feat(competitor): competitor analysis domain — spine + collector reframe + structured feeds

apps/web/eslint.config.mjs

@@ -22,11 +22,13 @@ const config = [
       // Next 16 bundles eslint-plugin-react-hooks v6 (React-Compiler-era) which
       // promotes these to errors. Our existing usages are intentional, benign
       // patterns (reset-optimistic-overlay-on-SWR-refresh effects; a monotonic
-      // key counter in a once-only lazy useState initializer) — keep them as
-      // warnings to match this repo's lenient lint posture. Revisit if we adopt
-      // the React Compiler.
+      // key counter in a once-only lazy useState initializer; Date.now() in async
+      // Server Components whose renders are request-scoped, not pure-functional) —
+      // keep them as warnings to match this repo's lenient lint posture. Revisit
+      // if we adopt the React Compiler.
       "react-hooks/set-state-in-effect": "warn",
       "react-hooks/refs": "warn",
+      "react-hooks/purity": "warn",
     },
   },
 ];

apps/web/src/__tests__/no-hardcoded-currency.test.ts

@@ -49,6 +49,25 @@ const ALLOWED = [
   // static bound labels on range inputs (min/max markers), not user data.
   "apps/web/src/app/(dashboard)/funding/funding-details.tsx",
 
+  // ── Competitor pricing collector ─────────────────────────────────────────
+  // pricing.ts: /(\$|€|EUR|£|GBP)?/ and /(\$|€|£)/ regex patterns used to
+  // PARSE currency symbols from third-party competitor HTML pages.
+  // symbolToCurrency map normalises parsed glyphs to ISO codes. Not display code.
+  "apps/web/src/lib/competitor/collectors/pricing.ts",
+
+  // ── Competitor collector-reframe tests: scraped-HTML fixtures ─────────────
+  // The Tier-1/Tier-2 tests use `$29`/`$39`/`$${amount}` INSIDE sample
+  // competitor HTML strings (what we fetch + normalize + diff) and as expected
+  // normalized-text assertions — third-party scraped-price INPUT, never app
+  // display code. Same rationale as the pricing.ts collector entry above.
+  // pipeline.test.ts (Tier-1/2 HTML fixtures), engine normalize/text-diff tests
+  // (normalized-text fixtures), db competitor.test.ts (snapshot raw/normalized).
+  "apps/web/src/lib/competitor/__tests__/",
+  "packages/engine/src/competitor/__tests__/",
+  // File-scoped (not the whole db __tests__ dir): only competitor.test.ts holds
+  // scraped-price fixtures; the DB layer has no display code to guard elsewhere.
+  "packages/db/src/__tests__/competitor.test.ts",
+
   // ── CSV import parser ─────────────────────────────────────────────────────
   // import-flow.tsx line 134: /[$,€£()]/ in a regex to STRIP currency
   // characters from user-supplied CSV amounts. Not display code.
@@ -225,6 +244,11 @@ const ALLOWED = [
   "apps/web/src/app/(dashboard)/ai/_components/generative/diff-gate.tsx",
   "apps/web/src/__tests__/component-reachability.test.ts",
   "apps/web/src/__tests__/no-console-in-production.test.ts",
+  // feed.ts line 8: `.replace(/<![CDATA[…]]>/g, "$1")` — a String.replace()
+  // backreference stripping CDATA wrappers from RSS/Atom feed text. `$1` is a
+  // regex capture-group reference, not a currency amount. Same false-positive
+  // class as the camelCase-splitter entries above.
+  "apps/web/src/lib/competitor/collectors/feed.ts",
 ];
 
 /**

apps/web/src/__tests__/no-mutation-invalidation-leak.test.ts

@@ -37,6 +37,10 @@ const ALLOWED: { match: string; why: string }[] = [
     match: "mcp/oauth/callback",
     why: "Completes an MCP OAuth handshake and re-probes the connection, invalidating only `mcp-connections` (non-financial). Same rationale as mcp/connections — no financial data changed.",
   },
+  {
+    match: "competitors",
+    why: "Competitor CRUD invalidates only the non-financial `competitors` cache (competitor list UI). No financial metric depends on competitor data and there is no MutationSource for competitors, so trackDataMutation must NOT fire — bumping it would start a bogus insight-regeneration grace countdown for changes that affect no financial compute.",
+  },
 ];
 
 function isAllowed(rel: string): boolean {

apps/web/src/app/(dashboard)/competitors/[id]/competitor-profile-view.tsx

@@ -0,0 +1,118 @@
+"use client";
+
+/**
+ * Competitor profile + change timeline view (Task 15). Nested route under
+ * /competitors — mirrors the cap-table / transactions-accounts nesting
+ * precedent (back-link header) and the Task-14 competitors-view conventions:
+ * design-system components only, SSR-seeded SWR (useCompetitorChanges
+ * fallbackData) for a live-updating timeline, and inline token-styled status
+ * spans following the StatusPill precedent (no new badge component).
+ *
+ * This view is now a thin wrapper: its own back-link + name + external-URL
+ * header, plus the shared <CompetitorAnalysisBody /> which renders the Sources
+ * (+ "Sync now"), Latest pricing, and Activity timeline. The same body is
+ * mounted on the dashboard card, so the analysis renders identically in both.
+ *
+ * Pricing snapshots are competitor-scraped data; prices are rendered (inside
+ * the shared body) via formatCurrency() from @burnless/types using the plan's
+ * OWN scraped currency (falling back to the company currency) — never a
+ * hardcoded symbol and never forcing the company currency onto a competitor's
+ * price.
+ */
+
+import Link from "next/link";
+import { ArrowLeft, ExternalLink } from "lucide-react";
+import type { CompetitorChangesPayload } from "@/lib/swr";
+import { CompetitorAnalysisBody } from "../competitor-analysis-body";
+
+// ── JSON-safe prop DTOs (Date → ISO string; mirrors the list-page DTO style) ──
+
+export interface CompetitorProfileDto {
+  id: string;
+  name: string;
+  url: string;
+}
+
+export interface SourceDto {
+  id: string;
+  /** "pricing" | "social" | "page" */
+  type: string;
+  url: string;
+  enabled: boolean;
+  lastRunAt: string | null;
+  lastStatus: string | null;
+  /** "ok" | "broken" */
+  healthState: string;
+}
+
+interface PlanDto {
+  name: string;
+  price: { amount: number | null; currency: string | null; period: string | null };
+  features: string[];
+}
+
+export interface SnapshotDto {
+  id: string;
+  sourceId: string;
+  capturedAt: string;
+  structured: {
+    plans?: PlanDto[];
+    items?: Record<string, { title: string; link: string; publishedAt: string | null }>;
+    urls?: Record<string, unknown>;
+    count?: number;
+  } | null;
+}
+
+interface CompetitorProfileViewProps {
+  readonly competitor: CompetitorProfileDto;
+  readonly sources: SourceDto[];
+  /** Latest snapshot per source, aligned by index with `sources`. */
+  readonly latestSnapshots: (SnapshotDto | null)[];
+  readonly initialChanges: CompetitorChangesPayload;
+}
+
+// ── View ────────────────────────────────────────────────────────────────────
+
+export function CompetitorProfileView({
+  competitor,
+  sources,
+  latestSnapshots,
+  initialChanges,
+}: CompetitorProfileViewProps) {
+  return (
+    <div className="space-y-6">
+      <header className="space-y-1">
+        <Link
+          href="/competitors"
+          className="inline-flex items-center gap-1 text-sm text-surface-500 hover:text-surface-900"
+        >
+          <ArrowLeft className="h-4 w-4" />
+          Back to Competitors
+        </Link>
+        <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+          <div>
+            <h1 className="text-xl sm:text-2xl font-bold text-surface-900">
+              {competitor.name}
+            </h1>
+            <a
+              href={competitor.url}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="mt-1 inline-flex items-center gap-1 text-sm text-surface-500 hover:text-brand-600 transition-colors"
+            >
+              {competitor.url}
+              <ExternalLink className="h-3 w-3" />
+            </a>
+          </div>
+        </div>
+      </header>
+
+      <CompetitorAnalysisBody
+        competitor={competitor}
+        sources={sources}
+        latestSnapshots={latestSnapshots}
+        initialChanges={initialChanges}
+      />
+    </div>
+  );
+}

apps/web/src/app/(dashboard)/competitors/[id]/page.tsx

@@ -0,0 +1,122 @@
+export const dynamic = "force-dynamic";
+export const revalidate = 0;
+
+import { Suspense } from "react";
+import { notFound } from "next/navigation";
+import {
+  getCompetitor,
+  listSources,
+  listChanges,
+  getLatestSnapshot,
+} from "@burnless/db";
+import { getCompany } from "@/lib/data";
+import { isDomainEnabled } from "@/lib/domain-gating";
+import { SetupPrompt } from "@/components/ui/empty-state";
+import { ReportContentSkeleton } from "@/components/reports/report-skeleton";
+import type { CompetitorChangesPayload } from "@/lib/swr";
+import {
+  CompetitorProfileView,
+  type CompetitorProfileDto,
+  type SourceDto,
+  type SnapshotDto,
+} from "./competitor-profile-view";
+
+export default async function CompetitorPage({
+  params,
+}: Readonly<{
+  params: Promise<{ id: string }>;
+}>) {
+  const { id } = await params;
+
+  const company = await getCompany();
+  if (!company) return <SetupPrompt context="tracking competitors" />;
+
+  // Page-level domain gate — mirrors the requireDomainEnabled guard the REST
+  // routes use and the Task-14 list page. If the competitor domain is off for
+  // this company/deployment, the route 404s.
+  if (!(await isDomainEnabled("competitor", { companyId: company.id }))) {
+    notFound();
+  }
+
+  const competitor = await getCompetitor(id, company.id);
+  if (!competitor) notFound();
+
+  return (
+    <Suspense fallback={<ReportContentSkeleton />}>
+      <CompetitorContent companyId={company.id} competitorId={id} competitor={competitor} />
+    </Suspense>
+  );
+}
+
+async function CompetitorContent({
+  companyId,
+  competitorId,
+  competitor,
+}: Readonly<{
+  companyId: string;
+  competitorId: string;
+  competitor: NonNullable<Awaited<ReturnType<typeof getCompetitor>>>;
+}>) {
+  const [sources, changes] = await Promise.all([
+    listSources(competitorId, companyId),
+    listChanges(companyId, { competitorId, limit: 50 }),
+  ]);
+  const snapshots = await Promise.all(sources.map((s) => getLatestSnapshot(s.id)));
+
+  // Shape everything to JSON-safe DTOs (Date → ISO string) so the SSR seed
+  // matches the client SWR fetch exactly (fallbackData applies cleanly) and no
+  // live Date objects cross the RSC → client boundary.
+  const competitorDto: CompetitorProfileDto = {
+    id: competitor.id,
+    name: competitor.name,
+    url: competitor.url,
+  };
+
+  const sourceDtos: SourceDto[] = sources.map((s) => ({
+    id: s.id,
+    type: s.type,
+    url: s.url,
+    enabled: s.enabled,
+    lastRunAt: s.lastRunAt ? s.lastRunAt.toISOString() : null,
+    lastStatus: s.lastStatus,
+    healthState: s.healthState,
+  }));
+
+  const latestSnapshots: (SnapshotDto | null)[] = snapshots.map((snap) =>
+    snap
+      ? {
+          id: snap.id,
+          sourceId: snap.sourceId,
+          capturedAt: snap.capturedAt.toISOString(),
+          structured: snap.structured as SnapshotDto["structured"],
+        }
+      : null,
+  );
+
+  const initialChanges: CompetitorChangesPayload = {
+    changes: changes.map((c) => ({
+      id: c.id,
+      competitorId: c.competitorId,
+      sourceId: c.sourceId,
+      snapshotId: c.snapshotId,
+      companyId: c.companyId,
+      detectedAt: c.detectedAt.toISOString(),
+      changeType: c.changeType,
+      summary: c.summary,
+      before: c.before as Record<string, unknown> | null,
+      after: c.after as Record<string, unknown> | null,
+      severity: c.severity,
+      acknowledgedAt: c.acknowledgedAt ? c.acknowledgedAt.toISOString() : null,
+      createdAt: c.createdAt.toISOString(),
+    })),
+  };
+
+  return (
+    <CompetitorProfileView
+      competitor={competitorDto}
+      sources={sourceDtos}
+      latestSnapshots={latestSnapshots}
+      initialChanges={initialChanges}
+    />
+  );
+}

apps/web/src/app/(dashboard)/competitors/__tests__/competitor-analysis-body.test.tsx

@@ -0,0 +1,59 @@
+import { describe, it, expect, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { CompetitorAnalysisBody } from "../competitor-analysis-body";
+
+// WidgetCard (design-system) calls useRouter — mount a stub app router.
+vi.mock("next/navigation", () => ({ useRouter: () => ({ refresh: vi.fn(), push: vi.fn() }) }));
+
+// happy-dom + SWR fallbackData → no fetch needed.
+const base = {
+  competitor: { id: "c1", name: "Acme", url: "https://acme.com" },
+  sources: [
+    { id: "s1", type: "page", url: "https://acme.com/x", enabled: true, lastRunAt: null, lastStatus: null, healthState: "ok" },
+  ],
+  latestSnapshots: [null],
+};
+
+describe("CompetitorAnalysisBody", () => {
+  it("renders a content_changed row with its summary and an expandable snippet", () => {
+    const initialChanges = {
+      changes: [
+        {
+          id: "ch1", competitorId: "c1", sourceId: "s1", snapshotId: "sn1", companyId: "co1",
+          detectedAt: new Date("2026-07-01").toISOString(),
+          changeType: "content_changed",
+          summary: "Page content changed: +1 / -1 lines",
+          before: { lines: ["Old line"], truncated: false },
+          after: { lines: ["New line"], truncated: false },
+          severity: "info", acknowledgedAt: null, createdAt: new Date("2026-07-01").toISOString(),
+        },
+      ],
+    };
+    render(<CompetitorAnalysisBody {...base} initialChanges={initialChanges} />);
+    expect(screen.getByText(/Page content changed/)).toBeTruthy();
+    // Disclosure content present (details/summary): added + removed lines.
+    // The snippet renders each line with a diff prefix ("+ New line" / "- Old
+    // line"), so match with a regex rather than an exact string.
+    expect(screen.getByText(/New line/)).toBeTruthy();
+    expect(screen.getByText(/Old line/)).toBeTruthy();
+  });
+
+  it("renders Recent posts from a feed snapshot and Pages-tracked from a sitemap snapshot", () => {
+    const props = {
+      competitor: { id: "c1", name: "Acme", url: "https://acme.com" },
+      sources: [
+        { id: "f1", type: "feed", url: "https://acme.com/rss", enabled: true, lastRunAt: null, lastStatus: null, healthState: "ok" },
+        { id: "m1", type: "sitemap", url: "https://acme.com/sitemap.xml", enabled: true, lastRunAt: null, lastStatus: null, healthState: "ok" },
+      ],
+      latestSnapshots: [
+        { id: "sn1", sourceId: "f1", capturedAt: new Date("2026-07-01").toISOString(), structured: { items: { g1: { title: "Launch Day", link: "https://acme.com/p/1", publishedAt: new Date("2026-07-01").toISOString() } } } },
+        { id: "sn2", sourceId: "m1", capturedAt: new Date("2026-07-01").toISOString(), structured: { urls: { "https://acme.com/": 1, "https://acme.com/pricing": 1 }, count: 2 } },
+      ],
+      initialChanges: { changes: [] },
+    };
+    render(<CompetitorAnalysisBody {...props} />);
+    expect(screen.getByText("Launch Day")).toBeTruthy();
+    expect(screen.getByText(/Pages tracked/i)).toBeTruthy();
+    expect(screen.getByText("2")).toBeTruthy();
+  });
+});