Stage M1

apps/api/prisma/seed.ts

@@ -6,8 +6,10 @@
  * users: account provisioning belongs to the auth milestone, and baking a
  * default admin password into a repository is how stores get compromised.
  */
-import { ALL_PERMISSIONS, PERMISSIONS, SYSTEM_ROLES, type Permission } from '@sport/types';
 import { PrismaClient } from '@prisma/client';
+import { ALL_PERMISSIONS, PERMISSIONS, SYSTEM_ROLES, type Permission } from '@sport/types';
+
+import { seedCatalog } from './seed/catalog';
 
 const prisma = new PrismaClient();
 
@@ -129,6 +131,19 @@ async function main(): Promise<void> {
   console.log(
     `Seed complete: ${permissionIds.size} permissions, ${Object.keys(ROLE_DEFINITIONS).length} roles.`,
   );
+
+  // Demo catalog: development and staging only. Guarded twice — by NODE_ENV and
+  // by an explicit opt-out — because sample products appearing in a production
+  // storefront is the kind of mistake that reaches customers.
+  const isProduction = process.env['NODE_ENV'] === 'production';
+  const demoDisabled = process.env['SEED_DEMO'] === 'false';
+
+  if (isProduction || demoDisabled) {
+    console.log('Skipping demo catalog seed.');
+    return;
+  }
+
+  await seedCatalog(prisma);
 }
 
 main()