React Router's CSRF check compared https Origin with the http URL seen behind Nginx,
rejecting every admin form save with 400.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- functions: add codegen config and the downloaded schema.graphql (generated/ ignored)
- order-reschedule: add the @preact/signals peer dependency
- widget: source moved to widget-src/, minified build in assets (npm run build:widget,
also run by predeploy); e2e passes on the minified file
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Prisma extension seals booking name/email/phone/address and waitlist contacts with
AES-256-GCM on write and opens them on read (incl. nested reads)
- keyed-hash columns for exact email/phone lookups (privacy webhooks, booking search,
waitlist de-duplication); migration 0002
- tests prove only ciphertext is stored; privacy/terms/SECURITY.md updated to match
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- brand/: 1200x1200 full-bleed app icon, 1600x900 feature image, transparent logos,
favicons, guidelines (palette, type, usage) and the build script
- / is now a branded landing page with no shop-domain form (App Store 2.3.1)
- /privacy and /terms describe Datewise's actual data handling and sub-processors
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
activateAppId pointed at a non-existent 'datewise-embed' handle; the embed is 'embed'.
Adds an addAppBlockId link that places the scheduler block on the cart template.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- segmented method control with line icons
- round calendar days with availability dots and scarcity badges
- pill time chips; confirmation stub shows method, place, date, time, fee
- colours derive from theme text colour + one merchant accent (light/dark safe)
- rename leftover ss- internals to dw-
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
