abmp-npm 10.3.13 → 10.3.15

package/.claude/skills/wix-data-query/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: wix-data-query
+description: Query the ABMP/ASCP/AHP Wix CMS collections (MembersDataLatest, SiteConfigs, etc.) via the Wix Data REST API to investigate member data issues. Use when a bug report, Monday ticket, or support escalation references a specific member ID, profile slug, or email — e.g. "services don't appear on the website", "book now link missing", "member still showing after they dropped", "expired license rendering", "address/lat-long is wrong", "upgraded membership didn't sync". Also use when you need a collection's real field names, types, or query operators before writing backend code.
+---
+
+# Wix Data queries for member data investigations
+
+Read the live CMS record before theorising. Most "the website is wrong" tickets are
+answered in one query: the site renders what is in `MembersDataLatest`, so if the field
+is wrong there, the bug is in the sync (`backend/daily-pull/`), not in the UI.
+
+## 1. Pick the site
+
+Every association is a **separate Wix site with its own copy of the collections**. A member
+who exists on ABMP may not exist on ASCP. Always confirm which site the ticket is about —
+the profile URL tells you (`abmpmembers.com` → ABMP, `ascpskincare.com` → ASCP).
+
+| Site                   | siteId                                 | Env  |
+| ---------------------- | -------------------------------------- | ---- |
+| ABMP Members Directory | `384d680a-2870-4086-bda0-9894ce4503b8` | prod |
+| ASCP Members Directory | `1cb02bba-3a36-45e0-bdb4-1a1a2cfe2fdc` | prod |
+| AHP Members Directory  | `5553798e-c71e-4a58-9b9e-515803823429` | prod |
+| Test ABMP Members      | `cd9fca47-63d3-4538-b26c-1f91ad0a9420` | test |
+| Test ASCP Members      | `8c031731-3f58-4d5f-b7dc-6ccabd1b5722` | test |
+| Test AHP Members       | `4535a35f-439d-4558-8e68-9000258e2a2a` | test |
+
+Collection IDs are in [`public/consts.js`](../../../public/consts.js) under `COLLECTIONS`.
+The main one is `MembersDataLatest`.
+
+## 2. Pick the auth path
+
+**Path A — Wix MCP (preferred when the `CallWixSiteAPI` tool is available).** No secrets to
+handle; auth is already managed. This is the path used to validate every recipe in this skill.
+
+```
+CallWixSiteAPI(
+  siteId:       "384d680a-2870-4086-bda0-9894ce4503b8",
+  url:          "https://www.wixapis.com/wix-data/v2/items/query",
+  method:       "POST",
+  sourceDocUrl: "https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/query-data-items",
+  body:         { ...see recipes... }
+)
+```
+
+**Path B — raw REST**, for scripts, CI, or any session without the MCP. Requires an admin API
+key from the [API Keys Manager](https://manage.wix.com/account/api-keys). Two headers, per the
+[auth docs](https://dev.wix.com/docs/api-reference/articles/authentication/api-keys/make-api-calls-with-an-api-key):
+
+```bash
+curl -s -X POST 'https://www.wixapis.com/wix-data/v2/items/query' \
+  -H "Authorization: $WIX_API_KEY" \
+  -H "wix-site-id: 384d680a-2870-4086-bda0-9894ce4503b8" \
+  -H 'Content-Type: application/json' \
+  -d '{"dataCollectionId":"MembersDataLatest","query":{"filter":{"memberId":731898},"paging":{"limit":1}}}'
+```
+
+Read the key from the environment (`$WIX_API_KEY`). Never paste a key into a file, a commit,
+a Monday comment, or a chat message. `MembersDataLatest` is `read: ADMIN` /
+`itemRead: PRIVILEGED`, so a visitor token will return nothing — this is expected, not a bug.
+
+## 3. Query
+
+Full cookbook with copy-paste bodies: [references/recipes.md](references/recipes.md).
+The single most common one — look a member up by profile slug:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "url": "karriknowles" }, "paging": { "limit": 1 } }
+}
+```
+
+By numeric PAC member ID (note: **number, not string**):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "memberId": 731898 }, "paging": { "limit": 1 } }
+}
+```
+
+## 4. Read the result against the field reference
+
+[references/members-data-latest.md](references/members-data-latest.md) lists every field, its
+type, and — importantly — the **traps**. The ones that cause wrong conclusions:
+
+- **`firstName`, `lastName`, `phone`, `toShowPhone` are encrypted.** They support only
+  `EQ`, `NE`, `HAS_SOME`, `EXISTS`. A `CONTAINS`/`STARTS_WITH` name search **fails** — it does
+  not silently return nothing, it errors. Search by `fullName` (not encrypted) instead.
+- **Duplicate legacy field pairs exist**: `showAbmp` _and_ `showABMP`, `apiBookingUrl` _and_
+  `APIBookingUrl`. Check both before concluding a value is missing.
+- **A `show*` boolean gates almost every "X doesn't appear on the site" ticket.** The data can
+  be perfectly correct and still not render because `showBookingUrl` / `showWebsite` /
+  `showContactForm` / `showName` is `false`. Check the flag before blaming the sync.
+- **`isVisible` and `action`** control directory presence. `action: "drop"` sets
+  `isVisible: false` (see `backend/daily-pull/process-member-methods.js`). A member who should
+  have been dropped but is still listed will show `action` other than `drop`, or
+  `isVisible: true` — that points at the PAC API payload, not at Wix.
+- **Two date formats, and mixing them fails silently.** `_createdDate` / `_updatedDate` are
+  real `DATETIME` fields using `{"$date":"...Z"}`. But dates inside the `memberships` and
+  `licenses` arrays are **plain ISO strings** (`"2027-06-12T00:00:00"` — no `Z`, no ms) and
+  must be compared as strings. Verified on ABMP prod: filtering
+  `memberships.expiration` with `$date` returns **0**; the same filter as a string returns
+  **1008**. A zero here is far more often a wrong filter than a clean bill of health.
+- **Totals:** `returnTotalCount` does not return a `total` on this collection. Use
+  `POST https://www.wixapis.com/wix-data/v2/items/count` (body: `dataCollectionId` +
+  top-level `filter`, no `query` wrapper) → `{"totalCount": N}`.
+
+## 5. Rules
+
+- **Read-only by default.** Query, count, distinct, aggregate, get-schema are all fine to run
+  unprompted during an investigation.
+- **Never write to a production collection without explicit approval in this conversation.**
+  Inserts, updates, patches, and `TRUNCATE` change live member-facing data. State exactly what
+  you intend to change and on which site, and wait for a yes. When a fix needs testing, use the
+  Test site IDs above.
+- **Don't paste member PII into external systems.** These records contain real names, emails,
+  phone numbers, and home addresses. Quote the minimum needed — a member ID and the one wrong
+  field — when writing a Monday comment or a commit message.
+- Ground endpoints in docs, not memory. If you need an endpoint this skill doesn't cover, find
+  it with `SearchWixRESTDocumentation` first.

package/.claude/skills/wix-data-query/references/members-data-latest.md

@@ -0,0 +1,125 @@
+# `MembersDataLatest` field reference
+
+Captured from the live **ABMP Members Directory** collection schema
+(`GET https://www.wixapis.com/wix-data/v2/collections/MembersDataLatest`) on 2026-08-04,
+collection revision `102`. Re-run that call to refresh — the schema is the source of truth,
+this file is a convenience copy.
+
+Permissions: `read/insert/update/remove: ADMIN`, `dataPermissions.itemRead: PRIVILEGED`.
+Paging modes: `OFFSET`, `CURSOR`. Supports `COUNT`, `DISTINCT`, `AGGREGATE`.
+
+## Identity
+
+| Field                           | Type       | Notes                                                                                                                                                    |
+| ------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `_id`                           | TEXT       | Wix item ID (system)                                                                                                                                     |
+| `memberId`                      | **NUMBER** | PAC member ID. Filter with a number, not a string.                                                                                                       |
+| `url`                           | TEXT       | Profile slug, e.g. `karriknowles` → `/profile/karriknowles`. Uniqueness enforced by `ensureUniqueUrl` in `backend/daily-pull/process-member-methods.js`. |
+| `generatedUrl`                  | BOOLEAN    | True when the slug was auto-generated rather than PAC-supplied                                                                                           |
+| `wixMemberId`                   | TEXT       | Wix Members app ID                                                                                                                                       |
+| `wixContactId`                  | TEXT       | Wix CRM contact ID                                                                                                                                       |
+| `contactId`                     | TEXT       | Legacy contact ID field                                                                                                                                  |
+| `_owner`                        | TEXT       | System                                                                                                                                                   |
+| `_createdDate` / `_updatedDate` | DATETIME   | `{"$date":"...Z"}` shape                                                                                                                                 |
+| `pageNumber`                    | NUMBER     | Which PAC API page last wrote this record — useful for tracing a sync run                                                                                |
+
+## Name and contact
+
+| Field                               | Type           | Notes                                                                               |
+| ----------------------------------- | -------------- | ----------------------------------------------------------------------------------- |
+| `firstName`                         | TEXT           | 🔒 **encrypted** — only `EQ`, `NE`, `HAS_SOME`, `EXISTS`                            |
+| `lastName`                          | TEXT           | 🔒 **encrypted** — same restriction                                                 |
+| `fullName`                          | TEXT           | Not encrypted → **use this for name searches** (`CONTAINS`, `STARTS_WITH` all work) |
+| `businessName` / `showBusinessName` | TEXT / BOOLEAN |                                                                                     |
+| `email`                             | TEXT           | Login email                                                                         |
+| `contactFormEmail`                  | TEXT           | Where contact-form mail goes; diverges from `email` by design                       |
+| `phone`                             | TEXT           | 🔒 **encrypted**                                                                    |
+| `toShowPhone`                       | TEXT           | 🔒 **encrypted** — the phone actually rendered                                      |
+| `phones`                            | ARRAY          | Full list from PAC                                                                  |
+
+## Membership and licensing
+
+| Field           | Type    | Notes                                                                                        |
+| --------------- | ------- | -------------------------------------------------------------------------------------------- |
+| `action`        | TEXT    | From the PAC API: `new` / `update` / `drop` / `none`. Drives `isVisible`.                    |
+| `isVisible`     | BOOLEAN | `action !== 'drop'`. Controls directory listing.                                             |
+| `optOut`        | BOOLEAN | Member-chosen suppression, independent of `action`                                           |
+| `memberships`   | ARRAY   | `{association, membertype, expiration, membersince}`                                         |
+| `licenses`      | ARRAY   | `{association, state, license, exempt}` — filtered per-site by `filterLicensesByAssociation` |
+| `showLicenseNo` | BOOLEAN |                                                                                              |
+
+## Location
+
+| Field                  | Type   | Notes                                                                              |
+| ---------------------- | ------ | ---------------------------------------------------------------------------------- |
+| `addresses`            | ARRAY  | `{key, line1, line2, city, state, postalcode, latitude, longitude, addressStatus}` |
+| `addressDisplayOption` | ARRAY  | `[{key, isMain}]` — which address is primary                                       |
+| `addressInfo`          | OBJECT | Map of address `key` → display mode                                                |
+| `locHash`              | ARRAY  | Geohash (precision 3, see `GEO_HASH_PRECISION`) used for proximity search          |
+
+`addressStatus` values come from `ADDRESS_STATUS_TYPES` in `public/consts.js`:
+`full_address`, `state_city_zip`, `dont_show`.
+
+## Profile content
+
+| Field              | Type          | Notes                                                                                                 |
+| ------------------ | ------------- | ----------------------------------------------------------------------------------------------------- |
+| `areasOfPractices` | ARRAY         | **This is the "services" list** members complain about. There is no field literally named `services`. |
+| `aboutService`     | RICH_TEXT     | HTML string                                                                                           |
+| `testimonial`      | ARRAY         | Free-text testimonials                                                                                |
+| `gallery`          | MEDIA_GALLERY |                                                                                                       |
+| `bannerImages`     | ARRAY         |                                                                                                       |
+| `profileImage`     | IMAGE         | `wix:image://` URI                                                                                    |
+| `logoImage`        | URL           |                                                                                                       |
+| `title`            | TEXT          | Default CMS field, generally unused                                                                   |
+
+## Display flags — check these first on "X doesn't appear" tickets
+
+| Field                         | Type    |
+| ----------------------------- | ------- | --------------------------------- |
+| `showName`                    | BOOLEAN |
+| `showPhone`                   | BOOLEAN |
+| `showWebsite`                 | BOOLEAN |
+| `showWixUrl`                  | BOOLEAN |
+| `showContactForm`             | BOOLEAN |
+| `showBookingUrl`              | BOOLEAN |
+| `showBusinessName`            | BOOLEAN |
+| `showLicenseNo`               | BOOLEAN |
+| `showAbmp` **and** `showABMP` | BOOLEAN | ⚠️ two separate fields both exist |
+
+## Links
+
+| Field                                   | Type | Notes                                                                                                                                          |
+| --------------------------------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `website`                               | URL  | Member's own site                                                                                                                              |
+| `bookingUrl`                            | URL  | Member-entered booking link; rendered only when `showBookingUrl` is `true`                                                                     |
+| `apiBookingUrl` **and** `APIBookingUrl` | TEXT | ⚠️ two separate fields. Can contain a raw HTML embed blob (e.g. a Genbook `<script>` badge), not just a URL — don't assume it parses as a URL. |
+
+## Known traps
+
+1. **Encrypted fields reject substring operators.** `CONTAINS` on `firstName` errors out. Use
+   `fullName`.
+2. **Duplicate-case field pairs** (`showAbmp`/`showABMP`, `apiBookingUrl`/`APIBookingUrl`) are
+   real and both queryable. A value "missing" from one may be present in the other.
+3. **`memberId` is a NUMBER.** `{"memberId": "731898"}` matches nothing and returns an empty
+   list rather than an error — the most common false "member not found".
+4. **Per-site collections.** Absence on one site is not absence everywhere.
+5. **Eventually consistent.** A write may not be visible to the next immediate query.
+6. **Two different date formats.** Only true `DATETIME` fields (`_createdDate`,
+   `_updatedDate`) use the `{"$date":"...Z"}` form. Dates _inside_ the `memberships` and
+   `licenses` arrays — notably `memberships.expiration` and `memberships.membersince` — are
+   **plain ISO strings without a `Z` or milliseconds** (`"2027-06-12T00:00:00"`) and must be
+   filtered as strings. Using `$date` against them silently returns zero rows rather than
+   erroring, which reads as "no affected members" when there may be thousands.
+7. **`returnTotalCount` yields no `total`** on this collection — use
+   `POST /wix-data/v2/items/count` instead.
+8. **`{"$ne": ""}` also matches rows where the field is absent.** Verified 2026-08-04: filtering
+   `{"website": {"$ne": ""}}` returned 300 rows whose projected `website` and `bookingUrl` came
+   back empty — the field simply wasn't set on them. So `$ne ""` is _not_ "has a value", and any
+   count built on it is inflated. To mean "actually has a value", pair it with
+   `{"$exists": true}` or filter/verify client-side after projecting the field.
+
+## No regex filtering
+
+Wix Data has no regex operator, so you cannot ask the API questions like "domains containing a
+digit". Project the field, page through, and evaluate in JS.

package/.claude/skills/wix-data-query/references/recipes.md

@@ -0,0 +1,210 @@
+# Query cookbook
+
+All bodies below are the JSON body for
+`POST https://www.wixapis.com/wix-data/v2/items/query`
+([docs](https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/query-data-items)).
+
+Send them via `CallWixSiteAPI(siteId, url, method: "POST", body)` or via curl with
+`Authorization: $WIX_API_KEY` + `wix-site-id: <siteId>`.
+
+---
+
+## Look up one member
+
+By profile slug (from the URL in the ticket):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "url": "karriknowles" }, "paging": { "limit": 1 } }
+}
+```
+
+By PAC member ID — **number, not string**:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "memberId": 731898 }, "paging": { "limit": 1 } }
+}
+```
+
+By email:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "email": "someone@example.com" }, "paging": { "limit": 1 } }
+}
+```
+
+By name — `fullName` only, never the encrypted `firstName`/`lastName`:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "fullName": { "$contains": "Knowles" } }, "paging": { "limit": 20 } }
+}
+```
+
+## Return only the fields you care about
+
+Large records (galleries, testimonials, rich text) drown the useful bits. Project:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "memberId": 949741 },
+    "fields": [
+      "memberId",
+      "url",
+      "fullName",
+      "bookingUrl",
+      "showBookingUrl",
+      "apiBookingUrl",
+      "APIBookingUrl",
+      "isVisible",
+      "action"
+    ],
+    "paging": { "limit": 1 }
+  }
+}
+```
+
+## Count / scope an issue
+
+How many members are affected, without pulling them all. Use the **dedicated count
+endpoint** — `POST https://www.wixapis.com/wix-data/v2/items/count`
+([docs](https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/count-data-items)).
+Note the different body shape: `filter` sits at the top level, there is no `query` wrapper.
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "filter": { "showBookingUrl": false, "bookingUrl": { "$ne": "" } }
+}
+```
+
+Returns `{"totalCount": 82449}`.
+
+> ⚠️ **Do not rely on `returnTotalCount` in the query endpoint.** Verified 2026-08-04 against
+> `MembersDataLatest`: passing `"returnTotalCount": true` — with or without an explicit
+> `paging.offset` — returns `pagingMetadata` containing `count`, `offset`, `tooManyToCount`,
+> `cursors` and `hasNext`, but **no `total` field**. Use `/items/count` for totals.
+
+## Members who should have been dropped but are still visible
+
+The shape behind the "multies not renewing / expired members still listed" class of ticket:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "action": "drop", "isVisible": true },
+    "fields": ["memberId", "url", "fullName", "action", "isVisible", "memberships"],
+    "paging": { "limit": 100 }
+  }
+}
+```
+
+Inverse — visible members whose membership already expired:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "isVisible": true, "memberships.expiration": { "$lt": "2026-08-04T00:00:00" } },
+    "fields": ["memberId", "url", "memberships", "action"],
+    "paging": { "limit": 100 }
+  }
+}
+```
+
+> ⚠️ **`memberships.expiration` is a plain ISO string, not a date.** Compare it as a string.
+> Verified 2026-08-04 on ABMP prod: `{"$lt": {"$date": "2026-08-04T00:00:00.000Z"}}` counts
+> **0**, while `{"$lt": "2026-08-04T00:00:00"}` counts **1008**. The `$date` wrapper is only
+> correct for true DATETIME fields such as `_createdDate` / `_updatedDate`. Note the stored
+> strings have no `Z` suffix and no milliseconds — match that format.
+
+## Recently synced records
+
+Useful for confirming whether a nightly run touched a member at all:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "_updatedDate": { "$gte": { "$date": "2026-08-01T00:00:00.000Z" } } },
+    "sort": [{ "fieldName": "_updatedDate", "order": "DESC" }],
+    "fields": ["memberId", "url", "_updatedDate", "action", "pageNumber"],
+    "paging": { "limit": 50 }
+  }
+}
+```
+
+## Combining conditions
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": {
+      "$and": [
+        { "isVisible": true },
+        { "$or": [{ "showBookingUrl": true }, { "showWebsite": true }] }
+      ]
+    },
+    "paging": { "limit": 25 }
+  }
+}
+```
+
+## Paging past 100
+
+Offset paging (each request may carry its own filter/sort):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": {}, "paging": { "limit": 100, "offset": 100 } }
+}
+```
+
+Cursor paging for a long scan — set `filter`/`sort` on the **first** request only, then pass
+back `pagingMetadata.cursors.next` alone:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "cursorPaging": { "limit": 100, "cursor": "<cursors.next>" } }
+}
+```
+
+---
+
+## Other endpoints
+
+**Collection schema** — field names, types, and which operators each field allows:
+
+```
+GET https://www.wixapis.com/wix-data/v2/collections/MembersDataLatest
+```
+
+**List all collections on the site:**
+
+```
+GET https://www.wixapis.com/wix-data/v2/collections
+```
+
+**Full-text search** across fields (`POST .../wix-data/v2/items/search`) — note it takes
+`data_collection_id` (snake_case) and a `search` object rather than `query`. Only works on
+CMS-native collections. See
+[Search Data Items](https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/search-data-items).
+
+**Aggregate** (`AGGREGATE` is supported on `MembersDataLatest`) for group-by counts, e.g.
+distribution of `action` values across the directory.
+
+Other collections worth knowing, from `COLLECTIONS` in `public/consts.js`:
+`SiteConfigs`, `CompiledStateCityMap`, `State`, `City`, `interests`,
+`contactUsSubmissions`, `updatedLoginEmails`, `QA_Users`, `ButtonClicks`.

package/backend/__tests__/url-validation.test.js

@@ -0,0 +1,69 @@
+const { isNotValidUrl } = require('../../public/Utils/personalDetailsUtils');
+
+// ─── Helpers ─────────────────────────────────────────────────────────
+
+const isValid = url => !isNotValidUrl(url);
+
+// ─── Regression: digits in the hostname ──────────────────────────────
+// Monday bug 12663709539 - a member could not save the booking link
+// https://patty-10439.square.site because the host character class was
+// written `[da-z.-]` instead of `[\da-z.-]`, rejecting every domain
+// containing a digit.
+
+describe('isNotValidUrl - digits in hostname', () => {
+  it('accepts the exact URL from the bug report', () => {
+    expect(isValid('https://patty-10439.square.site')).toBe(true);
+  });
+
+  it.each([
+    'https://my-spa123.com',
+    'https://massage4u.net',
+    'https://booksy.com/en-us/698924_therapist_health-fitness_119607_city',
+    'https://www.genbook.com/bookings/slot/reservation/30241562?bookingSourceId=1000',
+    'www.spa2go.com',
+    'https://123.example.com',
+  ])('accepts %s', url => {
+    expect(isValid(url)).toBe(true);
+  });
+});
+
+describe('isNotValidUrl - case insensitivity', () => {
+  it.each(['https://Patty-10439.Square.Site', 'HTTPS://EXAMPLE.COM', 'WWW.Example.Com'])(
+    'accepts %s',
+    url => {
+      expect(isValid(url)).toBe(true);
+    }
+  );
+});
+
+// ─── Guard against regressions in the previously-working cases ───────
+
+describe('isNotValidUrl - previously valid URLs stay valid', () => {
+  it.each([
+    'https://square.site',
+    'https://patty.square.site',
+    'http://healinghut.massagetherapy.com',
+    'www.example.com',
+    'https://example.co.uk',
+    'https://example.com/path/to/page',
+    'https://example.com?foo=bar',
+    'https://example.com#anchor',
+  ])('accepts %s', url => {
+    expect(isValid(url)).toBe(true);
+  });
+});
+
+describe('isNotValidUrl - invalid input is still rejected', () => {
+  it.each(['not a url', 'example', 'ftp://example.com', 'justtext.c', 'http://'])(
+    'rejects %s',
+    url => {
+      expect(isValid(url)).toBe(false);
+    }
+  );
+
+  it('treats an empty value as valid because the field is optional', () => {
+    expect(isValid('')).toBe(true);
+    expect(isValid(undefined)).toBe(true);
+    expect(isValid(null)).toBe(true);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abmp-npm",
-  "version": "10.3.13",
+  "version": "10.3.15",
   "main": "index.js",
   "scripts": {
     "check-cycles": "madge --circular .",

package/pages/personalDetails.js

@@ -975,36 +975,10 @@ async function personalDetailsOnReady({
     });
   }
 
-  async function handleItemDelete(event, getTextSelector, arrayRef, matchField, renderFn) {
-    const result = await wixWindow.openLightbox(LIGHTBOX_NAMES.DELETE_CONFIRM);
-
-    if (result && result.toDelete) {
-      const $clickedItem = _$w.at(event.context);
-      const textToRemove = $clickedItem(getTextSelector).text;
-
-      arrayRef.splice(
-        0,
-        arrayRef.length,
-        ...arrayRef.filter(item =>
-          typeof item === 'string' ? item !== textToRemove : item[matchField] !== textToRemove
-        )
-      );
-
-      renderFn();
-      checkFormChanges(FORM_SECTION_HANDLER_MAP.BUSINESS_SERVICES);
-    }
-  }
-
   async function setInterestData() {
     const interestsData = await getInterestAll();
 
     _$w('#removeServiceButton').onClick(async event => {
-      // Capture the stable item id BEFORE awaiting the confirm lightbox.
-      // Reading the chip's text after the await is unsafe: the repeater
-      // recycles its DOM items on re-render, so after a rapid sequence of
-      // deletes event.context can resolve to a recycled node showing a
-      // different service, removing the wrong item (or none). Matching on
-      // the stable _id (as the gallery delete does) avoids that race.
       const itemId = event.context.itemId;
       const result = await wixWindow.openLightbox(LIGHTBOX_NAMES.DELETE_CONFIRM);
 
@@ -1090,9 +1064,6 @@ async function personalDetailsOnReady({
   }
 
   function renderServices() {
-    // Pass a fresh array copy so the Wix repeater detects the change and
-    // re-renders. Assigning the same array reference (mutated in place by
-    // add/delete) is treated as a no-op, leaving stale chips on screen.
     setupRepeater('#servicesRepeater', [...selectedServices]);
   }
 
@@ -1291,9 +1262,10 @@ async function personalDetailsOnReady({
     console.groupEnd();
 
     const result = await saveData(formData);
-    formHasUnsavedChanges[FORM_SECTION_HANDLER_MAP.PERSONAL.section] = false;
 
     if (result.success) {
+      formHasUnsavedChanges[FORM_SECTION_HANDLER_MAP.PERSONAL.section] = false;
+
       if (personalChanges.url && personalChanges.url !== originalUrl) {
         const newProfileLink = `${baseUrl}/profile/${personalChanges.url}`;
         console.log('🔗 Updating profile link:', {
@@ -1346,7 +1318,10 @@ async function personalDetailsOnReady({
     console.groupEnd();
 
     const result = await saveData(formData);
-    formHasUnsavedChanges[FORM_SECTION_HANDLER_MAP.BUSINESS_SERVICES.section] = false;
+    if (result.success) {
+      formHasUnsavedChanges[FORM_SECTION_HANDLER_MAP.BUSINESS_SERVICES.section] = false;
+      _$w('#saveBusinessButton').disable();
+    }
     handleSaveDataFeedback(_$w('#businessMessage'), result.message);
     _$w('#businessNameText').text = formData.businessName || DEFAULT_BUSINESS_NAME_TEXT;
   }
@@ -1355,14 +1330,21 @@ async function personalDetailsOnReady({
     const addTestimonialButton = _$w('#addTestimonialButton');
 
     addTestimonialButton.onClick(handleAddTestimonial);
-    _$w('#deleteTestimonialButton').onClick(event => {
-      handleItemDelete(
-        event,
-        '#testimonialText',
-        itemMemberObj.testimonial,
-        null,
-        renderTestimonials
-      );
+    _$w('#deleteTestimonialButton').onClick(async event => {
+      const data = _$w('#testimonialRepeater').data || [];
+      const clickedIndex = data.findIndex(item => item._id === event.context.itemId);
+      const result = await wixWindow.openLightbox(LIGHTBOX_NAMES.DELETE_CONFIRM);
+
+      if (
+        result &&
+        result.toDelete &&
+        clickedIndex > 0 &&
+        Array.isArray(itemMemberObj.testimonial)
+      ) {
+        itemMemberObj.testimonial.splice(clickedIndex - 1, 1);
+        renderTestimonials();
+        checkFormChanges(FORM_SECTION_HANDLER_MAP.BUSINESS_SERVICES);
+      }
     });
 
     renderTestimonials();
@@ -2402,8 +2384,9 @@ async function personalDetailsOnReady({
       // Sync Personal Details opt-in from saved member.
       _$w('#optWebsiteCheckbox').checked = itemMemberObj.showWixUrl;
       toggleFreeWebsiteText(itemMemberObj.showWixUrl);
+      formHasUnsavedChanges[FORM_SECTION_HANDLER_MAP.CONTACT_BOOKING.section] = false;
+      _$w('#saveContactBookingButton').disable();
     }
-    formHasUnsavedChanges[FORM_SECTION_HANDLER_MAP.CONTACT_BOOKING.section] = false;
     handleSaveDataFeedback(_$w('#contactMessage'), result.message);
   }
 

package/public/Utils/personalDetailsUtils.js

@@ -13,8 +13,12 @@ function isNotValidUrl(url) {
   if (!url) return false;
 
   // URL must start with protocol OR www - handles all TLDs including multi-level and query params
+  // NOTE: the host class is `[\da-z.-]` (digit, letter, dot, hyphen). It previously read
+  // `[da-z.-]`, which - missing the backslash - matched only a literal "d" plus a-z, so any
+  // domain containing a digit was rejected (e.g. https://patty-10439.square.site).
+  // The `i` flag keeps mixed-case hosts valid; domains are case-insensitive.
   const urlRegex =
-    /^(https?:\/\/|www\.)([da-z.-]+)\.([a-z.]{2,})([/\w .-]*)*(\?[&\w=.-]*)?(#[&\w=.-]*)?\/?$/;
+    /^(https?:\/\/|www\.)([\da-z.-]+)\.([a-z.]{2,})([/\w .-]*)*(\?[&\w=.-]*)?(#[&\w=.-]*)?\/?$/i;
 
   return !urlRegex.test(url);
 }