abmp-npm 2.0.77 → 2.0.78

package/package.json

@@ -1,7 +1,14 @@
 {
   "name": "abmp-npm",
-  "version": "2.0.77",
+  "version": "2.0.78",
   "main": "index.js",
+  "files": [
+    "index.js",
+    "backend",
+    "pages",
+    "public",
+    "!backend/__tests__"
+  ],
   "scripts": {
     "check-cycles": "madge --circular .",
     "test": "jest backend/__tests__",

package/.claude/skills/wix-data-query/SKILL.md

@@ -1,167 +0,0 @@
----
-name: wix-data-query
-description: Query the ABMP/ASCP/AHP Wix CMS collections (MembersDataLatest, SiteConfigs, etc.) via the Wix Data REST API to investigate member data issues. Use when a bug report, Monday ticket, or support escalation references a specific member ID, profile slug, or email — e.g. "services don't appear on the website", "book now link missing", "member still showing after they dropped", "expired license rendering", "address/lat-long is wrong", "upgraded membership didn't sync". Also use when you need a collection's real field names, types, or query operators before writing backend code.
----
-
-# Wix Data queries for member data investigations
-
-Read the live CMS record before theorising. Most "the website is wrong" tickets are
-answered in one query: the site renders what is in `MembersDataLatest`, so if the field
-is wrong there, the bug is in the sync (`backend/daily-pull/`), not in the UI.
-
-## 1. Pick the site
-
-Every association is a **separate Wix site with its own copy of the collections**. A member
-who exists on ABMP may not exist on ASCP. Always confirm which site the ticket is about —
-the profile URL tells you (`abmpmembers.com` → ABMP, `ascpskincare.com` → ASCP).
-
-| Site                   | siteId                                 | Env  |
-| ---------------------- | -------------------------------------- | ---- |
-| ABMP Members Directory | `384d680a-2870-4086-bda0-9894ce4503b8` | prod |
-| ASCP Members Directory | `1cb02bba-3a36-45e0-bdb4-1a1a2cfe2fdc` | prod |
-| AHP Members Directory  | `5553798e-c71e-4a58-9b9e-515803823429` | prod |
-| Test ABMP Members      | `cd9fca47-63d3-4538-b26c-1f91ad0a9420` | test |
-| Test ASCP Members      | `8c031731-3f58-4d5f-b7dc-6ccabd1b5722` | test |
-| Test AHP Members       | `4535a35f-439d-4558-8e68-9000258e2a2a` | test |
-
-Collection IDs are in [`public/consts.js`](../../../public/consts.js) under `COLLECTIONS`.
-The main one is `MembersDataLatest`.
-
-## 2. Pick the auth path
-
-**Path A — Wix MCP (preferred when the `CallWixSiteAPI` tool is available).** No secrets to
-handle; auth is already managed. This is the path used to validate every recipe in this skill.
-
-```
-CallWixSiteAPI(
-  siteId:       "384d680a-2870-4086-bda0-9894ce4503b8",
-  url:          "https://www.wixapis.com/wix-data/v2/items/query",
-  method:       "POST",
-  sourceDocUrl: "https://dev.wix.com/docs/api-reference/business-solutions/cms/data-items/query-data-items",
-  body:         { ...see recipes... }
-)
-```
-
-**Path B — raw REST**, for scripts, CI, or any session without the MCP. Requires an admin API
-key from the [API Keys Manager](https://manage.wix.com/account/api-keys). Two headers, per the
-[auth docs](https://dev.wix.com/docs/api-reference/articles/authentication/api-keys/make-api-calls-with-an-api-key):
-
-```bash
-curl -s -X POST 'https://www.wixapis.com/wix-data/v2/items/query' \
-  -H "Authorization: $WIX_API_KEY" \
-  -H "wix-site-id: 384d680a-2870-4086-bda0-9894ce4503b8" \
-  -H 'Content-Type: application/json' \
-  -d '{"dataCollectionId":"MembersDataLatest","query":{"filter":{"memberId":731898},"paging":{"limit":1}}}'
-```
-
-Read the key from the environment (`$WIX_API_KEY`). Never paste a key into a file, a commit,
-a Monday comment, or a chat message. `MembersDataLatest` is `read: ADMIN` /
-`itemRead: PRIVILEGED`, so a visitor token will return nothing — this is expected, not a bug.
-
-## 3. Query
-
-Full cookbook with copy-paste bodies: [references/recipes.md](references/recipes.md).
-The single most common one — look a member up by profile slug:
-
-```json
-{
-  "dataCollectionId": "MembersDataLatest",
-  "query": { "filter": { "url": "karriknowles" }, "paging": { "limit": 1 } }
-}
-```
-
-By numeric PAC member ID (note: **number, not string**):
-
-```json
-{
-  "dataCollectionId": "MembersDataLatest",
-  "query": { "filter": { "memberId": 731898 }, "paging": { "limit": 1 } }
-}
-```
-
-## 4. Read the result against the field reference
-
-[references/members-data-latest.md](references/members-data-latest.md) lists every field, its
-type, and — importantly — the **traps**. The ones that cause wrong conclusions:
-
-- **`firstName`, `lastName`, `phone`, `toShowPhone` are encrypted.** They support only
-  `EQ`, `NE`, `HAS_SOME`, `EXISTS`. A `CONTAINS`/`STARTS_WITH` name search **fails** — it does
-  not silently return nothing, it errors. Search by `fullName` (not encrypted) instead.
-- **Duplicate legacy field pairs exist**: `showAbmp` _and_ `showABMP`, `apiBookingUrl` _and_
-  `APIBookingUrl`. Check both before concluding a value is missing.
-- **A `show*` boolean gates almost every "X doesn't appear on the site" ticket.** The data can
-  be perfectly correct and still not render because `showBookingUrl` / `showWebsite` /
-  `showContactForm` / `showName` is `false`. Check the flag before blaming the sync.
-- **`isVisible` and `action`** control directory presence. `action: "drop"` sets
-  `isVisible: false` (see `backend/daily-pull/process-member-methods.js`). A member who should
-  have been dropped but is still listed will show `action` other than `drop`, or
-  `isVisible: true` — that points at the PAC API payload, not at Wix.
-- **Two date formats, and mixing them fails silently.** `_createdDate` / `_updatedDate` are
-  real `DATETIME` fields using `{"$date":"...Z"}`. But dates inside the `memberships` and
-  `licenses` arrays are **plain ISO strings** (`"2027-06-12T00:00:00"` — no `Z`, no ms) and
-  must be compared as strings. Verified on ABMP prod: filtering
-  `memberships.expiration` with `$date` returns **0**; the same filter as a string returns
-  **1008**. A zero here is far more often a wrong filter than a clean bill of health.
-- **Totals:** `returnTotalCount` does not return a `total` on this collection. Use
-  `POST https://www.wixapis.com/wix-data/v2/items/count` (body: `dataCollectionId` +
-  top-level `filter`, no `query` wrapper) → `{"totalCount": N}`.
-
-- **`$eq` is case-sensitive; `$contains` is case-insensitive.** Verified on live ABMP: filtering
-  `url` with `"alisadanaeknowles"` matches the stored `"AlisaDanaeKnowles"` under `$contains`
-  and returns **nothing** under `$eq`. Stored slugs really are mixed case, so an exact-match
-  lookup on a user-supplied slug will silently miss. This is why `getMemberBySlug` originally
-  reached for full-text search.
-
-## 5. The historical PAC feed archive
-
-The live CMS answers _"what is true now"_. It cannot answer _"what did PAC actually send"_ or
-_"what did this member originally ask for"_ — and those are usually the questions that settle a
-dispute. For that, use the backup archive: [references/backup-archive.md](references/backup-archive.md).
-
-## 6. Writing data
-
-Read [§7 Rules](#7-rules) first. Writes need explicit approval, every time.
-
-**Prefer `PATCH` over `PUT`.** `PUT` (Update Data Item) replaces the entire payload — miss a
-field and you wipe it. `PATCH` changes only what you name:
-
-```
-PATCH https://www.wixapis.com/wix-data/v2/items/<itemId>
-{
-  "dataCollectionId": "MembersDataLatest",
-  "patch": {
-    "dataItemId": "<itemId>",
-    "fieldModifications": [
-      { "fieldPath": "optOut", "action": "SET_FIELD", "setFieldOptions": { "value": true } }
-    ]
-  }
-}
-```
-
-**Hiding a member is better than deleting one.** `optOut: true` is reversible, keeps the record,
-and **survives the nightly sync** — `optOut` is written only in `getNewMemberOnlyFields`, which
-returns `{}` for members that already exist, and it is absent from the always-update list in
-`backend/daily-pull/process-member-methods.js`. Deleting is irreversible, and if the member is
-still in PAC's feed the next sync simply recreates them as new.
-
-Deleting, when that is genuinely what was asked for:
-
-```
-DELETE https://www.wixapis.com/wix-data/v2/items/<itemId>?dataCollectionId=MembersDataLatest
-```
-
-Always verify afterwards with `/items/count` on the member id and report the result.
-
-## 7. Rules
-
-- **Read-only by default.** Query, count, distinct, aggregate, get-schema are all fine to run
-  unprompted during an investigation.
-- **Never write to a production collection without explicit approval in this conversation.**
-  Inserts, updates, patches, and `TRUNCATE` change live member-facing data. State exactly what
-  you intend to change and on which site, and wait for a yes. When a fix needs testing, use the
-  Test site IDs above.
-- **Don't paste member PII into external systems.** These records contain real names, emails,
-  phone numbers, and home addresses. Quote the minimum needed — a member ID and the one wrong
-  field — when writing a Monday comment or a commit message.
-- Ground endpoints in docs, not memory. If you need an endpoint this skill doesn't cover, find
-  it with `SearchWixRESTDocumentation` first.

package/.claude/skills/wix-data-query/references/backup-archive.md

@@ -1,136 +0,0 @@
-# The PAC feed archive (`abmp-backup-api`)
-
-A local archive of **raw PAC API responses**, in the repo behind `BACKUP_API_URL`
-(`backend/consts.js`). On this machine:
-
-```
-/Users/Matheusa/Documents/GitHub/abmp-backup-api/backups/
-```
-
-It is the only record of **what PAC actually sent** and of members' **pre-migration display
-preferences**. Neither exists anywhere in the live CMS.
-
-## Layout
-
-Bucketed by the PAC `action` value; each file is a verbatim API page.
-
-| Folder             | Files           | Records                |
-| ------------------ | --------------- | ---------------------- |
-| `new/`             | `page1.json`    | 233                    |
-| `new_Nov18th/`     | `page1..5.json` | 11,960 (full snapshot) |
-| `update/`          | `page1.json`    | 954                    |
-| `drop/`            | `page1.json`    | **416**                |
-| `failed requests/` | —               | empty                  |
-
-13,563 records, 13,478 unique members, all four associations
-(ABMP 5,586 / ASCP 6,656 / AHP 1,526 / ANP 176 memberships). Captured **Nov–Dec 2025**.
-
-Shape matches the live PAC API exactly:
-
-```json
-{
-  "total_results": 954,
-  "page_results": 954,
-  "total_pages": 1,
-  "results": [
-    {
-      "memberid": 1493418,
-      "firstname": "Andrea",
-      "lastname": "Williams",
-      "email": "…",
-      "phones": [],
-      "url": "…",
-      "action": "update",
-      "licenses": [],
-      "addresses": [],
-      "memberships": [],
-      "migrationData": {}
-    }
-  ]
-}
-```
-
-## `migrationData` — the part that matters
-
-Present on **every** record and absent from the live CMS. These are the members' legacy display
-preferences, carried over at migration:
-
-| Key                                              | Answers the ticket type                                   |
-| ------------------------------------------------ | --------------------------------------------------------- |
-| `opted_out`                                      | _"I asked not to be listed"_                              |
-| `interests`                                      | _"my services don't appear"_ (becomes `areasOfPractices`) |
-| `website`, `logo_url`                            | _"my website/logo used to show"_                          |
-| `schedule_code`                                  | _"my booking link is missing"_                            |
-| `show_phone`, `addressinfo`, `show_member_since` | _"my details display wrong"_                              |
-| `detailtext`                                     | original profile blurb                                    |
-
-## ⚠️ Limits — read before concluding anything
-
-1. **It is a single Nov–Dec 2025 snapshot, not a continuous log.** There is no record of any
-   later sync.
-2. **It does not contain every member.** 13,478 records against ~9,400 on the AHP site alone.
-3. Therefore **absence proves nothing.** "Not in the backup" does **not** mean "PAC never sent
-   it" — the single most tempting wrong inference here.
-
-Presence, by contrast, is solid evidence: if a member is in `drop/`, PAC really did send a drop
-for them.
-
-## Recipe: compare legacy preference against live state
-
-Index the archive by `memberid`, then batch-query the CMS. This is how the opted-out check below
-was done.
-
-```js
-const fs = require('fs');
-const dir = '/Users/Matheusa/Documents/GitHub/abmp-backup-api/backups';
-const idx = new Map();
-for (const d of fs.readdirSync(dir)) {
-  const p = `${dir}/${d}`;
-  if (!fs.statSync(p).isDirectory()) continue;
-  for (const f of fs.readdirSync(p)) {
-    if (!f.endsWith('.json')) continue;
-    for (const r of JSON.parse(fs.readFileSync(`${p}/${f}`, 'utf8')).results || []) {
-      idx.set(r.memberid, { bucket: d, action: r.action, mig: r.migrationData });
-    }
-  }
-}
-```
-
-Then, against the live site — `$hasSome` acts as "in" for a NUMBER field:
-
-```json
-{
-  "dataCollectionId": "MembersDataLatest",
-  "query": {
-    "filter": { "memberId": { "$hasSome": [804491, 817198, 137584] } },
-    "fields": ["memberId", "fullName", "optOut", "isVisible", "action"],
-    "paging": { "limit": 40 }
-  }
-}
-```
-
-## Finding on record (2026-08-04)
-
-40 members had `migrationData.opted_out === true`. 32 are still active (`new`/`update`); of those
-**29 correctly carry `optOut: true` today**, but **3 do not and are publicly visible on ABMP**:
-
-| memberId | Name                       |
-| -------- | -------------------------- |
-| 1091946  | Jessica Solorzano-Peterson |
-| 881021   | Arlette Underwood          |
-| 765272   | Summer Fairbanks           |
-
-**Not confirmed as a bug.** `optOut` is member-editable, so these three may have deliberately
-opted back in since migration. That cannot be distinguished remotely — the nightly sync touches
-`_updatedDate` on every record, so it is not a usable signal. Raise with PAC rather than assume,
-and do not change a member's `optOut` on the strength of this alone.
-
-## Other uses
-
-- **"Was this member ever actually dropped?"** — the `drop/` bucket is ground truth, and is the
-  unanswerable question behind the _multies not renewing_ ticket.
-- **Provenance** — telling a PAC-sourced record from a Wix-created test account. PAC-sourced
-  records have a real sequential `memberId` (~1.2M–1.8M), a `pageNumber` on the CMS side (written
-  only while processing a page of the PAC API response), and ISO `membersince`/`expiration`.
-  Wix-made test accounts use ids like `11111111`, throwaway email domains, and hand-typed date
-  strings such as `"November 2012"`.

package/.claude/skills/wix-data-query/references/members-data-latest.md

@@ -1,125 +0,0 @@
-# `MembersDataLatest` field reference
-
-Captured from the live **ABMP Members Directory** collection schema
-(`GET https://www.wixapis.com/wix-data/v2/collections/MembersDataLatest`) on 2026-08-04,
-collection revision `102`. Re-run that call to refresh — the schema is the source of truth,
-this file is a convenience copy.
-
-Permissions: `read/insert/update/remove: ADMIN`, `dataPermissions.itemRead: PRIVILEGED`.
-Paging modes: `OFFSET`, `CURSOR`. Supports `COUNT`, `DISTINCT`, `AGGREGATE`.
-
-## Identity
-
-| Field                           | Type       | Notes                                                                                                                                                    |
-| ------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `_id`                           | TEXT       | Wix item ID (system)                                                                                                                                     |
-| `memberId`                      | **NUMBER** | PAC member ID. Filter with a number, not a string.                                                                                                       |
-| `url`                           | TEXT       | Profile slug, e.g. `karriknowles` → `/profile/karriknowles`. Uniqueness enforced by `ensureUniqueUrl` in `backend/daily-pull/process-member-methods.js`. |
-| `generatedUrl`                  | BOOLEAN    | True when the slug was auto-generated rather than PAC-supplied                                                                                           |
-| `wixMemberId`                   | TEXT       | Wix Members app ID                                                                                                                                       |
-| `wixContactId`                  | TEXT       | Wix CRM contact ID                                                                                                                                       |
-| `contactId`                     | TEXT       | Legacy contact ID field                                                                                                                                  |
-| `_owner`                        | TEXT       | System                                                                                                                                                   |
-| `_createdDate` / `_updatedDate` | DATETIME   | `{"$date":"...Z"}` shape                                                                                                                                 |
-| `pageNumber`                    | NUMBER     | Which PAC API page last wrote this record — useful for tracing a sync run                                                                                |
-
-## Name and contact
-
-| Field                               | Type           | Notes                                                                               |
-| ----------------------------------- | -------------- | ----------------------------------------------------------------------------------- |
-| `firstName`                         | TEXT           | 🔒 **encrypted** — only `EQ`, `NE`, `HAS_SOME`, `EXISTS`                            |
-| `lastName`                          | TEXT           | 🔒 **encrypted** — same restriction                                                 |
-| `fullName`                          | TEXT           | Not encrypted → **use this for name searches** (`CONTAINS`, `STARTS_WITH` all work) |
-| `businessName` / `showBusinessName` | TEXT / BOOLEAN |                                                                                     |
-| `email`                             | TEXT           | Login email                                                                         |
-| `contactFormEmail`                  | TEXT           | Where contact-form mail goes; diverges from `email` by design                       |
-| `phone`                             | TEXT           | 🔒 **encrypted**                                                                    |
-| `toShowPhone`                       | TEXT           | 🔒 **encrypted** — the phone actually rendered                                      |
-| `phones`                            | ARRAY          | Full list from PAC                                                                  |
-
-## Membership and licensing
-
-| Field           | Type    | Notes                                                                                        |
-| --------------- | ------- | -------------------------------------------------------------------------------------------- |
-| `action`        | TEXT    | From the PAC API: `new` / `update` / `drop` / `none`. Drives `isVisible`.                    |
-| `isVisible`     | BOOLEAN | `action !== 'drop'`. Controls directory listing.                                             |
-| `optOut`        | BOOLEAN | Member-chosen suppression, independent of `action`                                           |
-| `memberships`   | ARRAY   | `{association, membertype, expiration, membersince}`                                         |
-| `licenses`      | ARRAY   | `{association, state, license, exempt}` — filtered per-site by `filterLicensesByAssociation` |
-| `showLicenseNo` | BOOLEAN |                                                                                              |
-
-## Location
-
-| Field                  | Type   | Notes                                                                              |
-| ---------------------- | ------ | ---------------------------------------------------------------------------------- |
-| `addresses`            | ARRAY  | `{key, line1, line2, city, state, postalcode, latitude, longitude, addressStatus}` |
-| `addressDisplayOption` | ARRAY  | `[{key, isMain}]` — which address is primary                                       |
-| `addressInfo`          | OBJECT | Map of address `key` → display mode                                                |
-| `locHash`              | ARRAY  | Geohash (precision 3, see `GEO_HASH_PRECISION`) used for proximity search          |
-
-`addressStatus` values come from `ADDRESS_STATUS_TYPES` in `public/consts.js`:
-`full_address`, `state_city_zip`, `dont_show`.
-
-## Profile content
-
-| Field              | Type          | Notes                                                                                                 |
-| ------------------ | ------------- | ----------------------------------------------------------------------------------------------------- |
-| `areasOfPractices` | ARRAY         | **This is the "services" list** members complain about. There is no field literally named `services`. |
-| `aboutService`     | RICH_TEXT     | HTML string                                                                                           |
-| `testimonial`      | ARRAY         | Free-text testimonials                                                                                |
-| `gallery`          | MEDIA_GALLERY |                                                                                                       |
-| `bannerImages`     | ARRAY         |                                                                                                       |
-| `profileImage`     | IMAGE         | `wix:image://` URI                                                                                    |
-| `logoImage`        | URL           |                                                                                                       |
-| `title`            | TEXT          | Default CMS field, generally unused                                                                   |
-
-## Display flags — check these first on "X doesn't appear" tickets
-
-| Field                         | Type    |
-| ----------------------------- | ------- | --------------------------------- |
-| `showName`                    | BOOLEAN |
-| `showPhone`                   | BOOLEAN |
-| `showWebsite`                 | BOOLEAN |
-| `showWixUrl`                  | BOOLEAN |
-| `showContactForm`             | BOOLEAN |
-| `showBookingUrl`              | BOOLEAN |
-| `showBusinessName`            | BOOLEAN |
-| `showLicenseNo`               | BOOLEAN |
-| `showAbmp` **and** `showABMP` | BOOLEAN | ⚠️ two separate fields both exist |
-
-## Links
-
-| Field                                   | Type | Notes                                                                                                                                          |
-| --------------------------------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| `website`                               | URL  | Member's own site                                                                                                                              |
-| `bookingUrl`                            | URL  | Member-entered booking link; rendered only when `showBookingUrl` is `true`                                                                     |
-| `apiBookingUrl` **and** `APIBookingUrl` | TEXT | ⚠️ two separate fields. Can contain a raw HTML embed blob (e.g. a Genbook `<script>` badge), not just a URL — don't assume it parses as a URL. |
-
-## Known traps
-
-1. **Encrypted fields reject substring operators.** `CONTAINS` on `firstName` errors out. Use
-   `fullName`.
-2. **Duplicate-case field pairs** (`showAbmp`/`showABMP`, `apiBookingUrl`/`APIBookingUrl`) are
-   real and both queryable. A value "missing" from one may be present in the other.
-3. **`memberId` is a NUMBER.** `{"memberId": "731898"}` matches nothing and returns an empty
-   list rather than an error — the most common false "member not found".
-4. **Per-site collections.** Absence on one site is not absence everywhere.
-5. **Eventually consistent.** A write may not be visible to the next immediate query.
-6. **Two different date formats.** Only true `DATETIME` fields (`_createdDate`,
-   `_updatedDate`) use the `{"$date":"...Z"}` form. Dates _inside_ the `memberships` and
-   `licenses` arrays — notably `memberships.expiration` and `memberships.membersince` — are
-   **plain ISO strings without a `Z` or milliseconds** (`"2027-06-12T00:00:00"`) and must be
-   filtered as strings. Using `$date` against them silently returns zero rows rather than
-   erroring, which reads as "no affected members" when there may be thousands.
-7. **`returnTotalCount` yields no `total`** on this collection — use
-   `POST /wix-data/v2/items/count` instead.
-8. **`{"$ne": ""}` also matches rows where the field is absent.** Verified 2026-08-04: filtering
-   `{"website": {"$ne": ""}}` returned 300 rows whose projected `website` and `bookingUrl` came
-   back empty — the field simply wasn't set on them. So `$ne ""` is _not_ "has a value", and any
-   count built on it is inflated. To mean "actually has a value", pair it with
-   `{"$exists": true}` or filter/verify client-side after projecting the field.
-
-## No regex filtering
-
-Wix Data has no regex operator, so you cannot ask the API questions like "domains containing a
-digit". Project the field, page through, and evaluate in JS.