@mohasinac/appkit 4.47.0 → 4.48.0

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -505,7 +505,7 @@ const rawTesterChecklistItems = [
                 {
                     key: "tester-fixtures-hidden-from-the-public",
                     label: "SIGNED OUT, no product on /products has an id containing \"tester\" — the sandbox is invisible to the public",
-                    description: "Fixed 2026-09-01. BEFORE: the public products endpoint had no viewer concept, so an ANONYMOUS caller got 25 tester fixtures in its first 40 rows — stickers-beyblade-original-classic-sheet, prizedraw-beyblade-metal-closed-revealed, live-golden-retriever-puppy — and they filled the public marketplace. AFTER: open /products in a private window and scan the grid; nothing should be named \"Tester …\". Then sign in AS A TESTER and reload — the sandbox items must come back. Both halves matter: hiding them from everyone would break the tester programme, and a fixture that never reappears is the opposite bug.",
+                    description: "Fixed 2026-09-01. BEFORE: the public products endpoint had no viewer concept, so an ANONYMOUS caller got 25 tester fixtures in its first 40 rows — sticker-beyblade-original-classic-sheet, prizedraw-beyblade-metal-closed-revealed, live-golden-retriever-puppy — and they filled the public marketplace. AFTER: open /products in a private window and scan the grid; nothing should be named \"Tester …\". Then sign in AS A TESTER and reload — the sandbox items must come back. Both halves matter: hiding them from everyone would break the tester programme, and a fixture that never reappears is the opposite bug.",
                     href: "/products",
                 },
                 {
@@ -3519,6 +3519,69 @@ const rawTesterChecklistItems = [
         },
     ]),
     ...group("community-support", "Community & Support", [
+        {
+            /*
+             * D9 chat. 🛑 Chat is OFF by default (`siteSettings.chat.enabled`, and
+             * `undefined` reads as off), so case 1 asserts the off-state and case 2
+             * turns it on — every case after depends on that order. Steps live in
+             * ./authored/community-support__messages.ts.
+             */
+            pageKey: "messages",
+            pageLabel: "Messages (chat)",
+            href: "/messages",
+            cases: [
+                {
+                    key: "chat-off-hides-everything",
+                    label: "With chat disabled, no Message Seller button, no header icon, and no unread-count request — absent, not disabled",
+                    description: "The baseline. `siteSettings.chat.enabled` is undefined on a fresh seed and must read as OFF. A feature that half-renders when disabled is the shape the original chat died of.",
+                },
+                {
+                    key: "enable-chat-reveals-entry-points",
+                    label: "Turning the Chat setting on makes both entry points appear with no code change or redeploy",
+                },
+                {
+                    key: "message-seller-creates-thread",
+                    label: "Message Seller creates ONE conversation, and clicking it again reuses that same thread rather than making a second",
+                    description: "A conversation is between two USERS, not per listing — a buyer with three questions about three items gets one thread. The storeId→ownerId resolution happens server-side because a product page never knows the owner's Auth UID.",
+                },
+                {
+                    key: "send-and-recipient-sees-it",
+                    label: "A sent message reaches the other participant with an unread badge, and opening the thread clears it",
+                    roles: ["buyer", "seller"],
+                },
+                {
+                    key: "pii-is-stripped-from-the-body",
+                    label: "A phone number, a dotted VPA and a bare name@bank VPA are ALL redacted before the message is stored",
+                    description: "The rule order is the fix: specific before general. A bare `name@bank` has no TLD dot so it matches neither the email nor the phone rule, and running phone first mangles `9876543210@upi` before the UPI rule sees it.",
+                },
+                {
+                    key: "retry-does-not-double-post",
+                    label: "Retrying a failed send posts the SAME message once, never a duplicate",
+                    description: "clientMessageId is generated once at compose time, not per attempt, and is the message's document id — so a replay resolves to the existing document.",
+                },
+                {
+                    key: "soft-ban-blocks-sending",
+                    label: "A user soft-banned from 'Send messages' is refused with the ban's own reason",
+                    description: "send_messages was a live BannedAction with NO reader anywhere — an admin could set it and nothing checked it. The check now lives in the domain function so every caller is covered.",
+                    roles: ["admin", "buyer"],
+                },
+                {
+                    key: "block-stops-the-other-side",
+                    label: "Blocking a participant refuses their next message with a clear reason, and leaves existing history readable",
+                    roles: ["buyer", "seller"],
+                },
+                {
+                    key: "live-ping-surfaces-failure",
+                    label: "When the realtime channel cannot connect, a visible warning says so — the failure is never swallowed",
+                    description: "THE control for the bug that killed the old feature: it swallowed permission-denied into setIsConnected(false) and a literal `// ignore`, so the channel looked implemented and was inert for its whole life. The message is still delivered; only the live notification is lost.",
+                },
+                {
+                    key: "inbox-read-is-bounded",
+                    label: "The inbox and thread reads are both cursor-paginated and capped — open 50 threads and the read count does not scale with them",
+                    description: "The negative control. The absence of a .limit() is literally what turned 20 messages into ~1,600 reads the first time this existed. Visible only in the network panel, never on the rendered page.",
+                },
+            ],
+        },
         {
             pageKey: "support-tickets",
             pageLabel: "Support Tickets",

package/dist/index.d.ts

@@ -652,8 +652,8 @@ export { groupedListingsSeedData } from "./seed/index";
 export type { CouponDiscountType } from "./seed/index";
 export type { FirestoreIndexConfig } from "./seed/index";
 export type { HomepageSectionType } from "./seed/index";
-export type { NotificationType } from "./features/admin/schemas/firestore";
-export { NOTIFICATION_TYPE_VALUES } from "./features/admin/schemas/firestore";
+export type { NotificationType, NotificationRelatedType } from "./features/admin/schemas/firestore";
+export { NOTIFICATION_TYPE_VALUES, NOTIFICATION_RELATED_TYPE_VALUES } from "./features/admin/schemas/firestore";
 export type { PayoutStatus } from "./seed/index";
 export type { SeedAddressDocument } from "./seed/index";
 export type { SeedBaseOrderDocument } from "./seed/index";
@@ -3228,3 +3228,9 @@ export { resolveReturnAddress, RTO_ENTRY_CUSTODY, rtoCostBearer, RETURN_ABUSE_SC
 export type { ReturnAddressResolution, ResolveReturnAddressInput, ReturnAbuseSignal, ReturnAbuseCounters, RtoCostBearer, } from "./_internal/shared/features/returns/destination";
 export { COURIER_RATING_MIN_CONFIDENT_SAMPLES, courierRatingDisplay, isValidCourierVote, courierVoteId, rollUpCourierVotes, } from "./_internal/shared/features/shipping/courier-rating";
 export type { CourierRatingPair, CourierRatingDisplay, CourierRatingVote, CourierStats, } from "./_internal/shared/features/shipping/courier-rating";
+/**
+ * D9 — chat. Plain data types, safe for client components that render a
+ * conversation/message prop — the write path (actions) stays server-only, see
+ * server.ts.
+ */
+export type { ConversationDocument, ConversationStatus, ConversationLastMessage, ParticipantRole, MessageDocument, MessageProductRef, } from "./features/messages/schemas/firestore";

package/dist/index.js

@@ -1364,7 +1364,7 @@ export { historySeedData } from "./seed/index.js";
 // SB-UNI-B â€" sublistingCategoriesSeedData merged into categoriesSeedData with categoryType:"sublisting".
 // groupedListingsSeedData - Model for grouped listings seed data.
 export { groupedListingsSeedData } from "./seed/index.js";
-export { NOTIFICATION_TYPE_VALUES } from "./features/admin/schemas/firestore.js";
+export { NOTIFICATION_TYPE_VALUES, NOTIFICATION_RELATED_TYPE_VALUES } from "./features/admin/schemas/firestore.js";
 // [UTIL]-Pure utility â€" no framework or runtime dependency; safe to import from any environment.
 // ErrorCategory - Shared export for error category.
 export { ErrorCategory } from "./monitoring/index.js";

package/dist/next/routing/route-map.d.ts

@@ -86,6 +86,10 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly HOW_REVIEWS_WORK: "/how-reviews-work";
         readonly HOW_PAYOUTS_WORK: "/how-payouts-work";
         readonly FEES: "/fees";
+        readonly GST: "/gst";
+        readonly SPOT_A_FAKE: "/spot-a-fake";
+        readonly GUIDES: "/guides";
+        readonly CITY_COLLECTIBLES: (city: string) => string;
         readonly EVENTS: "/events";
         readonly EVENT_DETAIL: (id: string) => string;
         readonly EVENT_PARTICIPATE: (id: string) => string;
@@ -175,6 +179,9 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly CATALOGUE: "/user/catalogue";
         readonly CATALOGUE_NEW: "/user/catalogue/new";
         readonly CATALOGUE_EDIT: (id: string) => string;
+        /** D9 — one universal inbox, same real-top-level-path precedent as WISHLIST/CART. */
+        readonly MESSAGES: "/messages";
+        readonly MESSAGE_THREAD: (conversationId: string) => string;
     };
     readonly STORE: {
         readonly DASHBOARD: "/store";
@@ -493,6 +500,10 @@ export declare const ROUTES: {
         readonly HOW_REVIEWS_WORK: "/how-reviews-work";
         readonly HOW_PAYOUTS_WORK: "/how-payouts-work";
         readonly FEES: "/fees";
+        readonly GST: "/gst";
+        readonly SPOT_A_FAKE: "/spot-a-fake";
+        readonly GUIDES: "/guides";
+        readonly CITY_COLLECTIBLES: (city: string) => string;
         readonly EVENTS: "/events";
         readonly EVENT_DETAIL: (id: string) => string;
         readonly EVENT_PARTICIPATE: (id: string) => string;
@@ -582,6 +593,9 @@ export declare const ROUTES: {
         readonly CATALOGUE: "/user/catalogue";
         readonly CATALOGUE_NEW: "/user/catalogue/new";
         readonly CATALOGUE_EDIT: (id: string) => string;
+        /** D9 — one universal inbox, same real-top-level-path precedent as WISHLIST/CART. */
+        readonly MESSAGES: "/messages";
+        readonly MESSAGE_THREAD: (conversationId: string) => string;
     };
     readonly STORE: {
         readonly DASHBOARD: "/store";

package/dist/next/routing/route-map.js

@@ -79,6 +79,29 @@ export const DEFAULT_ROUTE_MAP = {
         HOW_REVIEWS_WORK: "/how-reviews-work",
         HOW_PAYOUTS_WORK: "/how-payouts-work",
         FEES: "/fees",
+        /*
+         * D6b — the GST explainer. A differentiator rather than table stakes:
+         * exactly ONE of the seventeen crawled Indian collectibles sites states
+         * tax-inclusive pricing to the buyer in words, and sixteen say nothing.
+         */
+        GST: "/gst",
+        /*
+         * D6 — the anti-counterfeit guide. Framed on what the crawl actually
+         * measured: the biggest copy-seller in this market makes no authenticity
+         * claim at all, so the signals are silence + price, then code, then weight.
+         */
+        SPOT_A_FAKE: "/spot-a-fake",
+        /* D6 — the content hub. Fourteen explainers whose only entry point was the
+         * footer; a footer link is reachable but it is not a destination, so it
+         * cannot rank and gives a crawler no page establishing the cluster. */
+        GUIDES: "/guides",
+        /*
+         * D5 — local SEO, one page per city a classified listing actually names.
+         * 🛑 STATIC (`generateStaticParams`): a city page that awaited
+         * `searchParams` would be dynamic, and this is the surface most likely to
+         * be crawled widely (Root Cause #94).
+         */
+        CITY_COLLECTIBLES: (city) => `/collectibles/${city}`,
         EVENTS: "/events",
         EVENT_DETAIL: (id) => `/events/${id}`,
         EVENT_PARTICIPATE: (id) => `/events/${id}/participate`,
@@ -197,6 +220,9 @@ export const DEFAULT_ROUTE_MAP = {
         CATALOGUE: "/user/catalogue",
         CATALOGUE_NEW: "/user/catalogue/new",
         CATALOGUE_EDIT: (id) => `/user/catalogue/${id}/edit`,
+        /** D9 — one universal inbox, same real-top-level-path precedent as WISHLIST/CART. */
+        MESSAGES: "/messages",
+        MESSAGE_THREAD: (conversationId) => `/messages/${conversationId}`,
     },
     STORE: {
         DASHBOARD: "/store",

package/dist/providers/db-firebase/rtdb-paths.d.ts

@@ -26,4 +26,12 @@ export declare const RTDB_PATHS: {
      * `cleanupRtdbEvents` alongside the other three.
      */
     readonly EMAIL_EVENTS: "email_events";
+    /**
+     * D9 — new-message ping per conversation. RTDB-ping-plus-REST: the actual
+     * message content never crosses this channel, only "something changed,
+     * refetch" — `firestore.rules` forbids client Firestore access entirely, so
+     * this plus the bounded REST route is the only option, not a cost choice.
+     * Pruned by `cleanupRtdbEvents`'s sixth block.
+     */
+    readonly CHAT_EVENTS: "chat_events";
 };

package/dist/providers/db-firebase/rtdb-paths.js

@@ -26,4 +26,12 @@ export const RTDB_PATHS = {
      * `cleanupRtdbEvents` alongside the other three.
      */
     EMAIL_EVENTS: "email_events",
+    /**
+     * D9 — new-message ping per conversation. RTDB-ping-plus-REST: the actual
+     * message content never crosses this channel, only "something changed,
+     * refetch" — `firestore.rules` forbids client Firestore access entirely, so
+     * this plus the bounded REST route is the only option, not a cost choice.
+     * Pruned by `cleanupRtdbEvents`'s sixth block.
+     */
+    CHAT_EVENTS: "chat_events",
 };

package/dist/repositories/index.d.ts

@@ -64,3 +64,4 @@ export { MediaAssetsRepository, mediaAssetsRepository, } from "../features/media
 export type { MediaAssetDocument, MediaAssetCreateInput, } from "../features/media/repository/media-assets.repository";
 export { PageViewsRepository, pageViewsRepository, PAGE_VIEW_ENTITY_TYPES, } from "../features/analytics/repository/page-views.repository";
 export type { PageViewDocument, PageViewEntityType, RecordPageViewInput, } from "../features/analytics/repository/page-views.repository";
+export { ConversationsRepository, conversationsRepository, } from "../features/messages/repository/conversations.repository";

package/dist/repositories/index.js

@@ -77,3 +77,7 @@ export { LotteryEntryRepository, lotteryEntryRepository, } from "../features/lot
 // Media assets — short ID → storagePath mapping for SEO-friendly /media/{id} URLs
 export { MediaAssetsRepository, mediaAssetsRepository, } from "../features/media/repository/media-assets.repository.js";
 export { PageViewsRepository, pageViewsRepository, PAGE_VIEW_ENTITY_TYPES, } from "../features/analytics/repository/page-views.repository.js";
+// D9 — chat. Messages themselves are a subcollection (functional module, see
+// features/messages/repository/messages.repository.ts and server.ts), not a
+// BaseRepository class — there is no subcollection form of BaseRepository.
+export { ConversationsRepository, conversationsRepository, } from "../features/messages/repository/conversations.repository.js";

package/dist/schemas/registry.d.ts

@@ -4660,7 +4660,7 @@ export declare const SCHEMAS: {
             youtubeId: import("zod").ZodOptional<import("zod").ZodString>;
             externalVideoUrl: import("zod").ZodOptional<import("zod").ZodString>;
             price: import("zod").ZodOptional<import("zod").ZodNumber>;
-            compareAtPrice: import("zod").ZodOptional<import("zod").ZodNumber>;
+            originalPrice: import("zod").ZodOptional<import("zod").ZodNumber>;
             stockQuantity: import("zod").ZodOptional<import("zod").ZodNumber>;
             featured: import("zod").ZodOptional<import("zod").ZodBoolean>;
             isPromoted: import("zod").ZodOptional<import("zod").ZodBoolean>;
@@ -4750,7 +4750,7 @@ export declare const SCHEMAS: {
             youtubeId: import("zod").ZodOptional<import("zod").ZodString>;
             externalVideoUrl: import("zod").ZodOptional<import("zod").ZodString>;
             price: import("zod").ZodOptional<import("zod").ZodNumber>;
-            compareAtPrice: import("zod").ZodOptional<import("zod").ZodNumber>;
+            originalPrice: import("zod").ZodOptional<import("zod").ZodNumber>;
             stockQuantity: import("zod").ZodOptional<import("zod").ZodNumber>;
             featured: import("zod").ZodOptional<import("zod").ZodBoolean>;
             isPromoted: import("zod").ZodOptional<import("zod").ZodBoolean>;
@@ -4840,7 +4840,7 @@ export declare const SCHEMAS: {
             youtubeId: import("zod").ZodOptional<import("zod").ZodString>;
             externalVideoUrl: import("zod").ZodOptional<import("zod").ZodString>;
             price: import("zod").ZodOptional<import("zod").ZodNumber>;
-            compareAtPrice: import("zod").ZodOptional<import("zod").ZodNumber>;
+            originalPrice: import("zod").ZodOptional<import("zod").ZodNumber>;
             stockQuantity: import("zod").ZodOptional<import("zod").ZodNumber>;
             featured: import("zod").ZodOptional<import("zod").ZodBoolean>;
             isPromoted: import("zod").ZodOptional<import("zod").ZodBoolean>;

package/dist/security/index.d.ts

@@ -6,5 +6,5 @@ export type { UserRole } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
 export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, CONVERSATION_PII_FIELDS, MESSAGE_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";

package/dist/security/index.js

@@ -7,7 +7,7 @@ export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPi
 // pii-encrypt.ts) so this barrel stays safe to re-export from the
 // universal client+server index.ts. See pii-mask.ts's header comment.
 export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask.js";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas.js";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, CONVERSATION_PII_FIELDS, MESSAGE_PII_FIELDS, } from "./pii-schemas.js";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption.js";
 // RBAC system — DELETED 2026-08-29.
 //

package/dist/security/pii-schemas.d.ts

@@ -56,6 +56,23 @@ export declare const BID_PII_FIELDS: readonly ["userEmail"];
 export declare const TOKEN_PII_FIELDS: readonly ["email"];
 /** Blind-index mapping for token email queries */
 export declare const TOKEN_PII_INDEX_MAP: Record<string, string>;
+/**
+ * D9 — chat. Re-created against the SUBCOLLECTION redesign, not the old
+ * embedded-array one the comment below used to describe.
+ *
+ * `messages/{id}` is a true Firestore subcollection now (one document per
+ * message, not `conversations.messages[]`), so there is no array to walk and
+ * the old `messages[].body` `[]`-syntax path does not apply here — `body` is a
+ * plain top-level field on each message document. Only `lastMessage.body`, a
+ * nested object on the PARENT `conversations` document, needs the dotted-path
+ * form `encryptPiiFields` already supports.
+ *
+ * No blind index on either: nothing queries chat by body content, and a
+ * `searchTxt` over an encrypted body would hand back only what the encryption
+ * withheld — chat search, if it exists, indexes participant names only.
+ */
+export declare const CONVERSATION_PII_FIELDS: readonly ["lastMessage.body"];
+export declare const MESSAGE_PII_FIELDS: readonly ["body"];
 /** PII fields in reviews */
 export declare const REVIEW_PII_FIELDS: readonly ["userName"];
 /** Blind-index mapping for queryable review PII */

package/dist/security/pii-schemas.js

@@ -85,15 +85,23 @@ export const TOKEN_PII_FIELDS = ["email"];
 export const TOKEN_PII_INDEX_MAP = {
     email: "emailIndex",
 };
-/*
- * `CONVERSATION_PII_FIELDS` (`lastMessage`, `messages[].body`) was removed with
- * the conversations feature on 2026-08-31.
+/**
+ * D9 — chat. Re-created against the SUBCOLLECTION redesign, not the old
+ * embedded-array one the comment below used to describe.
+ *
+ * `messages/{id}` is a true Firestore subcollection now (one document per
+ * message, not `conversations.messages[]`), so there is no array to walk and
+ * the old `messages[].body` `[]`-syntax path does not apply here — `body` is a
+ * plain top-level field on each message document. Only `lastMessage.body`, a
+ * nested object on the PARENT `conversations` document, needs the dotted-path
+ * form `encryptPiiFields` already supports.
  *
- * 🛑 Its array-path form was the ONLY user of `encryptPiiFields`' `[]` syntax
- * outside status history. If a future schema needs to encrypt a field inside an
- * array, check that machinery still works before relying on it — a path that no
- * caller exercises is a path nothing proves.
+ * No blind index on either: nothing queries chat by body content, and a
+ * `searchTxt` over an encrypted body would hand back only what the encryption
+ * withheld — chat search, if it exists, indexes participant names only.
  */
+export const CONVERSATION_PII_FIELDS = ["lastMessage.body"];
+export const MESSAGE_PII_FIELDS = ["body"];
 /** PII fields in reviews */
 export const REVIEW_PII_FIELDS = ["userName"];
 /** Blind-index mapping for queryable review PII */

package/dist/seed/_helpers/category-content-generated.d.ts

@@ -17,8 +17,8 @@
  * move; a sentence saying "48 listings" is wrong the next day and nothing
  * reports it.
  *
- * Model leaves with a body: 213 of 216
- * Part leaves with a body:  532 of 752
+ * Model leaves with a body: 217 of 220
+ * Part leaves with a body:  534 of 752
  */
 export declare const GENERATED_CATEGORY_CONTENT: Record<string, string>;
-export declare const GENERATED_CATEGORY_CONTENT_COUNT = 745;
+export declare const GENERATED_CATEGORY_CONTENT_COUNT = 751;

package/dist/seed/_helpers/category-content-generated.js

@@ -17,12 +17,12 @@
  * move; a sentence saying "48 listings" is wrong the next day and nothing
  * reports it.
  *
- * Model leaves with a body: 213 of 216
- * Part leaves with a body:  532 of 752
+ * Model leaves with a body: 217 of 220
+ * Part leaves with a body:  534 of 752
  */
 export const GENERATED_CATEGORY_CONTENT = {
     "category-0": `<p><strong>0</strong> is a Disc.</p>
-<p>Shipped with Cho-Z Spriggan 0Wall Zeta, Spriggan Requiem 0 Zeta.</p>`,
+<p>Shipped with Spryzen S2 0Q, Cho-Z Spriggan 0Wall Zeta, Spriggan Requiem 0 Zeta.</p>`,
     "category-0-80": `<p><strong>0-80</strong> is a Ratchet.</p>
 <p>Shipped with GhostCircle 0-80GB.</p>`,
     "category-00": `<p><strong>00</strong> is a Disc.</p>
@@ -419,12 +419,17 @@ export const GENERATED_CATEGORY_CONTENT = {
 <p>Shipped with Evil Gemios DF145FS, Gemios DF145FS, Libra DF145BS, Night Virgo DF145BS, Thunder Libra DF145BS.</p>`,
     "category-df145-down-force-145": `<p><strong>DF145 Down Force 145</strong> is a Spin Track.</p>
 <p>Shipped with Dark Wolf DF145FS.</p>`,
+    "category-diablo-nemesis-x-d": `<p>Diablo Nemesis X:D is a balance-type Beyblade, right-spin, built on the 4D System.</p>
+<p>Product code <strong>BB-122</strong>.</p>
+<p>Released as part of Beyblade: Metal Fury.</p>`,
     "category-disk-ball": `<p><strong>Disk Ball</strong> is a Bit.</p>
 <p>Shipped with WizardRod 5-70DB.</p>`,
     "category-dj-spiker": `<p><strong>DJ Spiker</strong> is an Attack Ring.</p>
 <p>Shipped with Wyvern DJ.</p>`,
     "category-double-horn": `<p><strong>Double Horn</strong> is an Attack Ring.</p>
 <p>Shipped with Rock Bison.</p>`,
+    "category-double-wing": `<p><strong>Double Wing</strong> is an Attack Ring.</p>
+<p>Shipped with Dranzer S.</p>`,
     "category-draciel": `<p><strong>Draciel</strong> is a Bit Chip.</p>
 <p>Shipped with Draciel F, Draciel G, Draciel V, Draciel V2.</p>`,
     "category-draciel-emblem": `<p><strong>Draciel Emblem</strong> is a Bit Chip.</p>
@@ -512,7 +517,7 @@ export const GENERATED_CATEGORY_CONTENT = {
 <p>Sold outside Japan as <strong>Sword Dran 3-60F</strong> — the same mould under a different marque.</p>
 <p>Succeeded by DranDagger 4-60R in the same lineage.</p>`,
     "category-dranzer": `<p><strong>Dranzer</strong> is a Bit Chip.</p>
-<p>Shipped with Dranzer F, Dranzer G, Dranzer GT, Dranzer V, Dranzer V2.</p>`,
+<p>Shipped with Dranzer F, Dranzer G, Dranzer GT, Dranzer S, Dranzer V, Dranzer V2.</p>`,
     "category-dranzer-emblem": `<p><strong>Dranzer Emblem</strong> is a Bit Chip.</p>
 <p>Shipped with Dranzer MF, Dranzer MS.</p>`,
     "category-dranzer-f": `<p>Dranzer F is a balance-type Beyblade, right-spin, built on the Spin Gear System.</p>
@@ -538,6 +543,9 @@ export const GENERATED_CATEGORY_CONTENT = {
     "category-dranzer-ms": `<p>Dranzer MS is a balance-type Beyblade, dual-spin, built on the Hard Metal System.</p>
 <p>Product code <strong>A-131</strong> by Takara.</p>
 <p>Released as part of Beyblade: G-Revolution / manga Volume 13, Chapter 1.</p>`,
+    "category-dranzer-s": `<p>Dranzer S is a balance-type Beyblade, right-spin, built on the Spin Gear System.</p>
+<p>Product code <strong>A-2</strong> by Takara.</p>
+<p>Released as part of Bakuten Shoot Beyblade.</p>`,
     "category-dranzer-v": `<p>Dranzer V is a balance-type Beyblade, right-spin, built on the Magnacore System.</p>
 <p>Product code <strong>A-47</strong> by Takara.</p>
 <p>Released as part of Beyblade: V-Force.</p>
@@ -613,7 +621,7 @@ export const GENERATED_CATEGORY_CONTENT = {
     "category-eight-attacker": `<p><strong>Eight Attacker</strong> is an Attack Ring.</p>
 <p>Shipped with Dragoon V.</p>`,
     "category-eight-balance": `<p><strong>Eight Balance</strong> is a Weight Disk.</p>
-<p>Shipped with Shadow Driger, Draciel F, Driger F, Griffolyon, Metal Draciel, Trypio, and 2 more.</p>`,
+<p>Shipped with Shadow Driger, Draciel F, Dranzer S, Driger F, Griffolyon, Metal Draciel, and 3 more.</p>`,
     "category-eight-heavy": `<p><strong>Eight Heavy</strong> is a Weight Disk.</p>
 <p>Shipped with Dranzer F, Galeon, Galman.</p>`,
     "category-eight-spike": `<p><strong>Eight Spike</strong> is an Attack Ring.</p>
@@ -1293,7 +1301,7 @@ export const GENERATED_CATEGORY_CONTENT = {
     "category-right-mg-south-core": `<p><strong>Right MG South Core</strong> is a Spin Gear.</p>
 <p>Shipped with Flash Leopard 2.</p>`,
     "category-right-sg": `<p><strong>Right SG</strong> is a Spin Gear.</p>
-<p>Shipped with Shadow Driger, Draciel F, Dranzer F, Galeon, Galman, Galzzly, and 6 more.</p>`,
+<p>Shipped with Shadow Driger, Draciel F, Dranzer F, Dranzer S, Galeon, Galman, and 7 more.</p>`,
     "category-right-sg-bearing": `<p><strong>Right SG</strong> is a Spin Gear.</p>
 <p>Shipped with Wolborg, Wolborg 2.</p>`,
     "category-right-sg-full-auto": `<p><strong>Right SG</strong> is a Spin Gear.</p>
@@ -1469,6 +1477,8 @@ export const GENERATED_CATEGORY_CONTENT = {
 <p>Shipped with Wyborg.</p>`,
     "category-spike-dragon": `<p><strong>Spike Dragon</strong> is an Attack Ring.</p>
 <p>Shipped with Dragoon V2.</p>`,
+    "category-spiral-change-base": `<p><strong>Spiral Change Base</strong> is a Blade Base.</p>
+<p>Shipped with Dranzer S.</p>`,
     "category-spiral-upper": `<p><strong>Spiral Upper</strong> is an Attack Ring.</p>
 <p>Shipped with Dranzer MS.</p>`,
     "category-spriggan-requiem-0-zeta": `<p>Spriggan Requiem 0 Zeta is a balance-type Beyblade, dual-spin, built on the God Layer System.</p>
@@ -1478,6 +1488,9 @@ export const GENERATED_CATEGORY_CONTENT = {
 <p>Shipped with Einstein MS.</p>`,
     "category-spryzen-requiem-s3": `<p><strong>Spryzen Requiem S3</strong> is a Layer.</p>
 <p>Shipped with Spriggan Requiem 0 Zeta.</p>`,
+    "category-spryzen-s2-0q": `<p>Spryzen S2 0Q is a balance-type Beyblade, dual-spin, built on the Burst System.</p>
+<p>Product code <strong>E1048</strong> by Hasbro.</p>
+<p>Released as part of Beyblade Burst.</p>`,
     "category-sr200": `<p><strong>SR200</strong> is a Spin Track.</p>
 <p>Shipped with Berserker Begirados SR200BWD.</p>`,
     "category-sr200-slide-ride-200": `<p><strong>SR200 SLIDE-RIDE 200</strong> is a Spin Track.</p>
@@ -1748,6 +1761,9 @@ export const GENERATED_CATEGORY_CONTENT = {
 <p>Shipped with Dranzer G.</p>`,
     "category-wing-upper": `<p><strong>Wing Upper</strong> is an Attack Ring.</p>
 <p>Shipped with Thunder Pegasus, Torch Pegasus.</p>`,
+    "category-wizard-fafnir-ratchet-rise": `<p>Wizard Fafnir Ratchet Rise is a stamina-type Beyblade, left-spin, built on the Gatinko Layer System.</p>
+<p>Product code <strong>B-139</strong> by Takara Tomy.</p>
+<p>Released as part of Beyblade Burst Turbo / Cho-Z late / Burst Rise transition.</p>`,
     "category-wizardarrow": `<p><strong>WizardArrow</strong> is a Blade.</p>
 <p>Shipped with WizardArrow 4-80B.</p>`,
     "category-wizardarrow-4-80b": `<p>WizardArrow 4-80B is a stamina-type Beyblade, right-spin.</p>
@@ -1834,4 +1850,4 @@ export const GENERATED_CATEGORY_CONTENT = {
 <p>Released as part of Beyblade Burst Turbo.</p>
 <p>Sold outside Japan as <strong>Turbo Luinor L4 Drake Spiral</strong> — the same mould under a different marque.</p>`,
 };
-export const GENERATED_CATEGORY_CONTENT_COUNT = 745;
+export const GENERATED_CATEGORY_CONTENT_COUNT = 751;

package/dist/seed/_helpers/category-models.d.ts

@@ -2,4 +2,4 @@ import type { CategoryTreeNode } from "./category-tree";
 /** Named-model leaves, keyed by the tier-3 line they belong to. */
 export declare const MODEL_LEAVES: Record<string, CategoryTreeNode[]>;
 /** Total named-model leaves — asserted by the seed so a silent drop is loud. */
-export declare const MODEL_LEAF_COUNT = 216;
+export declare const MODEL_LEAF_COUNT = 220;

package/dist/seed/_helpers/category-models.js

@@ -142,6 +142,12 @@ export const MODEL_LEAVES = {
             description: "Luinor L2 — an Attack-type, left-spin Burst Classic release, product code E1056. Release note: Lost Lúinor L2 Nine Spiral. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
             extra: { aliases: ["E1056", "Lost Lúinor L2", "Lost Longinus"], productDefaults: { defaultFeatures: ["feature-blader-lui-shirosagi", "feature-type-attack", "feature-left-spin"] } },
         },
+        {
+            id: "category-spryzen-s2-0q",
+            name: "Spryzen S2 0Q",
+            description: "Spryzen S2 0Q — a Balance-type, dual-spin Burst Classic release, product code E1048, released by Hasbro. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
+            extra: { aliases: ["E1048", "Spryzen S2 0Q Layer: Spryzen S2", "Disc: 0", "Driver: Q — later evolves to Spryzen Requiem S3 0Cross"], productDefaults: { defaultFeatures: ["feature-blader-shu-kurenai", "feature-type-balance", "feature-dual-spin"] } },
+        },
         {
             id: "category-storm-spriggan-7glaive",
             name: "Storm Spriggan 7Glaive",
@@ -228,6 +234,12 @@ export const MODEL_LEAVES = {
             description: "Vanish Fafnir Tapered Kick-3 — a Stamina-type, left-spin Dynamite Battle release, product code B-180-class, released by Takara Tomy, ~2021. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
             extra: { aliases: ["B-180-class"], productDefaults: { defaultFeatures: ["feature-blader-fumiya-kindo", "feature-type-stamina", "feature-left-spin"] } },
         },
+        {
+            id: "category-wizard-fafnir-ratchet-rise",
+            name: "Wizard Fafnir Ratchet Rise",
+            description: "Wizard Fafnir Ratchet Rise — a Stamina-type, left-spin Dynamite Battle release, product code B-139, released by Takara Tomy, S3-S4 transitional. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
+            extra: { aliases: ["B-139"], productDefaults: { defaultFeatures: ["feature-blader-fubuki-sumiye", "feature-type-stamina", "feature-left-spin"] } },
+        },
     ],
     "category-burst-god": [
         {
@@ -386,6 +398,12 @@ export const MODEL_LEAVES = {
             description: "Cosmic Pegasis F:D — an Attack-type, right-spin Metal Fury (4D) release, product code BB-128, released by Takara Tomy. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
             extra: { aliases: ["BB-128"], productDefaults: { defaultFeatures: ["feature-blader-gingka-hagane", "feature-type-attack", "feature-right-spin"] } },
         },
+        {
+            id: "category-diablo-nemesis-x-d",
+            name: "Diablo Nemesis X:D",
+            description: "Diablo Nemesis X:D — a Balance-type, right-spin Metal Fury (4D) release, product code BB-122. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
+            extra: { aliases: ["BB-122"], productDefaults: { defaultFeatures: ["feature-blader-rago", "feature-type-balance", "feature-right-spin"] } },
+        },
         {
             id: "category-fang-leone-130w2d",
             name: "Fang Leone 130W2D",
@@ -1146,6 +1164,12 @@ export const MODEL_LEAVES = {
             description: "Dranzer F — a Balance-type, right-spin Spin Gear System release, product code A-27, released by Takara Tomy. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
             extra: { aliases: ["A-27", "Dranzer Flame"], productDefaults: { defaultFeatures: ["feature-blader-kai-hiwatari", "feature-type-balance", "feature-right-spin"] } },
         },
+        {
+            id: "category-dranzer-s",
+            name: "Dranzer S",
+            description: "Dranzer S — a Balance-type, right-spin Spin Gear System release, product code A-2, released by Takara. Complete tops, loose parts, sticker sheets and pre-owned examples of this model are listed here.",
+            extra: { aliases: ["A-2", "Dranzer Spiral"], productDefaults: { defaultFeatures: ["feature-blader-kai-hiwatari", "feature-type-balance", "feature-right-spin"] } },
+        },
         {
             id: "category-driger-f",
             name: "Driger F",
@@ -1361,4 +1385,4 @@ export const MODEL_LEAVES = {
     ],
 };
 /** Total named-model leaves — asserted by the seed so a silent drop is loud. */
-export const MODEL_LEAF_COUNT = 216;
+export const MODEL_LEAF_COUNT = 220;

package/dist/seed/_helpers/category-names.d.ts

@@ -0,0 +1,54 @@
+import type { ProductDocument } from "../../features/products/schemas";
+export declare function deriveCategoryNames(slugs: readonly string[] | undefined): string[] | undefined;
+/**
+ * Derive the full ancestor closure from the head of an existing chain.
+ *
+ * ## 🛑 The drift this ends — measured, 6 of 1,039 live products
+ *
+ * `categorySlugs` is the ancestor closure and it was hand-written per record
+ * too, so a chain could SKIP A TIER and nothing noticed:
+ *
+ *     product-beyblade-original-driger-v
+ *       got      driger-v > original-tops > beyblade-original > spinning-tops
+ *       expected driger-v > original-magnacore > original-tops > …
+ *
+ * The category page matches `array-contains-any [its own id]` against this
+ * array (CLAUDE.md: "a category page matches on its own id alone"), so a
+ * missing intermediate means the product is **absent from that node's page**
+ * while appearing correctly on every other node in its chain. Six products were
+ * invisible on their own system sub-line.
+ *
+ * `countersReconcile`'s rollup invariant cannot see this: it computes the counts
+ * FROM these closures, so a skipped tier is simply a tier with a lower count,
+ * and `own + Σ(children.total) === total` still holds exactly. The only way to
+ * find it is to re-derive the chain and compare.
+ *
+ * ## 🛑 A SECOND ASSIGNMENT IS LEFT ALONE, NOT COLLAPSED
+ *
+ * This derives from `slugs[0]` — the head, which is what `readAssignments`
+ * treats as the assignment. A product filed under two roots would carry two
+ * concatenated closures, and deriving from the head alone would silently DELETE
+ * the second one, turning a drift-fix into data loss.
+ *
+ * So the rule is: overwrite only when the existing array is a SUBSET of the
+ * derived closure. That is precisely the drift case (ids missing from the
+ * middle). An id outside the derived closure means either a second assignment
+ * or something this helper cannot safely interpret, and both must survive to be
+ * reported rather than be quietly rewritten.
+ *
+ * Measured when this was written: 0 of 71 seeded products carry `categoryIds`
+ * and 0 carry a multi-root closure — so the subset rule fires on all six real
+ * cases and guards a case that does not exist yet.
+ */
+export declare function deriveCategoryClosure(slugs: readonly string[] | undefined): string[] | undefined;
+/**
+ * Pipeline step: replace whatever `categorySlugs` and `categoryNames` a record
+ * carries with the derivation. Deliberately an OVERWRITE rather than a
+ * fill-if-absent — a hand-written value that disagrees IS the defect, so
+ * preferring it would preserve every one of them.
+ *
+ * Order matters: the closure is derived first, then the names from the derived
+ * closure. Deriving names from the stale chain and then fixing the chain would
+ * leave the two mirrors disagreeing again, one tier apart.
+ */
+export declare function withDerivedCategoryNames(p: Partial<ProductDocument>): Partial<ProductDocument>;