Phase 3: multi-location bi-directional menu sync, canonical store, Square OAuth, images

[crewcricle]

Multi-location, bi-directional menu sync engine with canonical store, image sync, and Square OAuth.

Changes

• Canonical menu store (menu_items table): all menu changes upsert canonical rows with content_hash (sha256 of name|price_cents|description|category|active) + origin tracking.
• Bi-directional sync + loop guard: reconcile_item pushes to each target only when last_synced_hash differs. Square inbound sets Square's hash first so it never echoes back. Deterministic idempotency keys prevent duplicate creates.
• Multi-location (locations table): GBP identity lives on locations not clients. Backfills default location. resolve_client_from_location rewritten (C2). drafts.location_id + menu_sync_log.location_id added (C6).
• 5 new services: square_oauth.py, square_catalog.py, square_images.py, gbp_media.py, menu_images.py
• Square webhook: POST /webhooks/square/catalog with HMAC-SHA256 verification, merchant_id resolution, watermark-based reconcile.
• Migrations 017–022: all with service_role_all RLS.
• Read APIs (C7): GET/POST/PATCH /locations, POST /menu/{location_id}/items/{item_id}/image.
• C4 durability: Square/GBP writes via arq wrappers with retry+dead-letter.

Testing

119/119 unit tests pass, migrations apply cleanly on scratch Postgres, locations API smoke passes. Live Square/GBP deferred to post-deploy.

---

Session Details

• Session: View Session
• Requested by: Unknown
• Address comments on this PR. Add (aside) to your comment to have me ignore it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
localmate	Error		Jul 22, 2026 7:13pm