@mohasinac/appkit 4.38.0 → 4.39.0

package/dist/_internal/server/features/digital-code/pool.js

@@ -0,0 +1,208 @@
+/**
+ * The digital-content pool for a `digital-code` listing.
+ *
+ * 🛑 THIS IS THE MISSING HALF OF THE FEATURE. Everything downstream already
+ * existed — `claimDigitalCodeForOrder` claims one at checkout, the buyer reveals
+ * it through `GET /api/orders/{id}/code`, a refund revokes unclaimed ones — but
+ * **nothing in the codebase had ever WRITTEN a row into the pool.** The one
+ * seller-facing route returned `501 "Digital code management is not implemented
+ * yet."` So every purchase of a digital-code listing hit
+ * `serverLogger.warn("claimDigitalCode: code pool exhausted")` and returned
+ * silently, the order completed normally, and the buyer's reveal panel answered
+ * 404. The seller form even has a "Code Pool Size" field, which made the pool
+ * look populated on the listing page while it was always empty.
+ *
+ * A "digital code" delivers digital CONTENT: a redemption string, a QR image, or
+ * a file. `contentKind` says which, defaulting to `"code"` so every pre-existing
+ * document keeps its meaning with no migration.
+ */
+import { getAdminDb } from "../../../../providers/db-firebase/admin";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring";
+import { ValidationError } from "../../../../errors";
+import { ORDER_FIELDS } from "../../../../constants/field-names";
+import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION, } from "../../../../features/products/schemas/firestore";
+/**
+ * Where a delivered asset's bytes live.
+ *
+ * Deliberately OUTSIDE every prefix the public media proxy knows how to resolve,
+ * and no `mediaAssets` row is ever created for it — a `mediaAssets` row is what
+ * mints a `/media/{shortId}` slug, and that slug is served without
+ * authentication. No row, no slug, no public URL.
+ */
+export const DIGITAL_CONTENT_PREFIX = "private/digital-content";
+/**
+ * 🛑 THE PERMISSION SPLIT, and the reason it is not simply "admins only".
+ *
+ * An image is the QR/voucher case and is the whole point of widening this from
+ * strings, so a seller must be able to add one — they are the person who has it.
+ * Any OTHER file type is admin-only to upload: the upload surface accepts bytes
+ * that will later be streamed to a buyer, and a `.html` renamed `.pdf` is stored
+ * XSS the moment anything renders it inline. Narrowing who can put a non-image
+ * file into that path is the cheap half of the defence; the magic-byte check and
+ * the forced `Content-Disposition: attachment` are the other half.
+ *
+ * READ is a third thing again and is not on this axis at all: whoever may
+ * upload, only the buyer who paid for that order (or staff) may download. See
+ * `assertCanDownloadCodeAsset`.
+ */
+export function assertCanUploadContentKind(kind, role) {
+    const isStaff = role === "admin" || role === "moderator" || role === "employee";
+    if (kind === "file" && !isStaff) {
+        throw new ValidationError("Only an administrator can attach a downloadable file to a listing. Sellers can attach a code or a QR image.");
+    }
+}
+function assertPoolEntryShape(input) {
+    if (input.contentKind === "code") {
+        if (!input.code || !input.code.trim()) {
+            throw new ValidationError("A code entry needs a code.");
+        }
+        return;
+    }
+    if (!input.assetPath) {
+        throw new ValidationError(`A ${input.contentKind} entry needs an uploaded asset.`);
+    }
+    /*
+     * Refuse anything outside the private prefix rather than "fixing it up".
+     * A caller that hands us `tmp/uploads/<uid>/x.png` is handing us a path the
+     * public proxy can already serve, and silently rewriting it would hide the
+     * mistake instead of surfacing it.
+     */
+    if (!input.assetPath.startsWith(`${DIGITAL_CONTENT_PREFIX}/`)) {
+        throw new ValidationError("Asset is not in the private digital-content store.");
+    }
+}
+/**
+ * Append entries to a product's pool and re-sync the two counters.
+ *
+ * `codePoolSize` and `codesAvailable` are recomputed from the subcollection, not
+ * incremented from the input — the seller form lets a human type `codePoolSize`
+ * by hand, so treating that number as authoritative would let the listing page
+ * advertise stock that does not exist. Counting is the only thing that cannot
+ * drift (Root Cause #42: a mirror is only as good as every writer of it).
+ */
+export async function addPoolEntries(entries) {
+    if (entries.length === 0)
+        throw new ValidationError("Nothing to add.");
+    const productId = entries[0].productId;
+    for (const e of entries) {
+        if (e.productId !== productId) {
+            throw new ValidationError("All entries must belong to the same listing.");
+        }
+        assertPoolEntryShape(e);
+    }
+    const db = getAdminDb();
+    const codesRef = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION);
+    const now = new Date();
+    const batch = db.batch();
+    for (const e of entries) {
+        const doc = {
+            productId,
+            code: e.contentKind === "code" ? e.code.trim() : "",
+            contentKind: e.contentKind,
+            status: "available",
+            createdAt: now,
+            updatedAt: now,
+            ...(e.assetPath ? { assetPath: e.assetPath } : {}),
+            ...(e.fileName ? { fileName: e.fileName } : {}),
+            ...(e.contentType ? { contentType: e.contentType } : {}),
+            ...(e.expiresAt ? { expiresAt: e.expiresAt } : {}),
+        };
+        batch.set(codesRef.doc(), doc);
+    }
+    await batch.commit();
+    const counts = await recountPool(productId);
+    return { added: entries.length, ...counts };
+}
+/**
+ * Recount the pool and write both counters onto the product.
+ *
+ * 🛑 `codesAvailable` HAD NO WRITER EITHER. `claimDigitalCodeForOrder` flips a
+ * code to `claimed` and never decrements it, so the counter only ever held
+ * whatever the seed or the seller typed. Since `hasCodesAvailable()` is what the
+ * availability predicate reads, a sold-out listing stayed "available" forever and
+ * a listing that never had codes still advertised stock. Both counters are
+ * derived here, so neither can drift from the subcollection.
+ */
+export async function recountPool(productId) {
+    const db = getAdminDb();
+    const codesRef = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION);
+    // Aggregation counts, not document reads — a pool can be large and this runs
+    // on every claim (Rule #6).
+    const [availableAgg, totalAgg] = await Promise.all([
+        codesRef.where(ORDER_FIELDS.STATUS, "==", "available").count().get(),
+        codesRef.count().get(),
+    ]);
+    const available = availableAgg.data().count;
+    const total = totalAgg.data().count;
+    try {
+        await db.collection(PRODUCT_COLLECTION).doc(productId).update({
+            "digitalCode.codesAvailable": available,
+            "digitalCode.codePoolSize": total,
+            updatedAt: new Date(),
+        });
+    }
+    catch (err) {
+        void normalizeError(err);
+        // Non-fatal: the pool itself is the source of truth and a stale counter only
+        // affects a badge. Failing the claim over it would be worse.
+        serverLogger.error("recountPool: counter write failed", { error: normalizeError(err).message, productId });
+    }
+    return { available, total };
+}
+/** The seller/admin view of a pool. Never returns `code` or `assetPath`. */
+export async function listPoolEntries(productId) {
+    const db = getAdminDb();
+    const snap = await db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION)
+        .orderBy(ORDER_FIELDS.CREATED_AT, "desc")
+        .limit(200)
+        .get();
+    /*
+     * 🛑 An ALLOW-LIST, not a spread-and-delete. The whole value of this
+     * subcollection is that the seller can see how many codes are left without
+     * seeing the codes, and a buyer's claimed code is not the seller's to read
+     * back either. Root Cause #70: a projection built by deleting keys publishes
+     * every field nobody thought to delete.
+     */
+    return snap.docs.map((d) => {
+        const c = d.data();
+        return {
+            id: d.id,
+            contentKind: c.contentKind ?? "code",
+            status: c.status,
+            ...(c.fileName ? { fileName: c.fileName } : {}),
+            ...(c.orderId ? { orderId: c.orderId } : {}),
+            ...(c.claimedAt ? { claimedAt: new Date(c.claimedAt).toISOString() } : {}),
+            ...(c.createdAt ? { createdAt: new Date(c.createdAt).toISOString() } : {}),
+        };
+    });
+}
+/**
+ * Remove an UNCLAIMED entry. A claimed one is somebody's purchase and deleting
+ * it would make their reveal 404 with no trace of what they bought.
+ */
+export async function deletePoolEntry(productId, codeId) {
+    const db = getAdminDb();
+    const ref = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION)
+        .doc(codeId);
+    const snap = await ref.get();
+    if (!snap.exists)
+        throw new ValidationError("Entry not found.");
+    if (snap.data().status === "claimed") {
+        throw new ValidationError("That entry has already been delivered to a buyer and cannot be removed.");
+    }
+    await ref.delete();
+    return recountPool(productId);
+}

package/dist/_internal/server/features/digital-code/upload.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Upload for delivered digital content.
+ *
+ * 🛑 A SEPARATE PIPELINE FROM `/api/media/*`, ON PURPOSE.
+ *
+ * The public media pipeline ends by creating a `mediaAssets` row, and that row
+ * IS the `/media/{shortId}` slug — which `GET /api/media/[...slug]` serves with
+ * no authentication at all. Reusing it for paid content and then "remembering
+ * not to publish the URL" is not a boundary; the slug exists the moment the row
+ * does. So this writes to `private/digital-content/...`, mints no row, and the
+ * bytes are only ever readable through `resolveCodeAssetForOrder`, which checks
+ * that the caller owns the order.
+ *
+ * Everything else about the flow is deliberately identical to the public one —
+ * a short-lived signed PUT so bytes never traverse the Next.js function (Rule
+ * #6 caps a request body at 4.5 MB), then a server-side finalize that verifies
+ * the file by its MAGIC BYTES rather than by what the client declared.
+ */
+import type { ProductCodeContentKind } from "../../../../features/products/schemas/firestore";
+/** The content kind a declared MIME maps to. */
+export declare function contentKindForMime(mime: string): ProductCodeContentKind;
+export interface SignDigitalContentInput {
+    productId: string;
+    fileName: string;
+    contentType: string;
+    size: number;
+}
+export interface SignedDigitalContent {
+    uploadUrl: string;
+    storagePath: string;
+    contentKind: ProductCodeContentKind;
+    expiresAt: string;
+}
+export declare function signDigitalContentUpload(input: SignDigitalContentInput): Promise<SignedDigitalContent>;
+export interface FinalizedDigitalContent {
+    storagePath: string;
+    contentType: string;
+    fileName: string;
+    contentKind: ProductCodeContentKind;
+    size: number;
+}
+/**
+ * Verify an uploaded object and return the facts a pool entry needs.
+ *
+ * 🛑 THE DECLARED MIME IS NOT EVIDENCE. `finalize` on the public pipeline exists
+ * for exactly this reason and returns a structured 422 `MIME_MISMATCH`; the same
+ * rule has to hold here, and matters more, because the output is handed to a
+ * paying buyer. A mismatch DELETES the object rather than leaving it in the
+ * bucket for a later caller to reference.
+ */
+export declare function finalizeDigitalContentUpload(storagePath: string, declaredContentType: string): Promise<FinalizedDigitalContent>;

package/dist/_internal/server/features/digital-code/upload.js

@@ -0,0 +1,144 @@
+/**
+ * Upload for delivered digital content.
+ *
+ * 🛑 A SEPARATE PIPELINE FROM `/api/media/*`, ON PURPOSE.
+ *
+ * The public media pipeline ends by creating a `mediaAssets` row, and that row
+ * IS the `/media/{shortId}` slug — which `GET /api/media/[...slug]` serves with
+ * no authentication at all. Reusing it for paid content and then "remembering
+ * not to publish the URL" is not a boundary; the slug exists the moment the row
+ * does. So this writes to `private/digital-content/...`, mints no row, and the
+ * bytes are only ever readable through `resolveCodeAssetForOrder`, which checks
+ * that the caller owns the order.
+ *
+ * Everything else about the flow is deliberately identical to the public one —
+ * a short-lived signed PUT so bytes never traverse the Next.js function (Rule
+ * #6 caps a request body at 4.5 MB), then a server-side finalize that verifies
+ * the file by its MAGIC BYTES rather than by what the client declared.
+ */
+import { randomUUID } from "node:crypto";
+import { getAdminStorage } from "../../../../providers/db-firebase";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring";
+import { ValidationError } from "../../../../errors";
+import { classifyMime, isAllowedMime, maxBytesFor, PDF_MAGIC, } from "../../../shared/media/limits";
+import { DIGITAL_CONTENT_PREFIX } from "./pool";
+/** Signed-PUT lifetime. Long enough for a slow upload, short enough to matter. */
+const SIGNED_URL_TTL_MS = 15 * 60 * 1000;
+/** Magic bytes are read from the head of the object; 4 KB is ample for every type. */
+const MAGIC_BYTE_WINDOW = 4096;
+/** The content kind a declared MIME maps to. */
+export function contentKindForMime(mime) {
+    return classifyMime(mime) === "image" ? "image" : "file";
+}
+export async function signDigitalContentUpload(input) {
+    if (!isAllowedMime(input.contentType)) {
+        throw new ValidationError(`Unsupported file type: ${input.contentType}`);
+    }
+    const kind = classifyMime(input.contentType);
+    if (kind === "video") {
+        // Video as a delivered good is a different product with different economics
+        // (egress on a 50 MB file, per download, on the Hobby tier). Refuse loudly
+        // rather than accept it and discover the bill.
+        throw new ValidationError("Video cannot be delivered as digital content.");
+    }
+    const max = maxBytesFor(input.contentType);
+    if (!(input.size > 0))
+        throw new ValidationError("Empty file.");
+    if (max !== null && input.size > max) {
+        throw new ValidationError("File is too large.");
+    }
+    /*
+     * A RANDOM object name, which is the opposite of the convention everywhere
+     * else in this codebase. Public media filenames are content-derived for SEO —
+     * and therefore guessable, which is precisely the property that must not hold
+     * for a paid good. The private prefix already means Storage's world-read rule
+     * cannot be reached through any app route, and an unguessable name means a
+     * leaked path is not a leaked catalogue.
+     */
+    const safeName = input.fileName.replace(/[^\w.\-]+/g, "_").slice(-80) || "asset";
+    const storagePath = `${DIGITAL_CONTENT_PREFIX}/${input.productId}/${randomUUID()}-${safeName}`;
+    const expires = Date.now() + SIGNED_URL_TTL_MS;
+    const [uploadUrl] = await getAdminStorage()
+        .bucket()
+        .file(storagePath)
+        .getSignedUrl({
+        version: "v4",
+        action: "write",
+        expires,
+        contentType: input.contentType,
+    });
+    return {
+        uploadUrl,
+        storagePath,
+        contentKind: contentKindForMime(input.contentType),
+        expiresAt: new Date(expires).toISOString(),
+    };
+}
+/**
+ * Verify an uploaded object and return the facts a pool entry needs.
+ *
+ * 🛑 THE DECLARED MIME IS NOT EVIDENCE. `finalize` on the public pipeline exists
+ * for exactly this reason and returns a structured 422 `MIME_MISMATCH`; the same
+ * rule has to hold here, and matters more, because the output is handed to a
+ * paying buyer. A mismatch DELETES the object rather than leaving it in the
+ * bucket for a later caller to reference.
+ */
+export async function finalizeDigitalContentUpload(storagePath, declaredContentType) {
+    if (!storagePath.startsWith(`${DIGITAL_CONTENT_PREFIX}/`)) {
+        throw new ValidationError("Not a digital-content upload path.");
+    }
+    const file = getAdminStorage().bucket().file(storagePath);
+    const [exists] = await file.exists();
+    if (!exists)
+        throw new ValidationError("Upload not found.");
+    const [meta] = await file.getMetadata();
+    const size = Number(meta.size ?? 0);
+    const declaredKind = classifyMime(declaredContentType);
+    if (!declaredKind) {
+        await file.delete({ ignoreNotFound: true });
+        throw new ValidationError("Unsupported file type.");
+    }
+    const max = maxBytesFor(declaredContentType);
+    if (size <= 0 || (max !== null && size > max)) {
+        await file.delete({ ignoreNotFound: true });
+        throw new ValidationError("File is empty or too large.");
+    }
+    const [head] = await file.download({ start: 0, end: MAGIC_BYTE_WINDOW - 1 });
+    let detectedKind = null;
+    try {
+        const { fileTypeFromBuffer } = await import("file-type");
+        const detected = await fileTypeFromBuffer(head);
+        detectedKind = detected ? classifyMime(detected.mime) : null;
+        if (!detectedKind && head.subarray(0, PDF_MAGIC.length).toString("latin1") === PDF_MAGIC) {
+            detectedKind = "pdf";
+        }
+    }
+    catch (err) {
+        const normalized = normalizeError(err);
+        /*
+         * Detection FAILING is treated exactly like detection DISAGREEING — the
+         * check below sees `detectedKind === null` and deletes the object. So this
+         * catch cannot hide a bad upload; it only records why the prover gave up
+         * (a corrupt head, or file-type failing to load). Logging it matters
+         * because a systematic failure here would look like "every upload is
+         * malformed" to the person uploading.
+         */
+        serverLogger.warn("digital-content: magic-byte detection failed", {
+            error: normalized.message,
+            storagePath,
+        });
+    }
+    if (!detectedKind || detectedKind !== declaredKind) {
+        await file.delete({ ignoreNotFound: true });
+        throw new ValidationError("The uploaded file is not the type it claims to be, so it was discarded.");
+    }
+    const fileName = storagePath.split("/").pop().replace(/^[0-9a-f-]{36}-/, "");
+    return {
+        storagePath,
+        contentType: declaredContentType,
+        fileName,
+        contentKind: contentKindForMime(declaredContentType),
+        size,
+    };
+}

package/dist/_internal/server/jobs/core/cleanupRtdbEvents.js

@@ -1,10 +1,18 @@
 import { normalizeError } from "../../../../errors/normalize";
 import { getAdminAuth, getAdminRealtimeDb } from "../../../../providers/db-firebase";
+import { RTDB_PATHS } from "../../../../providers/db-firebase/rtdb-paths";
 import { jobsRepository } from "../../../../repositories";
 import { batchDelete } from "../handlers/_helpers";
 const AUTH_STALE_MS = 3 * 60 * 1000;
 const PAYMENT_STALE_MS = 15 * 60 * 1000;
 const BULK_STALE_MS = 15 * 60 * 1000;
+/**
+ * Longer than the other three on purpose: a tester batch can take ten minutes
+ * between triggering a send and asserting on it, and a ping deleted mid-batch
+ * would read as "no email was sent" — the exact false negative these records
+ * exist to prevent.
+ */
+const EMAIL_STALE_MS = 60 * 60 * 1000;
 const JOBS_TTL_DAYS = 30;
 export async function runCleanupRtdbEvents(ctx) {
     ctx.logger.info("Starting RTDB events cleanup");
@@ -68,6 +76,38 @@ export async function runCleanupRtdbEvents(ctx) {
         void normalizeError(bulkErr);
         ctx.logger.error("Bulk events cleanup failed (non-fatal)", bulkErr);
     }
+    /*
+     * Tester email pings. Written only for the harness mailbox (see
+     * `send-recorder.ts`), so this is normally a no-op — but an unpruned RTDB
+     * channel is precisely the thing that quietly accumulates, and the Firebase
+     * budget notes `auction-bids/*` as the one family with no TTL. Do not make it
+     * the second.
+     *
+     * The Firestore row is the record and is NOT touched here; this only clears the
+     * ping.
+     */
+    try {
+        const emailSnap = await rtdb.ref(RTDB_PATHS.EMAIL_EVENTS).get();
+        if (emailSnap.exists()) {
+            const allEmailEvents = emailSnap.val();
+            const staleEmailIds = Object.entries(allEmailEvents)
+                .filter(([, node]) => {
+                const at = node.at ? Date.parse(node.at) : 0;
+                // An unparseable or missing timestamp is stale by definition: it can
+                // never age out on its own, so leaving it would pin the node forever.
+                return !Number.isFinite(at) || at === 0 || at < now - EMAIL_STALE_MS;
+            })
+                .map(([id]) => id);
+            if (staleEmailIds.length > 0) {
+                await Promise.all(staleEmailIds.map((id) => rtdb.ref(`${RTDB_PATHS.EMAIL_EVENTS}/${id}`).remove()));
+                ctx.logger.info("Email event pings removed", { count: staleEmailIds.length });
+            }
+        }
+    }
+    catch (emailErr) {
+        void normalizeError(emailErr);
+        ctx.logger.error("Email events cleanup failed (non-fatal)", emailErr);
+    }
     try {
         const staleJobRefs = await jobsRepository.getStaleFinishedRefs(JOBS_TTL_DAYS);
         if (staleJobRefs.length > 0) {

package/dist/_internal/server/jobs/core/countersReconcile.js

@@ -1,57 +1,170 @@
 import { normalizeError } from "../../../../errors/normalize";
 import { categoriesRepository, reviewRepository, storeRepository, } from "../../../../repositories";
 import { ProductStatusValues, PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore";
+import { CATEGORIES_COLLECTION } from "../../../../features/categories/schemas/firestore";
 import { ORDER_FIELDS, PRODUCT_FIELDS } from "../../../../constants/field-names";
 import { QUERY_LIMIT } from "../handlers/messages";
 const STORES_COLLECTION = "stores";
 const ORDERS_COLLECTION = "orders";
+/** Page size for the products scan. Bounded reads, unbounded total coverage. */
+const PAGE_SIZE = 500;
+const emptyTally = () => ({
+    productIds: [],
+    auctionIds: [],
+    totalProducts: 0,
+    totalAuctions: 0,
+});
+/** Filed DIRECTLY under this row — `metrics.productCount` / `auctionCount`. */
+function countOwn(t, productId, isAuction) {
+    if (isAuction)
+        t.auctionIds.push(productId);
+    else
+        t.productIds.push(productId);
+}
+/** This row or any ancestor — `metrics.totalProductCount` / `totalAuctionCount`. */
+function countRollup(t, isAuction) {
+    if (!t)
+        return;
+    if (isAuction)
+        t.totalAuctions++;
+    else
+        t.totalProducts++;
+}
+/**
+ * Fold one published product into the tallies.
+ *
+ * A named function rather than an inner block: this is the only place the
+ * own-vs-rollup distinction is actually APPLIED, and burying it four levels deep
+ * inside a paginating loop is how it stopped being visible last time.
+ * Returns true when the product names a category nothing recognises.
+ */
+function tallyProduct(productId, data, tallies, parentsOf) {
+    const isAuction = data.listingType === PRODUCT_FIELDS.LISTING_TYPE_VALUES.AUCTION;
+    // `category` is @deprecated in favour of `categorySlugs[]`; mirror the live
+    // trigger's selection exactly so the two agree (onProductWrite.ts).
+    const leaf = (Array.isArray(data.categorySlugs) && data.categorySlugs[0]) ||
+        data.category ||
+        null;
+    let unknown = false;
+    if (leaf && !tallies.has(leaf)) {
+        unknown = true;
+    }
+    else if (leaf) {
+        countOwn(tallies.get(leaf), productId, isAuction);
+        // Roll up through self + every ancestor. `parentIds` already holds the
+        // WHOLE chain, so this is one pass rather than a walk.
+        for (const id of [leaf, ...(parentsOf.get(leaf) ?? [])]) {
+            countRollup(tallies.get(id), isAuction);
+        }
+    }
+    // Brands are a flat dimension: a brand row has no product children of its own
+    // beyond what points at it, so own === total by construction — which is why
+    // it is counted on both axes at once.
+    if (data.brandSlug && tallies.has(data.brandSlug)) {
+        countOwn(tallies.get(data.brandSlug), productId, isAuction);
+        countRollup(tallies.get(data.brandSlug), isAuction);
+    }
+    return unknown;
+}
+/**
+ * Recount every category and brand row from the products collection.
+ *
+ * 🛑 THREE THINGS THIS HAS TO GET RIGHT, each of which the previous version
+ * got wrong, and none of which produced an error:
+ *
+ * 1. **Own vs rollup are different numbers.** `metrics.productCount` is what is
+ *    filed directly under a row; `metrics.totalProductCount` is that plus every
+ *    descendant. The old code passed one number for both — see `setMetrics`'s
+ *    header for the full account and the 19-of-65 measurement.
+ *
+ * 2. **Every row is written, including the ones that are now empty.** The old
+ *    code built its map from products that EXIST, so a category whose last item
+ *    was deleted was never visited and kept its stale count forever. Seeding
+ *    `tallies` from the category list instead of from the products is the whole
+ *    fix, and it is why the loop below walks `parentsOf` rather than `tallies`
+ *    entries.
+ *
+ * 3. **Brands are counted too.** Brands are `categoryType:"brand"` rows in this
+ *    same collection and `BrandDetailPageView` reads `metrics.productCount` off
+ *    them — but nothing has ever written it. They hang off `brandSlug`, not off
+ *    the category chain, so they get their own pass.
+ *
+ * Reads are bounded by pagination rather than by `.limit(QUERY_LIMIT)`, which
+ * silently recounted a subset the moment the catalogue passed 1,000 published
+ * rows — a truncated recount is indistinguishable from a correct one.
+ */
 async function reconcileCategories(ctx) {
-    const snap = await ctx.db
-        .collection(PRODUCT_COLLECTION)
-        .where(ORDER_FIELDS.STATUS, "==", ProductStatusValues.PUBLISHED)
-        .limit(QUERY_LIMIT)
-        .get();
-    ctx.logger.info(`[categories] ${snap.size} published products found`);
-    const leafCounts = {};
-    for (const doc of snap.docs) {
-        const data = doc.data();
-        // `category` is @deprecated in favor of `categorySlugs[]` — mirrors the
-        // same effective-category selection as onProductWrite.ts's live trigger
-        // so the nightly reconcile agrees with real-time updates instead of
-        // silently no-op'ing on products written via categorySlugs-only paths.
-        const catId = Array.isArray(data.categorySlugs) && data.categorySlugs.length > 0
-            ? data.categorySlugs[0]
-            : data.category;
-        if (!catId)
-            continue;
-        if (!leafCounts[catId])
-            leafCounts[catId] = { productIds: [], auctionIds: [] };
-        if (data.listingType === PRODUCT_FIELDS.LISTING_TYPE_VALUES.AUCTION)
-            leafCounts[catId].auctionIds.push(doc.id);
-        else
-            leafCounts[catId].productIds.push(doc.id);
+    // Every category row, so rows that dropped to zero are still reset.
+    const catSnap = await ctx.db.collection(CATEGORIES_COLLECTION).get();
+    const parentsOf = new Map();
+    for (const d of catSnap.docs) {
+        parentsOf.set(d.id, d.data().parentIds ?? []);
     }
-    const ancestorAggregates = {};
-    let leafUpdated = 0;
-    for (const [catId, { productIds, auctionIds }] of Object.entries(leafCounts)) {
-        await categoriesRepository.setMetrics(catId, productIds.length, auctionIds.length, productIds, auctionIds);
-        leafUpdated++;
-        const parentIds = (await categoriesRepository.findById(catId))?.parentIds ?? [];
-        for (const ancestorId of parentIds) {
-            if (!ancestorAggregates[ancestorId]) {
-                ancestorAggregates[ancestorId] = { productDelta: 0, auctionDelta: 0 };
+    const tallies = new Map();
+    for (const id of parentsOf.keys())
+        tallies.set(id, emptyTally());
+    let scanned = 0;
+    let unknownCategory = 0;
+    let cursor = null;
+    for (;;) {
+        let q = ctx.db
+            .collection(PRODUCT_COLLECTION)
+            .where(ORDER_FIELDS.STATUS, "==", ProductStatusValues.PUBLISHED)
+            .orderBy("__name__")
+            .limit(PAGE_SIZE);
+        if (cursor)
+            q = q.startAfter(cursor);
+        const page = await q.get();
+        if (page.empty)
+            break;
+        for (const doc of page.docs) {
+            scanned++;
+            if (tallyProduct(doc.id, doc.data(), tallies, parentsOf)) {
+                unknownCategory++;
             }
-            ancestorAggregates[ancestorId].productDelta += productIds.length;
-            ancestorAggregates[ancestorId].auctionDelta += auctionIds.length;
         }
+        cursor = page.docs[page.docs.length - 1];
+        if (page.size < PAGE_SIZE)
+            break;
     }
-    const ancestorEntries = Object.entries(ancestorAggregates);
-    for (const [ancestorId, { productDelta, auctionDelta }] of ancestorEntries) {
-        await categoriesRepository.setMetrics(ancestorId, productDelta, auctionDelta, [], []);
+    let written = 0;
+    let drifted = 0;
+    for (const doc of catSnap.docs) {
+        const t = tallies.get(doc.id) ?? emptyTally();
+        const m = doc.data().metrics ?? {};
+        const same = (m.productCount ?? 0) === t.productIds.length &&
+            (m.auctionCount ?? 0) === t.auctionIds.length &&
+            (m.totalProductCount ?? 0) === t.totalProducts &&
+            (m.totalAuctionCount ?? 0) === t.totalAuctions;
+        // Skipping no-op writes keeps a 65-row nightly pass near-free against the
+        // 20k/day write budget — and makes `drifted` a real signal rather than a
+        // count of how many rows exist. A non-zero `drifted` on a quiet day means
+        // the live trigger missed something.
+        if (same)
+            continue;
+        drifted++;
+        try {
+            await categoriesRepository.setMetrics(doc.id, {
+                productCount: t.productIds.length,
+                auctionCount: t.auctionIds.length,
+                totalProductCount: t.totalProducts,
+                totalAuctionCount: t.totalAuctions,
+                productIds: t.productIds,
+                auctionIds: t.auctionIds,
+            });
+            written++;
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.error(`[categories] setMetrics failed for ${doc.id}`, err);
+        }
     }
     ctx.logger.info("[categories] reconciliation complete", {
-        leafCategoriesUpdated: leafUpdated,
-        ancestorCategoriesUpdated: ancestorEntries.length,
+        categoryRows: catSnap.size,
+        publishedProductsScanned: scanned,
+        drifted,
+        written,
+        unknownCategory,
     });
 }
 async function reconcileStores(ctx) {