Execute the 2026 Market Domination Strategy: the parts that need no new schema

.github/workflows/ci.yml

@@ -34,25 +34,24 @@ jobs:
       - name: Marketing asset audit
         run: npm run marketing:audit:assets
 
-      - name: Typecheck
-        run: npm run typecheck
-        env:
-          # The standalone check needs the same schema/type heap as next build.
-          NODE_OPTIONS: --max-old-space-size=4096
-
       - name: Lint
         run: npm run lint
 
       - name: Unit tests
         run: npm test
 
+      # Build BEFORE Typecheck, deliberately. next.config.mjs turns off the
+      # type-check and lint passes inside `next build` — they were a duplicate
+      # of the two steps here, and the one worker that ran them peaked at
+      # 4,471 MB against the 4,096 MB cap below, which is where a Vercel
+      # deployment died. Building first still generates .next/types/**, which
+      # tsconfig.json includes, so the Typecheck step that follows validates
+      # every route signature as well as the app — the same coverage the build
+      # used to give, in its own process instead of alongside webpack's.
       - name: Build
         run: npm run build
         env:
-          # `next build` type-checks every route plus the generated .next/types
-          # in one worker; the 435-table types file pushes that past Node's
-          # default ~2 GB heap on the runner (OOM at "checking validity of
-          # types"). 4 GB fits the 7 GB runner with room for webpack.
+          # Webpack alone; the type-check moved to its own step below.
           NODE_OPTIONS: --max-old-space-size=4096
           # Dummy values so static generation doesn't crash on missing config.
           # Real data is fetched at runtime; build-time fetches fail closed
@@ -62,6 +61,13 @@ jobs:
           SUPABASE_SERVICE_ROLE_KEY: dummy-service-role-key
           NEXT_PUBLIC_APP_URL: https://example.com
 
+      - name: Typecheck
+        run: npm run typecheck
+        env:
+          # Checks app + tests + the .next/types route types the Build step
+          # just generated; needs the same schema/type heap as before.
+          NODE_OPTIONS: --max-old-space-size=4096
+
   mobile:
     # The Expo app (mobile/) is its own npm project sharing design/tokens.json
     # with the web app. Typecheck + config validation is enough to gate PRs;

app/(app)/auth/step-up/page.tsx

@@ -0,0 +1,45 @@
+import type { Metadata } from 'next';
+import { redirect } from 'next/navigation';
+import { requireUserContext } from '@/lib/supabase/auth';
+import { createServer } from '@/lib/supabase/server';
+import { readAssurance } from '@/lib/auth/require-aal2';
+import { isSafeReturnPath, sessionStrength } from '@/lib/auth/mfa';
+import { Logo } from '@/components/brand/logo';
+import { StepUpForm } from '@/components/auth/step-up-form';
+
+export const metadata: Metadata = { title: 'Confirm it’s you', robots: { index: false, follow: false } };
+export const dynamic = 'force-dynamic';
+
+/**
+ * Where an `aal1` session lands when a money/documents/trust page needs
+ * `aal2`. Sits under `(app)` for the App Lock gate but outside `/dashboard`,
+ * so it renders without the sidebar — a person mid-step-up should not be
+ * offered forty other places to go.
+ *
+ * A session that no longer needs a code (already `aal2`, or no factor at all)
+ * is sent straight back: the page never asks for something it cannot use.
+ */
+export default async function StepUpPage({ searchParams }: { searchParams: Promise<{ next?: string | string[] }> }) {
+  const ctx = await requireUserContext();
+  const params = await searchParams;
+  const rawNext = Array.isArray(params.next) ? params.next[0] : params.next;
+  const next = isSafeReturnPath(rawNext) ? rawNext : '/dashboard';
+
+  const supabase = await createServer();
+  const read = await readAssurance(supabase);
+  if (read.ok && sessionStrength(read.assurance) !== 'needs_step_up') redirect(next);
+  if (!read.ok) console.error('[auth/step-up] assurance level read failed', { userId: ctx.user.id, error: read.error });
+
+  return (
+    <div className="flex min-h-dvh flex-col">
+      <header className="flex items-center px-5 py-5 pt-[calc(1.25rem+var(--safe-top))] sm:px-8">
+        <Logo />
+      </header>
+      <main className="flex flex-1 items-start justify-center px-5 py-8">
+        <div className="w-full max-w-md">
+          <StepUpForm next={next} serverReadFailed={!read.ok} />
+        </div>
+      </main>
+    </div>
+  );
+}

app/(app)/dashboard/autopay/page.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from 'next';
 import { requireUserContext } from '@/lib/supabase/auth';
+import { requireAal2 } from '@/lib/auth/require-aal2';
 import { BillsView } from '@/components/finance/bills-view';
 export const metadata: Metadata = { title: 'Auto Pay' };
-export default async function Page() { await requireUserContext(); return <BillsView mode="autopay" />; }
+export default async function Page() { const ctx = await requireUserContext(); await requireAal2(ctx, 'money', '/dashboard/autopay'); return <BillsView mode="autopay" />; }

app/(app)/dashboard/bills/page.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from 'next';
 import { requireUserContext } from '@/lib/supabase/auth';
+import { requireAal2 } from '@/lib/auth/require-aal2';
 import { BillsView } from '@/components/finance/bills-view';
 export const metadata: Metadata = { title: 'Bill Manager' };
-export default async function Page() { await requireUserContext(); return <BillsView mode="all" />; }
+export default async function Page() { const ctx = await requireUserContext(); await requireAal2(ctx, 'money', '/dashboard/bills'); return <BillsView mode="all" />; }

app/(app)/dashboard/binder/page.tsx

@@ -1,10 +1,12 @@
 import type { Metadata } from 'next';
 import { requireFeature } from '@/lib/supabase/auth';
+import { requireAal2 } from '@/lib/auth/require-aal2';
 import { BinderModule } from '@/components/modules/binder-module';
 
 export const metadata: Metadata = { title: 'Household Binder' };
 
 export default async function BinderPage() {
-  await requireFeature('/dashboard/binder');
+  const ctx = await requireFeature('/dashboard/binder');
+  await requireAal2(ctx, 'documents', '/dashboard/binder');
   return <BinderModule />;
 }

app/(app)/dashboard/budgets/page.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from 'next';
 import { requireUserContext } from '@/lib/supabase/auth';
+import { requireAal2 } from '@/lib/auth/require-aal2';
 import { BudgetsView } from '@/components/finance/budgets-view';
 export const metadata: Metadata = { title: 'Budget Planner' };
-export default async function Page() { await requireUserContext(); return <BudgetsView />; }
+export default async function Page() { const ctx = await requireUserContext(); await requireAal2(ctx, 'money', '/dashboard/budgets'); return <BudgetsView />; }

app/(app)/dashboard/calendar/actions.ts

@@ -40,6 +40,8 @@ import { makeKey } from '@/lib/services/idempotency';
 import { scopeFromUserContext } from '@/lib/services/scope';
 import { isSubmissionId } from '@/lib/utils/submission-id';
 import { describeActionError } from '@/lib/supabase/errors';
+import { loadScheduleIntelligence } from '@/lib/schedule/intelligence-server';
+import type { ScheduleInsight } from '@/lib/schedule/intelligence';
 import type { EventCategory, RecurrenceFreq } from '@/lib/database.types';
 
 const PATH = '/dashboard/calendar';
@@ -293,3 +295,50 @@ export async function undoCalendarEventsAction(eventIds: string[]): Promise<Undo
     return { ok: false, error: describeActionError(err, t('actions.couldNotUndoThoseEvents')) };
   }
 }
+
+export type EventScheduleInsightsResult =
+  | { ok: true; insights: ScheduleInsight[]; leaveBy: { at: string; source: 'drive_time' | 'category_buffer'; travelMinutes: number } | null }
+  | { ok: false; error: string };
+
+/**
+ * The composed schedule model for ONE event (lib/schedule/intelligence): its
+ * leave-by, and every driver, car, dinner, care and double-booking constraint
+ * the rest of the family's day puts on it. Read-only.
+ *
+ * Fail-closed: a read failure is an error the modal shows with a retry, never
+ * an empty list — "no conflicts" is a claim, and one computed from missing
+ * rows would be false.
+ */
+export async function eventScheduleInsightsAction(eventId: string): Promise<EventScheduleInsightsResult> {
+  const t = await getTranslations();
+  if (!eventId) return { ok: false, error: t('actions.thatEventCouldNotBe') };
+  const ctx = await requireUserContext();
+  const supabase = await createServer();
+  const familyId = ctx.active.familyId;
+  try {
+    const { data: event, error } = await supabase
+      .from('calendar_events').select('id, starts_at, ends_at, all_day')
+      .eq('id', eventId).eq('family_id', familyId).maybeSingle();
+    if (error) {
+      console.error('[schedule] event read failed', error);
+      return { ok: false, error: t('actions.couldNotLoadScheduleInsights') };
+    }
+    if (!event) return { ok: false, error: t('actions.thatEventCouldNotBe') };
+    if (event.all_day) return { ok: true, insights: [], leaveBy: null };
+
+    const startMs = Date.parse(event.starts_at);
+    if (!Number.isFinite(startMs)) return { ok: true, insights: [], leaveBy: null };
+    // Everything that can constrain the event lives on the same family day,
+    // give or take: a day either side covers overnight rides and late dinners.
+    const result = await loadScheduleIntelligence(supabase, {
+      familyId, tz: ctx.active.family.timezone || 'UTC', now: new Date(),
+      fromMs: startMs - 86_400_000, toMs: startMs + 86_400_000,
+    });
+    if (!result.ok) return { ok: false, error: t('actions.couldNotLoadScheduleInsights') };
+    const sched = result.data.events.find((e) => e.eventId === eventId);
+    return { ok: true, insights: result.data.byEvent[eventId] ?? [], leaveBy: sched?.leaveBy ?? null };
+  } catch (err) {
+    console.error('[schedule] event insights read failed', err);
+    return { ok: false, error: describeActionError(err, t('actions.couldNotLoadScheduleInsights')) };
+  }
+}

app/(app)/dashboard/concierge-calls/actions.ts

@@ -107,3 +107,28 @@ export async function requeueCallAction(id: string, phone?: string): Promise<Res
   if (error) return { ok: false, error: error.message };
   return { ok: true };
 }
+
+/**
+ * A parent made the call themselves and is recording what happened. This is
+ * the only way a row reaches 'completed' today: Bubaly has no outbound voice
+ * integration, so no provider ever writes `provider_ref`, and the UI shows such
+ * a row as "Done — logged by hand" rather than "Called" (see
+ * `callDisplayState` in lib/concierge-calls/brief.ts).
+ */
+export async function logCallOutcomeAction(id: string, outcome: string): Promise<Result> {
+  const t = await getTranslations();
+  const ctx = await requireUserContext();
+  if (!isManager(ctx.active.role)) return { ok: false, error: t('actions.onlyParentsGuardiansCanManage') };
+  const text = (outcome ?? '').trim();
+  if (text.length < 2) return { ok: false, error: t('actions.sayWhatHappenedOnThe') };
+  const supabase = await createServer();
+  const { error } = await supabase.from('concierge_calls')
+    .update({ status: 'completed', outcome: text.slice(0, 2000), completed_at: new Date().toISOString() })
+    .eq('id', id).eq('family_id', ctx.active.familyId).in('status', ['draft', 'queued', 'failed', 'action_needed']);
+  if (error) return { ok: false, error: error.message };
+  await logAudit(supabase, {
+    familyId: ctx.active.familyId, actorId: ctx.user.id, action: 'update',
+    resource: 'concierge_calls', resourceId: id, metadata: { loggedByHand: true },
+  });
+  return { ok: true };
+}

app/(app)/dashboard/concierge-calls/page.tsx

@@ -1,24 +1,35 @@
 import type { Metadata } from 'next';
 import { requireUserContext } from '@/lib/supabase/auth';
 import { createServer } from '@/lib/supabase/server';
+import { getTranslations } from '@/lib/i18n/server';
+import { ErrorState } from '@/components/ui/states';
 import { ConciergeCallsModule } from '@/components/modules/concierge-calls-module';
 import type { Tables } from '@/lib/database.types';
 
 export const metadata: Metadata = { title: 'AI Calls' };
 export const dynamic = 'force-dynamic';
 
-/** "Bubaly calls for you" — outbound AI concierge calls. Any family member can
- *  request a call; the module shows the AI brief, live status, and outcomes. */
+/** Outbound concierge calls: the family writes the request, Bubaly writes the
+ *  call plan, and the row carries what is actually known about the call. Any
+ *  family member can see the queue; the module shows the brief, the persisted
+ *  state and the outcome. */
 export default async function ConciergeCallsPage() {
+  const t = await getTranslations();
   const ctx = await requireUserContext();
   const supabase = await createServer();
 
-  const { data } = await supabase
+  const { data, error } = await supabase
     .from('concierge_calls')
     .select('*')
     .eq('family_id', ctx.active.familyId)
     .order('created_at', { ascending: false })
     .limit(100);
+  if (error) {
+    // Fail closed: an empty queue after a failed read would tell a parent
+    // nothing is waiting when something might be.
+    console.error('[dashboard/concierge-calls] calls read failed', error);
+    return <ErrorState message={t('conciergeCalls.couldNotLoadYourCallRequests')} />;
+  }
 
   return (
     <ConciergeCallsModule

app/(app)/dashboard/concierge/page.tsx

@@ -1,4 +1,6 @@
 import type { Metadata } from 'next';
+import Link from 'next/link';
+import { History } from 'lucide-react';
 import { getTranslations } from '@/lib/i18n/server';
 import { requireUserContext } from '@/lib/supabase/auth';
 import { createServer } from '@/lib/supabase/server';
@@ -29,6 +31,17 @@ export default async function ConciergePage() {
 
   return (
     <>
+      {/* M35: the one chronological list of everything Bubaly has done and is
+          doing for this family. Linked here and from Home, never the sidebar. */}
+      <div className="mx-auto max-w-5xl px-4 pt-6">
+        <Link
+          href="/dashboard/concierge/runs"
+          className="inline-flex min-h-11 items-center gap-1.5 rounded-xl border border-border bg-surface/40 px-3.5 text-sm font-medium text-fg transition hover:bg-elevated focus-ring"
+        >
+          <History className="h-4 w-4 text-brand-text" aria-hidden /> {t('concierge.runHistory')}
+          <span className="hidden text-xs text-muted sm:inline">{t('concierge.everythingBubalyHasDoneAnd')}</span>
+        </Link>
+      </div>
       {reasoningError && (
         <div className="mx-auto mb-4 max-w-5xl px-4 pt-6">
           <ErrorState message={t('concierge.relationshipInsightsAreTemporarilyUnavailable')} />

app/(app)/dashboard/concierge/runs/[id]/page.tsx

@@ -26,12 +26,13 @@ import { editStepInput } from '@/lib/ai/runs/controls';
 import { kickRun } from '@/lib/ai/runs/continue';
 import type { StepState } from '@/lib/ai/runs/states';
 import { runPagePath } from '@/lib/ai/chat-request';
+import { toolDomain } from '@/lib/ai/tool-domains';
 import { editableFieldsFor } from '@/lib/approvals/card-data';
 import type { RunActionResult } from '@/app/(app)/dashboard/concierge/run-actions';
 import { ErrorState } from '@/components/ui/states';
 import { ApprovalCard } from '@/components/approvals/approval-card';
 import { StatusBadge } from '@/components/concierge/status-badge';
-import { RunTimeline } from '@/components/concierge/run-timeline';
+import { RunTimeline, type StepSources } from '@/components/concierge/run-timeline';
 import { RunControls, type EditableStep, type FailedStep } from '@/components/concierge/run-controls';
 import { ClarificationCard } from '@/components/concierge/clarification-card';
 import { getTranslations } from '@/lib/i18n/server';
@@ -76,6 +77,14 @@ export default async function RunDetailPage({ params }: { params: Promise<{ id:
   const requestId = detail.data.run.request_id;
   const canControl = manager || detail.data.run.requested_by_member_id === ctx.active.member.id;
   const view = toRunView(detail.data, familyId, manager);
+  // M6: which tool each step runs, from the persisted `tool_name` — the source
+  // shown beside the step. Passed apart from the view so the read boundary
+  // stays exactly what tests/run-detail-read-boundary.test.ts pins.
+  const stepSources: StepSources = Object.fromEntries(
+    detail.data.steps
+      .filter((s) => !!s.tool_name?.trim())
+      .map((s) => [s.id, { tool: (s.tool_name as string).trim(), domain: toolDomain(s.tool_name as string) }]),
+  );
 
   const failedSteps: FailedStep[] = view.steps
     .filter((s) => RERUNNABLE_STEP_STATES.includes(s.status))
@@ -179,7 +188,7 @@ export default async function RunDetailPage({ params }: { params: Promise<{ id:
       )}
 
       <section aria-label={t('dashboardConciergeRuns.progress')} className="rounded-2xl border border-border bg-surface/40 p-4 sm:p-5">
-        <RunTimeline view={view} showActivity={showActivity} />
+        <RunTimeline view={view} showActivity={showActivity} stepSources={stepSources} />
       </section>
     </div>
   );