") {
-      return c.json({ error: "Auth provider is already configured." }, e.code as 409);
-    }
-    if (e.message === "insert-failed") {
-      return c.json({ error: "Failed to save auth provider configuration." }, e.code as 500);
-    }
-    throw err;
+  if (!row) {
+    return c.json({ error: "Failed to save auth provider configuration." }, 500);
  }

  return c.json({
@@ -294,13 +243,6 @@ setupRouter.post("/auth-provider", async (c) => {
 * Only available when needsSetup is true (no super user = fresh install).
 */
 setupRouter.post("/auth-provider/test", async (c) => {
-  const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-  const { allowed, remaining } = rateLimitByIp(ip);
-  c.res.headers.set("x-rate-limit-remaining", String(remaining));
-  if (!allowed) {
-    return c.json({ ok: false, error: "Too many requests. Please try again later." }, 429);
-  }
-
  const db = getDb();

  // Guard: only allow during fresh install (no super user yet)
@@ -18,10 +18,6 @@ const createStaffSchema = z.object({

 const updateStaffSchema = createStaffSchema.partial().omit({ email: true });

-const linkUserSchema = z.object({
-  userId: z.string().min(1),
-});
-
 staffRouter.get("/me", async (c) => {
  const staffRow = c.get("staff");
  return c.json(staffRow);
@@ -110,32 +106,6 @@ staffRouter.patch("/:id", zValidator("json", updateStaffSchema), async (c) => {
  return c.json(row);
 });

-staffRouter.patch("/:id/link-user", zValidator("json", linkUserSchema), async (c) => {
-  const db = getDb();
-  const targetId = c.req.param("id");
-  const body = c.req.valid("json");
-  const currentStaff = c.get("staff");
-
-  if (currentStaff.role !== "manager" && !currentStaff.isSuperUser) {
-    return c.json({ error: "Forbidden: only managers or super users can link staff to users" }, 403);
-  }
-
-  const [existing] = await db
-    .select()
-    .from(staff)
-    .where(eq(staff.id, targetId))
-    .limit(1);
-  if (!existing) return c.json({ error: "Not found" }, 404);
-
-  const [updated] = await db
-    .update(staff)
-    .set({ userId: body.userId, updatedAt: new Date() })
-    .where(eq(staff.id, targetId))
-    .returning();
-
-  return c.json(updated);
-});
-
 staffRouter.delete("/:id", async (c) => {
  const db = getDb();
  const id = c.req.param("id");
@@ -1,119 +0,0 @@
-import { Hono } from "hono";
-import Stripe from "stripe";
-import { z } from "zod/v3";
-import { eq, getDb, invoices } from "@groombook/db";
-import { getStripeClient } from "../services/payment.js";
-
-export const webhooksRouter = new Hono();
-
-webhooksRouter.post("/stripe", async (c) => {
-  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
-  if (!webhookSecret) {
-    return c.json({ error: "Webhook secret not configured" }, 503);
-  }
-
-  const signature = c.req.header("stripe-signature");
-  if (!signature) {
-    return c.json({ error: "Missing signature" }, 401);
-  }
-
-  let rawBody: string;
-  try {
-    rawBody = await c.req.text();
-  } catch {
-    return c.json({ error: "Could not read body" }, 400);
-  }
-
-  const stripe = getStripeClient();
-  if (!stripe) {
-    return c.json({ error: "Stripe not configured" }, 503);
-  }
-
-  let event: Stripe.Event;
-  try {
-    event = stripe.webhooks.constructEvent(rawBody, signature, webhookSecret);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Invalid signature";
-    return c.json({ error: message }, 401);
-  }
-
-  const db = getDb();
-
-  if (event.type === "payment_intent.succeeded") {
-    const pi = event.data.object as Stripe.PaymentIntent;
-    if (pi.metadata?.groombook_invoice_ids) {
-      const invoiceIds = pi.metadata.groombook_invoice_ids.split(",");
-      for (const invoiceId of invoiceIds) {
-        if (!invoiceId) continue;
-        const parsed = z.string().uuid().safeParse(invoiceId.trim());
-        if (!parsed.success) continue;
-        const invoiceIdTrimmed = invoiceId.trim();
-        const [inv] = await db
-          .select()
-          .from(invoices)
-          .where(eq(invoices.id, invoiceIdTrimmed))
-          .limit(1);
-        if (!inv) continue;
-        if (inv.stripePaymentIntentId && inv.stripePaymentIntentId !== pi.id) continue;
-        await db
-          .update(invoices)
-          .set({
-            status: "paid",
-            paymentMethod: "card",
-            paidAt: new Date(),
-            stripePaymentIntentId: pi.id,
-            updatedAt: new Date(),
-          })
-          .where(eq(invoices.id, invoiceIdTrimmed));
-      }
-    }
-  } else if (event.type === "payment_intent.payment_failed") {
-    const pi = event.data.object as Stripe.PaymentIntent;
-    if (pi.metadata?.groombook_invoice_ids) {
-      const invoiceIds = pi.metadata.groombook_invoice_ids.split(",");
-      for (const invoiceId of invoiceIds) {
-        if (!invoiceId) continue;
-        const parsed = z.string().uuid().safeParse(invoiceId.trim());
-        if (!parsed.success) continue;
-        const invoiceIdTrimmed = invoiceId.trim();
-        await db
-          .update(invoices)
-          .set({
-            paymentFailureReason: pi.last_payment_error?.message ?? "Payment failed",
-            updatedAt: new Date(),
-          })
-          .where(eq(invoices.id, invoiceIdTrimmed));
-      }
-    }
-  } else if (event.type === "charge.refunded") {
-    const charge = event.data.object as Stripe.Charge;
-    if (typeof charge.payment_intent === "string" && charge.payment_intent) {
-      const [inv] = await db
-        .select({ id: invoices.id })
-        .from(invoices)
-        .where(eq(invoices.stripePaymentIntentId, charge.payment_intent))
-        .limit(1);
-      if (inv) {
-        const refundId =
-          typeof charge.refunded === "boolean" && charge.refunded
-            ? `ch_${charge.id}_refund`
-            : null;
-        await db
-          .update(invoices)
-          .set({
-            status: "void",
-            stripeRefundId: refundId,
-            updatedAt: new Date(),
-          })
-          .where(eq(invoices.id, inv.id));
-      }
-    }
-  } else if (event.type === "charge.dispute.created") {
-    const dispute = event.data.object as Stripe.Dispute;
-    console.error(
-      `[Stripe Webhook] Dispute created for payment intent: ${dispute.payment_intent}`
-    );
-  }
-
-  return c.json({ received: true });
-});
@@ -1,180 +0,0 @@
-import Stripe from "stripe";
-import { getDb, clients, eq, inArray, invoices } from "@groombook/db";
-
-let _stripe: Stripe | null | undefined;
-
-export function getStripeClient(): Stripe | null {
-  if (_stripe === undefined) {
-    const secretKey = process.env.STRIPE_SECRET_KEY;
-    if (!secretKey) return null;
-    _stripe = new Stripe(secretKey);
-  }
-  return _stripe;
-}
-
-export async function getOrCreateStripeCustomer(clientId: string): Promise<string | null> {
-  const stripe = getStripeClient();
-  if (!stripe) return null;
-
-  const db = getDb();
-  const [client] = await db.select().from(clients).where(eq(clients.id, clientId)).limit(1);
-  if (!client) return null;
-
-  if (client.stripeCustomerId) return client.stripeCustomerId;
-
-  const customer = await stripe.customers.create({
-    metadata: { groombook_client_id: clientId },
-  });
-
-  await db
-    .update(clients)
-    .set({ stripeCustomerId: customer.id, updatedAt: new Date() })
-    .where(eq(clients.id, clientId));
-
-  return customer.id;
-}
-
-export async function createPaymentIntent(
-  invoiceIdOrIds: string | string[],
-  clientId: string
-): Promise<{ clientSecret: string; paymentIntentId: string } | null> {
-  const stripe = getStripeClient();
-  if (!stripe) return null;
-
-  const db = getDb();
-  const invoiceIds = Array.isArray(invoiceIdOrIds) ? invoiceIdOrIds : [invoiceIdOrIds];
-  const firstInvoiceId = invoiceIds[0];
-  if (!firstInvoiceId) return null;
-
-  const invoiceRows = await db
-    .select()
-    .from(invoices)
-    .where(eq(invoices.id, firstInvoiceId));
-
-  const [invoice] = invoiceRows;
-  if (!invoice) return null;
-
-  let totalCents = invoice.totalCents;
-  if (invoiceIds.length > 1) {
-    const allInvoices = await db
-      .select({ totalCents: invoices.totalCents })
-      .from(invoices)
-      .where(inArray(invoices.id, invoiceIds));
-    totalCents = allInvoices.reduce((sum, inv) => sum + inv.totalCents, 0);
-  }
-
-  const stripeCustomerId = await getOrCreateStripeCustomer(clientId);
-  if (!stripeCustomerId) return null;
-
-  const paymentIntent = await stripe.paymentIntents.create({
-    amount: totalCents,
-    currency: "usd",
-    customer: stripeCustomerId,
-    metadata: {
-      groombook_invoice_ids: invoiceIds.join(","),
-      groombook_client_id: clientId,
-    },
-    automatic_payment_methods: { enabled: true },
-  });
-
-  for (const invId of invoiceIds) {
-    await db
-      .update(invoices)
-      .set({ stripePaymentIntentId: paymentIntent.id, updatedAt: new Date() })
-      .where(eq(invoices.id, invId));
-  }
-
-  const clientSecret = paymentIntent.client_secret;
-  if (!clientSecret) return null;
-
-  return { clientSecret, paymentIntentId: paymentIntent.id };
-}
-
-export async function processRefund(
-  invoiceId: string,
-  amountCents?: number
-): Promise<{ refundId: string } | null> {
-  const stripe = getStripeClient();
-  if (!stripe) return null;
-
-  const db = getDb();
-  const [invoice] = await db.select().from(invoices).where(eq(invoices.id, invoiceId)).limit(1);
-  if (!invoice?.stripePaymentIntentId) return null;
-
-  const refund = await stripe.refunds.create({
-    payment_intent: invoice.stripePaymentIntentId,
-    amount: amountCents,
-  });
-
-  await db
-    .update(invoices)
-    .set({ stripeRefundId: refund.id, updatedAt: new Date() })
-    .where(eq(invoices.id, invoiceId));
-
-  return { refundId: refund.id };
-}
-
-export async function listPaymentMethods(clientId: string): Promise<Stripe.PaymentMethod[] | null> {
-  const stripe = getStripeClient();
-  if (!stripe) return null;
-
-  const stripeCustomerId = await getOrCreateStripeCustomer(clientId);
-  if (!stripeCustomerId) return null;
-
-  const methods = await stripe.paymentMethods.list({
-    customer: stripeCustomerId,
-    type: "card",
-  });
-
-  return methods.data;
-}
-
-export async function attachPaymentMethod(
-  clientId: string,
-  paymentMethodId: string
-): Promise<boolean> {
-  const stripe = getStripeClient();
-  if (!stripe) return false;
-
-  const stripeCustomerId = await getOrCreateStripeCustomer(clientId);
-  if (!stripeCustomerId) return false;
-
-  await stripe.paymentMethods.attach(paymentMethodId, { customer: stripeCustomerId });
-  return true;
-}
-
-export async function detachPaymentMethod(paymentMethodId: string): Promise<boolean> {
-  const stripe = getStripeClient();
-  if (!stripe) return false;
-
-  await stripe.paymentMethods.detach(paymentMethodId);
-  return true;
-}
-
-export async function createSetupIntent(customerId: string): Promise<{ clientSecret: string } | null> {
-  const stripe = getStripeClient();
-  if (!stripe) return null;
-
-  const setupIntent = await stripe.setupIntents.create({
-    customer: customerId,
-    payment_method_types: ["card"],
-  });
-
-  return { clientSecret: setupIntent.client_secret! };
-}
-
-export async function getPaymentIntentDetails(
-  paymentIntentId: string
-): Promise<{ cardLast4: string | null; paymentStatus: string | null } | null> {
-  const stripe = getStripeClient();
-  if (!stripe) return null;
-
-  const pi = await stripe.paymentIntents.retrieve(paymentIntentId, { expand: ["payment_method"] });
-  const cardLast4 = pi.payment_method
-    ? (pi.payment_method as Stripe.PaymentMethod).card?.last4 ?? null
-    : null;
-  return {
-    cardLast4,
-    paymentStatus: pi.status ?? null,
-  };
-}
@@ -5,7 +5,6 @@ import {
  eq,
  getDb,
  gte,
-  inArray,
  lt,
  appointments,
  clients,
@@ -13,16 +12,14 @@ import {
  services,
  staff,
  reminderLogs,
-  session,
 } from "@groombook/db";
 import {
  buildReminderEmail,
  sendEmail,
 } from "./email.js";
-import { smsSend } from "./sms.js";
-
-const TCPA_OPT_OUT = "Reply STOP to opt out. Msg & data rates may apply.";

+// How many hours before the appointment to send each reminder.
+// Override via env: REMINDER_HOURS_EARLY (default 24) and REMINDER_HOURS_LATE (default 2).
 function getReminderWindows(): { label: string; hours: number }[] {
  const early = Number(process.env.REMINDER_HOURS_EARLY ?? 24);
  const late = Number(process.env.REMINDER_HOURS_LATE ?? 2);
@@ -32,14 +29,20 @@ function getReminderWindows(): { label: string; hours: number }[] {
  ];
 }

+// Checks for upcoming appointments that need reminders and sends them.
+// Runs every minute — idempotent via reminder_logs unique constraint.
 export async function runReminderCheck(): Promise<void> {
  const db = getDb();
  const now = new Date();

  for (const window of getReminderWindows()) {
+    // Target window: appointments starting between (hours - 1) and hours from now.
+    // Running every minute means we check a 1-minute slice; the 1-hour window
+    // ensures we catch appointments that started between heartbeats.
    const windowStart = new Date(now.getTime() + (window.hours - 1) * 3600_000);
    const windowEnd = new Date(now.getTime() + window.hours * 3600_000);

+    // Find upcoming appointments in this time window that haven't been cancelled/completed
    const upcoming = await db
      .select({
        id: appointments.id,
@@ -60,78 +63,56 @@ export async function runReminderCheck(): Promise<void> {
        )
      );

-    const appointmentIds: string[] = upcoming.map((a) => a.id as string);
-    if (appointmentIds.length === 0) continue;
-
-    // Bulk check: which appointments already have email and SMS reminders sent?
-    const sentRows = await db
-      .select({ appointmentId: reminderLogs.appointmentId, channel: reminderLogs.channel })
-      .from(reminderLogs)
-      .where(
-        and(
-          eq(reminderLogs.reminderType, window.label),
-          appointmentIds.length === 1
-            ? eq(reminderLogs.appointmentId, appointmentIds[0]!)
-            : inArray(reminderLogs.appointmentId, appointmentIds)
-        )
-      );
-
-    const sentEmail = new Set(
-      sentRows.filter((r) => r.channel === "email").map((r) => r.appointmentId)
-    );
-    const sentSms = new Set(
-      sentRows.filter((r) => r.channel === "sms").map((r) => r.appointmentId)
-    );
-
-    // Bulk JOIN: fetch all client/pet/service/staff data in one query
-    const joinedRows = await db
-      .select({
-        appointmentId: appointments.id,
-        startTime: appointments.startTime,
-        clientId: appointments.clientId,
-        petId: appointments.petId,
-        serviceId: appointments.serviceId,
-        staffId: appointments.staffId,
-        confirmationToken: appointments.confirmationToken,
-        clientName: clients.name,
-        clientEmail: clients.email,
-        clientEmailOptOut: clients.emailOptOut,
-        clientSmsOptIn: clients.smsOptIn,
-        clientPhone: clients.phone,
-        petName: pets.name,
-        serviceName: services.name,
-        staffName: staff.name,
-      })
-      .from(appointments)
-      .innerJoin(clients, eq(appointments.clientId, clients.id))
-      .innerJoin(pets, eq(appointments.petId, pets.id))
-      .innerJoin(services, eq(appointments.serviceId, services.id))
-      .leftJoin(staff, eq(appointments.staffId, staff.id))
-      .where(
-        and(
-          gte(appointments.startTime, windowStart),
-          lt(appointments.startTime, windowEnd),
-          eq(appointments.status, "scheduled")
-        )
-      );
-
-    const appointmentMap = new Map<string, typeof joinedRows[number]>();
-    for (const row of joinedRows) {
-      appointmentMap.set(row.appointmentId, row);
-    }
-
    for (const appt of upcoming) {
-      const joined = appointmentMap.get(appt.id as string);
-      if (!joined) continue;
+      // Check if reminder already sent (unique constraint prevents double-send)
+      const existing = await db
+        .select({ id: reminderLogs.id })
+        .from(reminderLogs)
+        .where(
+          and(
+            eq(reminderLogs.appointmentId, appt.id),
+            eq(reminderLogs.reminderType, window.label)
+          )
+        )
+        .limit(1);

-      const { clientName, clientEmail, clientEmailOptOut, clientSmsOptIn, clientPhone, petName, serviceName, staffName } = joined;
+      if (existing.length > 0) continue; // already sent

-      if (!clientEmail || clientEmailOptOut) continue;
-      if (!petName || !serviceName) continue;
+      // Fetch related records for the email
+      const [client] = await db
+        .select({ name: clients.name, email: clients.email, emailOptOut: clients.emailOptOut })
+        .from(clients)
+        .where(eq(clients.id, appt.clientId))
+        .limit(1);

-      const emailSent = sentEmail.has(appt.id as string);
-      const smsSent = sentSms.has(appt.id as string);
+      if (!client || !client.email || client.emailOptOut) continue;

+      const [pet] = await db
+        .select({ name: pets.name })
+        .from(pets)
+        .where(eq(pets.id, appt.petId))
+        .limit(1);
+
+      const [service] = await db
+        .select({ name: services.name })
+        .from(services)
+        .where(eq(services.id, appt.serviceId))
+        .limit(1);
+
+      let groomerName: string | null = null;
+      if (appt.staffId) {
+        const [groomer] = await db
+          .select({ name: staff.name })
+          .from(staff)
+          .where(eq(staff.id, appt.staffId))
+          .limit(1);
+        groomerName = groomer?.name ?? null;
+      }
+
+      if (!pet || !service) continue;
+
+      // Ensure the appointment has a confirmation token before sending the reminder.
+      // Generate one if it doesn't have one yet (e.g. pre-existing appointments).
      let confirmationToken = appt.confirmationToken;
      if (!confirmationToken) {
        confirmationToken = randomBytes(32).toString("hex");
@@ -141,74 +122,39 @@ export async function runReminderCheck(): Promise<void> {
          .where(eq(appointments.id, appt.id));
      }

-      if (!emailSent) {
-        const sent = await sendEmail(
-          buildReminderEmail(
-            clientEmail,
-            {
-              clientName,
-              petName,
-              serviceName,
-              groomerName: staffName,
-              startTime: appt.startTime,
-            },
-            window.hours,
-            confirmationToken
-          )
-        );
+      const sent = await sendEmail(
+        buildReminderEmail(
+          client.email,
+          {
+            clientName: client.name,
+            petName: pet.name,
+            serviceName: service.name,
+            groomerName,
+            startTime: appt.startTime,
+          },
+          window.hours,
+          confirmationToken
+        )
+      );

-        if (sent) {
-          await db
-            .insert(reminderLogs)
-            .values({ appointmentId: appt.id, reminderType: window.label, channel: "email" })
-            .onConflictDoNothing();
-        }
-      }
-
-      if (!smsSent && clientSmsOptIn && clientPhone) {
-        const apiUrl = process.env.API_URL ?? "http://localhost:3000";
-        const confirmUrl = `${apiUrl}/api/book/confirm/${confirmationToken}`;
-        const cancelUrl = `${apiUrl}/api/book/cancel/${confirmationToken}`;
-        const when = window.hours >= 24 ? "tomorrow" : `in ${window.hours} hours`;
-        const smsBody = [
-          `Hi ${clientName}, just a reminder: ${petName}'s grooming appointment is ${when}.`,
-          `Service: ${serviceName}${staffName ? ` with ${staffName}` : ""}`,
-          `Confirm: ${confirmUrl}`,
-          `Cancel: ${cancelUrl}`,
-          TCPA_OPT_OUT,
-        ].join(". ");
-        try {
-          const smsOk = await smsSend(clientPhone, smsBody);
-          if (smsOk) {
-            await db
-              .insert(reminderLogs)
-              .values({ appointmentId: appt.id, reminderType: window.label, channel: "sms" })
-              .onConflictDoNothing();
-          }
-        } catch (err) {
-          console.error("[reminders] SMS send failed:", err);
-        }
+      if (sent) {
+        // Record send — ignore conflicts (race condition between instances)
+        await db
+          .insert(reminderLogs)
+          .values({ appointmentId: appt.id, reminderType: window.label })
+          .onConflictDoNothing();
      }
    }
  }
 }

+// Starts the cron scheduler. Call once at server startup.
 export function startReminderScheduler(): void {
+  // Run every minute
  cron.schedule("* * * * *", () => {
    runReminderCheck().catch((err) => {
      console.error("[reminders] Error during reminder check:", err);
    });
-    runSessionCleanup().catch((err) => {
-      console.error("[reminders] Error during session cleanup:", err);
-    });
  });
  console.log("[reminders] Reminder scheduler started");
 }
-
-export async function runSessionCleanup(): Promise<void> {
-  const db = getDb();
-  const now = new Date();
-  await db
-    .delete(session)
-    .where(lt(session.expiresAt, now));
-}
@@ -1,142 +0,0 @@
-import { Telnyx } from "telnyx";
-import { createHmac } from "crypto";
-
-export interface SmsProvider {
-  sendSms(to: string, body: string, mediaUrls?: string[]): Promise<{ messageId: string; status: string }>;
-  validateWebhookSignature(req: Request): boolean;
-}
-
-interface TelnyxSmsResult {
-  message_id: string;
-  status: string;
-}
-
-function createTelnyxClient(): Telnyx | null {
-  const apiKey = process.env.TELNYX_API_KEY;
-  if (!apiKey) return null;
-  return new Telnyx(apiKey);
-}
-
-let _client: Telnyx | null | undefined;
-
-function getClient(): Telnyx | null {
-  if (_client === undefined) _client = createTelnyxClient();
-  return _client;
-}
-
-function getFromNumber(): string | null {
-  return process.env.TELNYX_FROM_NUMBER ?? null;
-}
-
-function isE164(phone: string): boolean {
-  return /^\+[1-9]\d{7,14}$/.test(phone);
-}
-
-export async function sendSms(
-  to: string,
-  body: string,
-  mediaUrls?: string[]
-): Promise<{ messageId: string; status: string }> {
-  const client = getClient();
-  if (!client) throw new Error("Telnyx client not initialized. Set TELNYX_API_KEY.");
-
-  const from = getFromNumber();
-  if (!from) throw new Error("TELNYX_FROM_NUMBER is not set");
-
-  if (!isE164(to)) throw new Error(`Invalid recipient phone format: ${to}. Expected E.164.`);
-  if (!isE164(from)) throw new Error(`Invalid sender phone format: ${from}. Expected E.164.`);
-
-  const payload: Record<string, unknown> = {
-    from,
-    to,
-    body,
-  };
-
-  if (mediaUrls && mediaUrls.length > 0) {
-    payload.media_urls = mediaUrls;
-  }
-
-  const result = await client.messages.create(payload as Record<string, string | string[]>);
-  const smsResult = result.data as unknown as TelnyxSmsResult;
-  return {
-    messageId: smsResult.message_id,
-    status: smsResult.status,
-  };
-}
-
-export class TelnyxProvider implements SmsProvider {
-  async sendSms(
-    to: string,
-    body: string,
-    mediaUrls?: string[]
-  ): Promise<{ messageId: string; status: string }> {
-    return sendSms(to, body, mediaUrls);
-  }
-
-  validateWebhookSignature(req: Request): boolean {
-    const secret = process.env.TELNYX_WEBHOOK_SECRET;
-    if (!secret) return false;
-
-    const signature = req.headers.get("telnyx-signature");
-    if (!signature) return false;
-
-    const payload = JSON.stringify(req.body);
-
-    try {
-      const hmac = createHmac("sha256", secret);
-      const expected = `sha256=${hmac.update(payload).digest("hex")}`;
-
-      const sigBuf = Buffer.from(signature);
-      const expBuf = Buffer.from(expected);
-
-      if (sigBuf.length !== expBuf.length) return false;
-
-      let diff = 0;
-      for (let i = 0; i < sigBuf.length; i++) {
-        const sigByte = sigBuf[i] ?? 0;
-        const expByte = expBuf[i] ?? 0;
-        diff |= sigByte ^ expByte;
-      }
-      return diff === 0;
-    } catch {
-      return false;
-    }
-  }
-}
-
-let _provider: SmsProvider | null | undefined;
-
-export function createSmsProvider(): SmsProvider | null {
-  if (_provider === undefined) {
-    if (process.env.SMS_ENABLED !== "true") {
-      _provider = null;
-      return null;
-    }
-    switch (process.env.SMS_PROVIDER) {
-      case "telnyx": {
-        const client = getClient();
-        if (!client) {
-          _provider = null;
-          return null;
-        }
-        _provider = new TelnyxProvider();
-        break;
-      }
-      default:
-        _provider = null;
-    }
-  }
-  return _provider;
-}
-
-export async function smsSend(
-  to: string,
-  body: string,
-  mediaUrls?: string[]
-): Promise<boolean> {
-  const provider = createSmsProvider();
-  if (!provider) return false;
-
-  await provider.sendSms(to, body, mediaUrls);
-  return true;
-}
@@ -1,19 +0,0 @@
-declare module "telnyx" {
-  export interface MessageResult {
-    data: unknown;
-  }
-
-  export interface MessagesCreateParams {
-    from: string;
-    to: string;
-    body: string;
-    media_urls?: string[];
-  }
-
-  export class Telnyx {
-    constructor(apiKey: string);
-    messages: {
-      create(params: Record<string, string | string[]>): Promise<MessageResult>;
-    };
-  }
-}
@@ -63,52 +63,3 @@ test("clicking a client shows their details", async ({ page }) => {
  // Email appears in both the list row and the detail panel once selected
  await expect(page.getByText("alice@example.com")).toHaveCount(2);
 });
-
-test("direct URL navigation to client detail fetches data and renders client name", async ({ page }) => {
-  // Mock individual client fetch for direct navigation
-  await page.route("/api/clients/client-1", (route) =>
-    route.fulfill({ json: MOCK_CLIENTS[0] })
-  );
-  // Mock pets for this client
-  await page.route("/api/pets**", (route) =>
-    route.fulfill({ json: [] })
-  );
-
-  await page.goto("/admin/clients/client-1");
-  // Client name must be visible without any clicking
-  await expect(page.getByText("Alice Johnson")).toBeVisible();
-  // Should show back to list link
-  await expect(page.getByText("← Back to list")).toBeVisible();
-});
-
-test("direct URL navigation shows loading then client", async ({ page }) => {
-  let resolvePets: (value: unknown) => void;
-  const petsPromise = new Promise((resolve) => { resolvePets = resolve; });
-
-  await page.route("/api/clients/client-1", (route) =>
-    route.fulfill({ json: MOCK_CLIENTS[0] })
-  );
-  await page.route("/api/pets**", async (route) => {
-    await petsPromise;
-    await route.fulfill({ json: [] });
-  });
-
-  const navigationPromise = page.goto("/admin/clients/client-1");
-  // Should show loading state briefly
-  await expect(page.getByText("Loading client…")).toBeVisible();
-  // Resolve pets and wait for navigation
-  resolvePets!();
-  await navigationPromise;
-  // After data loads, client name is shown
-  await expect(page.getByText("Alice Johnson")).toBeVisible();
-});
-
-test("direct URL navigation shows error state on failure", async ({ page }) => {
-  await page.route("/api/clients/nonexistent", (route) =>
-    route.fulfill({ status: 404, json: { error: "Client not found" } })
-  );
-
-  await page.goto("/admin/clients/nonexistent");
-  await expect(page.getByText(/client not found/i)).toBeVisible();
-  await expect(page.getByText("← Back to clients")).toBeVisible();
-});
@@ -44,20 +44,7 @@ test.beforeEach(async ({ page }) => {
        json: { newClients: [], activeInPeriodCount: 0, churnRisk: [], churnRiskTotal: 0 },
      });
    }
-    if (url.includes("/api/invoices/stats/summary")) {
-      return route.fulfill({
-        json: {
-          revenueThisMonth: 0,
-          outstanding: 0,
-          refundsThisMonth: 0,
-          methodBreakdown: [],
-        },
-      });
-    }
-    if (url.includes("/api/invoices")) {
-      return route.fulfill({ json: { data: [], total: 0 } });
-    }
-    // Appointments, clients, services, staff, book, etc.
+    // Appointments, clients, services, staff, invoices, book, etc.
    return route.fulfill({ json: [] });
  });
 });
@@ -95,7 +82,6 @@ test("admin staff page loads", async ({ page }) => {

 test("admin invoices page loads", async ({ page }) => {
  await page.goto("/admin/invoices");
-  await page.waitForLoadState("domcontentloaded");
  await expect(page.getByText("GroomBook")).toBeVisible();
  await expect(page.getByRole("link", { name: "Invoices" })).toBeVisible();
 });
@@ -20,5 +20,3 @@ FROM nginx:alpine AS runner
 COPY apps/web/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=builder /app/apps/web/dist /usr/share/nginx/html
 EXPOSE 80
-HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
-  CMD curl -f http://localhost:80/ || exit 1
@@ -3,7 +3,7 @@ import { defineConfig, devices } from "@playwright/test";
 /**
 * Playwright configuration for GroomBook Web E2E tests.
 *
- * Targets the deployed dev environment at dev.groombook.dev.
+ * Targets the deployed dev environment at groombook.dev.farh.net.
 * Uses the dev login selector (/login) for authentication — no hardcoded credentials.
 *
 * Run locally:
@@ -19,7 +19,7 @@ export default defineConfig({
  reporter: process.env.CI ? "github" : "list",

  use: {
-    baseURL: "https://dev.groombook.dev",
+    baseURL: "https://groombook.dev.farh.net",
    trace: "on-first-retry",
    screenshot: "only-on-failure",
    serviceWorkers: "block",
@@ -3,22 +3,10 @@ server {
    root /usr/share/nginx/html;
    index index.html;

-    # Security headers
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-
    # Cache static assets
    location ~* \.(js|css|png|svg|ico|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    }

    # Proxy API calls to the API service
@@ -14,10 +14,8 @@
  },
  "dependencies": {
    "@groombook/types": "workspace:*",
-    "@stripe/react-stripe-js": "^6.1.0",
-    "@stripe/stripe-js": "^9.1.0",
    "@tailwindcss/vite": "^4.2.2",
-    "better-auth": "^1.5.6",
+    "better-auth": "^1.0.0",
    "lucide-react": "^0.577.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96C853FAECD363909C4A0</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96CFC84D7A9333708F278</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96D48D7892E37386B9ACB</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96C25663D703833F23607</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96D89851C843332073968</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96C9C5A03D33730C61AD8</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96BEB91911B30317E3BE8</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96BFB7B92D33535D6D90D</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96B8BDF4B473630A2E120</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,9 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>AccessDenied</Code>
-  <Message>You have no right to access this object because of bucket acl.</Message>
-  <RequestId>69D96D78BFFCAD343037C27C</RequestId>
-  <HostId>hailuo-image-algeng-data-us.oss-us-east-1.aliyuncs.com</HostId>
-  <EC>0003-00000001</EC>
-  <RecommendDoc>https://api.alibabacloud.com/troubleshoot?q=0003-00000001</RecommendDoc>
-</Error>
@@ -1,8 +1,7 @@
-import { Routes, Route, Link, useLocation, Navigate, useNavigate } from "react-router-dom";
+import { Routes, Route, Link, useLocation, Navigate } from "react-router-dom";
 import { useEffect, useState } from "react";
 import { AppointmentsPage } from "./pages/Appointments.js";
 import { ClientsPage } from "./pages/Clients.js";
-import { ClientDetailPage } from "./pages/ClientDetailPage.js";
 import { ServicesPage } from "./pages/Services.js";
 import { StaffPage } from "./pages/Staff.js";
 import { InvoicesPage } from "./pages/Invoices.js";
@@ -13,43 +12,22 @@ import { SettingsPage } from "./pages/Settings.js";
 import { BookingConfirmedPage } from "./pages/BookingConfirmed.js";
 import { BookingCancelledPage } from "./pages/BookingCancelled.js";
 import { BookingErrorPage } from "./pages/BookingError.js";
-import { SetupWizard } from "./pages/SetupWizard.tsx";
+import { SetupWizard } from "./pages/SetupWizard.jsx";
 import { CustomerPortal } from "./portal/CustomerPortal.js";
 import { DevLoginSelector, getDevUser } from "./pages/DevLoginSelector.js";
 import { DevSessionIndicator } from "./components/DevSessionIndicator.js";
 import { BrandingProvider, useBranding } from "./BrandingContext.js";
 import { GlobalSearch } from "./components/GlobalSearch.js";
-import { useSession, signIn, signOut } from "./lib/auth-client.js";
+import { useSession, signIn } from "./lib/auth-client.js";

 function LoginPage() {
  const [isLoading, setIsLoading] = useState(false);
-  const [providers, setProviders] = useState<string[]>([]);
-  const [error, setError] = useState<string | null>(null);

-  useEffect(() => {
-    fetch("/api/auth/providers")
-      .then((r) => r.json())
-      .then((data) => setProviders(data.providers ?? []))
-      .catch(() => setProviders([]));
-    const params = new URLSearchParams(window.location.search);
-    const authError = params.get("error");
-    if (authError) setError(authError.replace(/_/g, " "));
-  }, []);
-
-  const handleSocialLogin = async (provider: string) => {
+  const handleLogin = async () => {
    setIsLoading(true);
-    setError(null);
-    const result = await signIn.social({ provider, callbackURL: window.location.origin });
-    if (result?.error) {
-      setError(result.error.message ?? "Sign-in failed");
-      setIsLoading(false);
-    }
+    await signIn.social({ provider: "authentik", callbackURL: window.location.origin });
  };

-  const isGoogle = providers.includes("google");
-  const isGitHub = providers.includes("github");
-  const isAuthentik = providers.includes("authentik");
-
  return (
    <div
      style={{
@@ -75,94 +53,23 @@ function LoginPage() {
        <p style={{ color: "#6b7280", marginBottom: "1.5rem", fontSize: 14 }}>
          Sign in to continue
        </p>
-        {error && (
-          <div style={{ background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 6, padding: "0.5rem 0.75rem", marginBottom: "1rem", color: "#991b1b", fontSize: 13 }}>
-            {error}
-          </div>
-        )}
-        {isGoogle && (
-          <button
-            onClick={() => handleSocialLogin("google")}
-            disabled={isLoading}
-            style={{
-              display: "flex",
-              alignItems: "center",
-              justifyContent: "center",
-              gap: 8,
-              width: "100%",
-              padding: "0.6rem 1.5rem",
-              borderRadius: 6,
-              border: "1px solid #e2e8f0",
-              background: "#fff",
-              color: "#1a202c",
-              fontWeight: 600,
-              fontSize: 14,
-              cursor: isLoading ? "wait" : "pointer",
-              opacity: isLoading ? 0.7 : 1,
-              marginBottom: "0.5rem",
-            }}
-          >
-            <svg width="18" height="18" viewBox="0 0 24 24">
-              <path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/>
-              <path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/>
-              <path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/>
-              <path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/>
-            </svg>
-            Sign in with Google
-          </button>
-        )}
-        {isGitHub && (
-          <button
-            onClick={() => handleSocialLogin("github")}
-            disabled={isLoading}
-            style={{
-              display: "flex",
-              alignItems: "center",
-              justifyContent: "center",
-              gap: 8,
-              width: "100%",
-              padding: "0.6rem 1.5rem",
-              borderRadius: 6,
-              border: "1px solid #e2e8f0",
-              background: "#24292f",
-              color: "#fff",
-              fontWeight: 600,
-              fontSize: 14,
-              cursor: isLoading ? "wait" : "pointer",
-              opacity: isLoading ? 0.7 : 1,
-              marginBottom: isAuthentik ? "0.5rem" : 0,
-            }}
-          >
-            <svg width="18" height="18" viewBox="0 0 24 24" fill="#fff">
-              <path d="M12 0c-6.626 0-12 5.373-12 12 0 5.302 3.438 9.8 8.207 11.387.599.111.793-.261.793-.577v-2.234c-3.338.726-4.033-1.416-4.033-1.416-.546-1.387-1.333-1.756-1.333-1.756-1.089-.745.083-.729.083-.729 1.205.084 1.839 1.237 1.839 1.237 1.07 1.834 2.807 1.304 3.492.997.107-.775.418-1.305.762-1.604-2.665-.305-5.467-1.334-5.467-5.931 0-1.311.469-2.381 1.236-3.221-.124-.303-.535-1.524.117-3.176 0 0 1.008-.322 3.301 1.23.957-.266 1.983-.399 3.003-.404 1.02.005 2.047.138 3.006.404 2.291-1.552 3.297-1.23 3.297-1.23.653 1.653.242 2.874.118 3.176.77.84 1.235 1.911 1.235 3.221 0 4.609-2.807 5.624-5.479 5.921.43.372.823 1.102.823 2.222v3.293c0 .319.192.694.801.576 4.765-1.589 8.199-6.086 8.199-11.386 0-6.627-5.373-12-12-12z"/>
-            </svg>
-            Sign in with GitHub
-          </button>
-        )}
-        {isAuthentik && (
-          <button
-            onClick={() => handleSocialLogin("authentik")}
-            disabled={isLoading}
-            style={{
-              display: "flex",
-              alignItems: "center",
-              justifyContent: "center",
-              gap: 8,
-              width: "100%",
-              padding: "0.6rem 1.5rem",
-              borderRadius: 6,
-              border: "none",
-              background: "#4f8a6f",
-              color: "#fff",
-              fontWeight: 600,
-              fontSize: 14,
-              cursor: isLoading ? "wait" : "pointer",
-              opacity: isLoading ? 0.7 : 1,
-            }}
-          >
-            {isLoading ? "Redirecting…" : "Sign in with SSO"}
-          </button>
-        )}
+        <button
+          onClick={handleLogin}
+          disabled={isLoading}
+          style={{
+            padding: "0.6rem 1.5rem",
+            borderRadius: 6,
+            border: "none",
+            background: "#4f8a6f",
+            color: "#fff",
+            fontWeight: 600,
+            fontSize: 14,
+            cursor: isLoading ? "wait" : "pointer",
+            opacity: isLoading ? 0.7 : 1,
+          }}
+        >
+          {isLoading ? "Redirecting…" : "Sign in with SSO"}
+        </button>
      </div>
    </div>
  );
@@ -182,7 +89,6 @@ const NAV_LINKS = [

 function AdminLayout() {
  const location = useLocation();
-  const navigate = useNavigate();
  const { branding } = useBranding();

  const logoSrc = branding.logoBase64 && branding.logoMimeType
@@ -211,7 +117,6 @@ function AdminLayout() {
          alignItems: "center",
          gap: 8,
          marginRight: "1.25rem",
-          flexShrink: 0,
        }}>
          {logoSrc && (
            <img src={logoSrc} alt="" style={{ width: 24, height: 24, objectFit: "contain" }} />
@@ -225,79 +130,50 @@ function AdminLayout() {
          </strong>
        </div>
        <GlobalSearch />
-        <div style={{
-          display: "flex",
-          overflowX: "auto",
-          flex: 1,
-          minWidth: 0,
-          gap: "0.25rem",
-        }}>
-          <Link
-            to="/admin/book"
-            style={{
-              padding: "0.4rem 0.85rem",
-              borderRadius: 6,
-              textDecoration: "none",
-              fontSize: 13,
-              fontWeight: 600,
-              color: "#fff",
-              background: branding.primaryColor,
-              boxShadow: "0 1px 2px rgba(79, 138, 111, 0.3)",
-              flexShrink: 0,
-            }}
-          >
-            Book
-          </Link>
-          {NAV_LINKS.map(({ to, label }) => {
-            const active =
-              to === "/admin"
-                ? location.pathname === "/admin"
-                : location.pathname.startsWith(to);
-            return (
-              <Link
-                key={to}
-                to={to}
-                style={{
-                  padding: "0.4rem 0.75rem",
-                  borderRadius: 6,
-                  textDecoration: "none",
-                  fontSize: 13,
-                  fontWeight: active ? 600 : 500,
-                  color: active ? "#2d6a4f" : "#4b5563",
-                  background: active ? "#ecfdf5" : "transparent",
-                  flexShrink: 0,
-                }}
-              >
-                {label}
-              </Link>
-            );
-          })}
-        </div>
-        <button
-          onClick={async () => {
-            await signOut();
-            navigate("/login");
-          }}
+        <Link
+          to="/admin/book"
          style={{
-            flexShrink: 0,
            padding: "0.4rem 0.85rem",
            borderRadius: 6,
-            border: "1px solid #e2e8f0",
-            background: "#fff",
-            color: "#4b5563",
+            textDecoration: "none",
            fontSize: 13,
-            fontWeight: 500,
-            cursor: "pointer",
+            fontWeight: 600,
+            color: "#fff",
+            background: branding.primaryColor,
+            marginRight: "0.5rem",
+            boxShadow: "0 1px 2px rgba(79, 138, 111, 0.3)",
          }}
        >
-          Logout
-        </button>
+          Book
+        </Link>
+        {NAV_LINKS.map(({ to, label }) => {
+          const active =
+            to === "/admin"
+              ? location.pathname === "/admin"
+              : location.pathname.startsWith(to);
+          return (
+            <Link
+              key={to}
+              to={to}
+              style={{
+                padding: "0.4rem 0.75rem",
+                borderRadius: 6,
+                textDecoration: "none",
+                fontSize: 13,
+                fontWeight: active ? 600 : 500,
+                color: active ? "#2d6a4f" : "#4b5563",
+                background: active ? "#ecfdf5" : "transparent",
+              }}
+            >
+              {label}
+            </Link>
+          );
+        })}
      </nav>
      <main style={{ padding: "1.25rem 1.5rem" }}>
        <Routes>
          <Route path="/" element={<AppointmentsPage />} />
          <Route path="/clients" element={<ClientsPage />} />
-          <Route path="/clients/:clientId" element={<ClientDetailPage />} />
          <Route path="/services" element={<ServicesPage />} />
          <Route path="/staff" element={<StaffPage />} />
          <Route path="/invoices" element={<InvoicesPage />} />
@@ -93,7 +93,7 @@ describe("CustomerNotesSection", () => {
        "/api/portal/appointments/appt-1/notes",
        expect.objectContaining({
          headers: expect.objectContaining({
-            "X-Impersonation-Session-Id": "test-session-id",
+            "Authorization": "Bearer test-session-id",
          }),
        })
      );
@@ -269,7 +269,7 @@ describe("ConfirmationSection", () => {
        "/api/portal/appointments/appt-1/confirm",
        expect.objectContaining({
          headers: expect.objectContaining({
-            "X-Impersonation-Session-Id": "test-session-id",
+            "Authorization": "Bearer test-session-id",
          }),
        })
      );
@@ -26,7 +26,6 @@ export function GlobalSearch() {
  const [query, setQuery] = useState("");
  const [results, setResults] = useState<SearchResults | null>(null);
  const [loading, setLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
  const [open, setOpen] = useState(false);
  const inputRef = useRef<HTMLInputElement>(null);
  const dropdownRef = useRef<HTMLDivElement>(null);
@@ -46,18 +45,15 @@ export function GlobalSearch() {

    debounceRef.current = setTimeout(async () => {
      setLoading(true);
-      setError(null);
      try {
        const res = await fetch(`/api/search?q=${encodeURIComponent(trimmed)}`);
        if (res.ok) {
          const data: SearchResults = await res.json();
          setResults(data);
          setOpen(true);
-        } else {
-          setError("Search failed. Please try again.");
        }
-      } catch {
-        setError("Search failed. Please try again.");
+      } catch (err) {
+        console.warn("GlobalSearch: fetch error", err);
      } finally {
        setLoading(false);
      }
@@ -164,13 +160,7 @@ export function GlobalSearch() {
            </div>
          )}

-          {!loading && error && (
-            <div style={{ padding: "12px 16px", fontSize: 13, color: "#dc2626" }}>
-              {error}
-            </div>
-          )}
-
-          {!loading && !error && !hasResults && (
+          {!loading && !hasResults && (
            <div style={{ padding: "12px 16px", fontSize: 13, color: "#6b7280" }}>
              No results found
            </div>
@@ -71,12 +71,6 @@ export function PetPhotoUpload({ petId, onUploaded }: Props) {
  }

  async function handleFile(file: File) {
-    const MAX_FILE_SIZE = 50 * 1024 * 1024;
-    if (file.size > MAX_FILE_SIZE) {
-      setState({ status: "error", message: "File exceeds 50MB limit. Please choose a smaller image." });
-      return;
-    }
-
    if (!ACCEPTED_TYPES.includes(file.type)) {
      setState({ status: "error", message: "Please select a JPEG, PNG, WebP, or GIF image." });
      return;
@@ -4,4 +4,4 @@ export const authClient = createAuthClient({
  baseURL: import.meta.env.VITE_API_URL ?? "",
 });

-export const { signIn, signOut, useSession, changePassword } = authClient;
+export const { signIn, signOut, useSession } = authClient;
@@ -1,4 +1,4 @@
-import { useEffect, useState, useCallback, useRef } from "react";
+import { useEffect, useState, useCallback } from "react";
 import type { Appointment, Client, Pet, Service, Staff } from "@groombook/types";

 // ─── Helpers ────────────────────────────────────────────────────────────────
@@ -112,17 +112,9 @@ export function AppointmentsPage() {
  const [viewMode, setViewMode] = useState<"status" | "groomer">("status");
  // null key = unassigned; staffId string = that groomer; undefined set = all visible
  const [hiddenGroomers, setHiddenGroomers] = useState<Set<string | null>>(new Set());
-  const [paymentStats, setPaymentStats] = useState<{ revenueThisMonth: number; outstanding: number; refundsThisMonth: number; methodBreakdown: { method: string | null; total: number }[] } | null>(null);

  const weekEnd = addDays(weekStart, 6);

-  useEffect(() => {
-    fetch("/api/invoices/stats/summary")
-      .then((r) => r.ok ? r.json() : null)
-      .then((data) => { if (data) setPaymentStats(data); })
-      .catch(() => {});
-  }, []);
-
  const loadAppointments = useCallback(() => {
    const from = weekStart.toISOString();
    const to = addDays(weekStart, 7).toISOString();
@@ -281,15 +273,7 @@ export function AppointmentsPage() {
      cascade !== "this_only"
        ? `/api/appointments/${id}?cascade=${cascade}`
        : `/api/appointments/${id}`;
-    try {
-      const res = await fetch(url, { method: "DELETE" });
-      if (!res.ok) {
-        const err = (await res.json()) as { error?: string };
-        throw new Error(err.error ?? `HTTP ${res.status}`);
-      }
-    } catch (e: unknown) {
-      alert(e instanceof Error ? e.message : "Failed to delete appointment");
-    }
+    await fetch(url, { method: "DELETE" });
    setSelectedAppt(null);
    await loadAppointments();
  }
@@ -322,24 +306,6 @@ export function AppointmentsPage() {
        </button>
      </div>

-      {/* Payment Stats Summary */}
-      {paymentStats && (
-        <div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fit, minmax(160px, 1fr))", gap: "0.75rem", marginBottom: "1.25rem" }}>
-          <div style={{ background: "#f0fdf4", border: "1px solid #bbf7d0", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#166534", fontWeight: 600, marginBottom: "0.25rem" }}>Revenue (paid)</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#15803d" }}>${(paymentStats.revenueThisMonth / 100).toFixed(2)}</div>
-          </div>
-          <div style={{ background: "#fefce8", border: "1px solid #fde047", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#854d0e", fontWeight: 600, marginBottom: "0.25rem" }}>Outstanding</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#a16207" }}>${(paymentStats.outstanding / 100).toFixed(2)}</div>
-          </div>
-          <div style={{ background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#991b1b", fontWeight: 600, marginBottom: "0.25rem" }}>Refunds (this mo.)</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#dc2626" }}>${(paymentStats.refundsThisMonth / 100).toFixed(2)}</div>
-          </div>
-        </div>
-      )}
-
      {/* ── View Mode + Groomer Filters ── */}
      <div style={{ display: "flex", alignItems: "center", gap: "0.5rem", marginBottom: "0.75rem", flexWrap: "wrap" }}>
        <span style={{ fontSize: 13, fontWeight: 600, color: "#374151" }}>Color by:</span>
@@ -853,49 +819,8 @@ function AppointmentDetail({
 }

 function Modal({ children, onClose }: { children: React.ReactNode; onClose: () => void }) {
-  const modalRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
-    const previouslyFocused = document.activeElement as HTMLElement;
-    const focusableSelectors = 'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
-    const focusableElements = modalRef.current?.querySelectorAll<HTMLElement>(focusableSelectors);
-    const firstFocusable = focusableElements?.[0];
-    firstFocusable?.focus();
-
-    function handleKeyDown(e: KeyboardEvent) {
-      if (e.key === "Escape") {
-        onClose();
-        return;
-      }
-      if (e.key !== "Tab") return;
-      if (!modalRef.current) return;
-      const focusables = modalRef.current.querySelectorAll<HTMLElement>(focusableSelectors);
-      const first = focusables[0];
-      const last = focusables[focusables.length - 1];
-      if (e.shiftKey) {
-        if (document.activeElement === first) {
-          e.preventDefault();
-          last?.focus();
-        }
-      } else {
-        if (document.activeElement === last) {
-          e.preventDefault();
-          first?.focus();
-        }
-      }
-    }
-
-    document.addEventListener("keydown", handleKeyDown);
-    return () => {
-      document.removeEventListener("keydown", handleKeyDown);
-      previouslyFocused?.focus();
-    };
-  }, [onClose]);
-
  return (
    <div
-      role="dialog"
-      aria-modal="true"
      style={{
        position: "fixed",
        inset: 0,
@@ -908,7 +833,6 @@ function Modal({ children, onClose }: { children: React.ReactNode; onClose: () =
      onClick={(e) => { if (e.target === e.currentTarget) onClose(); }}
    >
      <div
-        ref={modalRef}
        style={{
          background: "#fff",
          borderRadius: 8,
@@ -1,236 +0,0 @@
-import { useEffect, useState, useCallback } from "react";
-import { useParams, Link } from "react-router-dom";
-import type { Client, GroomingVisitLog, Pet } from "@groombook/types";
-import { PetPhotoDisplay } from "../components/PetPhotoDisplay.js";
-import { PetPhotoUpload } from "../components/PetPhotoUpload.js";
-
-export function ClientDetailPage() {
-  const { clientId } = useParams<{ clientId: string }>();
-  const [client, setClient] = useState<Client | null>(null);
-  const [pets, setPets] = useState<Pet[]>([]);
-  const [visitLogs, setVisitLogs] = useState<Record<string, GroomingVisitLog[]>>({});
-  const [logsLoading, setLogsLoading] = useState<Record<string, boolean>>({});
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
-  const [photoRevisions, setPhotoRevisions] = useState<Record<string, number>>({});
-
-  const handlePhotoUploaded = useCallback((petId: string) => {
-    setPhotoRevisions((prev) => ({ ...prev, [petId]: (prev[petId] ?? 0) + 1 }));
-  }, []);
-
-  useEffect(() => {
-    if (!clientId) {
-      setError("No client ID provided");
-      setLoading(false);
-      return;
-    }
-
-    async function load() {
-      const id = clientId!;
-      setLoading(true);
-      setError(null);
-      try {
-        const [clientRes, petsRes] = await Promise.all([
-          fetch(`/api/clients/${encodeURIComponent(id)}`),
-          fetch(`/api/pets?clientId=${encodeURIComponent(id)}`),
-        ]);
-
-        if (!clientRes.ok) {
-          const err = await clientRes.json().catch(() => ({})) as { error?: string };
-          throw new Error(err.error ?? `Client fetch failed: ${clientRes.status}`);
-        }
-        if (!petsRes.ok) {
-          throw new Error(`Pets fetch failed: ${petsRes.status}`);
-        }
-
-        setClient(await clientRes.json() as Client);
-        setPets(await petsRes.json() as Pet[]);
-      } catch (e) {
-        setError(e instanceof Error ? e.message : "Failed to load client");
-      } finally {
-        setLoading(false);
-      }
-    }
-
-    void load();
-  }, [clientId]);
-
-  async function loadVisitLogs(petId: string) {
-    setLogsLoading((prev) => ({ ...prev, [petId]: true }));
-    const r = await fetch(`/api/grooming-logs?petId=${encodeURIComponent(petId)}`);
-    if (r.ok) {
-      const logs = await r.json() as GroomingVisitLog[];
-      setVisitLogs((prev) => ({ ...prev, [petId]: logs }));
-    }
-    setLogsLoading((prev) => ({ ...prev, [petId]: false }));
-  }
-
-  if (loading) {
-    return (
-      <div style={{ padding: "2rem", textAlign: "center", color: "#6b7280", fontFamily: "system-ui, sans-serif" }}>
-        Loading client…
-      </div>
-    );
-  }
-
-  if (error || !client) {
-    return (
-      <div style={{ padding: "2rem", fontFamily: "system-ui, sans-serif" }}>
-        <div style={{ marginBottom: "1rem" }}>
-          <Link to="/admin/clients" style={{ color: "#4f8a6f", fontSize: 13 }}>← Back to clients</Link>
-        </div>
-        <div style={{ background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 8, padding: "1rem", color: "#991b1b" }}>
-          {error ?? "Client not found"}
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div style={{ fontFamily: "system-ui, sans-serif" }}>
-      {/* Header */}
-      <div style={{ display: "flex", alignItems: "flex-start", marginBottom: "1.5rem", gap: "1rem" }}>
-        <div style={{ flex: 1 }}>
-          <div style={{ display: "flex", alignItems: "center", gap: "0.75rem", marginBottom: "0.25rem" }}>
-            <h1 style={{ margin: 0, fontSize: 22 }}>{client.name}</h1>
-            {client.status === "disabled" && (
-              <span style={{ fontSize: 12, background: "#fef2f2", color: "#dc2626", padding: "0.15rem 0.5rem", borderRadius: 4, fontWeight: 500 }}>
-                Disabled
-              </span>
-            )}
-          </div>
-          {client.email && <div style={{ fontSize: 14, color: "#6b7280" }}>{client.email}</div>}
-          {client.phone && <div style={{ fontSize: 14, color: "#6b7280" }}>{client.phone}</div>}
-          {client.address && <div style={{ fontSize: 13, color: "#6b7280" }}>{client.address}</div>}
-          {client.notes && (
-            <div style={{ fontSize: 13, marginTop: "0.4rem", background: "#fef9c3", padding: "0.4rem 0.6rem", borderRadius: 4, maxWidth: 500 }}>
-              {client.notes}
-            </div>
-          )}
-        </div>
-        <Link
-          to="/admin/clients"
-          style={{
-            padding: "0.4rem 0.85rem",
-            border: "1px solid #d1d5db",
-            borderRadius: 6,
-            background: "#fff",
-            color: "#374151",
-            fontSize: 13,
-            fontWeight: 500,
-            textDecoration: "none",
-            flexShrink: 0,
-          }}
-        >
-          ← Back to list
-        </Link>
-      </div>
-
-      {/* Pets */}
-      <div style={{ display: "flex", alignItems: "center", gap: "0.75rem", marginBottom: "0.75rem" }}>
-        <h2 style={{ margin: 0, fontSize: 18 }}>Pets</h2>
-      </div>
-
-      {pets.length === 0 ? (
-        <p style={{ color: "#6b7280", fontSize: 14 }}>No pets on file for this client.</p>
-      ) : (
-        <div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fill, minmax(260px, 1fr))", gap: "0.75rem" }}>
-          {pets.map((p) => (
-            <div key={p.id} style={{ border: "1px solid #e5e7eb", borderRadius: 10, padding: "0.85rem", background: "#fff", boxShadow: "0 1px 3px rgba(0, 0, 0, 0.04)" }}>
-              {/* Photo + header */}
-              <div style={{ display: "flex", gap: "0.75rem", marginBottom: "0.4rem" }}>
-                <PetPhotoDisplay
-                  petId={p.id}
-                  size={56}
-                  key={`${p.id}-photo-${photoRevisions[p.id] ?? 0}`}
-                />
-                <div style={{ flex: 1, minWidth: 0 }}>
-                  <div style={{ display: "flex", justifyContent: "space-between", alignItems: "flex-start" }}>
-                    <strong style={{ fontSize: 15 }}>{p.name}</strong>
-                  </div>
-                  <div style={{ fontSize: 13, color: "#6b7280", marginTop: "0.15rem" }}>
-                    {p.species}{p.breed ? ` · ${p.breed}` : ""}
-                  </div>
-                  {p.weightKg != null && <div style={{ fontSize: 12, color: "#6b7280" }}>{p.weightKg} kg</div>}
-                  {p.dateOfBirth && <div style={{ fontSize: 12, color: "#6b7280" }}>Born {new Date(p.dateOfBirth).toLocaleDateString()}</div>}
-                  <div style={{ marginTop: "0.3rem" }}>
-                    <PetPhotoUpload petId={p.id} onUploaded={() => handlePhotoUploaded(p.id)} />
-                  </div>
-                </div>
-              </div>
-
-              {p.healthAlerts && (
-                <div style={{ fontSize: 12, marginTop: "0.35rem", background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 4, padding: "0.3rem 0.5rem", color: "#dc2626" }}>
-                  <span style={{ fontWeight: 600 }}>⚠ Health alerts:</span> {p.healthAlerts}
-                </div>
-              )}
-
-              {/* Grooming preferences */}
-              {(p.cutStyle || p.shampooPreference || p.specialCareNotes || p.groomingNotes) && (
-                <div style={{ marginTop: "0.5rem", borderTop: "1px solid #f3f4f6", paddingTop: "0.4rem" }}>
-                  {p.cutStyle && (
-                    <div style={{ fontSize: 12, color: "#374151" }}>
-                      <span style={{ fontWeight: 600 }}>Cut:</span> {p.cutStyle}
-                    </div>
-                  )}
-                  {p.shampooPreference && (
-                    <div style={{ fontSize: 12, color: "#374151" }}>
-                      <span style={{ fontWeight: 600 }}>Shampoo:</span> {p.shampooPreference}
-                    </div>
-                  )}
-                  {p.specialCareNotes && (
-                    <div style={{ fontSize: 12, marginTop: "0.2rem", background: "#fffbeb", border: "1px solid #fde68a", borderRadius: 4, padding: "0.3rem 0.5rem", color: "#92400e" }}>
-                      <span style={{ fontWeight: 600 }}>Special care:</span> {p.specialCareNotes}
-                    </div>
-                  )}
-                  {p.groomingNotes && (
-                    <div style={{ fontSize: 12, marginTop: "0.2rem", color: "#374151" }}>
-                      <span style={{ fontWeight: 600 }}>Notes:</span> {p.groomingNotes}
-                    </div>
-                  )}
-                </div>
-              )}
-
-              {/* Visit history */}
-              {(() => {
-                const logs = visitLogs[p.id];
-                const loadingLogs = logsLoading[p.id];
-                return (
-                  <div style={{ marginTop: "0.5rem", borderTop: "1px solid #f3f4f6", paddingTop: "0.4rem" }}>
-                    <div style={{ display: "flex", alignItems: "center", justifyContent: "space-between", marginBottom: "0.25rem" }}>
-                      <div style={{ fontSize: 11, fontWeight: 600, color: "#6b7280" }}>VISIT HISTORY</div>
-                      {!logs && !loadingLogs && (
-                        <button
-                          onClick={() => { void loadVisitLogs(p.id); }}
-                          style={{ fontSize: 11, color: "#4f8a6f", background: "none", border: "none", cursor: "pointer", padding: 0 }}
-                        >
-                          Load history
-                        </button>
-                      )}
-                    </div>
-                    {loadingLogs && <div style={{ fontSize: 11, color: "#9ca3af" }}>Loading…</div>}
-                    {logs && logs.length === 0 && <div style={{ fontSize: 11, color: "#9ca3af" }}>No visits yet</div>}
-                    {logs && logs.length > 0 && (
-                      <>
-                        {logs.slice(0, 3).map((log) => (
-                          <div key={log.id} style={{ fontSize: 11, color: "#374151", marginBottom: "0.2rem", borderLeft: "2px solid #e2e8f0", paddingLeft: "0.4rem" }}>
-                            <span style={{ color: "#6b7280" }}>{new Date(log.groomedAt).toLocaleDateString()}</span>
-                            {log.cutStyle && <span> · {log.cutStyle}</span>}
-                            {log.notes && <span> · {log.notes}</span>}
-                          </div>
-                        ))}
-                        {logs.length > 3 && (
-                          <div style={{ fontSize: 11, color: "#6b7280" }}>+{logs.length - 3} more visits</div>
-                        )}
-                      </>
-                    )}
-                  </div>
-                );
-              })()}
-            </div>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
@@ -1,4 +1,4 @@
-import { useEffect, useState, useCallback, useRef, useId } from "react";
+import { useEffect, useState, useCallback, useRef } from "react";
 import { useSearchParams } from "react-router-dom";
 import type { Client, GroomingVisitLog, Pet } from "@groombook/types";
 import { PetPhotoDisplay } from "../components/PetPhotoDisplay.js";
@@ -647,7 +647,8 @@ export function ClientsPage() {

      {/* ── Client modal ── */}
      {showClientForm && (
-        <Modal title={editingClient ? "Edit Client" : "New Client"} onClose={() => setShowClientForm(false)}>
+        <Modal onClose={() => setShowClientForm(false)}>
+          <h2 style={{ marginTop: 0 }}>{editingClient ? "Edit Client" : "New Client"}</h2>
          <form onSubmit={submitClient}>
            <Field label="Full name">
              <input value={clientForm.name} onChange={(e) => setClientForm((f) => ({ ...f, name: e.target.value }))} required style={inputStyle} />
@@ -677,7 +678,8 @@ export function ClientsPage() {

      {/* ── Pet modal ── */}
      {showPetForm && (
-        <Modal title={editingPet ? "Edit Pet" : "Add Pet"} onClose={() => setShowPetForm(false)}>
+        <Modal onClose={() => setShowPetForm(false)}>
+          <h2 style={{ marginTop: 0 }}>{editingPet ? "Edit Pet" : "Add Pet"}</h2>
          <form onSubmit={submitPet}>
            <Field label="Pet name">
              <input value={petForm.name} onChange={(e) => setPetForm((f) => ({ ...f, name: e.target.value }))} required style={inputStyle} />
@@ -751,7 +753,8 @@ export function ClientsPage() {

      {/* ── Visit log modal ── */}
      {showLogForm && logPetId && (
-        <Modal title="Log Grooming Visit" onClose={() => setShowLogForm(false)}>
+        <Modal onClose={() => setShowLogForm(false)}>
+          <h2 style={{ marginTop: 0 }}>Log Grooming Visit</h2>
          {logsLoading[logPetId] && <p style={{ fontSize: 13, color: "#6b7280" }}>Loading history…</p>}
          {visitLogs[logPetId] && visitLogs[logPetId].length > 0 && (
            <div style={{ marginBottom: "1rem" }}>
@@ -814,7 +817,8 @@ export function ClientsPage() {

      {/* ── Delete confirmation modal ── */}
      {showDeleteConfirm && selectedClient && (
-        <Modal title="Permanently Delete Client" titleStyle={{ color: "#dc2626" }} onClose={() => setShowDeleteConfirm(false)}>
+        <Modal onClose={() => setShowDeleteConfirm(false)}>
+          <h2 style={{ marginTop: 0, color: "#dc2626" }}>Permanently Delete Client</h2>
          <p style={{ fontSize: 14, color: "#374151" }}>
            This will permanently delete <strong>{selectedClient.name}</strong> and all their pets. This action cannot be undone.
          </p>
@@ -852,60 +856,13 @@ export function ClientsPage() {

 // ─── Shared UI ───────────────────────────────────────────────────────────────

-function Modal({ children, onClose, title, titleStyle }: { children: React.ReactNode; onClose: () => void; title: string; titleStyle?: React.CSSProperties }) {
-  const titleId = useId();
-  const modalRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
-    const previouslyFocused = document.activeElement as HTMLElement;
-    const focusableSelectors = 'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
-    const focusableElements = modalRef.current?.querySelectorAll<HTMLElement>(focusableSelectors);
-    const firstFocusable = focusableElements?.[0];
-    firstFocusable?.focus();
-
-    function handleKeyDown(e: KeyboardEvent) {
-      if (e.key === "Escape") {
-        onClose();
-        return;
-      }
-      if (e.key !== "Tab") return;
-      if (!modalRef.current) return;
-      const focusables = modalRef.current.querySelectorAll<HTMLElement>(focusableSelectors);
-      const first = focusables[0];
-      const last = focusables[focusables.length - 1];
-      if (e.shiftKey) {
-        if (document.activeElement === first) {
-          e.preventDefault();
-          last?.focus();
-        }
-      } else {
-        if (document.activeElement === last) {
-          e.preventDefault();
-          first?.focus();
-        }
-      }
-    }
-
-    document.addEventListener("keydown", handleKeyDown);
-    return () => {
-      document.removeEventListener("keydown", handleKeyDown);
-      previouslyFocused?.focus();
-    };
-  }, [onClose]);
-
+function Modal({ children, onClose }: { children: React.ReactNode; onClose: () => void }) {
  return (
    <div
      style={{ position: "fixed", inset: 0, background: "rgba(0,0,0,0.45)", display: "flex", alignItems: "center", justifyContent: "center", zIndex: 100 }}
      onClick={(e) => { if (e.target === e.currentTarget) onClose(); }}
    >
-      <div
-        ref={modalRef}
-        role="dialog"
-        aria-modal="true"
-        aria-labelledby={titleId}
-        style={{ background: "#fff", borderRadius: 8, padding: "1.5rem", maxWidth: 480, width: "calc(100% - 2rem)", maxHeight: "90vh", overflowY: "auto", boxShadow: "0 20px 60px rgba(0,0,0,0.3)" }}
-      >
-        <h2 id={titleId} style={{ marginTop: 0, ...titleStyle }}>{title}</h2>
+      <div style={{ background: "#fff", borderRadius: 8, padding: "1.5rem", maxWidth: 480, width: "calc(100% - 2rem)", maxHeight: "90vh", overflowY: "auto", boxShadow: "0 20px 60px rgba(0,0,0,0.3)" }}>
        {children}
      </div>
    </div>
@@ -1,4 +1,4 @@
-import { useEffect, useState, useRef } from "react";
+import { useEffect, useState } from "react";
 import type { Invoice, Client, Appointment, Service, Staff, InvoiceTipSplit } from "@groombook/types";

 // ─── Types ────────────────────────────────────────────────────────────────────
@@ -173,21 +173,6 @@ function InvoiceDetailModal({
  const [error, setError] = useState<string | null>(null);
  const [tipStr, setTipStr] = useState((invoice.tipCents / 100).toFixed(2));
  const [paymentMethod, setPaymentMethod] = useState<string>(invoice.paymentMethod ?? "cash");
-const [showRefundDialog, setShowRefundDialog] = useState(false);
-  const [refundType, setRefundType] = useState<"full" | "partial">("full");
-  const [refundAmount, setRefundAmount] = useState("");
-  const [refundError, setRefundError] = useState<string | null>(null);
-  const [refunding, setRefunding] = useState(false);
-
-  // Fetch current staff role to determine manager access
-  const [staffMe, setStaffMe] = useState<{ role: string; isSuperUser: boolean } | null>(null);
-  useEffect(() => {
-    fetch("/api/staff/me")
-      .then((r) => r.json())
-      .then((d) => setStaffMe(d))
-      .catch(() => setStaffMe(null));
-  }, []);
-  const isManager = staffMe && (staffMe.role === "manager" || staffMe.isSuperUser);

  // Tip split state: array of {staffId, staffName, pct}
  const linkedAppt = invoice.appointmentId
@@ -226,41 +211,36 @@ const [showRefundDialog, setShowRefundDialog] = useState(false);
    setSaving(true);
    setError(null);
    const tipCents = Math.round(parseFloat(tipStr) * 100) || 0;
-    // Real-time validation: prevent submit if tip splits don't sum to 100%
-    if (showSplits && tipCents > 0 && tipSplits.length > 0) {
-      const totalPct = tipSplits.reduce((s, r) => s + r.pct, 0);
-      if (Math.abs(totalPct - 100) >= 0.01) {
-        setError("Tip split percentages must sum to 100%");
-        setSaving(false);
-        return;
-      }
-    }
    try {
-      const patchBody: {
-        status: string;
-        paymentMethod: string;
-        tipCents: number;
-        tipSplits?: Array<{ staffId: string | null; staffName: string; sharePct: number }>;
-      } = { status: "paid", paymentMethod, tipCents };
-
-      if (showSplits && tipCents > 0 && tipSplits.length > 0) {
-        patchBody.tipSplits = tipSplits.map((r) => ({
-          staffId: r.staffId,
-          staffName: r.staffName,
-          sharePct: r.pct,
-        }));
-      }
-
      const res = await fetch(`/api/invoices/${invoice.id}`, {
        method: "PATCH",
        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(patchBody),
+        body: JSON.stringify({ status: "paid", paymentMethod, tipCents }),
      });
      if (!res.ok) {
        const err = (await res.json()) as { error?: string };
        throw new Error(err.error ?? `HTTP ${res.status}`);
      }

+      // Save tip splits if applicable and tip > 0
+      if (showSplits && tipCents > 0 && tipSplits.length > 0) {
+        const totalPct = tipSplits.reduce((s, r) => s + r.pct, 0);
+        if (Math.abs(totalPct - 100) < 0.01) {
+          const splitsRes = await fetch(`/api/invoices/${invoice.id}/tip-splits`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              splits: tipSplits.map((r) => ({
+                staffId: r.staffId,
+                staffName: r.staffName,
+                sharePct: r.pct,
+              })),
+            }),
+          });
+          if (!splitsRes.ok) console.warn("Tip split save failed (non-blocking)");
+        }
+      }
+
      onUpdated();
    } catch (e: unknown) {
      setError(e instanceof Error ? e.message : "Failed to update");
@@ -350,19 +330,6 @@ const [showRefundDialog, setShowRefundDialog] = useState(false);
        />
        {invoice.paidAt && <SummaryRow label="Paid on" value={fmtDate(invoice.paidAt)} />}
        {invoice.paymentMethod && <SummaryRow label="Payment" value={invoice.paymentMethod} />}
-        {invoice.stripePaymentIntentId && (
-          <>
-            {invoice.cardLast4 && (
-              <SummaryRow label="Card" value={`•••• ${invoice.cardLast4}`} />
-            )}
-            {invoice.paymentStatus && (
-              <SummaryRow label="Stripe status" value={invoice.paymentStatus} />
-            )}
-            {invoice.stripeRefundId && (
-              <SummaryRow label="Refund" value="Refunded" />
-            )}
-          </>
-        )}
      </div>

      {/* ── Tip Distribution ── */}
@@ -480,92 +447,11 @@ const [showRefundDialog, setShowRefundDialog] = useState(false);
        </div>
      )}
      {(invoice.status === "paid" || invoice.status === "void") && (
-        <div style={{ marginTop: "1rem", borderTop: "1px solid #e2e8f0", paddingTop: "1rem" }}>
-          {invoice.stripeRefundId && (
-            <div style={{ marginBottom: "0.75rem", display: "flex", alignItems: "center", gap: "0.5rem" }}>
-              <span style={{ background: "#fef3c7", color: "#92400e", padding: "0.2rem 0.6rem", borderRadius: 4, fontSize: 13, fontWeight: 600 }}>Refunded</span>
-            </div>
-          )}
-          <div style={{ display: "flex", gap: "0.5rem", justifyContent: "flex-end" }}>
-            {invoice.status === "paid" && !invoice.stripeRefundId && isManager && (
-              <button onClick={() => setShowRefundDialog(true)} style={{ ...btnStyle, color: "#fff", backgroundColor: "#7c3aed", borderColor: "#7c3aed" }}>
-                Refund
-              </button>
-            )}
-            <button onClick={onClose} style={btnStyle}>Close</button>
-          </div>
+        <div style={{ marginTop: "1rem", display: "flex", justifyContent: "flex-end" }}>
+          <button onClick={onClose} style={btnStyle}>Close</button>
        </div>
      )}
-
-      {showRefundDialog && (
-        <div style={{ marginTop: "1rem", border: "1px solid #e2e8f0", borderRadius: 8, padding: "1rem", background: "#f9fafb" }}>
-          <p style={{ fontWeight: 600, margin: "0 0 0.75rem" }}>Process Refund</p>
-          <div style={{ display: "flex", gap: "0.75rem", marginBottom: "0.75rem" }}>
-            <label style={{ display: "flex", alignItems: "center", gap: "0.25rem", cursor: "pointer" }}>
-              <input type="radio" checked={refundType === "full"} onChange={() => setRefundType("full")} />
-              Full refund
-            </label>
-            <label style={{ display: "flex", alignItems: "center", gap: "0.25rem", cursor: "pointer" }}>
-              <input type="radio" checked={refundType === "partial"} onChange={() => setRefundType("partial")} />
-              Partial refund
-            </label>
-          </div>
-          {refundType === "partial" && (
-            <div style={{ marginBottom: "0.75rem" }}>
-              <input
-                type="number"
-                min="0.01"
-                step="0.01"
-                placeholder="Amount ($)"
-                value={refundAmount}
-                onChange={(e) => setRefundAmount(e.target.value)}
-                style={{ ...inputStyle, width: 100 }}
-              />
-            </div>
-          )}
-          {refundError && <p style={{ color: "red", margin: "0 0 0.5rem", fontSize: 13 }}>{refundError}</p>}
-          <div style={{ display: "flex", gap: "0.5rem" }}>
-            <button
-              onClick={async () => {
-                setRefunding(true);
-                setRefundError(null);
-                try {
-                  if (refundType === "partial") {
-                    const parsed = parseFloat(refundAmount);
-                    if (isNaN(parsed) || parsed <= 0) {
-                      setRefundError("Please enter a valid amount greater than zero.");
-                      setRefunding(false);
-                      return;
-                    }
-                  }
-                  const body = refundType === "partial" ? { amountCents: Math.round(parseFloat(refundAmount) * 100) } : {};
-                  const res = await fetch(`/api/invoices/${invoice.id}/refund`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify(body),
-                  });
-                  if (!res.ok) {
-                    const err = (await res.json()) as { error?: string };
-                    throw new Error(err.error ?? `HTTP ${res.status}`);
-                  }
-                  setShowRefundDialog(false);
-                  onUpdated();
-                } catch (e: unknown) {
-                  setRefundError(e instanceof Error ? e.message : "Refund failed");
-                } finally {
-                  setRefunding(false);
-                }
-              }}
-              disabled={refunding}
-              style={{ ...btnStyle, color: "#fff", backgroundColor: "#7c3aed", borderColor: "#7c3aed" }}
-            >
-              {refunding ? "Processing…" : "Process Refund"}
-            </button>
-            <button onClick={() => { setShowRefundDialog(false); setRefundError(null); }} style={btnStyle}>Cancel</button>
-          </div>
-        </div>
-      )}
-      </Modal>
+    </Modal>
  );
 }

@@ -606,17 +492,9 @@ export function InvoicesPage() {
  const [createLoading, setCreateLoading] = useState(false);
  const [detailData, setDetailData] = useState<{ staff: Staff[]; appointments: Appointment[] } | null>(null);
  const [detailLoading, setDetailLoading] = useState(false);
-  const [paymentStats, setPaymentStats] = useState<{ revenueThisMonth: number; outstanding: number; refundsThisMonth: number; methodBreakdown: { method: string | null; total: number }[] } | null>(null);

  const LIMIT = 50;

-  useEffect(() => {
-    fetch("/api/invoices/stats/summary")
-      .then((r) => r.ok ? r.json() : null)
-      .then((data) => { if (data) setPaymentStats(data); })
-      .catch(() => {});
-  }, []);
-
  async function loadInvoices(newOffset: number) {
    const params = new URLSearchParams({ limit: String(LIMIT), offset: String(newOffset) });
    if (statusFilter) params.set("status", statusFilter);
@@ -695,34 +573,6 @@ export function InvoicesPage() {
        </button>
      </div>

-      {/* Payment Stats Summary */}
-      {paymentStats && (
-        <div style={{ display: "grid", gridTemplateColumns: "repeat(auto-fit, minmax(160px, 1fr))", gap: "0.75rem", marginBottom: "1.25rem" }}>
-          <div style={{ background: "#f0fdf4", border: "1px solid #bbf7d0", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#166534", fontWeight: 600, marginBottom: "0.25rem" }}>Revenue (paid)</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#15803d" }}>{fmtMoney(paymentStats.revenueThisMonth)}</div>
-          </div>
-          <div style={{ background: "#fefce8", border: "1px solid #fde047", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#854d0e", fontWeight: 600, marginBottom: "0.25rem" }}>Outstanding</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#a16207" }}>{fmtMoney(paymentStats.outstanding)}</div>
-          </div>
-          <div style={{ background: "#fef2f2", border: "1px solid #fecaca", borderRadius: 8, padding: "0.75rem 1rem" }}>
-            <div style={{ fontSize: 12, color: "#991b1b", fontWeight: 600, marginBottom: "0.25rem" }}>Refunds (this mo.)</div>
-            <div style={{ fontSize: 20, fontWeight: 700, color: "#dc2626" }}>{fmtMoney(paymentStats.refundsThisMonth)}</div>
-          </div>
-          {paymentStats.methodBreakdown.length > 0 && (
-            <div style={{ background: "#f8fafc", border: "1px solid #e2e8f0", borderRadius: 8, padding: "0.75rem 1rem" }}>
-              <div style={{ fontSize: 12, color: "#475569", fontWeight: 600, marginBottom: "0.25rem" }}>By method</div>
-              <div style={{ fontSize: 13, color: "#64748b" }}>
-                {paymentStats.methodBreakdown.map((b) => (
-                  <div key={b.method ?? "unknown"}>{b.method ?? "other"}: {b.total}</div>
-                ))}
-              </div>
-            </div>
-          )}
-        </div>
-      )}
-
      {invoiceList.length === 0 ? (
        <p style={{ color: "#6b7280" }}>
          No invoices yet. Create one from a completed appointment.
@@ -827,63 +677,19 @@ export function InvoicesPage() {
 // ─── Shared UI helpers ────────────────────────────────────────────────────────

 function Modal({ children, onClose }: { children: React.ReactNode; onClose: () => void }) {
-  const modalRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
-    const previouslyFocused = document.activeElement as HTMLElement;
-    const focusableSelectors = 'button, [href], input, select, textarea, [tabindex]:not([tabindex="-1"])';
-    const focusableElements = modalRef.current?.querySelectorAll<HTMLElement>(focusableSelectors);
-    const firstFocusable = focusableElements?.[0];
-    firstFocusable?.focus();
-
-    function handleKeyDown(e: KeyboardEvent) {
-      if (e.key === "Escape") {
-        onClose();
-        return;
-      }
-      if (e.key !== "Tab") return;
-      if (!modalRef.current) return;
-      const focusables = modalRef.current.querySelectorAll<HTMLElement>(focusableSelectors);
-      const first = focusables[0];
-      const last = focusables[focusables.length - 1];
-      if (e.shiftKey) {
-        if (document.activeElement === first) {
-          e.preventDefault();
-          last?.focus();
-        }
-      } else {
-        if (document.activeElement === last) {
-          e.preventDefault();
-          first?.focus();
-        }
-      }
-    }
-
-    document.addEventListener("keydown", handleKeyDown);
-    return () => {
-      document.removeEventListener("keydown", handleKeyDown);
-      previouslyFocused?.focus();
-    };
-  }, [onClose]);
-
  return (
    <div
-      role="dialog"
-      aria-modal="true"
      style={{
        position: "fixed", inset: 0, background: "rgba(0,0,0,0.45)",
        display: "flex", alignItems: "center", justifyContent: "center", zIndex: 100,
      }}
      onClick={(e) => { if (e.target === e.currentTarget) onClose(); }}
    >
-      <div
-        ref={modalRef}
-        style={{
-          background: "#fff", borderRadius: 8, padding: "1.5rem",
-          maxWidth: 520, width: "calc(100% - 2rem)", maxHeight: "90vh", overflowY: "auto",
-          boxShadow: "0 20px 60px rgba(0,0,0,0.3)",
-        }}
-      >
+      <div style={{
+        background: "#fff", borderRadius: 8, padding: "1.5rem",
+        maxWidth: 520, width: "calc(100% - 2rem)", maxHeight: "90vh", overflowY: "auto",
+        boxShadow: "0 20px 60px rgba(0,0,0,0.3)",
+      }}>
        {children}
      </div>
    </div>
@@ -199,11 +199,11 @@ export function ReportsPage() {
      }

      const [summData, revData, apptData, svcData, clientData] = await Promise.all([
-        summRes.ok ? summRes.json() as Promise<Summary> : summRes.text().then(() => { throw new Error("summary response not ok"); }),
-        revRes.ok ? revRes.json() as Promise<{ byPeriod: RevenuePeriod[]; byGroomer: RevenueByGroomer[] }> : revRes.text().then(() => { throw new Error("revenue response not ok"); }),
-        apptRes.ok ? apptRes.json() as Promise<{ byPeriod: ApptPeriod[] }> : apptRes.text().then(() => { throw new Error("appointments response not ok"); }),
-        svcRes.ok ? svcRes.json() as Promise<{ rows: ServiceRow[] }> : svcRes.text().then(() => { throw new Error("services response not ok"); }),
-        clientRes.ok ? clientRes.json() as Promise<ClientReport> : clientRes.text().then(() => { throw new Error("clients response not ok"); }),
+        summRes.json() as Promise<Summary>,
+        revRes.json() as Promise<{ byPeriod: RevenuePeriod[]; byGroomer: RevenueByGroomer[] }>,
+        apptRes.json() as Promise<{ byPeriod: ApptPeriod[] }>,
+        svcRes.json() as Promise<{ rows: ServiceRow[] }>,
+        clientRes.json() as Promise<ClientReport>,
      ]);

      setSummary(summData);
@@ -27,8 +27,6 @@ interface AuthProviderForm {

 const REDACTED = "••••••••";

-const ALLOWED_LOGO_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
-
 interface CurrentUser {
  id: string;
  name: string;
@@ -89,14 +87,24 @@ export function SettingsPage() {
    fetch("/api/admin/settings")
      .then((r) => r.json())
      .then(async (data) => {
-        // The logo is now proxied through the API server so the browser
-        // never receives an S3 URL — use the proxy path directly as the src.
+        let logoUrl: string | null = null;
+        if (data.logoKey) {
+          try {
+            const logoRes = await fetch("/api/admin/settings/logo");
+            if (logoRes.ok) {
+              const logoData = await logoRes.json();
+              logoUrl = logoData.url;
+            }
+          } catch {
+            // ignore
+          }
+        }
        setForm({
          businessName: data.businessName ?? "GroomBook",
          primaryColor: data.primaryColor ?? "#4f8a6f",
          accentColor: data.accentColor ?? "#8b7355",
          logoKey: data.logoKey ?? null,
-          logoUrl: data.logoKey ? "/api/admin/settings/logo" : null,
+          logoUrl,
          logoBase64: data.logoBase64 ?? null,
          logoMimeType: data.logoMimeType ?? null,
        });
@@ -141,28 +149,54 @@ export function SettingsPage() {
      return;
    }

-    const validTypes = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+    const validTypes = ["image/png", "image/svg+xml", "image/jpeg", "image/webp"];
    if (!validTypes.includes(file.type)) {
-      setMessage({ type: "error", text: "Logo must be PNG, JPEG, GIF, or WebP." });
+      setMessage({ type: "error", text: "Logo must be PNG, SVG, JPEG, or WebP." });
      return;
    }

    try {
-      // Upload directly through the API server to avoid mixed-content issues
-      // with pre-signed URLs that use the internal HTTP endpoint
-      const formData = new FormData();
-      formData.append("file", file);
-
-      const uploadRes = await fetch("/api/admin/settings/logo/upload", {
+      // Step 1: Get presigned upload URL
+      const uploadRes = await fetch("/api/admin/settings/logo/upload-url", {
        method: "POST",
-        body: formData,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ contentType: file.type, fileSizeBytes: file.size }),
      });
      if (!uploadRes.ok) {
        const err = await uploadRes.json().catch(() => null);
-        throw new Error(err?.error ?? "Failed to upload logo");
+        throw new Error(err?.error ?? "Failed to get upload URL");
+      }
+      const { uploadUrl, key } = await uploadRes.json();
+
+      // Step 2: PUT the file directly to S3
+      const putRes = await fetch(uploadUrl, {
+        method: "PUT",
+        headers: { "Content-Type": file.type },
+        body: file,
+      });
+      if (!putRes.ok) {
+        throw new Error("Failed to upload logo to storage");
+      }
+
+      // Step 3: Confirm the upload
+      const confirmRes = await fetch("/api/admin/settings/logo/confirm", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ key }),
+      });
+      if (!confirmRes.ok) {
+        const err = await confirmRes.json().catch(() => null);
+        throw new Error(err?.error ?? "Failed to confirm logo upload");
+      }
+
+      // Step 4: Fetch the presigned GET URL for display
+      const logoRes = await fetch("/api/admin/settings/logo");
+      if (logoRes.ok) {
+        const logoData = await logoRes.json();
+        setForm((f) => ({ ...f, logoKey: key, logoUrl: logoData.url, logoBase64: null, logoMimeType: null }));
+      } else {
+        setForm((f) => ({ ...f, logoKey: key, logoUrl: null, logoBase64: null, logoMimeType: null }));
      }
-      const { logoKey } = await uploadRes.json();
-      setForm((f) => ({ ...f, logoKey, logoUrl: `/api/admin/settings/logo?t=${Date.now()}`, logoBase64: null, logoMimeType: null }));
      setMessage({ type: "success", text: "Logo uploaded." });
      refresh();
    } catch (err: unknown) {
@@ -292,7 +326,7 @@ issuerUrl: authForm.issuerUrl,

  if (!loaded) return <p>Loading settings...</p>;

-  const logoSrc = form.logoUrl ?? (form.logoBase64 && form.logoMimeType && ALLOWED_LOGO_TYPES.has(form.logoMimeType) ? `data:${form.logoMimeType};base64,${form.logoBase64}` : null);
+  const logoSrc = form.logoUrl ?? (form.logoBase64 && form.logoMimeType ? `data:${form.logoMimeType};base64,${form.logoBase64}` : null);

  return (
    <div style={{ maxWidth: 600 }}>
@@ -359,7 +393,7 @@ issuerUrl: authForm.issuerUrl,
            <input
              ref={fileInputRef}
              type="file"
-              accept="image/png,image/jpeg,image/gif,image/webp"
+              accept="image/png,image/svg+xml,image/jpeg,image/webp"
              onChange={handleLogoChange}
              style={{ display: "none" }}
            />
@@ -1 +1 @@
-export { SetupWizard } from "./SetupWizard.tsx";
+export { SetupWizard } from "./SetupWizard.jsx";
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Paperclip	39e72a1441	fix(gro-527): update infra submodule to SEED_PROFILE wiring Updates infra submodule to e8bd354 which wires SEED_PROFILE env var into seed-job patches for dev/uat/prod overlays. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-10 15:22:49 +00:00
Flea Flicker	16fb887bbf	feat(GRO-537): add UAT Super User and Staff Groomer to seed script In seedKnownUsers(), add staff records for UAT Super User (manager, superuser) and UAT Staff Groomer (groomer) with oidcSub read from SEED_UAT_SUPER_OIDC_SUB and SEED_UAT_STAFF_OIDC_SUB env vars. Only creates records when the env vars are present. Idempotent: skips if email already exists. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-10 15:16:01 +00:00
Pawla Abdul	c01c8d93d7	docs(GRO-530): Add seed strategy runbook Documents seed system across environments: - Environment profiles table (dev/UAT/demo data volumes) - Seed script env vars (SEED_PROFILE, SEED_KNOWN_USERS_ONLY, etc.) - How to re-seed each environment (kubectl commands) - Authentik UAT user personas (references sealed secrets) - OOBE flag behavior - Dev-mode access (AUTH_DISABLED, X-Dev-User-Id header) cc @cpfarhood Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-10 01:26:57 +00:00
Pawla Abdul	e8c81bfccd	Parameterize seed script with SEED_PROFILE env var Implements GRO-526: Add SEED_PROFILE env var accepting dev/uat/demo values. - dev profile: 4 staff (1 manager, 1 receptionist, 2 groomers), 100 clients, ~1000 invoices, appointments 7d back / 30d forward - uat profile: 8 staff (1 manager, 1 receptionist, 3 groomers, 3 bathers), 500 clients, ~4000 invoices, appointments 30d back / 90d forward - demo profile: Same data volume as UAT Default (SEED_PROFILE unset): UAT-like behavior for backwards compatibility. Existing SEED_KNOWN_USERS_ONLY=true path unchanged. All appointment dates are computed relative to NOW() at seed time. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-10 01:21:58 +00:00