@mohasinac/appkit 4.57.0 → 4.59.0

package/dist/ui/index.js

@@ -86,6 +86,8 @@ export { Breadcrumb } from "./components/Breadcrumb.js";
 export { ImageMosaic, MOSAIC_MIN } from "./components/ImageMosaic.js";
 /* D3 — two real branches, side by side with real photos and real counts. */
 export { SplitTile } from "./components/SplitTile.js";
+/* Image-led tile — artwork fills the card, a scrim carries the type. */
+export { PosterCard, PosterChip, PosterGrid, PlainCard, POSTER_CLASS, PLAIN_CLASS, } from "./components/PosterCard.js";
 export { ImageLightbox } from "./components/ImageLightbox.js";
 export { TagInput } from "./components/TagInput.js";
 export { StepperNav } from "./components/StepperNav.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.57.0",
+  "version": "4.59.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
@@ -212,7 +212,9 @@
     "scripts/seed-cli-loader.mjs",
     "scripts/dedupe-peer-deps.mjs",
     "scripts/copy-assets.mjs",
-    "scripts/bundle-css.mjs"
+    "scripts/bundle-css.mjs",
+    "!dist/seed",
+    "!dist/features/tester/seed-data"
   ],
   "bin": {
     "appkit-sieve-audit": "./scripts/sieve-audit.mjs",

package/scripts/seed-cli.mjs

@@ -175,7 +175,75 @@ console.log(`✓ Connected to project: ${process.env.FIREBASE_ADMIN_PROJECT_ID |
 // ---------------------------------------------------------------------------
 // Pull seed data + helpers from @mohasinac/appkit
 // ---------------------------------------------------------------------------
-const appkit = await import("@mohasinac/appkit");
+/*
+ * ── 🛑 SEED DATA COMES FROM ./seed, NOT THE MAIN BARREL ──────────────────
+ *
+ * `appkit/src/seed/` is 61% of this package's source bytes and 60% of the
+ * published dist — 540 files of pure fixture data. While the main barrel
+ * re-exported it, every consumer importing `@mohasinac/appkit` pulled that
+ * graph into scope and Turbopack traced all 24 MB of it for nothing.
+ *
+ * The re-exports are gone from `index.ts`/`server.ts`, so this CLI — the
+ * only real consumer of the data — reads it from a dedicated subpath.
+ *
+ * 🛑 Two imports, deliberately. The seed ARRAYS come from ./seed; the
+ * HELPERS (id generators, token builders, PII field maps) stay on the main
+ * barrel because they are real library code that the app uses too. Merging
+ * them would pull the helpers back into the seed graph and undo the split.
+ */
+/*
+ * ── 🛑 TWO PLACES THE SEED CAN LIVE, AND A CLEAR ERROR IF NEITHER ────────
+ *
+ * `dist/seed/**` is 27 MB of the 52 MB dist and is EXCLUDED from the
+ * published tarball — a package consumer has no business carrying fixture
+ * data. So the `./seed` subpath resolves only where the data actually is:
+ *
+ *   · an installed copy that was resynced from this repo (the normal local
+ *     case — `cp -r appkit/dist node_modules/@mohasinac/appkit/dist`)
+ *   · this repo's own `appkit/dist/seed`, when run from the source tree
+ *
+ * 🛑 A fresh `npm install` from the registry has NEITHER, and that is
+ * deliberate: seeding needs the generators and the 18 MB of research JSON
+ * that only exist in this repo, so it is a repo operation by nature. What
+ * must not happen is the SILENT version — an import that resolves to nothing
+ * and a loader that then reports `no seed data, skipping` with exit 0, which
+ * is Root Cause #90 and has already cost this project six empty collections.
+ * Hence an explicit throw naming both paths.
+ */
+async function importSeedModule() {
+  const attempts = [];
+  /*
+   * 🛑 A RELATIVE path, not the `@mohasinac/appkit/seed` subpath.
+   *
+   * That subpath was added and then REMOVED in the same change: once
+   * `dist/seed` is excluded from the tarball, a declared export pointing at a
+   * file the package does not contain is a landmine for anyone who imports it.
+   * Attempting it here would also be dead code — it can never resolve now — and
+   * a dead attempt whose throw is swallowed is exactly what makes the next
+   * reader think the subpath still works.
+   *
+   * Relative resolution covers both real cases: run from this repo it finds
+   * `appkit/dist/seed`; run as an installed copy that was resynced from the
+   * repo it finds `node_modules/@mohasinac/appkit/dist/seed`.
+   */
+  const local = pathToFileURL(resolve(__dirname, "../dist/seed/index.js")).href;
+  try {
+    return await import(local);
+  } catch (err) {
+    attempts.push(`${local} — ${err?.code ?? err?.message ?? err}`);
+  }
+  console.error(
+    "\u001b[31m✗ Could not load the seed data.\u001b[0m\n" +
+      "  The seed is excluded from the published package on purpose — it is a repo\n" +
+      "  operation, not something a consumer does. Build it first:\n\n" +
+      "      npm --prefix ./appkit run build\n\n" +
+      "  Tried:\n" +
+      attempts.map((a) => `      ${a}`).join("\n"),
+  );
+  process.exit(1);
+}
+const appkitSeed = await importSeedModule();
+const appkit = { ...(await import("@mohasinac/appkit")), ...appkitSeed };
 // PII crypto functions moved server-only in appkit 3.8.1 (they touch
 // firebase-admin's crypto chain) — no longer exported from the main
 // client-safe barrel, only from "@mohasinac/appkit/server". The *_PII_FIELDS
@@ -209,6 +277,8 @@ const {
   scammersSeedData, productFeaturesSeedData, taxCodesSeedData,
   authenticityKnowledgeSeedData,
   partGlossarySeedData, modelCompositionSeedData,
+  beysSeedData, beyProductsSeedData,
+  BEYS_COLLECTION, BEY_PRODUCTS_COLLECTION,
   testerChecklistSeedData, testerResponsesSeedData,
   supportTicketsSeedData, catalogueSeedData,
   shipmentsSeedData, shipmentLotsSeedData, shipmentItemsSeedData,
@@ -322,6 +392,14 @@ const COLLECTION_MAP = {
   taxCodes: TAX_CODES_COLLECTION,
   // E4/D12 — extracted from the local corpus, generated into the seed.
   partGlossary: PART_GLOSSARY_COLLECTION,
+  /*
+   * The BEY reference database. Mirrors `partGlossary`: extracted from a
+   * corpus by committed scripts, shares its id with the paired category leaf,
+   * and keeps measured data OFF `categories` so a reseed cannot drop every
+   * bey page's ISR entry.
+   */
+  beys: BEYS_COLLECTION,
+  beyProducts: BEY_PRODUCTS_COLLECTION,
   modelComposition: MODEL_COMPOSITION_COLLECTION,
   testerChecklistItems: TESTER_CHECKLIST_ITEM_COLLECTION,
   /*
@@ -686,6 +764,10 @@ const SEED_DATA_MAP = {
   authenticityKnowledge: authenticityKnowledgeSeedData,
   taxCodes: taxCodesSeedData,
   partGlossary: partGlossarySeedData,
+  // 🛑 Both halves are mandatory: load() short-circuits on an empty array, so a
+  // COLLECTION_MAP entry alone logs "no seed data, skipping" and exits 0.
+  beys: beysSeedData,
+  beyProducts: beyProductsSeedData,
   modelComposition: modelCompositionSeedData,
   testerChecklistItems: testerChecklistSeedData,
   testerChecklistResponses: testerResponsesSeedData,
@@ -1022,7 +1104,88 @@ async function loadOneDocPerUser(seed, coll, stats) {
   }
 }
 
+/**
+ * Collections whose rows a human may hand-correct, with the correction
+ * protected from the next reseed.
+ *
+ * 🛑 AN EXPLICIT LIST, not "every collection". Protection costs one query per
+ * load, and more importantly it is only meaningful for GENERATED data: a row
+ * an admin authored from scratch (a coupon, an event) is not competing with a
+ * generator for ownership of its fields, so there is nothing to protect it
+ * from. Adding a collection here is a statement that a generator owns the row
+ * and a human may override named fields of it.
+ */
+/**
+ * Drop the keys a human owns from one payload.
+ *
+ * 🛑 A LOCAL copy of `stripAdminOwnedFields` from
+ * `appkit/src/features/parts/schemas/admin-edit.ts`, and the duplication is
+ * deliberate: this CLI must run without a built appkit. Importing it from
+ * `dist` would reintroduce exactly the build dependency the catalogue
+ * generator just shed, and would make a reseed impossible under a memory cap.
+ * The function is five lines; the dependency would not be.
+ */
+function stripAdminOwned(payload, ownedFields) {
+  if (!ownedFields?.length) return payload;
+  const out = {};
+  for (const [k, v] of Object.entries(payload)) {
+    if (ownedFields.includes(k)) continue;
+    out[k] = v;
+  }
+  return out;
+}
+
+const ADMIN_EDIT_PROTECTED = new Set(["partGlossary", "beys"]);
+
+/**
+ * The fields a human owns, per document id, for one collection.
+ *
+ * 🛑 ONE INDEXED EQUALITY, not a read per document. The alternative is
+ * fetching all 2,488 parts and 1,988 beys to discover the handful that are
+ * protected — 4,476 reads against a 50,000/day free tier, every load, to find
+ * what is usually a dozen rows.
+ *
+ * 🛑 It must be an EQUALITY on a boolean, not an `orderBy` or `!=` on
+ * `adminEditedFields`. Both of those silently exclude every document that
+ * LACKS the field, which is nearly all of them — the trap that made a store's
+ * whole review set return zero (Root Cause #100) and the one `isTestData`
+ * warning in the Known TS Patterns table.
+ *
+ * Fails OPEN to an empty map: if this query errors the load proceeds
+ * unprotected, which loses a hand-edit. The alternative — aborting the load —
+ * loses the entire reseed. A warning names the collection either way.
+ */
+async function fetchAdminOwnedFields(colName, firestoreCollection) {
+  if (!ADMIN_EDIT_PROTECTED.has(colName)) return new Map();
+  try {
+    const snap = await db
+      .collection(firestoreCollection)
+      .where("adminEdited", "==", true)
+      .select("adminEditedFields")
+      .get();
+    const map = new Map();
+    for (const d of snap.docs) {
+      const fields = d.get("adminEditedFields");
+      if (Array.isArray(fields) && fields.length > 0) map.set(d.id, fields);
+    }
+    if (map.size > 0) {
+      console.log(
+        `    ${map.size} row(s) carry admin-owned fields — those keys will not be overwritten`,
+      );
+    }
+    return map;
+  } catch (err) {
+    console.warn(
+      `    ⚠ could not read admin-owned fields for ${colName} (${err?.message ?? err}).
+` +
+        `      Proceeding WITHOUT protection — a hand-correction in this collection may be lost.`,
+    );
+    return new Map();
+  }
+}
+
 async function loadGeneric(colName, seed, firestoreCollection, stats) {
+  const adminOwned = await fetchAdminOwnedFields(colName, firestoreCollection);
   if (REPLACE_ON_LOAD.has(colName)) {
     const removed = await purgeCollection(firestoreCollection);
     if (VERBOSE) console.log(`    purged ${removed} pre-existing docs`);
@@ -1064,7 +1227,19 @@ async function loadGeneric(colName, seed, firestoreCollection, stats) {
        * `store-letitrip-official` loaded as `test` — the platform's own store,
        * which is one of exactly two rows the keep-list exists to protect.
        */
-      data: encryptSeedPii(colName, stripUndefined(stampSeedPurpose(colName, data, docId))),
+      /*
+       * 🛑 Admin-owned keys dropped LAST, after every other transform.
+       *
+       * Stripping earlier would let `stampSeedPurpose` or `encryptSeedPii`
+       * re-add a key a human owns — both of them write fields — and the whole
+       * point is that what reaches Firestore carries none of them. A
+       * merge-write leaves an absent key exactly as it was, which is how the
+       * correction survives.
+       */
+      data: stripAdminOwned(
+        encryptSeedPii(colName, stripUndefined(stampSeedPurpose(colName, data, docId))),
+        adminOwned.get(docId),
+      ),
     });
   }
   /*

package/dist/features/tester/seed-data/_happy-path.d.ts

@@ -1,23 +0,0 @@
-import type { TesterCaseRole } from "../schemas";
-interface HappyPathCase {
-    key: string;
-    label: string;
-    /** Every role the case affects; per-role detail goes inline in the expectations. */
-    roles: TesterCaseRole[];
-    startPage?: string;
-    steps: string[];
-    inputs?: Record<string, string | number | boolean>;
-    expectedBehaviour: string;
-    expectedUiState: string;
-    expectedData?: Record<string, string | number | boolean>;
-    endResult: string;
-    href?: string;
-}
-interface HappyPathPage {
-    pageKey: string;
-    pageLabel: string;
-    href?: string;
-    cases: HappyPathCase[];
-}
-export declare const happyPathPages: HappyPathPage[];
-export {};