Phase 12 R3: Marketplace γ + δ — Discovery + Engagement + Subscribe + Smart-Merge

Routes (additiv unter /api/v1/marketplace/*):

Discovery (optional-auth, anonymer Read erlaubt):
- GET /explore — featured + trending side-by-side
- GET /decks — browse mit q/tag/language/author/sort/limit/offset
  (sort: recent | popular | trending; trending = star-velocity 7d)
- GET /tags — flacher Tag-Tree

Engagement (auth pro Schreib-Route, optional-auth für GET state):
- POST/DELETE/GET /decks/:slug/star
- POST/DELETE/GET /authors/:slug/follow (cannot-follow-self → 409)

Subscribe + Version-Read + Smart-Merge-Diff:
- POST/DELETE/GET /decks/:slug/subscribe
- GET /me/subscriptions (mit update_available-Indicator)
- GET /decks/:slug/versions/:semver — voller Cards-Payload in ord-
  Reihenfolge
- GET /decks/:slug/diff?from=:semver — computeDiff (added/changed/
  removed/unchanged) basierend auf content_hash + ord-Heuristik für
  "changed an gleicher Position"

Fork + Smart-Merge-Pull (auth):
- POST /decks/:slug/fork — kopiert latest version in privaten
  cards.decks (forked_from_marketplace_* gesetzt) + cards.cards mit
  übernommenem content_hash + frische FSRS-Reviews
- POST /private/:deckId/pull-update — Smart-Merge: existing private
  hashes deduplizieren, nur added/changed cards einfügen (mit fresh
  reviews), unveränderte Karten BEHALTEN inkl. FSRS-State, removed
  cards bleiben lokal (server-authoritative User-Choice). Update der
  forked_from_marketplace_version_id auf latest.

Schema (R3a):
- cards.decks: 2 neue Columns forked_from_marketplace_deck_id +
  forked_from_marketplace_version_id (text, nullable). Drizzle-push
  grün.

Architektur-Highlights:
- @cards/domain.cardContentHash ist die single source of truth für
  Karten-Hashing; marketplace.deck_cards und cards.cards berechnen
  identisch → Smart-Merge ist hash-equality + INSERT-IGNORE statt
  Diff-Replay
- pgSchema-Trennung (marketplace.* vs. cards.*) zahlt sich aus:
  Marketplace-Read-Path (Public + Engagement) und privater Lern-Pfad
  haben separate FK-Welten und können unabhängig versioniert werden
- Hono-Middleware-Pattern: per-route authMiddleware/optionalAuth statt
  Sub-Router-Mount, weil ein Wildcard '*' auf einem Sub-Router via
  r.route('/', sub) sonst die Public-GET-Routes des Parents fängt
  (Hono-Routing-Subtilität, kostete eine Smoke-Iteration)

Verifikation:
- type-check 0 errors
- 6 neue Diff-Heuristik-Tests, 78 gesamt grün
- End-to-End-Smoke gegen lokale cards-api:
  · Cardecky-Author + Deck `r3-stoische-grundbegriffe` v1.0.0 (3 Karten)
  · Till browst (anon → 200), starred, folgt Cardecky, subscribed
  · Till forkt → privates Deck mit 3 Karten + 3 fresh FSRS-Reviews
  · SQL-Manipulation: Apatheia-Review auf state='review',
    stability=10, reps=3 (simuliert "schon gelernt")
  · Cardecky publisht v1.1.0: Apatheia + Eudaimonia unverändert,
    Logos präzisiert (changed), Tugendlehre neu (added)
  · Diff-Endpoint zeigt: unchanged=2, changed=1, added=1, removed=0
  · Till pull-update → cards_inserted=2 (changed.next + added)
  · Verifikation: card_count=5 (war 3), Apatheia-Review **identisch
    erhalten** (state=review, stability=10, reps=3, last_review IS
    NOT NULL), neue Karten state=new — FSRS-State der unveränderten
    Karte überlebt Smart-Merge unverletzt

Verbleibend: R4 ε (PRs + Card-Discussions), R5 Frontend-Routes
(/explore, /d/[slug], /u/[slug], /me/subscribed, /me/forks), R6
voller UI-E2E.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/tests/marketplace-diff.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest';
+
+import { computeDiff } from '../src/lib/marketplace/diff.ts';
+
+const fromInfo = { semver: '1.0.0', versionId: 'v1' };
+const toInfo = { semver: '1.1.0', versionId: 'v2' };
+
+function fullCard(ord: number, hash: string, front = `Q${ord}`, back = `A${ord}`) {
+	return { contentHash: hash, type: 'basic', fields: { front, back }, ord };
+}
+
+describe('computeDiff', () => {
+	it('classifies all-unchanged when nothing moved', () => {
+		const diff = computeDiff({
+			from: [
+				{ contentHash: 'h1', ord: 0 },
+				{ contentHash: 'h2', ord: 1 },
+			],
+			to: [fullCard(0, 'h1'), fullCard(1, 'h2')],
+			fromInfo,
+			toInfo,
+		});
+		expect(diff.unchanged).toHaveLength(2);
+		expect(diff.added).toHaveLength(0);
+		expect(diff.changed).toHaveLength(0);
+		expect(diff.removed).toHaveLength(0);
+	});
+
+	it('detects added when a brand-new card appears', () => {
+		const diff = computeDiff({
+			from: [{ contentHash: 'h1', ord: 0 }],
+			to: [fullCard(0, 'h1'), fullCard(1, 'h2')],
+			fromInfo,
+			toInfo,
+		});
+		expect(diff.added).toHaveLength(1);
+		expect(diff.added[0].contentHash).toBe('h2');
+		expect(diff.unchanged).toHaveLength(1);
+	});
+
+	it('detects removed when a card vanishes (and ord is unique)', () => {
+		const diff = computeDiff({
+			from: [
+				{ contentHash: 'h1', ord: 0 },
+				{ contentHash: 'h2', ord: 1 },
+			],
+			to: [fullCard(0, 'h1')],
+			fromInfo,
+			toInfo,
+		});
+		expect(diff.removed).toHaveLength(1);
+		expect(diff.removed[0].contentHash).toBe('h2');
+	});
+
+	it('detects changed when same ord has different hash', () => {
+		const diff = computeDiff({
+			from: [{ contentHash: 'h1', ord: 0 }],
+			to: [fullCard(0, 'h1-tweaked', 'Q0', 'A0-edited')],
+			fromInfo,
+			toInfo,
+		});
+		expect(diff.changed).toHaveLength(1);
+		expect(diff.changed[0].previous.contentHash).toBe('h1');
+		expect(diff.changed[0].next.contentHash).toBe('h1-tweaked');
+		expect(diff.added).toHaveLength(0);
+		expect(diff.removed).toHaveLength(0);
+	});
+
+	it('mixed: 1 unchanged, 1 changed, 1 added, 1 removed', () => {
+		const diff = computeDiff({
+			from: [
+				{ contentHash: 'h-stay', ord: 0 },
+				{ contentHash: 'h-old', ord: 1 },
+				{ contentHash: 'h-bye', ord: 2 },
+			],
+			to: [
+				fullCard(0, 'h-stay'),
+				fullCard(1, 'h-new', 'replaced', 'card'),
+				fullCard(3, 'h-fresh', 'new', 'card'),
+			],
+			fromInfo,
+			toInfo,
+		});
+		expect(diff.unchanged.map((c) => c.contentHash)).toEqual(['h-stay']);
+		expect(diff.changed).toHaveLength(1);
+		expect(diff.changed[0].previous.contentHash).toBe('h-old');
+		expect(diff.changed[0].next.contentHash).toBe('h-new');
+		expect(diff.added).toHaveLength(1);
+		expect(diff.added[0].contentHash).toBe('h-fresh');
+		expect(diff.removed).toHaveLength(1);
+		expect(diff.removed[0].contentHash).toBe('h-bye');
+	});
+
+	it('returns the version-info verbatim', () => {
+		const diff = computeDiff({
+			from: [],
+			to: [],
+			fromInfo,
+			toInfo,
+		});
+		expect(diff.from).toEqual(fromInfo);
+		expect(diff.to).toEqual(toInfo);
+	});
+});