@blamejs/blamejs-shop 0.3.44 → 0.3.46

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.46 (2026-06-01) — **Storefront pages render in far fewer database round trips, and the search collection filter is consistent across cache tiers.** The dynamically rendered storefront (the path that serves returning, signed-in, or non-default-currency shoppers) re-derived product data with one database query per item — a home or search page could issue dozens to hundreds of round trips, where the cached edge already did the same work in a single batched query. The home grid, search results, product page, related-products rail, and cart now read product, variant, price, inventory, and media data in batched queries that mirror the edge exactly, so those pages render with far fewer round trips and identical output. As part of this, the search 'collection' filter now reflects manual collection membership consistently whether a page is served from the cache or rendered dynamically. **Changed:** *Batched product reads on storefront pages* — The home grid, search results, product detail, related-products rail, and cart now load product/variant/price/inventory/media data in batched database queries instead of one query per item. On a cache miss, a signed-in session, or a non-default currency the dynamic render path previously issued a query per product (and per variant); these pages now match the single-query shape the cached edge already used. Rendered pages are unchanged. · *Consistent search collection filter across cache tiers* — The 'collection' filter on the search page now reflects manual collection membership on both the cached and the dynamically rendered paths. Previously the dynamic path could additionally surface smart-collection rule matches in that filter, so a shopper could see different collection filter options depending on which path served the page. If you relied on smart (rule-based) collections appearing as search filters, they now appear only where a product is an explicit member; this aligns the two render paths.
+
+- v0.3.45 (2026-06-01) — **Tax, VAT, bulk price changes, and customer emails now compute money in exact integer arithmetic.** Several money calculations were performed with floating-point intermediates. On a large order subtotal the sales-tax math could lose a minor unit, and the customer-facing wishlist emails formatted prices by dividing by 100 — which is wrong for zero-decimal currencies like JPY (¥1,050 rendered as 10.5) and three-decimal currencies like BHD, and dropped trailing zeros ($10.00 shown as 10). All of these now run through the framework's exact BigInt money primitive: sales-tax and VAT/GST extraction, the per-rate owed figure on a tax filing, the admin bulk price-adjust, the wishlist price-drop and digest emails, and subscription monthly-revenue normalization. Prices in customer emails are now rendered with the correct currency exponent and symbol for every currency. **Changed:** *Bulk price-adjust rounds to even on exact half-unit ties* — The admin bulk price-adjust now rounds a price that lands exactly halfway between two minor units to the nearest even unit, matching the rounding used everywhere else in the money surface, instead of always rounding the half up. This only changes the result on an exact tie and by at most one minor unit (for example a price computed as 200.5 now becomes 200 rather than 201). If a pricing regime requires rounding halves up, that is a one-line option change. **Fixed:** *Exact sales-tax and VAT computation* — Sales tax, VAT-inclusive extraction, and VAT-exclusive addition are computed in exact integer arithmetic rather than with a floating-point intermediate, so the tax on a large order total is no longer off by a minor unit. The per-rate owed figure on a tax filing is likewise computed exactly, which matters when a filing window aggregates a very large taxable total. · *Currency-correct prices in wishlist emails* — Price-drop alert emails and the wishlist digest now format prices with each currency's own decimal places and symbol. Zero-decimal currencies (such as JPY) and three-decimal currencies (such as BHD) render correctly, and whole amounts keep their trailing zeros — for example $10.00 instead of 10. · *Exact subscription monthly-revenue normalization* — Normalizing a weekly or annual plan to a monthly figure for revenue reporting now uses exact rational arithmetic instead of a floating-point cadence factor, so the dashboard total is stable and does not drift by a cent between refreshes.
+
 - v0.3.44 (2026-05-31) — **Customers can rate a delivered order, and the admin console moderates and replies.** There was no way for a customer to give feedback on how an order was fulfilled, and no way for an operator to act on it. Customers can now rate one of their own delivered orders on shipping, packaging, and how likely they are to recommend you, with an optional comment. The admin console gets a Ratings screen with a moderation queue of every flagged comment plus the most recent ratings, where an operator can flag a comment or post one public reply that the customer then sees on their order page. A customer can only rate an order they own, and every comment and reply is HTML-escaped wherever it is shown, so feedback text can't inject markup into another shopper's or an operator's page. **Added:** *Order ratings* — A customer viewing one of their own orders can rate it on three axes — shipping, packaging, and likelihood to recommend (1 to 5) — and optionally leave a comment. Each order can be rated once. The rating, and any public reply from the store, appear on the customer's order page. A customer can only rate an order tied to their own account; the rating is always recorded against the signed-in customer, never a value taken from the request. · *Ratings moderation in the admin console* — A new Ratings screen lists recent ratings with their scores and comments, alongside a moderation queue that surfaces every flagged comment regardless of its score, so a flagged comment on an otherwise high rating is never hidden. An operator can flag a comment for moderation and post a single public reply to a rating, which is then shown to the customer. Comments and replies are HTML-escaped everywhere they are rendered.
 
 - v0.3.43 (2026-05-31) — **Export orders for a date range as CSV or NDJSON, with scheduled exports.** There was no way to pull a bulk export of orders over a date range. A new Exports screen in the admin console previews how many orders and how much revenue a date range covers, then downloads them as a CSV or NDJSON file. The export can also be scheduled and managed as a queued job. Customer email addresses are exported only as a hash, never in the clear, and any field that could be interpreted as a spreadsheet formula is neutralized so an exported file can't run code when opened. This release also updates the vendored blamejs runtime to v0.14.16. **Added:** *Order export* — An Exports screen in the admin console exports orders over a chosen date range. It first shows a preview — the order count, revenue, and average order value for the range — then downloads the orders as a CSV or NDJSON file with a standard set of columns. Exports can also be queued as scheduled jobs and cancelled before they run. Customer email is exported as a hash rather than in the clear, and any cell that begins with a character a spreadsheet would treat as a formula is escaped, so an exported file can't execute anything when opened in Excel or Sheets. **Changed:** *Vendored blamejs runtime updated to v0.14.16* — The bundled blamejs runtime is updated to v0.14.16, which validates connection ports at configuration time — a malformed port (a non-integer or out-of-range value) is now rejected with a clear error at startup instead of silently falling back to a default. No operator action is required.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.44",
+  "version": "0.3.46",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/catalog.js

@@ -171,6 +171,23 @@ function _contentType(s) {
 function _genId() { return b.uuid.v7(); }
 function _now()   { return Date.now(); }
 
+// Build the LIKE pattern for a single term — lowercased + the
+// `\`-first metacharacter neutralisation so a term containing `%` /
+// `_` matches only the literal character (otherwise `100%` would
+// match every row). The `\\` substitution MUST run first, before the
+// `%` / `_` passes, so the `\` we insert in front of a wildcard
+// isn't itself re-escaped on the next pass and the wildcard survives
+// un-neutralised. `products.search` and `batch.searchDecorate` both
+// compose this so the escape can't drift between the two surfaces;
+// it mirrors the edge `_likePattern` (worker/data/catalog.js).
+function _likePattern(term) {
+  var escaped = String(term).toLowerCase()
+    .replace(/\\/g, "\\\\")
+    .replace(/%/g, "\\%")
+    .replace(/_/g, "\\_");
+  return "%" + escaped + "%";
+}
+
 // ---- factory -------------------------------------------------------------
 
 function create(opts) {
@@ -206,6 +223,13 @@ function create(opts) {
   // failure never rolls back the stock op that triggered it.
   var inventory = _inventoryModule(query, { onStockChange: opts.onStockChange || null });
   var media     = _mediaModule(query);
+  // Batched read helpers — one or a few `IN (...)` / window-function
+  // queries that replace the per-item loops the container storefront
+  // ran (N+1 over the D1 bridge). Each is ported from the named edge
+  // function in worker/data/catalog.js with the SAME SQL shape +
+  // output field names, so the dual-rendered HTML stays byte-identical
+  // across the edge + container substrates.
+  var batch     = _batchModule(query);
 
   return {
     products:  products,
@@ -213,6 +237,7 @@ function create(opts) {
     prices:    prices,
     inventory: inventory,
     media:     media,
+    batch:     batch,
   };
 }
 
@@ -381,17 +406,12 @@ function _productsModule(query, cursorSecret) {
       if (qTrim.length === 0) {
         return { rows: [], next_cursor: null };
       }
-      var qLower = qTrim.toLowerCase();
       // Neutralize LIKE metacharacters so a search containing `%`
       // or `_` matches only the literal character (otherwise `100%`
-      // would match every row). `\` is the escape character; it has
-      // to be escaped first so we don't double-escape the
-      // `\` we insert in front of `%` / `_`.
-      var qEscaped = qLower
-        .replace(/\\/g, "\\\\")
-        .replace(/%/g, "\\%")
-        .replace(/_/g, "\\_");
-      var pattern = "%" + qEscaped + "%";
+      // would match every row). The shared `_likePattern` lowercases
+      // and escapes `\` first so the wildcard neutralisation can't be
+      // re-escaped — the same helper `batch.searchDecorate` composes.
+      var pattern = _likePattern(qTrim);
       var cursorVals = null;
       if (opts.cursor != null) {
         if (typeof opts.cursor !== "string") {
@@ -851,6 +871,485 @@ function _mediaModule(query) {
   };
 }
 
+// ---- batch (N+1-collapsing read helpers) ---------------------------------
+//
+// These mirror worker/data/catalog.js — the edge worker already
+// produces, in one or a few `IN (...)` / window-function queries, what
+// the container storefront re-derived with per-item loops (each a
+// full D1-bridge hop). Porting the edge SQL verbatim keeps the two
+// substrates in lockstep: the field names + row shapes below are the
+// ones the storefront renderers already accept, so the rendered HTML /
+// JSON-LD is unchanged.
+//
+// Every helper composes the module's `query(sql, params)` closure +
+// the existing validators. Each is missing-table-resilient (catch
+// `/no such table/i` → empty) to match the edge + the never-500-the-
+// page stance, EXCEPT entry-point validation (a malformed id throws
+// TypeError, which the route catches → 404/empty). The IN(...) lists
+// use positional placeholders generated from array length, values
+// bound positionally — never interpolated.
+
+// First-variant / first-media decorated SELECT — ported verbatim from
+// the edge `DECORATED_SELECT` (worker/data/catalog.js). Window
+// functions pick the first variant (position ASC, created_at ASC) +
+// first media per product in one round trip; the price is joined off
+// the hero variant for the requested currency. `?1` is the currency.
+var _DECORATED_SELECT =
+  "SELECT p.*, " +
+  "       v.id        AS hero_variant_id, " +
+  "       pr.amount_minor AS starting_price_minor, " +
+  "       pr.currency     AS starting_price_currency, " +
+  "       m.r2_key    AS hero_r2_key, " +
+  "       m.alt_text  AS hero_alt_text " +
+  "FROM products p " +
+  "LEFT JOIN ( " +
+  "  SELECT iv.*, " +
+  "         ROW_NUMBER() OVER (PARTITION BY iv.product_id ORDER BY iv.position ASC, iv.created_at ASC) AS rn " +
+  "  FROM variants iv " +
+  ") v ON v.product_id = p.id AND v.rn = 1 " +
+  "LEFT JOIN prices pr ON pr.variant_id = v.id AND pr.currency = ?1 AND pr.effective_until IS NULL " +
+  "LEFT JOIN ( " +
+  "  SELECT im.*, " +
+  "         ROW_NUMBER() OVER (PARTITION BY im.product_id ORDER BY im.position ASC, im.created_at ASC) AS rn " +
+  "  FROM media im " +
+  "  WHERE im.product_id IS NOT NULL " +
+  ") m ON m.product_id = p.id AND m.rn = 1 ";
+
+// Shape a decorated row to the exact output `_shapeDecoratedRow`
+// produces at the edge (worker/data/catalog.js): the product columns
+// plus `starting_price_minor` / `starting_price_currency` /
+// `hero_media`. No arithmetic — `starting_price_minor` is the raw
+// integer minor-unit amount passed through.
+function _shapeDecoratedRow(r) {
+  var hero = (r.hero_r2_key != null)
+    ? { r2_key: r.hero_r2_key, alt_text: r.hero_alt_text || "" }
+    : null;
+  return {
+    id:                      r.id,
+    slug:                    r.slug,
+    title:                   r.title,
+    description:             r.description,
+    status:                  r.status,
+    created_at:              r.created_at,
+    updated_at:              r.updated_at,
+    starting_price_minor:    r.starting_price_minor != null ? r.starting_price_minor : null,
+    starting_price_currency: r.starting_price_currency || "USD",
+    hero_media:              hero,
+  };
+}
+
+function _batchModule(query) {
+  // Default to USD when an unset / wrong-shape currency reaches a
+  // helper, matching the edge's `(len === 3) ? cur : "USD"` guard.
+  function _ccy(c) {
+    return (typeof c === "string" && c.length === 3) ? c : "USD";
+  }
+
+  return {
+    // Decorate a set of product ids in one query (backs PERF-5 home
+    // grid + PERF-1 related). Returns `{ rows, byId }`: `rows` carries
+    // one decorated row per matching id in `created_at`-stable order
+    // and `byId` maps id → row so the caller can re-impose its own
+    // order. Mirrors the edge `DECORATED_SELECT` + `_shapeDecoratedRow`.
+    decoratedProducts: async function (productIds, currency) {
+      if (!Array.isArray(productIds) || productIds.length === 0) return { rows: [], byId: {} };
+      var ids = productIds.map(function (id) { return _id(id, "product id"); });
+      var cur = _ccy(currency);
+      var placeholders = ids.map(function (_v, n) { return "?" + (n + 2); }).join(", ");
+      var params = [cur].concat(ids);
+      var r = await query(
+        _DECORATED_SELECT +
+        "WHERE p.id IN (" + placeholders + ") " +
+        "ORDER BY p.created_at ASC, p.id ASC",
+        params,
+      );
+      var rows = [];
+      var byId = {};
+      for (var i = 0; i < r.rows.length; i += 1) {
+        var shaped = _shapeDecoratedRow(r.rows[i]);
+        rows.push(shaped);
+        byId[shaped.id] = shaped;
+      }
+      return { rows: rows, byId: byId };
+    },
+
+    // Active products decorated in one query (backs PERF-5 / UX-8 home
+    // grid). Mirrors the edge `listActiveProducts`: status='active',
+    // ORDER BY updated_at DESC, id DESC, LIMIT/OFFSET. Returns
+    // `{ rows }`.
+    decoratedActive: async function (opts) {
+      opts = opts || {};
+      var cur = _ccy(opts.currency);
+      var limit  = opts.limit  == null ? 24 : opts.limit;
+      var offset = opts.offset == null ? 0  : opts.offset;
+      _positiveInt(limit, "limit");
+      _nonNegInt(offset, "offset");
+      var r = await query(
+        _DECORATED_SELECT +
+        "WHERE p.status = 'active' " +
+        "ORDER BY p.updated_at DESC, p.id DESC " +
+        "LIMIT ?2 OFFSET ?3",
+        [cur, limit, offset],
+      );
+      var rows = [];
+      for (var i = 0; i < r.rows.length; i += 1) rows.push(_shapeDecoratedRow(r.rows[i]));
+      return { rows: rows };
+    },
+
+    // Variants + their current price for a product in one query (backs
+    // PERF-3 PDP). Mirrors the edge `listVariantsWithPrices`: LEFT JOIN
+    // the active price (effective_until IS NULL) for `currency`,
+    // ordered position ASC, created_at ASC. Returns `{ rows, prices }`:
+    //   - `rows`   — the variant rows shaped like `variants.listForProduct`
+    //                (options_json parsed to `options`), price columns dropped
+    //                so the shape is byte-identical to the per-item path.
+    //   - `prices` — { variantId: priceRow } for variants that HAVE a
+    //                price in `currency`, each priceRow shaped like
+    //                `prices.current` output.
+    variantsWithPrices: async function (productId, currency) {
+      _id(productId, "product_id");
+      var cur = _ccy(currency);
+      var r = await query(
+        "SELECT v.*, " +
+        "       pr.id              AS price_id, " +
+        "       pr.amount_minor    AS price_amount_minor, " +
+        "       pr.currency        AS price_currency, " +
+        "       pr.effective_from  AS price_effective_from, " +
+        "       pr.effective_until AS price_effective_until, " +
+        "       pr.created_at      AS price_created_at " +
+        "FROM variants v " +
+        "LEFT JOIN prices pr ON pr.variant_id = v.id AND pr.currency = ?1 AND pr.effective_until IS NULL " +
+        "WHERE v.product_id = ?2 " +
+        "ORDER BY v.position ASC, v.created_at ASC",
+        [cur, productId],
+      );
+      var rows = [];
+      var prices = {};
+      for (var i = 0; i < r.rows.length; i += 1) {
+        var raw = r.rows[i];
+        // Lift the joined price into the per-variant prices map, shaped
+        // exactly like `prices.current` output (only when a price for
+        // `currency` exists), then strip the joined price columns off
+        // the variant row so the row shape is byte-identical to
+        // `variants.listForProduct` (the variant columns + parsed
+        // `options`). Deleting the extra keys in place preserves the
+        // row's identity/prototype so the two paths deep-equal.
+        if (raw.price_amount_minor != null) {
+          prices[raw.id] = {
+            id:              raw.price_id,
+            variant_id:      raw.id,
+            currency:        raw.price_currency,
+            amount_minor:    raw.price_amount_minor,
+            effective_from:  raw.price_effective_from,
+            effective_until: raw.price_effective_until,
+            created_at:      raw.price_created_at,
+          };
+        }
+        delete raw.price_id;
+        delete raw.price_amount_minor;
+        delete raw.price_currency;
+        delete raw.price_effective_from;
+        delete raw.price_effective_until;
+        delete raw.price_created_at;
+        raw.options = JSON.parse(raw.options_json);
+        rows.push(raw);
+      }
+      return { rows: rows, prices: prices };
+    },
+
+    // Inventory rows for a set of SKUs in one query, keyed by SKU
+    // (backs PERF-6 cart-line stock). Mirrors the edge
+    // `listInventoryForSkus`: the trimmed `{ stock_on_hand, stock_held }`
+    // shape — sufficient for the cart, which derives its low-stock band
+    // from an operator config value, not the per-SKU column. A SKU with
+    // no inventory row is absent from the map (the renderer treats
+    // absence as available). Missing-table-resilient → {}.
+    inventoryForSkus: async function (skus) {
+      if (!Array.isArray(skus) || skus.length === 0) return {};
+      var out = {};
+      try {
+        var placeholders = skus.map(function (_s, i) { return "?" + (i + 1); }).join(", ");
+        var r = await query(
+          "SELECT sku, stock_on_hand, stock_held FROM inventory WHERE sku IN (" + placeholders + ")",
+          skus,
+        );
+        for (var i = 0; i < r.rows.length; i += 1) {
+          out[r.rows[i].sku] = { stock_on_hand: r.rows[i].stock_on_hand, stock_held: r.rows[i].stock_held };
+        }
+      } catch (e) {
+        if (e && /no such table/i.test(e.message || "")) return {};
+        throw e;
+      }
+      return out;
+    },
+
+    // Full inventory rows for a set of SKUs in one query, keyed by SKU
+    // (backs PERF-3 PDP availability). Returns the SAME full-row shape
+    // `inventory.get` does (`SELECT *` → sku, stock_on_hand, stock_held,
+    // low_stock_threshold, updated_at), keeping the PDP's per-SKU
+    // inventory map byte-identical to the prior per-variant
+    // `inventory.get` loop. The PDP's availability resolver reads
+    // `low_stock_threshold` to surface the "Only N left" nudge, so the
+    // PDP needs the full row — the trimmed `inventoryForSkus` above is
+    // for the cart, which doesn't. A SKU with no inventory row is absent
+    // (renderer treats absence as available). Missing-table-resilient
+    // → {}.
+    inventoryRowsForSkus: async function (skus) {
+      if (!Array.isArray(skus) || skus.length === 0) return {};
+      var out = {};
+      try {
+        var placeholders = skus.map(function (_s, i) { return "?" + (i + 1); }).join(", ");
+        var r = await query(
+          "SELECT * FROM inventory WHERE sku IN (" + placeholders + ")",
+          skus,
+        );
+        for (var i = 0; i < r.rows.length; i += 1) {
+          out[r.rows[i].sku] = r.rows[i];
+        }
+      } catch (e) {
+        if (e && /no such table/i.test(e.message || "")) return {};
+        throw e;
+      }
+      return out;
+    },
+
+    // The facetable product universe for a set of search terms (backs
+    // PERF-2). Ported from the edge `searchFacetableProducts`: one
+    // decorated SELECT with an OR-of-LIKE term clause, then a
+    // collection_members `IN` (MANUAL membership only — see PD-1) +
+    // a grouped-inventory `IN`. Terms are deduped case-insensitively.
+    // Returns `{ rows }` where each row is the decorated shape PLUS
+    // `collection` (array of slugs), `price_minor` (int|null), and
+    // `in_stock` (bool) — the shape the faceting walker + search-card
+    // renderer consume. The collection + inventory reads are
+    // missing-table-resilient (a partially-migrated deploy degrades to
+    // the fields it has rather than 500ing search).
+    searchDecorate: async function (opts) {
+      opts = opts || {};
+      var terms = Array.isArray(opts.terms) ? opts.terms : [];
+      var dedup = {};
+      var cleaned = [];
+      for (var ti = 0; ti < terms.length; ti += 1) {
+        var term = typeof terms[ti] === "string" ? terms[ti].trim() : "";
+        if (!term.length || dedup[term.toLowerCase()]) continue;
+        dedup[term.toLowerCase()] = true;
+        cleaned.push(term);
+      }
+      if (!cleaned.length) return { rows: [] };
+      var cur = _ccy(opts.currency);
+      // Cap the candidate universe wider than the page so facet counts
+      // reflect the full match set. MAX_LIMIT keeps the in-memory facet
+      // walk bounded — matches the edge's MAX_LIMIT (100) cap.
+      var universeLimit = 100;
+
+      // One OR-of-LIKE clause per term. Positional params: ?1 is the
+      // price currency, ?2 the universe limit; term patterns start at ?3.
+      var likeClauses = [];
+      var params = [cur, universeLimit];
+      var ph = 3;
+      for (var c = 0; c < cleaned.length; c += 1) {
+        var pat = _likePattern(cleaned[c]);
+        likeClauses.push("lower(p.title) LIKE ?" + ph + " ESCAPE '\\'");
+        params.push(pat);
+        ph += 1;
+        likeClauses.push("lower(p.description) LIKE ?" + ph + " ESCAPE '\\'");
+        params.push(pat);
+        ph += 1;
+      }
+      var r = await query(
+        _DECORATED_SELECT +
+        "WHERE p.status = 'active' AND (" + likeClauses.join(" OR ") + ") " +
+        "ORDER BY p.updated_at DESC, p.id DESC LIMIT ?2",
+        params,
+      );
+      var raw = r.rows;
+      if (!raw.length) return { rows: [] };
+
+      var ids = raw.map(function (row) { return row.id; });
+      var byId = {};
+      var rows = [];
+      for (var i = 0; i < raw.length; i += 1) {
+        var shaped = _shapeDecoratedRow(raw[i]);
+        shaped.collection = [];
+        shaped.price_minor = shaped.starting_price_minor != null ? shaped.starting_price_minor : null;
+        shaped.in_stock = false;
+        byId[shaped.id] = shaped;
+        rows.push(shaped);
+      }
+
+      var placeholders = ids.map(function (_v, n) { return "?" + (n + 1); }).join(", ");
+
+      // Collection memberships — categorical facet field `collection`.
+      // MANUAL membership only (collection_members joined to a live
+      // collection), matching the edge. Smart-collection rule matches
+      // are intentionally NOT included (PD-1 convergence).
+      try {
+        var cmRes = await query(
+          "SELECT cm.product_id AS pid, cm.collection_slug AS slug " +
+          "FROM collection_members cm " +
+          "JOIN collections col ON col.slug = cm.collection_slug AND col.archived_at IS NULL " +
+          "WHERE cm.product_id IN (" + placeholders + ")",
+          ids,
+        );
+        for (var cm = 0; cm < cmRes.rows.length; cm += 1) {
+          var pr1 = byId[cmRes.rows[cm].pid];
+          if (pr1 && cmRes.rows[cm].slug) pr1.collection.push(cmRes.rows[cm].slug);
+        }
+      } catch (e) {
+        if (!(e && /no such table/i.test(e.message || ""))) throw e;
+      }
+
+      // In-stock — true when any variant SKU has available stock
+      // (stock_on_hand > stock_held). Boolean facet field `in_stock`.
+      try {
+        var invRes = await query(
+          "SELECT v.product_id AS pid, " +
+          "       MAX(CASE WHEN (inv.stock_on_hand - inv.stock_held) > 0 THEN 1 ELSE 0 END) AS any_stock " +
+          "FROM variants v " +
+          "JOIN inventory inv ON inv.sku = v.sku " +
+          "WHERE v.product_id IN (" + placeholders + ") " +
+          "GROUP BY v.product_id",
+          ids,
+        );
+        for (var iv = 0; iv < invRes.rows.length; iv += 1) {
+          var pr2 = byId[invRes.rows[iv].pid];
+          if (pr2) pr2.in_stock = Number(invRes.rows[iv].any_stock) === 1;
+        }
+      } catch (e2) {
+        if (!(e2 && /no such table/i.test(e2.message || ""))) throw e2;
+      }
+
+      return { rows: rows };
+    },
+
+    // "You may also like" siblings for a product, decorated in one
+    // query (backs PERF-1). Ported from the edge `listRelatedProducts`
+    // sibling SELECT: the other active members of `collectionSlug`
+    // (self excluded), ordered membership position ASC then product id
+    // ASC, capped at `limit`, each carrying its first variant's current
+    // price + first media row. Returns the exact
+    // `{ slug, title, hero_r2_key, hero_alt_text, price_minor,
+    // price_currency }` shape the rail renderer consumes. NOTE: this is
+    // ONLY the sibling decoration — the primary-collection lookup stays
+    // in the caller (it already has it).
+    relatedSiblings: async function (collectionSlug, excludeProductId, currency, limit) {
+      _slug(collectionSlug);
+      _id(excludeProductId, "product_id");
+      var cur = _ccy(currency);
+      var n = (Number.isInteger(limit) && limit > 0) ? limit : 4;
+      var r = await query(
+        "SELECT p.id AS id, p.slug AS slug, p.title AS title, " +
+        "       pr.amount_minor AS price_amount_minor, " +
+        "       pr.currency     AS price_currency, " +
+        "       m.r2_key        AS hero_r2_key, " +
+        "       m.alt_text      AS hero_alt_text " +
+        "FROM collection_members cm " +
+        "JOIN products p ON p.id = cm.product_id " +
+        "LEFT JOIN ( " +
+        "  SELECT iv.*, " +
+        "         ROW_NUMBER() OVER (PARTITION BY iv.product_id ORDER BY iv.position ASC, iv.created_at ASC) AS rn " +
+        "  FROM variants iv " +
+        ") v ON v.product_id = p.id AND v.rn = 1 " +
+        "LEFT JOIN prices pr ON pr.variant_id = v.id AND pr.currency = ?1 AND pr.effective_until IS NULL " +
+        "LEFT JOIN ( " +
+        "  SELECT im.*, " +
+        "         ROW_NUMBER() OVER (PARTITION BY im.product_id ORDER BY im.position ASC, im.created_at ASC) AS rn " +
+        "  FROM media im " +
+        "  WHERE im.product_id IS NOT NULL " +
+        ") m ON m.product_id = p.id AND m.rn = 1 " +
+        "WHERE cm.collection_slug = ?2 AND cm.product_id != ?3 AND p.status = 'active' " +
+        "ORDER BY cm.position ASC, cm.product_id ASC LIMIT ?4",
+        [cur, collectionSlug, excludeProductId, n],
+      );
+      return r.rows.map(function (row) {
+        return {
+          slug:           row.slug,
+          title:          row.title,
+          hero_r2_key:    row.hero_r2_key != null ? row.hero_r2_key : null,
+          hero_alt_text:  row.hero_r2_key != null ? (row.hero_alt_text || row.title) : null,
+          price_minor:    row.price_amount_minor != null ? row.price_amount_minor : null,
+          price_currency: row.price_currency || "USD",
+        };
+      });
+    },
+
+    // Variants for a set of SKUs in one query, keyed by SKU (backs
+    // PERF-9 bundle member-title batching). Returns a map sku → variant
+    // row shaped like `variants.bySku` output (options_json parsed to
+    // `options`). Used to collect every bundle member's owning product
+    // id in one hop instead of a per-member `variants.bySku`.
+    variantsBySkus: async function (skus) {
+      if (!Array.isArray(skus) || skus.length === 0) return {};
+      var unique = [];
+      var seen = Object.create(null);
+      for (var s = 0; s < skus.length; s += 1) {
+        var sk = skus[s];
+        if (typeof sk !== "string" || seen[sk]) continue;
+        seen[sk] = true;
+        unique.push(sk);
+      }
+      if (!unique.length) return {};
+      var placeholders = unique.map(function (_v, n) { return "?" + (n + 1); }).join(", ");
+      var r = await query(
+        "SELECT * FROM variants WHERE sku IN (" + placeholders + ")",
+        unique,
+      );
+      var out = {};
+      for (var i = 0; i < r.rows.length; i += 1) {
+        var row = r.rows[i];
+        row.options = JSON.parse(row.options_json);
+        out[row.sku] = row;
+      }
+      return out;
+    },
+
+    // Variants for a set of variant ids in one query, keyed by id
+    // (backs PERF-6 cart reprice). Returns a map id → variant row
+    // shaped like `variants.get` output (options_json parsed to
+    // `options`) — the same value the prior per-line `variants.get`
+    // returned, keyed by the stable variant_id the cart line carries.
+    variantsByIds: async function (variantIds) {
+      if (!Array.isArray(variantIds) || variantIds.length === 0) return {};
+      var unique = [];
+      var seen = Object.create(null);
+      for (var n = 0; n < variantIds.length; n += 1) {
+        var vid = variantIds[n];
+        if (typeof vid !== "string" || !vid.length || seen[vid]) continue;
+        seen[vid] = true;
+        unique.push(_id(vid, "variant id"));
+      }
+      if (!unique.length) return {};
+      var placeholders = unique.map(function (_v, i) { return "?" + (i + 1); }).join(", ");
+      var r = await query(
+        "SELECT * FROM variants WHERE id IN (" + placeholders + ")",
+        unique,
+      );
+      var out = {};
+      for (var i = 0; i < r.rows.length; i += 1) {
+        var row = r.rows[i];
+        row.options = JSON.parse(row.options_json);
+        out[row.id] = row;
+      }
+      return out;
+    },
+
+    // Products for a set of ids in one query, keyed by id (backs PERF-9
+    // bundle member-title batching). Returns a map id → product row.
+    productsByIds: async function (productIds) {
+      if (!Array.isArray(productIds) || productIds.length === 0) return {};
+      var ids = productIds.map(function (id) { return _id(id, "product id"); });
+      var placeholders = ids.map(function (_v, n) { return "?" + (n + 1); }).join(", ");
+      var r = await query(
+        "SELECT * FROM products WHERE id IN (" + placeholders + ")",
+        ids,
+      );
+      var out = {};
+      for (var i = 0; i < r.rows.length; i += 1) out[r.rows[i].id] = r.rows[i];
+      return out;
+    },
+  };
+}
+
 module.exports = {
   create: create,
 };

package/lib/product-bulk-ops.js

@@ -16,8 +16,8 @@
  *     bulkAdjustPrice    — apply a percent delta (e.g. -1500 bps for a
  *                          15% markdown) to every matched variant's
  *                          current price in the given currency. The new
- *                          amount is rounded half-away-from-zero in
- *                          minor units; the floor is 0 (no negative
+ *                          amount is rounded half-even in minor units
+ *                          via b.money; the floor is 0 (no negative
  *                          prices). Variants without a current price in
  *                          the target currency are skipped.
  *     bulkArchive        — set products.status='archived' on every
@@ -489,8 +489,9 @@ function create(opts) {
     // Apply a percent_bps delta to every matched variant's CURRENT
     // price in the given currency. Variants without a current price
     // in the target currency are skipped (they don't have a "before"
-    // amount to multiply against). The new amount is rounded with
-    // Math.round and floored at 0.
+    // amount to multiply against). The new amount = current ×
+    // (1 + percent_bps/10000), rounded half-even in minor units via
+    // b.money, and floored at 0.
     bulkAdjustPrice: async function (input) {
       if (!input || typeof input !== "object") throw new TypeError("productBulkOps.bulkAdjustPrice: input object required");
       var filter = input.filter;
@@ -501,11 +502,14 @@ function create(opts) {
       var variants = await _variantsForProducts(productIds);
       var affected = 0;
       var skipped = 0;
-      var multiplier = (10000 + input.percent_bps) / 10000;
       for (var i = 0; i < variants.length; i += 1) {
         var current = await catalog.prices.current(variants[i].id, input.currency);
         if (!current) { skipped += 1; continue; }
-        var next = Math.round(current.amount_minor * multiplier);
+        var next = Number(
+          b.money.fromMinorUnits(BigInt(current.amount_minor), input.currency)
+            .multiply([BigInt(10000 + input.percent_bps), 10000n], { rounding: "half-even" })
+            .toMinorUnits()
+        );
         if (next < 0) next = 0;
         await catalog.prices.set(variants[i].id, {
           currency:     input.currency,