abmp-npm 2.0.76 → 2.0.77

package/.claude/skills/wix-data-query/SKILL.md

@@ -0,0 +1,167 @@
+---
+name: wix-data-query
+description: Query the ABMP/ASCP/AHP Wix CMS collections (MembersDataLatest, SiteConfigs, etc.) via the Wix Data REST API to investigate member data issues. Use when a bug report, Monday ticket, or support escalation references a specific member ID, profile slug, or email — e.g. "services don't appear on the website", "book now link missing", "member still showing after they dropped", "expired license rendering", "address/lat-long is wrong", "upgraded membership didn't sync". Also use when you need a collection's real field names, types, or query operators before writing backend code.
+---
+
+# Wix Data queries for member data investigations
+
+Read the live CMS record before theorising. Most "the website is wrong" tickets are
+answered in one query: the site renders what is in `MembersDataLatest`, so if the field
+is wrong there, the bug is in the sync (`backend/daily-pull/`), not in the UI.
+
+## 1. Pick the site
+
+Every association is a **separate Wix site with its own copy of the collections**. A member
+who exists on ABMP may not exist on ASCP. Always confirm which site the ticket is about —
+the profile URL tells you (`abmpmembers.com` → ABMP, `ascpskincare.com` → ASCP).
+
+| Site                   | siteId                                 | Env  |
+| ---------------------- | -------------------------------------- | ---- |
+| ABMP Members Directory | `384d680a-2870-4086-bda0-9894ce4503b8` | prod |
+| ASCP Members Directory | `1cb02bba-3a36-45e0-bdb4-1a1a2cfe2fdc` | prod |
+| AHP Members Directory  | `5553798e-c71e-4a58-9b9e-515803823429` | prod |
+| Test ABMP Members      | `cd9fca47-63d3-4538-b26c-1f91ad0a9420` | test |
+| Test ASCP Members      | `8c031731-3f58-4d5f-b7dc-6ccabd1b5722` | test |
+| Test AHP Members       | `4535a35f-439d-4558-8e68-9000258e2a2a` | test |
+
+Collection IDs are in [`public/consts.js`](../../../public/consts.js) under `COLLECTIONS`.
+The main one is `MembersDataLatest`.
+
+## 2. Pick the auth path
+
+**Path A — Wix MCP (preferred when the `CallWixSiteAPI` tool is available).** No secrets to
+handle; auth is already managed. This is the path used to validate every recipe in this skill.
+
+```
+CallWixSiteAPI(
+  siteId:       "384d680a-2870-4086-bda0-9894ce4503b8",
+  url:          "https://www.wixapis.com/wix-data/v2/items/query",
+  method:       "POST",
+  sourceDocUrl: "https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/query-data-items",
+  body:         { ...see recipes... }
+)
+```
+
+**Path B — raw REST**, for scripts, CI, or any session without the MCP. Requires an admin API
+key from the [API Keys Manager](https://manage.wix.com/account/api-keys). Two headers, per the
+[auth docs](https://dev.wix.com/docs/api-reference/articles/authentication/api-keys/make-api-calls-with-an-api-key):
+
+```bash
+curl -s -X POST 'https://www.wixapis.com/wix-data/v2/items/query' \
+  -H "Authorization: $WIX_API_KEY" \
+  -H "wix-site-id: 384d680a-2870-4086-bda0-9894ce4503b8" \
+  -H 'Content-Type: application/json' \
+  -d '{"dataCollectionId":"MembersDataLatest","query":{"filter":{"memberId":731898},"paging":{"limit":1}}}'
+```
+
+Read the key from the environment (`$WIX_API_KEY`). Never paste a key into a file, a commit,
+a Monday comment, or a chat message. `MembersDataLatest` is `read: ADMIN` /
+`itemRead: PRIVILEGED`, so a visitor token will return nothing — this is expected, not a bug.
+
+## 3. Query
+
+Full cookbook with copy-paste bodies: [references/recipes.md](references/recipes.md).
+The single most common one — look a member up by profile slug:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "url": "karriknowles" }, "paging": { "limit": 1 } }
+}
+```
+
+By numeric PAC member ID (note: **number, not string**):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "memberId": 731898 }, "paging": { "limit": 1 } }
+}
+```
+
+## 4. Read the result against the field reference
+
+[references/members-data-latest.md](references/members-data-latest.md) lists every field, its
+type, and — importantly — the **traps**. The ones that cause wrong conclusions:
+
+- **`firstName`, `lastName`, `phone`, `toShowPhone` are encrypted.** They support only
+  `EQ`, `NE`, `HAS_SOME`, `EXISTS`. A `CONTAINS`/`STARTS_WITH` name search **fails** — it does
+  not silently return nothing, it errors. Search by `fullName` (not encrypted) instead.
+- **Duplicate legacy field pairs exist**: `showAbmp` _and_ `showABMP`, `apiBookingUrl` _and_
+  `APIBookingUrl`. Check both before concluding a value is missing.
+- **A `show*` boolean gates almost every "X doesn't appear on the site" ticket.** The data can
+  be perfectly correct and still not render because `showBookingUrl` / `showWebsite` /
+  `showContactForm` / `showName` is `false`. Check the flag before blaming the sync.
+- **`isVisible` and `action`** control directory presence. `action: "drop"` sets
+  `isVisible: false` (see `backend/daily-pull/process-member-methods.js`). A member who should
+  have been dropped but is still listed will show `action` other than `drop`, or
+  `isVisible: true` — that points at the PAC API payload, not at Wix.
+- **Two date formats, and mixing them fails silently.** `_createdDate` / `_updatedDate` are
+  real `DATETIME` fields using `{"$date":"...Z"}`. But dates inside the `memberships` and
+  `licenses` arrays are **plain ISO strings** (`"2027-06-12T00:00:00"` — no `Z`, no ms) and
+  must be compared as strings. Verified on ABMP prod: filtering
+  `memberships.expiration` with `$date` returns **0**; the same filter as a string returns
+  **1008**. A zero here is far more often a wrong filter than a clean bill of health.
+- **Totals:** `returnTotalCount` does not return a `total` on this collection. Use
+  `POST https://www.wixapis.com/wix-data/v2/items/count` (body: `dataCollectionId` +
+  top-level `filter`, no `query` wrapper) → `{"totalCount": N}`.
+
+- **`$eq` is case-sensitive; `$contains` is case-insensitive.** Verified on live ABMP: filtering
+  `url` with `"alisadanaeknowles"` matches the stored `"AlisaDanaeKnowles"` under `$contains`
+  and returns **nothing** under `$eq`. Stored slugs really are mixed case, so an exact-match
+  lookup on a user-supplied slug will silently miss. This is why `getMemberBySlug` originally
+  reached for full-text search.
+
+## 5. The historical PAC feed archive
+
+The live CMS answers _"what is true now"_. It cannot answer _"what did PAC actually send"_ or
+_"what did this member originally ask for"_ — and those are usually the questions that settle a
+dispute. For that, use the backup archive: [references/backup-archive.md](references/backup-archive.md).
+
+## 6. Writing data
+
+Read [§7 Rules](#7-rules) first. Writes need explicit approval, every time.
+
+**Prefer `PATCH` over `PUT`.** `PUT` (Update Data Item) replaces the entire payload — miss a
+field and you wipe it. `PATCH` changes only what you name:
+
+```
+PATCH https://www.wixapis.com/wix-data/v2/items/<itemId>
+{
+  "dataCollectionId": "MembersDataLatest",
+  "patch": {
+    "dataItemId": "<itemId>",
+    "fieldModifications": [
+      { "fieldPath": "optOut", "action": "SET_FIELD", "setFieldOptions": { "value": true } }
+    ]
+  }
+}
+```
+
+**Hiding a member is better than deleting one.** `optOut: true` is reversible, keeps the record,
+and **survives the nightly sync** — `optOut` is written only in `getNewMemberOnlyFields`, which
+returns `{}` for members that already exist, and it is absent from the always-update list in
+`backend/daily-pull/process-member-methods.js`. Deleting is irreversible, and if the member is
+still in PAC's feed the next sync simply recreates them as new.
+
+Deleting, when that is genuinely what was asked for:
+
+```
+DELETE https://www.wixapis.com/wix-data/v2/items/<itemId>?dataCollectionId=MembersDataLatest
+```
+
+Always verify afterwards with `/items/count` on the member id and report the result.
+
+## 7. Rules
+
+- **Read-only by default.** Query, count, distinct, aggregate, get-schema are all fine to run
+  unprompted during an investigation.
+- **Never write to a production collection without explicit approval in this conversation.**
+  Inserts, updates, patches, and `TRUNCATE` change live member-facing data. State exactly what
+  you intend to change and on which site, and wait for a yes. When a fix needs testing, use the
+  Test site IDs above.
+- **Don't paste member PII into external systems.** These records contain real names, emails,
+  phone numbers, and home addresses. Quote the minimum needed — a member ID and the one wrong
+  field — when writing a Monday comment or a commit message.
+- Ground endpoints in docs, not memory. If you need an endpoint this skill doesn't cover, find
+  it with `SearchWixRESTDocumentation` first.

package/.claude/skills/wix-data-query/references/backup-archive.md

@@ -0,0 +1,136 @@
+# The PAC feed archive (`abmp-backup-api`)
+
+A local archive of **raw PAC API responses**, in the repo behind `BACKUP_API_URL`
+(`backend/consts.js`). On this machine:
+
+```
+/Users/Matheusa/Documents/GitHub/abmp-backup-api/backups/
+```
+
+It is the only record of **what PAC actually sent** and of members' **pre-migration display
+preferences**. Neither exists anywhere in the live CMS.
+
+## Layout
+
+Bucketed by the PAC `action` value; each file is a verbatim API page.
+
+| Folder             | Files           | Records                |
+| ------------------ | --------------- | ---------------------- |
+| `new/`             | `page1.json`    | 233                    |
+| `new_Nov18th/`     | `page1..5.json` | 11,960 (full snapshot) |
+| `update/`          | `page1.json`    | 954                    |
+| `drop/`            | `page1.json`    | **416**                |
+| `failed requests/` | —               | empty                  |
+
+13,563 records, 13,478 unique members, all four associations
+(ABMP 5,586 / ASCP 6,656 / AHP 1,526 / ANP 176 memberships). Captured **Nov–Dec 2025**.
+
+Shape matches the live PAC API exactly:
+
+```json
+{
+  "total_results": 954,
+  "page_results": 954,
+  "total_pages": 1,
+  "results": [
+    {
+      "memberid": 1493418,
+      "firstname": "Andrea",
+      "lastname": "Williams",
+      "email": "…",
+      "phones": [],
+      "url": "…",
+      "action": "update",
+      "licenses": [],
+      "addresses": [],
+      "memberships": [],
+      "migrationData": {}
+    }
+  ]
+}
+```
+
+## `migrationData` — the part that matters
+
+Present on **every** record and absent from the live CMS. These are the members' legacy display
+preferences, carried over at migration:
+
+| Key                                              | Answers the ticket type                                   |
+| ------------------------------------------------ | --------------------------------------------------------- |
+| `opted_out`                                      | _"I asked not to be listed"_                              |
+| `interests`                                      | _"my services don't appear"_ (becomes `areasOfPractices`) |
+| `website`, `logo_url`                            | _"my website/logo used to show"_                          |
+| `schedule_code`                                  | _"my booking link is missing"_                            |
+| `show_phone`, `addressinfo`, `show_member_since` | _"my details display wrong"_                              |
+| `detailtext`                                     | original profile blurb                                    |
+
+## ⚠️ Limits — read before concluding anything
+
+1. **It is a single Nov–Dec 2025 snapshot, not a continuous log.** There is no record of any
+   later sync.
+2. **It does not contain every member.** 13,478 records against ~9,400 on the AHP site alone.
+3. Therefore **absence proves nothing.** "Not in the backup" does **not** mean "PAC never sent
+   it" — the single most tempting wrong inference here.
+
+Presence, by contrast, is solid evidence: if a member is in `drop/`, PAC really did send a drop
+for them.
+
+## Recipe: compare legacy preference against live state
+
+Index the archive by `memberid`, then batch-query the CMS. This is how the opted-out check below
+was done.
+
+```js
+const fs = require('fs');
+const dir = '/Users/Matheusa/Documents/GitHub/abmp-backup-api/backups';
+const idx = new Map();
+for (const d of fs.readdirSync(dir)) {
+  const p = `${dir}/${d}`;
+  if (!fs.statSync(p).isDirectory()) continue;
+  for (const f of fs.readdirSync(p)) {
+    if (!f.endsWith('.json')) continue;
+    for (const r of JSON.parse(fs.readFileSync(`${p}/${f}`, 'utf8')).results || []) {
+      idx.set(r.memberid, { bucket: d, action: r.action, mig: r.migrationData });
+    }
+  }
+}
+```
+
+Then, against the live site — `$hasSome` acts as "in" for a NUMBER field:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "memberId": { "$hasSome": [804491, 817198, 137584] } },
+    "fields": ["memberId", "fullName", "optOut", "isVisible", "action"],
+    "paging": { "limit": 40 }
+  }
+}
+```
+
+## Finding on record (2026-08-04)
+
+40 members had `migrationData.opted_out === true`. 32 are still active (`new`/`update`); of those
+**29 correctly carry `optOut: true` today**, but **3 do not and are publicly visible on ABMP**:
+
+| memberId | Name                       |
+| -------- | -------------------------- |
+| 1091946  | Jessica Solorzano-Peterson |
+| 881021   | Arlette Underwood          |
+| 765272   | Summer Fairbanks           |
+
+**Not confirmed as a bug.** `optOut` is member-editable, so these three may have deliberately
+opted back in since migration. That cannot be distinguished remotely — the nightly sync touches
+`_updatedDate` on every record, so it is not a usable signal. Raise with PAC rather than assume,
+and do not change a member's `optOut` on the strength of this alone.
+
+## Other uses
+
+- **"Was this member ever actually dropped?"** — the `drop/` bucket is ground truth, and is the
+  unanswerable question behind the _multies not renewing_ ticket.
+- **Provenance** — telling a PAC-sourced record from a Wix-created test account. PAC-sourced
+  records have a real sequential `memberId` (~1.2M–1.8M), a `pageNumber` on the CMS side (written
+  only while processing a page of the PAC API response), and ISO `membersince`/`expiration`.
+  Wix-made test accounts use ids like `11111111`, throwaway email domains, and hand-typed date
+  strings such as `"November 2012"`.

package/.claude/skills/wix-data-query/references/members-data-latest.md

@@ -0,0 +1,125 @@
+# `MembersDataLatest` field reference
+
+Captured from the live **ABMP Members Directory** collection schema
+(`GET https://www.wixapis.com/wix-data/v2/collections/MembersDataLatest`) on 2026-08-04,
+collection revision `102`. Re-run that call to refresh — the schema is the source of truth,
+this file is a convenience copy.
+
+Permissions: `read/insert/update/remove: ADMIN`, `dataPermissions.itemRead: PRIVILEGED`.
+Paging modes: `OFFSET`, `CURSOR`. Supports `COUNT`, `DISTINCT`, `AGGREGATE`.
+
+## Identity
+
+| Field                           | Type       | Notes                                                                                                                                                    |
+| ------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `_id`                           | TEXT       | Wix item ID (system)                                                                                                                                     |
+| `memberId`                      | **NUMBER** | PAC member ID. Filter with a number, not a string.                                                                                                       |
+| `url`                           | TEXT       | Profile slug, e.g. `karriknowles` → `/profile/karriknowles`. Uniqueness enforced by `ensureUniqueUrl` in `backend/daily-pull/process-member-methods.js`. |
+| `generatedUrl`                  | BOOLEAN    | True when the slug was auto-generated rather than PAC-supplied                                                                                           |
+| `wixMemberId`                   | TEXT       | Wix Members app ID                                                                                                                                       |
+| `wixContactId`                  | TEXT       | Wix CRM contact ID                                                                                                                                       |
+| `contactId`                     | TEXT       | Legacy contact ID field                                                                                                                                  |
+| `_owner`                        | TEXT       | System                                                                                                                                                   |
+| `_createdDate` / `_updatedDate` | DATETIME   | `{"$date":"...Z"}` shape                                                                                                                                 |
+| `pageNumber`                    | NUMBER     | Which PAC API page last wrote this record — useful for tracing a sync run                                                                                |
+
+## Name and contact
+
+| Field                               | Type           | Notes                                                                               |
+| ----------------------------------- | -------------- | ----------------------------------------------------------------------------------- |
+| `firstName`                         | TEXT           | 🔒 **encrypted** — only `EQ`, `NE`, `HAS_SOME`, `EXISTS`                            |
+| `lastName`                          | TEXT           | 🔒 **encrypted** — same restriction                                                 |
+| `fullName`                          | TEXT           | Not encrypted → **use this for name searches** (`CONTAINS`, `STARTS_WITH` all work) |
+| `businessName` / `showBusinessName` | TEXT / BOOLEAN |                                                                                     |
+| `email`                             | TEXT           | Login email                                                                         |
+| `contactFormEmail`                  | TEXT           | Where contact-form mail goes; diverges from `email` by design                       |
+| `phone`                             | TEXT           | 🔒 **encrypted**                                                                    |
+| `toShowPhone`                       | TEXT           | 🔒 **encrypted** — the phone actually rendered                                      |
+| `phones`                            | ARRAY          | Full list from PAC                                                                  |
+
+## Membership and licensing
+
+| Field           | Type    | Notes                                                                                        |
+| --------------- | ------- | -------------------------------------------------------------------------------------------- |
+| `action`        | TEXT    | From the PAC API: `new` / `update` / `drop` / `none`. Drives `isVisible`.                    |
+| `isVisible`     | BOOLEAN | `action !== 'drop'`. Controls directory listing.                                             |
+| `optOut`        | BOOLEAN | Member-chosen suppression, independent of `action`                                           |
+| `memberships`   | ARRAY   | `{association, membertype, expiration, membersince}`                                         |
+| `licenses`      | ARRAY   | `{association, state, license, exempt}` — filtered per-site by `filterLicensesByAssociation` |
+| `showLicenseNo` | BOOLEAN |                                                                                              |
+
+## Location
+
+| Field                  | Type   | Notes                                                                              |
+| ---------------------- | ------ | ---------------------------------------------------------------------------------- |
+| `addresses`            | ARRAY  | `{key, line1, line2, city, state, postalcode, latitude, longitude, addressStatus}` |
+| `addressDisplayOption` | ARRAY  | `[{key, isMain}]` — which address is primary                                       |
+| `addressInfo`          | OBJECT | Map of address `key` → display mode                                                |
+| `locHash`              | ARRAY  | Geohash (precision 3, see `GEO_HASH_PRECISION`) used for proximity search          |
+
+`addressStatus` values come from `ADDRESS_STATUS_TYPES` in `public/consts.js`:
+`full_address`, `state_city_zip`, `dont_show`.
+
+## Profile content
+
+| Field              | Type          | Notes                                                                                                 |
+| ------------------ | ------------- | ----------------------------------------------------------------------------------------------------- |
+| `areasOfPractices` | ARRAY         | **This is the "services" list** members complain about. There is no field literally named `services`. |
+| `aboutService`     | RICH_TEXT     | HTML string                                                                                           |
+| `testimonial`      | ARRAY         | Free-text testimonials                                                                                |
+| `gallery`          | MEDIA_GALLERY |                                                                                                       |
+| `bannerImages`     | ARRAY         |                                                                                                       |
+| `profileImage`     | IMAGE         | `wix:image://` URI                                                                                    |
+| `logoImage`        | URL           |                                                                                                       |
+| `title`            | TEXT          | Default CMS field, generally unused                                                                   |
+
+## Display flags — check these first on "X doesn't appear" tickets
+
+| Field                         | Type    |
+| ----------------------------- | ------- | --------------------------------- |
+| `showName`                    | BOOLEAN |
+| `showPhone`                   | BOOLEAN |
+| `showWebsite`                 | BOOLEAN |
+| `showWixUrl`                  | BOOLEAN |
+| `showContactForm`             | BOOLEAN |
+| `showBookingUrl`              | BOOLEAN |
+| `showBusinessName`            | BOOLEAN |
+| `showLicenseNo`               | BOOLEAN |
+| `showAbmp` **and** `showABMP` | BOOLEAN | ⚠️ two separate fields both exist |
+
+## Links
+
+| Field                                   | Type | Notes                                                                                                                                          |
+| --------------------------------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `website`                               | URL  | Member's own site                                                                                                                              |
+| `bookingUrl`                            | URL  | Member-entered booking link; rendered only when `showBookingUrl` is `true`                                                                     |
+| `apiBookingUrl` **and** `APIBookingUrl` | TEXT | ⚠️ two separate fields. Can contain a raw HTML embed blob (e.g. a Genbook `<script>` badge), not just a URL — don't assume it parses as a URL. |
+
+## Known traps
+
+1. **Encrypted fields reject substring operators.** `CONTAINS` on `firstName` errors out. Use
+   `fullName`.
+2. **Duplicate-case field pairs** (`showAbmp`/`showABMP`, `apiBookingUrl`/`APIBookingUrl`) are
+   real and both queryable. A value "missing" from one may be present in the other.
+3. **`memberId` is a NUMBER.** `{"memberId": "731898"}` matches nothing and returns an empty
+   list rather than an error — the most common false "member not found".
+4. **Per-site collections.** Absence on one site is not absence everywhere.
+5. **Eventually consistent.** A write may not be visible to the next immediate query.
+6. **Two different date formats.** Only true `DATETIME` fields (`_createdDate`,
+   `_updatedDate`) use the `{"$date":"...Z"}` form. Dates _inside_ the `memberships` and
+   `licenses` arrays — notably `memberships.expiration` and `memberships.membersince` — are
+   **plain ISO strings without a `Z` or milliseconds** (`"2027-06-12T00:00:00"`) and must be
+   filtered as strings. Using `$date` against them silently returns zero rows rather than
+   erroring, which reads as "no affected members" when there may be thousands.
+7. **`returnTotalCount` yields no `total`** on this collection — use
+   `POST /wix-data/v2/items/count` instead.
+8. **`{"$ne": ""}` also matches rows where the field is absent.** Verified 2026-08-04: filtering
+   `{"website": {"$ne": ""}}` returned 300 rows whose projected `website` and `bookingUrl` came
+   back empty — the field simply wasn't set on them. So `$ne ""` is _not_ "has a value", and any
+   count built on it is inflated. To mean "actually has a value", pair it with
+   `{"$exists": true}` or filter/verify client-side after projecting the field.
+
+## No regex filtering
+
+Wix Data has no regex operator, so you cannot ask the API questions like "domains containing a
+digit". Project the field, page through, and evaluate in JS.

package/.claude/skills/wix-data-query/references/recipes.md

@@ -0,0 +1,264 @@
+# Query cookbook
+
+All bodies below are the JSON body for
+`POST https://www.wixapis.com/wix-data/v2/items/query`
+([docs](https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/query-data-items)).
+
+Send them via `CallWixSiteAPI(siteId, url, method: "POST", body)` or via curl with
+`Authorization: $WIX_API_KEY` + `wix-site-id: <siteId>`.
+
+---
+
+## Look up one member
+
+By profile slug (from the URL in the ticket):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "url": "karriknowles" }, "paging": { "limit": 1 } }
+}
+```
+
+By PAC member ID — **number, not string**:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "memberId": 731898 }, "paging": { "limit": 1 } }
+}
+```
+
+By email:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "email": "someone@example.com" }, "paging": { "limit": 1 } }
+}
+```
+
+By name — `fullName` only, never the encrypted `firstName`/`lastName`:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": { "fullName": { "$contains": "Knowles" } }, "paging": { "limit": 20 } }
+}
+```
+
+## Return only the fields you care about
+
+Large records (galleries, testimonials, rich text) drown the useful bits. Project:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "memberId": 949741 },
+    "fields": [
+      "memberId",
+      "url",
+      "fullName",
+      "bookingUrl",
+      "showBookingUrl",
+      "apiBookingUrl",
+      "APIBookingUrl",
+      "isVisible",
+      "action"
+    ],
+    "paging": { "limit": 1 }
+  }
+}
+```
+
+## Count / scope an issue
+
+How many members are affected, without pulling them all. Use the **dedicated count
+endpoint** — `POST https://www.wixapis.com/wix-data/v2/items/count`
+([docs](https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/count-data-items)).
+Note the different body shape: `filter` sits at the top level, there is no `query` wrapper.
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "filter": { "showBookingUrl": false, "bookingUrl": { "$ne": "" } }
+}
+```
+
+Returns `{"totalCount": 82449}`.
+
+> ⚠️ **Do not rely on `returnTotalCount` in the query endpoint.** Verified 2026-08-04 against
+> `MembersDataLatest`: passing `"returnTotalCount": true` — with or without an explicit
+> `paging.offset` — returns `pagingMetadata` containing `count`, `offset`, `tooManyToCount`,
+> `cursors` and `hasNext`, but **no `total` field**. Use `/items/count` for totals.
+
+## Members who should have been dropped but are still visible
+
+The shape behind the "multies not renewing / expired members still listed" class of ticket:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "action": "drop", "isVisible": true },
+    "fields": ["memberId", "url", "fullName", "action", "isVisible", "memberships"],
+    "paging": { "limit": 100 }
+  }
+}
+```
+
+Inverse — visible members whose membership already expired:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "isVisible": true, "memberships.expiration": { "$lt": "2026-08-04T00:00:00" } },
+    "fields": ["memberId", "url", "memberships", "action"],
+    "paging": { "limit": 100 }
+  }
+}
+```
+
+> ⚠️ **`memberships.expiration` is a plain ISO string, not a date.** Compare it as a string.
+> Verified 2026-08-04 on ABMP prod: `{"$lt": {"$date": "2026-08-04T00:00:00.000Z"}}` counts
+> **0**, while `{"$lt": "2026-08-04T00:00:00"}` counts **1008**. The `$date` wrapper is only
+> correct for true DATETIME fields such as `_createdDate` / `_updatedDate`. Note the stored
+> strings have no `Z` suffix and no milliseconds — match that format.
+
+## Recently synced records
+
+Useful for confirming whether a nightly run touched a member at all:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": { "_updatedDate": { "$gte": { "$date": "2026-08-01T00:00:00.000Z" } } },
+    "sort": [{ "fieldName": "_updatedDate", "order": "DESC" }],
+    "fields": ["memberId", "url", "_updatedDate", "action", "pageNumber"],
+    "paging": { "limit": 50 }
+  }
+}
+```
+
+## Combining conditions
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": {
+    "filter": {
+      "$and": [
+        { "isVisible": true },
+        { "$or": [{ "showBookingUrl": true }, { "showWebsite": true }] }
+      ]
+    },
+    "paging": { "limit": 25 }
+  }
+}
+```
+
+## Paging past 100
+
+Offset paging (each request may carry its own filter/sort):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "filter": {}, "paging": { "limit": 100, "offset": 100 } }
+}
+```
+
+Cursor paging for a long scan — set `filter`/`sort` on the **first** request only, then pass
+back `pagingMetadata.cursors.next` alone:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "query": { "cursorPaging": { "limit": 100, "cursor": "<cursors.next>" } }
+}
+```
+
+---
+
+## Simulate a site query to test whether a filter really excludes something
+
+The highest-value technique in this skill. When a ticket claims "X shouldn't be showing but is",
+rebuild the site's own filters against `/items/count` and check whether the record survives. This
+tests the filter's real semantics instead of reasoning about the code.
+
+The directory query (`buildMembersSearchQuery` in `backend/cms-data-methods.js`) is:
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "filter": {
+    "optOut": { "$ne": true },
+    "action": { "$ne": "drop" },
+    "memberships.membertype": { "$ne": "PAC STAFF" },
+    "isVisible": true
+  }
+}
+```
+
+Add the member you are investigating and read the count. **Always run the control too** — the
+same filter _without_ the clause under test — or a `0` tells you nothing:
+
+```
+with the PAC STAFF clause     -> 0   (excluded)
+without the PAC STAFF clause  -> 1   (would otherwise appear)
+```
+
+To ask "does _anything_ slip through?", combine both conditions on the same field with `$and`
+(a filter object cannot hold two operators under one key):
+
+```json
+{
+  "dataCollectionId": "MembersDataLatest",
+  "filter": {
+    "$and": [
+      { "memberships.membertype": { "$contains": "PAC" } },
+      { "memberships.membertype": { "$ne": "PAC STAFF" } },
+      { "optOut": { "$ne": true } },
+      { "isVisible": true }
+    ]
+  }
+}
+```
+
+Nested paths into array fields (`memberships.membertype`, `addresses.postalcode`) work
+throughout.
+
+> Caveat proven on 2026-08-04: this validates **filter semantics**, not that the deployed site
+> applies them. A filter can be provably correct while the live page still misbehaves. To settle
+> that, get the site's actual API response — the browser devtools network tab is faster than any
+> amount of reasoning, and `?nearby=true` style search UIs often need geolocation before they
+> return anything at all.
+
+## Other endpoints
+
+**Collection schema** — field names, types, and which operators each field allows:
+
+```
+GET https://www.wixapis.com/wix-data/v2/collections/MembersDataLatest
+```
+
+**List all collections on the site:**
+
+```
+GET https://www.wixapis.com/wix-data/v2/collections
+```
+
+**Full-text search** across fields (`POST .../wix-data/v2/items/search`) — note it takes
+`data_collection_id` (snake_case) and a `search` object rather than `query`. Only works on
+CMS-native collections. See
+[Search Data Items](https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/search-data-items).
+
+**Aggregate** (`AGGREGATE` is supported on `MembersDataLatest`) for group-by counts, e.g.
+distribution of `action` values across the directory.
+
+Other collections worth knowing, from `COLLECTIONS` in `public/consts.js`:
+`SiteConfigs`, `CompiledStateCityMap`, `State`, `City`, `interests`,
+`contactUsSubmissions`, `updatedLoginEmails`, `QA_Users`, `ButtonClicks`.

package/backend/__tests__/map-link.test.js

@@ -0,0 +1,115 @@
+const { ADDRESS_STATUS_TYPES } = require('../../public/consts');
+const { buildMapLink } = require('../../public/Utils/sharedUtils');
+
+// ─── Helpers ─────────────────────────────────────────────────────────
+
+const fullAddress = (overrides = {}) => ({
+  line1: '1366 4th Ave',
+  line2: '',
+  city: 'Coraopolis',
+  state: 'PA',
+  postalcode: '15108-1675',
+  latitude: 40.4129180908203,
+  longitude: -80.0293197631836,
+  addressStatus: ADDRESS_STATUS_TYPES.FULL_ADDRESS,
+  ...overrides,
+});
+
+const queryOf = url => decodeURIComponent((url.split('?q=')[1] || '').replace(/\+/g, ' '));
+
+// ─── Monday 12596102059 ──────────────────────────────────────────────
+// NetForum's address verifier returned coordinates ~10.8 miles from the real
+// address for member 1806273. The directions link should resolve from the
+// address text, which is correct, rather than from the coordinates.
+
+describe('buildMapLink - prefers the address over coordinates', () => {
+  it('builds the link from the street address, not the lat/long', () => {
+    const url = buildMapLink(fullAddress());
+
+    expect(url).toContain('maps.google.com');
+    expect(queryOf(url)).toBe('1366 4th Ave, Coraopolis, PA, 15108');
+  });
+
+  it('does not put the stored coordinates in the link when an address exists', () => {
+    const url = buildMapLink(fullAddress());
+
+    expect(url).not.toContain('40.4129');
+    expect(url).not.toContain('-80.0293');
+  });
+
+  it('still resolves correctly when the coordinates are wrong', () => {
+    // Coordinates deliberately far from the address - the link must ignore them.
+    const url = buildMapLink(fullAddress({ latitude: 0, longitude: 0 }));
+
+    expect(queryOf(url)).toBe('1366 4th Ave, Coraopolis, PA, 15108');
+  });
+
+  it('url-encodes the address so spaces do not break the link', () => {
+    const url = buildMapLink(fullAddress());
+
+    expect(url).not.toMatch(/\?q=.*\s/);
+  });
+});
+
+// ─── Privacy ─────────────────────────────────────────────────────────
+// formatAddress omits line1 for anything other than full_address. Callers gate
+// on full_address before showing the button, but the helper must not leak a
+// hidden street address even if it is called directly.
+
+describe('buildMapLink - does not leak a hidden street address', () => {
+  it('omits the street line for a state_city_zip address', () => {
+    const url = buildMapLink(fullAddress({ addressStatus: ADDRESS_STATUS_TYPES.STATE_CITY_ZIP }));
+
+    expect(url).not.toContain('4th');
+    expect(queryOf(url)).toBe('Coraopolis, PA, 15108');
+  });
+
+  it('falls back to coordinates rather than the street line for dont_show', () => {
+    const url = buildMapLink(fullAddress({ addressStatus: ADDRESS_STATUS_TYPES.DONT_SHOW }));
+
+    expect(url).not.toContain('4th');
+    expect(url).toBe('https://maps.google.com/?q=40.4129180908203,-80.0293197631836');
+  });
+
+  it('truncates the postal code to five digits', () => {
+    const url = buildMapLink(fullAddress());
+
+    expect(url).not.toContain('1675');
+  });
+});
+
+// ─── Fallbacks ───────────────────────────────────────────────────────
+
+describe('buildMapLink - fallbacks', () => {
+  it('uses coordinates when the address has no printable parts', () => {
+    const url = buildMapLink({
+      line1: '',
+      line2: '',
+      city: '',
+      state: '',
+      postalcode: '',
+      latitude: 40.5,
+      longitude: -80.1,
+      addressStatus: ADDRESS_STATUS_TYPES.FULL_ADDRESS,
+    });
+
+    expect(url).toBe('https://maps.google.com/?q=40.5,-80.1');
+  });
+
+  it('returns an empty string when there is neither an address nor coordinates', () => {
+    expect(
+      buildMapLink({
+        line1: '',
+        city: '',
+        state: '',
+        postalcode: '',
+        addressStatus: ADDRESS_STATUS_TYPES.FULL_ADDRESS,
+      })
+    ).toBe('');
+  });
+
+  it('returns an empty string for a missing address', () => {
+    expect(buildMapLink(null)).toBe('');
+    expect(buildMapLink(undefined)).toBe('');
+  });
+});

package/backend/__tests__/url-validation.test.js

@@ -0,0 +1,69 @@
+const { isNotValidUrl } = require('../../public/Utils/personalDetailsUtils');
+
+// ─── Helpers ─────────────────────────────────────────────────────────
+
+const isValid = url => !isNotValidUrl(url);
+
+// ─── Regression: digits in the hostname ──────────────────────────────
+// Monday bug 12663709539 - a member could not save the booking link
+// https://patty-10439.square.site because the host character class was
+// written `[da-z.-]` instead of `[\da-z.-]`, rejecting every domain
+// containing a digit.
+
+describe('isNotValidUrl - digits in hostname', () => {
+  it('accepts the exact URL from the bug report', () => {
+    expect(isValid('https://patty-10439.square.site')).toBe(true);
+  });
+
+  it.each([
+    'https://my-spa123.com',
+    'https://massage4u.net',
+    'https://booksy.com/en-us/698924_therapist_health-fitness_119607_city',
+    'https://www.genbook.com/bookings/slot/reservation/30241562?bookingSourceId=1000',
+    'www.spa2go.com',
+    'https://123.example.com',
+  ])('accepts %s', url => {
+    expect(isValid(url)).toBe(true);
+  });
+});
+
+describe('isNotValidUrl - case insensitivity', () => {
+  it.each(['https://Patty-10439.Square.Site', 'HTTPS://EXAMPLE.COM', 'WWW.Example.Com'])(
+    'accepts %s',
+    url => {
+      expect(isValid(url)).toBe(true);
+    }
+  );
+});
+
+// ─── Guard against regressions in the previously-working cases ───────
+
+describe('isNotValidUrl - previously valid URLs stay valid', () => {
+  it.each([
+    'https://square.site',
+    'https://patty.square.site',
+    'http://healinghut.massagetherapy.com',
+    'www.example.com',
+    'https://example.co.uk',
+    'https://example.com/path/to/page',
+    'https://example.com?foo=bar',
+    'https://example.com#anchor',
+  ])('accepts %s', url => {
+    expect(isValid(url)).toBe(true);
+  });
+});
+
+describe('isNotValidUrl - invalid input is still rejected', () => {
+  it.each(['not a url', 'example', 'ftp://example.com', 'justtext.c', 'http://'])(
+    'rejects %s',
+    url => {
+      expect(isValid(url)).toBe(false);
+    }
+  );
+
+  it('treats an empty value as valid because the field is optional', () => {
+    expect(isValid('')).toBe(true);
+    expect(isValid(undefined)).toBe(true);
+    expect(isValid(null)).toBe(true);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abmp-npm",
-  "version": "2.0.76",
+  "version": "2.0.77",
   "main": "index.js",
   "scripts": {
     "check-cycles": "madge --circular .",

package/pages/Home.js

@@ -3,20 +3,15 @@ const { location: wixLocation } = require('@wix/site-location');
 const { window: wixWindow, rendering } = require('@wix/site-window');
 const { withWarmUpData } = require('psdev-utils/frontend');
 
-const {
-  ADDRESS_STATUS_TYPES,
-  DEFAULT_FILTER,
-  DROPDOWN_OPTIONS,
-  LIGHTBOX_NAMES,
-} = require('../public/consts.js');
+const { ADDRESS_STATUS_TYPES, DEFAULT_FILTER, DROPDOWN_OPTIONS } = require('../public/consts.js');
 const { createHomepageUtils } = require('../public/Utils/homePage.js');
 const {
   getMainAddress,
-  findMainAddress,
-  checkAddressIsVisible,
   formatPracticeAreasForDisplay,
+  checkAddressIsVisible,
   isWixHostedImage,
   normalizeExternalUrl,
+  buildMapLink,
 } = require('../public/Utils/sharedUtils.js');
 
 let filter = JSON.parse(JSON.stringify(DEFAULT_FILTER));
@@ -36,28 +31,6 @@ const pagination = {
 let searchResults = [];
 let isMobile = false;
 
-const isMappable = addr =>
-  addr?.addressStatus === ADDRESS_STATUS_TYPES.FULL_ADDRESS && addr.latitude && addr.longitude;
-
-// The button is only offered when the member has at least one mappable address, which is
-// the same condition as before the lightbox was introduced. When that address is not the
-// primary one we still show the button but withhold the link, so the click opens the
-// lightbox instead of sending the visitor to a secondary address in another city.
-const getDirectionsTarget = itemData => {
-  const addresses = Array.isArray(itemData?.addresses) ? itemData.addresses : [];
-  const showButton = checkAddressIsVisible(addresses).some(isMappable);
-  if (!showButton) {
-    return { showButton: false, mapsLink: null };
-  }
-  const mainAddr = findMainAddress(itemData?.addressDisplayOption, addresses);
-  return {
-    showButton: true,
-    mapsLink: isMappable(mainAddr)
-      ? `https://maps.google.com/?q=${mainAddr.latitude},${mainAddr.longitude}`
-      : null,
-  };
-};
-
 const homePageOnReady = async ({
   _$w,
   getCompiledFiltersOptions,
@@ -209,16 +182,6 @@ const homePageOnReady = async ({
       await updateResults('zeroTimeout');
     });
     const baseUrl = await wixLocation.baseUrl();
-    _$w('#showMaps').onClick(event => {
-      const member = searchResults.find(result => result._id === event.context.itemId);
-      if (!member) {
-        return;
-      }
-      const { showButton, mapsLink } = getDirectionsTarget(member);
-      if (showButton && !mapsLink) {
-        wixWindow.openLightbox(LIGHTBOX_NAMES.CONTACT_FOR_LOCATION, member);
-      }
-    });
     _$w('#profileRepeater').onItemReady(($item, itemData) => {
       // 1) safely default to arrays
       const addresses = Array.isArray(itemData.addresses) ? itemData.addresses : [];
@@ -263,24 +226,33 @@ const homePageOnReady = async ({
         $item('#milesAwayText').text = '';
       }
 
-      // 7) "Show maps" button. Links to the primary address when it is a full address;
-      // otherwise it stays visible and the page-level onClick opens a lightbox.
-      const { showButton, mapsLink } = getDirectionsTarget(itemData);
+      // 7) "Show maps" button shown only when we can actually build a link for it
+      const visible = checkAddressIsVisible(addresses);
+      const fullAddressWithValidCoords = visible.find(
+        addr =>
+          addr.addressStatus === ADDRESS_STATUS_TYPES.FULL_ADDRESS &&
+          addr.latitude &&
+          addr.longitude
+      );
 
-      if (!showButton) {
-        $item('#showMaps').hide();
-      } else {
+      // Links to the street address rather than the stored coordinates, which are
+      // unreliable for some members. The full-address filter above is what keeps
+      // this safe: members set to state_city_zip or dont_show never reach here, so
+      // a hidden street address is never put in a maps URL.
+      //
+      // Gate on the link rather than on the address. buildMapLink returns '' when
+      // it can build neither an address nor a coordinate link, and it also handles
+      // being passed undefined - so this cannot leave a visible button linking
+      // nowhere, even if the filter above is later relaxed.
+      const mapLink = buildMapLink(fullAddressWithValidCoords);
+
+      if (mapLink) {
         $item('#showMaps').enable();
         $item('#showMaps').show();
-
-        if (mapsLink) {
-          $item('#showMaps').link = mapsLink;
-          $item('#showMaps').target = '_blank';
-        } else {
-          // Clear any link left over from a recycled repeater item, otherwise the
-          // button would still navigate to the previous member's address.
-          $item('#showMaps').link = undefined;
-        }
+        $item('#showMaps').link = mapLink;
+        $item('#showMaps').target = '_blank';
+      } else {
+        $item('#showMaps').hide();
       }
 
       // 8) Phone / contact form

package/pages/index.js

@@ -9,5 +9,4 @@ module.exports = {
   ...require('./deleteConfirm.js'),
   ...require('./SaveAlerts.js'),
   ...require('./LearnMore.js'),
-  ...require('./contactForLocation.js'),
 };

package/public/Utils/personalDetailsUtils.js

@@ -13,8 +13,12 @@ function isNotValidUrl(url) {
   if (!url) return false;
 
   // URL must start with protocol OR www - handles all TLDs including multi-level and query params
+  // NOTE: the host class is `[\da-z.-]` (digit, letter, dot, hyphen). It previously read
+  // `[da-z.-]`, which - missing the backslash - matched only a literal "d" plus a-z, so any
+  // domain containing a digit was rejected (e.g. https://patty-10439.square.site).
+  // The `i` flag keeps mixed-case hosts valid; domains are case-insensitive.
   const urlRegex =
-    /^(https?:\/\/|www\.)([da-z.-]+)\.([a-z.]{2,})([/\w .-]*)*(\?[&\w=.-]*)?(#[&\w=.-]*)?\/?$/;
+    /^(https?:\/\/|www\.)([\da-z.-]+)\.([a-z.]{2,})([/\w .-]*)*(\?[&\w=.-]*)?(#[&\w=.-]*)?\/?$/i;
 
   return !urlRegex.test(url);
 }

package/public/Utils/sharedUtils.js

@@ -118,6 +118,37 @@ function formatAddress(item) {
   return addressParts.filter(Boolean).join(', ');
 }
 
+/**
+ * Builds the outbound map link for an address.
+ *
+ * Prefers the street address over the stored coordinates. NetForum's address
+ * verifier (Cdyne) sometimes returns coordinates that are miles away from the
+ * real address, and some coordinates were edited by hand in the past to change
+ * directory ranking, so the address text is the more reliable of the two.
+ * Distance ranking and the "XX miles away" figure keep using the coordinates -
+ * that is a separate calculation (see calculateDistance) and is unaffected.
+ *
+ * Falls back to coordinates only when the address cannot be formatted, so the
+ * button never links nowhere.
+ *
+ * @param {Object} address - a single address entry
+ * @returns {string} map URL, or '' when neither an address nor coordinates exist
+ */
+function buildMapLink(address) {
+  if (!address) return '';
+
+  const query = formatAddress(address);
+  if (query) {
+    return `https://maps.google.com/?q=${encodeURIComponent(query)}`;
+  }
+
+  if (isValidLocation(address)) {
+    return `https://maps.google.com/?q=${address.latitude},${address.longitude}`;
+  }
+
+  return '';
+}
+
 /**
  * @param {Array} addressDisplayOption
  * @param {Array} addresses
@@ -228,6 +259,7 @@ module.exports = {
   toRadians,
   generateId,
   formatAddress,
+  buildMapLink,
   isWixHostedImage,
   normalizeExternalUrl,
   normalizeEmail,

package/public/consts.js

@@ -85,7 +85,6 @@ const LIGHTBOX_NAMES = {
   SELECT_BANNER_IMAGES: 'Select Banner Images',
   CONTACT_US: 'Contact Us',
   MAIN_ADDRESS_ERROR: 'mainAddressError',
-  CONTACT_FOR_LOCATION: 'contactForLocation',
 };
 
 const FREE_WEBSITE_TEXT_STATES = {

package/pages/contactForLocation.js

@@ -1,28 +0,0 @@
-const { location: wixLocation } = require('@wix/site-location');
-const { lightbox } = require('@wix/site-window');
-
-const { PAGES_PATHS } = require('../public/consts.js');
-
-/**
- * Shown from the directory when a member's primary address is not a full address,
- * so "Directions" cannot be offered. Sends the visitor to the member's profile
- * page rather than opening the contact form.
- */
-async function contactForLocationOnReady({ $w: _$w }) {
-  const member = await lightbox.getContext();
-  const profilePath = member?.url;
-
-  if (!profilePath) {
-    _$w('#contact').hide();
-    return;
-  }
-
-  _$w('#contact').onClick(async () => {
-    await lightbox.close();
-    wixLocation.to(`/${PAGES_PATHS.PROFILE}/${profilePath}`);
-  });
-}
-
-module.exports = {
-  contactForLocationOnReady,
-};