[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_198":199,"_200":201},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_38":-7,"_121":-5,"_19":122,"_123":124,"_125":126,"_127":128,"_129":130,"_21":131,"_132":-5,"_133":-5,"_134":24,"_135":136,"_137":84,"_138":-5,"_139":-5,"_140":141},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","iamgodmatters","name","god-matters-commerce-qa","branchName","main","path","HUMAN_QA.md","project",{"_32":71,"_13":14,"_36":72,"_73":-5,"_74":24,"_75":76,"_77":76,"_78":79,"_80":-5,"_30":67,"_81":82,"_83":84,"_85":-5,"_86":-5,"_87":26,"_40":41,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":93,"_94":93,"_95":96,"_97":96,"_98":96,"_99":93,"_100":93,"_53":101,"_102":103,"_104":105,"_106":24},"file",{"_63":64,"_13":18,"_65":21,"_66":24,"_70":-5},"isDirectory",false,"page",0,"history",[31],"hasNext","userId",{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":-5,"_58":-5,"_59":-5,"_60":61},"id","35a9d9ca-4ee6-4867-868a-e26d9db79cfc","branchId","40ce0313-f829-4280-ae74-425c06cd49f5","createdAt",["D",1789115915007],"version",4,"orgId","01a06cfb-4bd3-744f-bb74-43b388ce2944","parentId","cb715da7-3610-40e6-9797-211c4ec4b869","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","ChatGPT","user",{"_32":67,"_40":41,"_11":12,"_68":69},{"_63":64,"_13":18,"_65":21,"_66":24},"pull","merge","revert","multiple","commits",[62],{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":-5,"_58":-5},"fileId","2d46d27a-adbc-11f1-989f-1607ee4eb77e","fileType","deleted","1db7f6b1-502a-4018-8620-3f051aa5a3ba","avatar","https://avatars.githubusercontent.com/u/169981264?v=4","deletedAtVersion","8bd9cabc-a784-40f0-9473-1b15d98ef97a",["D",1789115798497],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Read-only QA monitor for God Matters Commerce Manager","imageUrl","pinnedFileId","e7dd1c3a-adbb-11f1-800c-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_120":69},"org",{"_11":12,"_115":116,"_68":69,"_30":67,"_117":118,"_119":24},"branch",{"_38":39,"_13":16,"_32":35,"_107":71,"_108":-5,"_109":-5,"_110":-5,"_111":-5,"_112":-5,"_113":14,"_114":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","IAMGodmatters","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_32":71,"_13":14,"_36":194,"_73":-5,"_74":24,"_75":76,"_77":76,"_78":79,"_80":-5,"_30":67,"_81":82,"_83":84,"_85":-5,"_86":-5,"_87":26,"_40":41,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":93,"_94":93,"_95":96,"_97":96,"_98":96,"_99":93,"_100":93,"_53":195,"_102":196,"_104":197,"_106":24},"tree",[161,162,163,164],"files",[161,162,163,164],"counts",{"_150":26,"_151":152,"_153":26,"_154":155,"_156":157},"contents",[],{"_32":142,"_13":18,"_63":64,"_42":-5,"_34":35,"_143":39,"_144":84,"_36":145,"_38":26,"_65":21,"_146":147,"_66":24,"_148":-5,"_17":149},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},"ef5da627-2c38-42f3-812a-14db839abeab","branchVersion","latest",["D",1789115915007],"content","# God Matters Commerce Manager — Manual Authenticated QA\n\nUse this checklist only on a Shopify development/client-transfer test store or another store explicitly designated for QA. Do not use a real customer store for destructive tests.\n\n## A. Shopify install and permissions\n- [ ] Install/open Commerce Manager from Shopify Admin.\n- [ ] Confirm App Bridge loads inside Admin.\n- [ ] Confirm current requested scopes are displayed correctly.\n- [ ] Reauthorize when new scopes are requested.\n- [ ] Confirm refusing authorization leaves the store unchanged.\n- [ ] Confirm uninstall removes future app access.\n\n## B. Merchant isolation\n- [ ] Test with two separate Shopify development stores.\n- [ ] Store A cannot read Store B package, supplier status, jobs, products, billing, or credentials.\n- [ ] Store B cannot read Store A state.\n- [ ] Queue processing for one store never processes another store's interactive job.\n\n## C. Store packages\n- [ ] Launch = up to 20 products / $79 total.\n- [ ] Grow = up to 50 products / $149 total.\n- [ ] Business = up to 100 products / $249 total.\n- [ ] Scale = up to 200 products / $399 total.\n- [ ] Plus Growth = $999 service / up to 200 products; Shopify Plus fees separate.\n- [ ] Changing package updates the correct merchant only.\n\n## D. Core store provisioning\n- [ ] Prepare My Store creates/reuses Featured, New Arrivals, Best Sellers.\n- [ ] About Us, FAQ, Shipping & Returns are created/reused.\n- [ ] Main/footer navigation updates without duplicates.\n- [ ] Re-running core setup is idempotent.\n- [ ] Existing merchant content is not silently deleted.\n\n## E. Supplier connection\n- [ ] Connect a QA CJdropshipping account using the secure embedded form.\n- [ ] API key field clears after submission.\n- [ ] Raw API key is not returned in UI/API/log output.\n- [ ] Supplier token is isolated to the current Shopify store.\n- [ ] Disconnect/error state is clear and recoverable.\n- [ ] U.S.-warehouse/source filters behave as expected for the intended U.S. catalog path.\n\n## F. Product import and automatic build\nStart with 1–3 QA products, never 200 at once.\n- [ ] Product title/description/images match supplier data.\n- [ ] Variants and inventory map correctly.\n- [ ] Calculated selling price matches configured target margin logic.\n- [ ] Online Store publication occurs only after required permissions.\n- [ ] New Arrivals assignment works.\n- [ ] Featured assignment behaves as intended.\n- [ ] Re-import does not create duplicate `gm-cj-*` products.\n- [ ] Package product-count limit is enforced.\n- [ ] Out-of-stock/unavailable supplier products are skipped safely.\n- [ ] Failed supplier API call leaves a recoverable job state.\n\n## G. Queue and worker\n- [ ] Starting automatic build creates one persistent job for the merchant.\n- [ ] Job status survives refresh/reopen.\n- [ ] Worker advances the oldest eligible queued work.\n- [ ] Interactive process-next is restricted to the authenticated shop.\n- [ ] Retry/idle/error state is visible and does not loop endlessly.\n- [ ] Completed jobs stop creating products.\n\n## H. $19 reservation funnel\nUse Stripe test/sandbox capability if available; do not generate fake live customer charges.\n- [ ] Checkout clearly states the $19 is a credit, not the full store price.\n- [ ] Successful payment is recorded once.\n- [ ] Duplicate webhook delivery is idempotent.\n- [ ] Post-payment `/start` flow recognizes the reservation.\n- [ ] Package selection and Shopify-store status save correctly.\n- [ ] First qualifying $19 gross sale claims the one-time Shopify-registration funding trigger only once.\n- [ ] Later $19 reservations do not re-trigger the first-sale event.\n- [ ] Invalid Stripe signatures are rejected.\n\n## I. Shopify billing / AI plan\nOn a Shopify development store with test billing only.\n- [ ] Starter $4.99, Growth $9.99, Pro $19.99 display correctly.\n- [ ] 14-day trial wording is accurate.\n- [ ] Billing approval is performed by Shopify, not silently by the app.\n- [ ] Cancelled/declined approval does not unlock paid access.\n- [ ] Approved test subscription reflects in billing status.\n\n## J. Security and resilience\n- [ ] Anonymous merchant endpoints return 4xx.\n- [ ] Invalid Shopify HMAC is rejected.\n- [ ] Invalid Stripe signature is rejected.\n- [ ] Secrets/tokens never appear in health/public capability responses.\n- [ ] Oversized/invalid JSON requests are rejected.\n- [ ] Refresh, back button, double click, and duplicate submissions do not duplicate paid/build actions.\n- [ ] Mobile Shopify Admin view remains usable.\n\n## Release rule\nDo not call a release fully verified until automated QA is green and all applicable authenticated/manual checks above are PASS or explicitly BLOCKED by a third-party protected step.\n","label",[18],"pulls","branches",1,"forks","envVars",{"_158":26,"_160":26},"connections",{"_158":26,"_159":26},"count","unfilledCount","emptyCount",{"_32":142,"_13":18,"_63":64,"_42":-5,"_34":35,"_143":39,"_144":84,"_36":191,"_38":26,"_65":21,"_146":147,"_66":24,"_148":-5,"_172":192,"_17":193},{"_32":184,"_13":185,"_63":82,"_42":-5,"_34":35,"_143":152,"_144":84,"_36":186,"_38":26,"_65":187,"_146":188,"_66":24,"_148":14,"_172":189,"_17":190},{"_32":175,"_13":176,"_63":177,"_42":-5,"_34":35,"_143":178,"_144":84,"_36":179,"_38":26,"_65":180,"_146":181,"_66":24,"_148":-5,"_172":182,"_17":183},{"_32":165,"_13":166,"_63":167,"_42":-5,"_34":35,"_143":168,"_144":84,"_36":169,"_38":26,"_65":170,"_146":171,"_66":24,"_148":-5,"_172":173,"_17":174},"bfd30328-f89d-4351-a17b-806c23ab9ba4","qa.ts","fd28f898-adbb-11f1-8e04-1607ee4eb77e",2,["D",1789115834282],"script","const TARGET='https://god-matters-commerce.val.run';\n\ntype Check={name:string;ok:boolean;detail:string;ms:number};\ntype Report={ok:boolean;target:string;startedAt:string;finishedAt:string;passed:number;failed:number;total:number;checks:Check[]};\n\nasync function timed(name:string,fn:()=>Promise):Promise{\n const start=Date.now();\n try{return {name,ok:true,detail:await fn(),ms:Date.now()-start};}\n catch(e){return {name,ok:false,detail:e instanceof Error?e.message:String(e),ms:Date.now()-start};}\n}\nfunction must(condition:unknown,message:string){if(!condition)throw new Error(message);}\nasync function req(path:string,init:RequestInit={}){\n const r=await fetch(TARGET+path,{redirect:'manual',...init});\n const text=await r.text();\n return {r,text,json:()=>{try{return JSON.parse(text)}catch{return null}}};\n}\nfunction expectStatus(actual:number,allowed:number[],context:string){must(allowed.includes(actual),`${context}: expected ${allowed.join('/')}, got ${actual}`);}\nfunction hasNoSecrets(text:string){\n const lowered=text.toLowerCase();\n const suspicious=['client_secret','access_token\":\"','refresh_token\":\"','stripe_webhook_secret','api_key\":\"','authorization\":\"bearer'];\n for(const x of suspicious)must(!lowered.includes(x),`response appears to expose ${x}`);\n}\n\nexport async function runShopifyQA():Promise{\n const startedAt=new Date().toISOString();\n const checks:Promise[]=[];\n checks.push(timed('Health endpoint',async()=>{const {r,text,json}=await req('/health');expectStatus(r.status,[200],'health');const j=json();must(j?.ok===true,'health ok flag missing');must(j?.name==='God Matters Commerce Manager','unexpected app name');must(typeof j?.version==='string','version missing');must(j?.provisioningMode==='multi-tenant','multi-tenant mode missing');must(j?.billingProvider==='Shopify','Shopify billing provider missing');must(j?.features?.includes('stripe-launch-reservation'),'$19 reservation feature missing');must(j?.features?.includes('first-sale-shopify-registration-funding-trigger'),'first-sale funding trigger missing');must(j?.features?.includes('shopify-write-provisioning'),'write provisioning feature missing');must(j?.features?.includes('cj-us-supplier-connection'),'CJ feature missing');hasNoSecrets(text);return `HTTP 200 · version ${j.version} · ${j.features.length} declared features`; }));\n checks.push(timed('Public capabilities contract',async()=>{const {r,text,json}=await req('/api/capabilities');expectStatus(r.status,[200],'capabilities');const j=json();must(j?.name==='God Matters Commerce Manager','name mismatch');must(Array.isArray(j?.features)&&j.features.length>=5,'features incomplete');must(Array.isArray(j?.limitations)&&j.limitations.length>=3,'limitations incomplete');hasNoSecrets(text);return `${j.features.length} features · ${j.limitations.length} limitations`; }));\n checks.push(timed('Store package catalog',async()=>{const {r,json}=await req('/api/store-packages');expectStatus(r.status,[200],'packages');const j=json();const list=j?.packages;must(Array.isArray(list),'packages missing');const s=JSON.stringify(list);for(const key of ['launch20','grow50','business100','scale200','plusGrowth'])must(s.includes(key),`missing package ${key}`);for(const price of [79,149,249,399,999])must(s.includes(String(price)),`missing price ${price}`);return '20/50/100/200 + Plus package definitions present'; }));\n checks.push(timed('AI subscription plan contract',async()=>{const {r,json}=await req('/api/plans');expectStatus(r.status,[200],'plans');const j=json();must(j?.billingProvider==='Shopify','billing provider mismatch');must(j?.trialDays===14,'trial length mismatch');must(j?.plans?.starter?.price===4.99,'Starter price mismatch');must(j?.plans?.growth?.price===9.99,'Growth price mismatch');must(j?.plans?.pro?.price===19.99,'Pro price mismatch');return 'Starter/Growth/Pro prices and 14-day trial match'; }));\n checks.push(timed('$19 launch entry page',async()=>{const {r,text}=await req('/start');expectStatus(r.status,[200],'start');must(text.includes('$19'),'$19 text missing');must(text.includes('buy.stripe.com'),'Stripe checkout link missing');must(text.toLowerCase().includes('credited'),'credit disclosure missing');return 'Reservation CTA, Stripe link and credit disclosure present'; }));\n checks.push(timed('Embedded Shopify app shell',async()=>{const {r,text}=await req('/shopify/app');expectStatus(r.status,[200],'embedded app');for(const token of ['data-store-package=\"launch20\"','data-store-package=\"grow50\"','data-store-package=\"business100\"','data-store-package=\"scale200\"','data-store-package=\"plusGrowth\"','id=\"approve-scopes\"','id=\"build-core\"','id=\"connect-cj\"','id=\"start-auto-build\"'])must(text.includes(token),`missing UI control ${token}`);must(text.includes('app-bridge.js'),'Shopify App Bridge missing');return 'Package, permissions, core-build, CJ and catalog controls present'; }));\n checks.push(timed('Policy/support pages',async()=>{for(const p of ['/privacy','/terms','/support']){const {r,text}=await req(p);expectStatus(r.status,[200],p);must(text.length>500,`${p} unexpectedly short`);}return 'Privacy, terms and support are available'; }));\n checks.push(timed('Static assets',async()=>{for(const p of ['/assets/app.css','/assets/app.js','/assets/embedded.js']){const {r,text}=await req(p);expectStatus(r.status,[200],p);must(text.length>100,`${p} unexpectedly short`);must((r.headers.get('x-content-type-options')||'').toLowerCase()==='nosniff',`${p} nosniff missing`);}return 'CSS, standalone JS and embedded JS load with nosniff'; }));\n checks.push(timed('Security headers',async()=>{const {r}=await req('/shopify/app');const csp=r.headers.get('content-security-policy')||'';must(csp.includes('frame-ancestors https://admin.shopify.com https://*.myshopify.com'),'embedded frame policy mismatch');must((r.headers.get('x-content-type-options')||'').toLowerCase()==='nosniff','nosniff missing');must((r.headers.get('cache-control')||'').includes('no-store'),'no-store missing');return 'CSP, frame-ancestors, no-store and nosniff present'; }));\n checks.push(timed('Pricing calculation',async()=>{const {r,json}=await req('/api/price',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({productCost:100,supplierShipping:20,customerShipping:10,feePercent:5,targetMarginPercent:20,currency:'USD'})});expectStatus(r.status,[200],'price');const j=json();must(j?.itemPrice===150,'unexpected item price');must(j?.totalCustomerPayment===160,'unexpected customer payment');must(j?.estimatedProfit>0,'profit estimate missing');return 'Known pricing fixture returns $150 item / $160 total'; }));\n checks.push(timed('Pricing validation rejects unsafe input',async()=>{const {r}=await req('/api/price',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({productCost:-1})});expectStatus(r.status,[400],'negative price');return 'Negative product cost rejected with HTTP 400'; }));\n checks.push(timed('Catalog draft remains unpublished',async()=>{const body={items:[{title:'QA Test Product',description:'QA only',vendor:'QA',productType:'test',sku:'QA-001',tags:['qa'],pricing:{productCost:10,currency:'USD'}}],includeShopifyCsv:true};const {r,text,json}=await req('/api/catalog',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(body)});expectStatus(r.status,[200],'catalog');const j=json();must(typeof j?.shopifyCsv==='string','CSV missing');must(j.shopifyCsv.toLowerCase().includes('draft'),'CSV is not draft');must(j.shopifyCsv.includes('0'),'zero-inventory marker missing');must(!text.toLowerCase().includes('

History · HUMAN_QA.md