Pull each SMS client's actual credit balance from the provider panel instead of
manual entry. sms.balance_api_url (dated setting, default 164.52.195.161/API/
BalAlert.aspx) returns pipe-delimited code|STATUS|payload; parseBalanceResponse
reads the trailing number and flags ERROR lines, never guessing. Uses each
subscription's already-imported username/password_enc — the automated path decrypts
directly (no reveal-audit spam) and audits sms_balance ONLY when it changes;
per-poll telemetry lands in the unaudited sms_balance_check table (SQLite schema +
PG migration 010). Managerial 'Refresh from gateway' button (POST /reports/sms-
balances/refresh) + per-client refresh; scheduler does one pass per day
(maybeRefreshSmsDaily). Low-balance alert on the Dashboard + cockpit tile. Needs
HQ_SECRET_KEY (import-time key) to decrypt — no-ops with a clear message otherwise,
never stores plaintext. Parser unit-tested; full suite 408 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Durable specs for tickets/reconciliation/MIS/sms-balance/tds/audit-viewer/
notifications/einvoice (+ renewals, delivered) with schema/repo/route/UI/test
detail and a collision-safe build order. WhatsApp design was transiently
classifier-blocked; to re-run.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- recordPayment locks the target invoice row (SELECT ... FOR UPDATE, Postgres
only — SQLite is serialized by the connection mutex) before reading
outstanding, so concurrent payments cannot over-allocate on prod.
- INDEX_DDL now runs AFTER migrate() in openDb, so indexes referencing
migrate-added columns (owner_id, lockout cols) build on older DBs.
- D24 remediation recorded in 06-DECISIONS; test counts 377 -> 389.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each module declares its own operational fields (field_spec JSON);
per-client values organized by that module schema; generalized encrypted
secret map. Flexibility mandate made concrete: new module or new field =
no code, no migration. Queued after the D20 trial import.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Survey verdicts for all 25 real APEX tables; founder calls locked:
full ticket desk (4,567-ticket history), client_module service columns
(provider/username/password_enc/details), client_branch, five modules
= SMS, RTGS, WhatsApp, Mobile App, ATM.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Locked decisions: pg driver behind an async Db interface with dual
engines (sqlite for fast tests, pg for prod), bigint paise, TEXT ISO
dates, jsonb payloads, numbered migrations, ?->$n in the adapter,
DATABASE_URL selects the engine. Build order: async refactor first
(zero behavior change), then schema, adapter, dual-engine suite, smoke.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
STATUS: count + review summary, D18 sentence in the intro, honest migrate()
column list, routes table gains /reminders /documents /profile /import and the
collapse/user-menu shell description. README + CLAUDE: 345. D18 record in
06-DECISIONS gains the review outcome. Spec banner notes the post-review
deltas (CSV support columns, LIKE filters).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Records the decision the code already cites (staff_user IS the employee
table; rename would churn FKs and audit names) and the reviewed deviation
from the funnel spec's blanket pagination rule: GET /employees returns the
bounded console-user set whole with total, no page/pageSize.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The historical HQ-1/2/3a build plans and the live-preview spec referenced sibling
Store apps (apps/store-server, apps/backoffice) as copy-sources and cited Store-only
docs. Rewrote those to describe the patterns intrinsically and to name the Store
product/repo where the scope boundary is genuine, so each plan stands alone in the
HQ repo. Technical content and task lists unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update the shared-heritage docs that still described the old combined monorepo:
D15 and the HQ console spec now note the 2026-07-16 split into two independent
repos, and the deploy runbook uses the correct repo name (sims-hq, was sims-next).
Historical decisions are preserved; only stale present-tense/naming is corrected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Marks the split spec DELIVERED with the outcome: both repos verified, the
pre-split combined repo deleted, and the kept-@sims/kept-env decisions recorded.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds the front-page README, a first STATUS.md build-state doc (the console had
none), and a CLAUDE.md with the house rules that govern this repo. De-links four
references to Store-only planning docs (04-ROADMAP, 08-MARKET-ARCHITECTURES,
09-UX-FLOWS-AND-MENUS) that now live in the Store repo, and regenerates the
lockfile to drop the removed Store workspace entries.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This repo keeps its 60-commit HQ history and becomes independent of the Store
product. Removed the Store apps (pos, store-server, backoffice), the Store-only
packages (config, scanning, search-core, printing — printing was already a dead
dependency in hq-web), and the Store planning docs.
Shared packages are forked and trimmed to exactly what HQ uses: domain keeps
ids/money/business-day/doc-series/gstin/documents; auth keeps pin; billing-engine
keeps compute/tax. Store-only tests for the removed modules were dropped, and
auth.test.ts was trimmed to its PIN blocks. Package renamed sims-hq; root
tsconfig/vitest paths narrowed to the four kept packages.
Verified independently: npm install + typecheck clean, 177 tests pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two products share one repo: HQ (internal client book, proforma billing,
call tracking) and Store (the GST retail product shipped to ~300 clients).
Different DBs, different audiences, different cadences — 60 of 75 commits
touch HQ, 2 touch Store.
Design: two repos. HQ inherits the existing history; Store starts fresh so
its history carries zero HQ bytes. Shared packages fork into each side,
trimmed to verified usage — safe because GST rates are dated DB rows, not
code, so the forked arithmetic has no reason to diverge.
Project tracking and conversion reporting are deferred: they don't exist
yet, and mixing new features into a mechanical move hides failures.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Snapshot of the store-product workstream's in-progress work (apps/pos,
apps/backoffice, apps/store-server, packages): returns + credit notes, GST
returns exports, offline bill queue, rate-limiting, session policy, print
guard, batch tracking, and the SEC-C6/SEC-A5 auth fixes; plus docs/18 red-team
review. Committed to preserve work for the repo push. HQ console already
committed separately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Turnkey deployment for the AWS box: documented env vars, pm2/systemd run,
HTTPS reverse-proxy, nightly SQLite->S3 backup with rotation, and the Postgres
switch note. No secrets; unblocks go-live the moment the server/creds arrive.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Automated review (CRITICAL): route registered above requireAuth, identity
fields trusted from the body. Two fix options specified; must land before
any pilot. Companion to SEC-C6.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Automated review flagged POST /api/bills trusting overrides[].approvedByUserId
from the client; verify-pin result never bound to the commit. Server-side
approval-token fix specified; must land before any pilot (Phase 1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
POS, back office, store-server, all packages, workspace configs, README/
BUILDING, and the WIP HQ-2 plan — everything except gitignored data
(client import staging, .env, local DBs).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thomas Joise
Thomas Joise