Seven radii were in circulation (4/5/6/8/12/16px + pill) with no rule for
which went where; one toolbar row on /transactions mixed four shape
languages. This locks a 4-tier ladder (design.md convention 16):
- pill: interactive toolbar controls (buttons, chips, pickers, segmented
controls, toolbar search, count nubs)
- rounded-xl (12px): overlay tier: page panel, dialogs, slide-overs
- rounded-lg (8px): cards, form fields, popover/menu content, boxes
- rounded-sm (4px): nested leaves (menu items, checkboxes, kbd/code nubs)
Changes:
- New SegmentedControl primitive (pill-in-pill tablist, h-8) replaces the
hand-rolled bg-muted/70 tablist copied across 11 files
- New ToolbarSearch primitive (pill, h-8) adopted on 9 page toolbars;
dialog/picker searches keep the rounded-lg Input
- dialog.tsx 8px -> 12px, matching SettingsModal/slide-over/CommandPalette
- ContextPicker chips at the shared h-8 toolbar height
- ~300 rounded-md / bare rounded call sites remapped by role; auth icon
tiles and the mobile nav sheet come down from 16px to 12px
- rounded-md, bare rounded, rounded-2xl and rounded-[Npx] are dead
vocabulary, enforced by a new off-ladder-radius check in check:guards
Verified: lint 0 errors, 14422 unit tests pass, check:guards green, tsc
clean on all changed files, sandbox screenshots of transactions/
bookkeeping/granskning toolbars and the Ny verifikation dialog.
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(whatsapp): app-side unmute, close silent intake paths, health visibility
- add POST /link/unmute and a Reactivate control on the Pausad state
- company resolution: transient query errors release the row for sweep
retry; genuine zero-options sends M19 instead of parking silently
- media from unlinked senders bypasses the hourly greeting throttle
(10 min burst window, daily cap kept)
- GET /link returns 7-day failed-delivery and parked-inbound counts;
sweep summary logs outboundFailed24h
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(documents): real HEIC/HEIF magic-byte validation, bilingual upload errors
- detect ISO-BMFF ftyp brands (heic/heix/heim/heis/hevc/hevx/hevm/hevs,
mif1/msf1) instead of exempting image/heic from validation; declared
heic/heif accepts either family member (iOS labels vary)
- new INBOX_UPLOAD_* structured error codes replace raw English strings
on the inbox upload and attach-document routes
- registry doc corrected to the real 10 MB cap
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* feat(inbox): staged upload with instant ack and deferred AI extraction
- web uploads insert the inbox item as status processing and respond
immediately; Bedrock extraction and supplier match run via after()
with a CAS flip to received (email and WhatsApp channels keep the
synchronous path)
- widen invoice_inbox_items.status CHECK to include processing
(migration 20260813180000, pg-real test included)
- crash-recovery sweep cron (*/2) flips stale processing rows;
bulk-book skips extraction_in_progress items
- workspace: processing chip, in-flight rows disable actions, realtime
flip, retry-extraction button for empty extractions
- picker accept list drops HEIC/HEIF so iOS transcodes library photos
to JPEG; server allowlists unchanged (supersedes 2026-08-01 HEIC
decision, see DECISIONS.md)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(migrations): bump inbox processing-status migration past main's latest
Main merged 20260813210000 while this PR was in flight; an inserted
version older than the latest applied aborts the prod db push at merge.
Renamed 20260813180000 to 20260813213000 and updated references.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(decisions): log preview-tracker orphan repair after migration rename
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix(whatsapp): make every silent disposition observable, stop pure silence for linked senders (#1552)
Silence was a legitimate outcome in seven places and none left a trace a
support question could be answered from. Now:
- Unknown-sender declines (over quota, quota RPC failure, greeting
throttle) persist content-free trace rows: wamid, phone hash, type,
disposition. No body, media, raw payload, or profile name; capped at
20 rows per hash and day; deleted by the existing 30-day retention.
The wamid dedupe also stops redelivered bad-code/greeting messages
from earning a second reply.
- Linked-sender deliberate silences (muted, stale tap, ignorable type)
record their reason on the skipped row.
- Non-policy silences reply: a row missing its media reference sends
M18 through the link's reply address, a link revoked between arrival
and processing sends the M1 unlinked copy (greeting-throttled).
- Outbound rows keep WHY a send failed (Graph error detail), and Meta
'failed' delivery statuses store their error code and title.
- The WhatsApp settings panel shows the last inbound event (closed
enum, server-derived) and warns when the latest reply never left.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(whatsapp): include errorDetail in typed sendText mock results
SendTextResult gained errorDetail; vi.mocked call sites must match the
widened type or they raise fresh tsc errors over the repo baseline.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(whatsapp): review fixes: fail-closed greeting throttle, cap only declined traces
From CodeRabbit's pass on #1563:
- greetingThrottled fails closed when the throttle window cannot be
read, matching the unknown-sender quota's stance.
- The decline-trace day cap applies only to 'skipped' rows (the one
unbounded path); 'done' traces always insert so the wamid dedupe
keeps preventing duplicate M1/M2 replies even past the cap. Their
volume is already bounded upstream by the greeting throttle and the
pre-binding quota.
- company-question test mocks match the widened SendTextResult.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The page had no visual signal that it configures a third-party channel,
so it read like any other Accounted setting. Adds an inline-SVG WhatsApp
mark next to the section title and on the button that opens WhatsApp
(replacing the generic lucide chat bubble, which was standing in for a
logo it is not).
Inline SVG rather than a bundled asset: no network request, scales, and
survives the CSP. SettingsSectionHeader gains an optional `mark` slot;
every other settings tab is untouched and stays mark-less on purpose, so
the rail does not turn into a sticker album. The green is the one place
brand colour appears in settings, which matches the design rule that
colour belongs to actors rather than chrome.
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Webhook lifecycle: GET hub.challenge handshake (constant-time verify-token
compare); POST verifies X-Hub-Signature-256 over the RAW body before any
parse, Zod-parses the envelope, persists inbound rows (partial-unique wamid
= dedupe against Meta's up-to-7-day redelivery), acks 200 fast and defers
media processing via the after() idiom. Rejected and rate-limited content
always acks 200 and lands as skipped/error rows, never a retryable status.
Linking: the settings panel (Installningar -> WhatsApp) mints AC- one-time
codes (sha256 stored, 10 min TTL, single use, ambiguity-free alphabet); the
webhook consumes the code, binds phone to user (HMAC-peppered hash + AES-256-
GCM at rest) and confirms with M3. Keyword commands stopp/start/hjalp;
unknown senders get one throttled M1 greeting (1/h, 3/day) behind the
sender-quota RPC, with no media download and no content persistence.
Intake worker: atomic claim on the message row (the durable job record),
company resolution (default -> sole membership -> M6 fallback, no item),
per-company inbox quota (ack-and-drop, M17 once per 10 min per sender),
MIME allowlist, 10 MB stream-checked media download, exact sha256 duplicate
check, then the shared uploadAndExtract funnel (source 'whatsapp',
channel_context caption, whatsapp_message_id) and the M4 ack with extracted
merchant/total/date. Failures wrap to 'error' + error_message + one M18.
uploadAndExtract widened: source 'whatsapp', optional channelMeta + actorId;
email/upload paths behaviorally unchanged.
Deferred to PR4: burst debounce + combined ack (M5), in-chat company choice
(M6 buttons + 8h pin), clarifying questions M7-M10, interpret-answer LLM
call, sweep cron, retention cron.
Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
