@mohasinac/appkit 2.6.3 → 2.6.4

package/dist/_internal/server/features/checkout/actions.js

@@ -14,15 +14,18 @@ import { sendOrderConfirmationEmail } from "../../../../features/contact/server"
 import { splitCartIntoOrderGroups } from "../../../../features/orders/index";
 import { resolveDate } from "../../../../utils";
 import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase";
-import { PRODUCT_COLLECTION, ProductStatusValues } from "../../../../features/products/schemas/firestore";
+import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore";
 import { CART_COLLECTION } from "../../../../features/cart/schemas/index";
+// S-SBUNI-RULES 2026-05-13 — bundle cart-line stock fan-out helpers.
+import { getCartItemMemberIds, getExpandedDecrements, validateCartItemStock, } from "./bundle-expansion";
 import { consentOtpRef, consentOtpRateLimitRef, CONSENT_OTP_MAX_BYPASS_CREDITS, } from "../../../../features/auth/server";
 import { OrderStatusValues, PaymentStatusValues, PaymentMethodValues, } from "../../../../features/orders/schemas/index";
 import { getDefaultCurrency } from "../../../../core/index";
 import { verifyPaymentSignatureWithKeys, fetchRazorpayOrder, paiseToRupees, } from "../../../../providers/payment-razorpay/index";
 import { CHECKOUT_DEFAULT_COMMISSIONS } from "../../../shared/features/checkout/config";
 import { formatShippingAddress } from "./data";
-import { enforceMaxPerUserForCart, enforcePrizePoolCap, computePrizeRevealDeadline, } from "./prize-bundle-gates";
+import { enforceMaxPerUserForCart, computePrizeRevealDeadline, } from "./prize-bundle-gates";
+import { getListingRule, runSyncPreflight, } from "../../../shared/checkout/rules";
 /**
  * Fire-and-forget in-app notifications when an order is created.
  *
@@ -89,7 +92,10 @@ export async function createCheckoutOrderAction(input) {
     if (cartItems.length === 0) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.CART_EMPTY);
     }
-    const address = await unitOfWork.addresses.findById(uid, addressId);
+    const addressDoc = await unitOfWork.addresses.findById(addressId);
+    const address = addressDoc && addressDoc.ownerType === "user" && addressDoc.ownerId === uid
+        ? addressDoc
+        : null;
     if (!address) {
         failedCheckoutRepository
             .logCheckout(uid, "address_not_found", "Address not found", { addressId, paymentMethod })
@@ -104,14 +110,26 @@ export async function createCheckoutOrderAction(input) {
     // product docs are re-read inside the transaction below for stock + prize
     // pool checks; this is intentional (the tx is the source of truth for the
     // counts we actually mutate).
-    const preTxProductRefs = cartItems.map((item) => db.collection(PRODUCT_COLLECTION).doc(item.productId));
+    //
+    // SB-UNI-5 2026-05-13 — for bundle cart-lines we pair the bundle item with
+    // its FIRST member product (so the maxPerUser cap check uses real product
+    // data instead of failing the bundle's category-id lookup). The full
+    // bundle-member stock fan-out happens in-tx below.
+    const preTxLookup = getExpandedDecrements(cartItems);
+    const preTxProductRefs = preTxLookup.productIds.map((pid) => db.collection(PRODUCT_COLLECTION).doc(pid));
     const preTxProductSnaps = await Promise.all(preTxProductRefs.map((r) => r.get()));
+    const preTxProductById = new Map();
+    for (let i = 0; i < preTxLookup.productIds.length; i++) {
+        const snap = preTxProductSnaps[i];
+        if (snap.exists) {
+            preTxProductById.set(preTxLookup.productIds[i], snap.data());
+        }
+    }
     const preTxPairs = cartItems
-        .map((item, i) => {
-        const data = preTxProductSnaps[i].exists
-            ? preTxProductSnaps[i].data()
-            : undefined;
-        return data ? { item, product: data } : null;
+        .map((item) => {
+        const [firstMember] = getCartItemMemberIds(item);
+        const product = preTxProductById.get(firstMember);
+        return product ? { item, product } : null;
     })
         .filter((pair) => pair !== null);
     await enforceMaxPerUserForCart({ userId: uid, items: preTxPairs });
@@ -130,40 +148,63 @@ export async function createCheckoutOrderAction(input) {
                 throw Object.assign(new ApiError(403, "Order verification required. Please complete OTP verification before placing this order."), { _failReason: reason });
             }
             const emailOtpUsed = otpData.verifiedVia !== "sms";
-            const productRefs = cartItems.map((item) => db.collection(PRODUCT_COLLECTION).doc(item.productId));
-            const productDocs = await Promise.all(productRefs.map((ref) => tx.get(ref)));
+            // SB-UNI-5 2026-05-13 — bundle-aware stock fan-out. Build the unique
+            // product-id set across the whole cart (regular items + each bundle's
+            // members) and fetch each one ONCE. Validation walks per cart-line and
+            // checks every required member against the cart-cumulative decrement.
+            const expansion = getExpandedDecrements(cartItems);
+            const productRefById = new Map();
+            for (const pid of expansion.productIds) {
+                productRefById.set(pid, db.collection(PRODUCT_COLLECTION).doc(pid));
+            }
+            const productDocs = await Promise.all(expansion.productIds.map((pid) => tx.get(productRefById.get(pid))));
+            const productById = new Map();
+            for (let i = 0; i < expansion.productIds.length; i++) {
+                const doc = productDocs[i];
+                if (doc.exists) {
+                    productById.set(expansion.productIds[i], doc.data());
+                }
+            }
             const availableItems = [];
             const unavailableItems = [];
-            for (let i = 0; i < cartItems.length; i++) {
-                const item = cartItems[i];
-                const doc = productDocs[i];
-                const productData = doc.exists ? doc.data() : null;
-                if (!productData ||
-                    productData.status !== ProductStatusValues.PUBLISHED ||
-                    productData.availableQuantity < item.quantity) {
+            for (const item of cartItems) {
+                const shortfall = validateCartItemStock(item, productById, expansion.decrements);
+                if (shortfall) {
                     unavailableItems.push({
-                        productId: item.productId,
+                        productId: shortfall.productId,
                         productTitle: item.productTitle,
                         requestedQty: item.quantity,
-                        availableQty: productData?.availableQuantity ?? 0,
+                        availableQty: shortfall.availableQty,
                     });
+                    continue;
                 }
-                else {
-                    // SB6-C — prize-draw pool cap (in-tx, atomic with availableQuantity).
-                    enforcePrizePoolCap({
-                        productSnapshot: productData,
-                        requestedQuantity: item.quantity,
-                    });
-                    const productUpdate = {
-                        availableQuantity: productData.availableQuantity - item.quantity,
+                // Bundle cart-lines surface the first member as the "product" so
+                // downstream listingType branching (prize-draw) stays sound — bundle
+                // pricing is always "standard" so the prize-draw cap isn't enforced.
+                const memberIds = getCartItemMemberIds(item);
+                const representative = productById.get(memberIds[0]);
+                // S-SBUNI-RULES 2026-05-13 — sync preflight (prize-pool cap, pre-order
+                // quota) via rule registry. Bundles skip — they bypass the cart path.
+                if (!item.bundleProductIds?.length) {
+                    runSyncPreflight([{ item, product: representative }]);
+                }
+                availableItems.push({ item, product: representative });
+            }
+            // Apply per-product decrements ONCE per unique product (sums across the
+            // cart) so two cart lines sharing a product don't double-decrement.
+            if (availableItems.length > 0) {
+                for (const [pid, qtyDelta] of expansion.decrements) {
+                    const product = productById.get(pid);
+                    if (!product)
+                        continue;
+                    const lt = (product.listingType ?? "standard");
+                    const rule = getListingRule(lt);
+                    const update = {
+                        availableQuantity: product.availableQuantity - qtyDelta,
                         updatedAt: new Date(),
+                        ...rule.stockDecrementExtras(product, qtyDelta),
                     };
-                    if (productData.listingType === "prize-draw") {
-                        productUpdate.prizeCurrentEntries =
-                            (productData.prizeCurrentEntries ?? 0) + item.quantity;
-                    }
-                    tx.update(productRefs[i], productUpdate);
-                    availableItems.push({ item, product: productData });
+                    tx.update(productRefById.get(pid), update);
                 }
             }
             if (availableItems.length > 0) {
@@ -217,30 +258,27 @@ export async function createCheckoutOrderAction(input) {
         const firstItem = group[0].item;
         const groupTotal = group.reduce((sum, { item }) => sum + item.price * item.quantity, 0);
         total += groupTotal;
-        // SB8-F — when a line is a prize-draw entry, stamp the listingType +
-        // reveal status + deadline so the user-orders surface can render the
-        // reveals-remaining badge immediately after order creation.
-        const groupRevealDeadline = orderType === "prize-draw"
-            ? computePrizeRevealDeadline(group[0].product)
-            : undefined;
+        // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
         const orderItems = group.map(({ item, product }) => {
-            const isPrizeDrawLine = product.listingType === "prize-draw";
-            return {
+            const lt = (product.listingType ?? "standard");
+            const itemRule = getListingRule(lt);
+            // SB-UNI-5 2026-05-13 — forward bundle identifiers so the order-detail
+            // UI can collapse expanded lines back under a "Bundle: <name>" header.
+            const bundleFields = item.bundleCategorySlug && item.bundleProductIds
+                ? {
+                    bundleCategorySlug: item.bundleCategorySlug,
+                    bundleProductIds: item.bundleProductIds,
+                }
+                : {};
+            const baseLine = {
                 productId: item.productId,
                 productTitle: item.productTitle,
                 quantity: item.quantity,
                 unitPrice: item.price,
                 totalPrice: item.price * item.quantity,
-                ...(isPrizeDrawLine
-                    ? {
-                        listingType: "prize-draw",
-                        prizeRevealStatus: product.prizeRevealStatus === "open" ? "open" : "pending",
-                        prizeRevealDeadline: groupRevealDeadline?.toISOString(),
-                    }
-                    : product.listingType
-                        ? { listingType: product.listingType }
-                        : {}),
+                ...bundleFields,
             };
+            return itemRule.decorateOrderItem(baseLine, product);
         });
         const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
         let shippingFee = 0;
@@ -327,17 +365,15 @@ export async function createCheckoutOrderAction(input) {
                 .map(({ product }) => product.mainImage)
                 .filter((url) => typeof url === "string" && url.length > 0)),
         ];
-        // SB-UNI-D — "bundle" order-type removed; bundle cart lines will expand
-        // to N product order lines at checkout (forward-looking feature, not
-        // wired yet). Prize-draw fields only.
-        const isPrizeDrawOrder = orderType === "prize-draw";
-        const prizeDrawFields = isPrizeDrawOrder
-            ? {
-                prizeDrawProductId: group[0].product.id,
-                isNonRefundable: true,
-                prizeRevealDeadline: computePrizeRevealDeadline(group[0].product),
-            }
-            : {};
+        // S-SBUNI-RULES 2026-05-13 — order-doc decoration via rule registry.
+        const lt0 = (group[0].product.listingType ?? "standard");
+        const groupRule = getListingRule(lt0);
+        const extraOrderFields = {
+            ...groupRule.decorateOrderDoc(group[0].item, group[0].product),
+            ...(orderType === "prize-draw"
+                ? { prizeRevealDeadline: computePrizeRevealDeadline(group[0].product) }
+                : {}),
+        };
         const order = await unitOfWork.orders.create({
             productId: firstItem.productId,
             productTitle: firstItem.productTitle,
@@ -365,7 +401,7 @@ export async function createCheckoutOrderAction(input) {
             couponDiscount: couponDiscount > 0 ? couponDiscount : undefined,
             appliedDiscounts: appliedDiscounts.length > 0 ? appliedDiscounts : undefined,
             imageUrls: imageUrls.length > 0 ? imageUrls : undefined,
-            ...prizeDrawFields,
+            ...extraOrderFields,
         });
         orderIds.push(order.id);
         for (const code of groupCouponCodes) {
@@ -473,7 +509,10 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     if (!cart.items || cart.items.length === 0) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.CART_EMPTY);
     }
-    const address = await unitOfWork.addresses.findById(uid, addressId);
+    const addressDoc = await unitOfWork.addresses.findById(addressId);
+    const address = addressDoc && addressDoc.ownerType === "user" && addressDoc.ownerId === uid
+        ? addressDoc
+        : null;
     if (!address) {
         throw new NotFoundError(ERROR_MESSAGES.CHECKOUT.ADDRESS_REQUIRED);
     }
@@ -500,10 +539,22 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             throw new ApiError(403, "Order verification required. Please complete OTP verification and retry.");
         }
     }
-    const productChecks = await Promise.all(cart.items.map(async (item) => {
-        const product = await unitOfWork.products.findById(item.productId);
+    // SB-UNI-5 2026-05-13 — bundle-aware product fetch + validation. Each
+    // cart line gets paired with a "representative" product (first member id
+    // for bundles, productId for regular items). The full bundle-member
+    // decrement runs against `expansionPaid.decrements` lower down.
+    const expansionPaid = getExpandedDecrements(cart.items);
+    const productByIdPaid = new Map();
+    for (const pid of expansionPaid.productIds) {
+        const product = await unitOfWork.products.findById(pid);
+        if (product)
+            productByIdPaid.set(pid, product);
+    }
+    const productChecks = cart.items.map((item) => {
+        const [firstMember] = getCartItemMemberIds(item);
+        const product = productByIdPaid.get(firstMember) ?? null;
         return { item, product };
-    }));
+    });
     // SB6-C — maxPerUser cap check before we touch any state.
     await enforceMaxPerUserForCart({
         userId: uid,
@@ -511,39 +562,40 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             .filter((p) => p.product !== null && p.product !== undefined)
             .map(({ item, product }) => ({ item, product })),
     });
-    // SB6-C — prize-pool cap. Runs against the freshly-read product snapshots.
-    for (const { item, product } of productChecks) {
-        if (!product)
-            continue;
-        enforcePrizePoolCap({
-            productSnapshot: product,
-            requestedQuantity: item.quantity,
-        });
-    }
-    for (const { item, product } of productChecks) {
-        if (!product || product.status !== ProductStatusValues.PUBLISHED) {
-            failedCheckoutRepository
-                .logPayment(uid, "product_unavailable", `Product ${item.productId} not published`, {
-                gatewayOrderId: razorpay_order_id,
-                gatewayPaymentId: razorpay_payment_id,
-                addressId,
-            })
-                .catch(() => { });
-            throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PRODUCT_UNAVAILABLE);
-        }
-        if (product.availableQuantity < item.quantity) {
+    // S-SBUNI-RULES 2026-05-13 — sync preflight via rule registry.
+    // Bundle items bypass the cart flow so skip the prize-pool cap.
+    const preflightPairs = productChecks.filter((p) => p.product !== null && p.product !== undefined && !p.item.bundleProductIds?.length);
+    runSyncPreflight(preflightPairs);
+    // SB-UNI-5 — validate every required member product across the cart with
+    // cumulative decrement awareness (two bundles sharing a member must NOT
+    // both succeed unless the product has enough stock for the sum).
+    for (const item of cart.items) {
+        const shortfall = validateCartItemStock(item, productByIdPaid, expansionPaid.decrements);
+        if (shortfall) {
+            const exists = productByIdPaid.has(shortfall.productId);
+            const reason = exists ? "stock_insufficient" : "product_unavailable";
             failedCheckoutRepository
-                .logPayment(uid, "stock_insufficient", `Product ${item.productId} has ${product.availableQuantity} left, requested ${item.quantity}`, {
+                .logPayment(uid, reason, exists
+                ? `Product ${shortfall.productId} has ${shortfall.availableQty} left, requested ${item.quantity}`
+                : `Product ${shortfall.productId} not published`, {
                 gatewayOrderId: razorpay_order_id,
                 gatewayPaymentId: razorpay_payment_id,
                 addressId,
             })
                 .catch(() => { });
-            throw new ValidationError(ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK);
+            throw new ValidationError(exists
+                ? ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK
+                : ERROR_MESSAGES.CHECKOUT.PRODUCT_UNAVAILABLE);
         }
     }
     {
-        const cartSubtotalRs = productChecks.reduce((sum, { item, product }) => sum + product.price * item.quantity, 0);
+        // SB-UNI-5 2026-05-13 — bundle cart-lines use item.price (locked
+        // bundlePriceInPaise) instead of the representative member's product.price.
+        const cartSubtotalRs = productChecks.reduce((sum, { item, product }) => {
+            const isBundle = Boolean(item.bundleCategorySlug && item.bundleProductIds?.length);
+            const unit = isBundle ? item.price : product.price;
+            return sum + unit * item.quantity;
+        }, 0);
         const expectedPlatformFee = Math.round(cartSubtotalRs * (razorpayFeePercent / 100) * 100) / 100;
         const expectedPaymentAmountRs = cartSubtotalRs + expectedPlatformFee;
         const rzpOrderRecord = await fetchRazorpayOrder(razorpay_order_id);
@@ -566,11 +618,17 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     const orderIds = [];
     let total = 0;
     const emailsToSend = [];
+    // SB-UNI-5 2026-05-13 — bundle cart-lines use item.price (locked bundle
+    // price); regular lines use product.price. The helper keeps the math
+    // local to this block.
+    const unitPriceFor = (item, product) => item.bundleCategorySlug && item.bundleProductIds?.length
+        ? item.price
+        : product.price;
     const cartSubtotal = orderGroups.reduce((s, { items: g }) => s +
-        g.reduce((gs, { item, product }) => gs + product.price * item.quantity, 0), 0);
+        g.reduce((gs, { item, product }) => gs + unitPriceFor(item, product) * item.quantity, 0), 0);
     for (const { items: group, orderType } of orderGroups) {
         const firstItem = group[0].item;
-        const groupTotal = group.reduce((sum, { item, product }) => sum + product.price * item.quantity, 0);
+        const groupTotal = group.reduce((sum, { item, product }) => sum + unitPriceFor(item, product) * item.quantity, 0);
         let shippingFee = 0;
         let storeOwnerId;
         const storeId = firstItem.storeId;
@@ -600,7 +658,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
                 if (coupon.applicableItemIds?.length) {
                     const eligibleTotal = group
                         .filter(({ item }) => coupon.applicableItemIds.includes(item.itemId))
-                        .reduce((s, { item, product }) => s + product.price * item.quantity, 0);
+                        .reduce((s, { item, product }) => s + unitPriceFor(item, product) * item.quantity, 0);
                     couponGroupDiscount =
                         eligibleTotal > 0
                             ? Math.min(Math.round((eligibleTotal / groupTotal) * coupon.discountAmount * 100) / 100, eligibleTotal)
@@ -629,30 +687,30 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
         const platformFee = Math.round(groupTotal * (razorpayFeePercent / 100) * 100) / 100;
         const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee;
         total += orderTotal;
-        // SB8-F — stamp listingType + reveal-status + deadline for prize-draw lines.
-        const groupRevealDeadlineRzp = orderType === "prize-draw" && group[0].product
-            ? computePrizeRevealDeadline(group[0].product)
-            : undefined;
+        // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
         const orderItems = group.map(({ item, product }) => {
-            const isPrizeDrawLine = product?.listingType === "prize-draw";
-            return {
+            const lt = (product?.listingType ?? "standard");
+            const itemRule = getListingRule(lt);
+            // SB-UNI-5 2026-05-13 — bundle cart-lines surface the locked
+            // bundlePriceInPaise (item.price), not the representative member's
+            // product.price. Stock decrement still runs per member elsewhere.
+            const isBundle = Boolean(item.bundleCategorySlug && item.bundleProductIds?.length);
+            const unitPrice = isBundle ? item.price : product.price;
+            const bundleFields = isBundle
+                ? {
+                    bundleCategorySlug: item.bundleCategorySlug,
+                    bundleProductIds: item.bundleProductIds,
+                }
+                : {};
+            const baseLine = {
                 productId: item.productId,
                 productTitle: item.productTitle,
                 quantity: item.quantity,
-                unitPrice: product.price,
-                totalPrice: product.price * item.quantity,
-                ...(isPrizeDrawLine
-                    ? {
-                        listingType: "prize-draw",
-                        prizeRevealStatus: product?.prizeRevealStatus === "open"
-                            ? "open"
-                            : "pending",
-                        prizeRevealDeadline: groupRevealDeadlineRzp?.toISOString(),
-                    }
-                    : product?.listingType
-                        ? { listingType: product.listingType }
-                        : {}),
+                unitPrice,
+                totalPrice: unitPrice * item.quantity,
+                ...bundleFields,
             };
+            return itemRule.decorateOrderItem(baseLine, product);
         });
         const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
         const imageUrls = [
@@ -660,16 +718,15 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
                 .map(({ product }) => product?.mainImage)
                 .filter((url) => typeof url === "string" && url.length > 0)),
         ];
-        // SB-UNI-D — "bundle" order-type removed; bundle cart lines will expand
-        // to N product order lines at checkout (forward-looking, not wired).
-        const isPrizeDrawOrder = orderType === "prize-draw";
-        const prizeDrawFields = isPrizeDrawOrder && group[0].product
-            ? {
-                prizeDrawProductId: group[0].product.id,
-                isNonRefundable: true,
-                prizeRevealDeadline: computePrizeRevealDeadline(group[0].product),
-            }
-            : {};
+        // S-SBUNI-RULES 2026-05-13 — order-doc decoration via rule registry.
+        const lt0Rzp = (group[0].product?.listingType ?? "standard");
+        const groupRuleRzp = getListingRule(lt0Rzp);
+        const extraOrderFields = {
+            ...groupRuleRzp.decorateOrderDoc(group[0].item, group[0].product),
+            ...(orderType === "prize-draw" && group[0].product
+                ? { prizeRevealDeadline: computePrizeRevealDeadline(group[0].product) }
+                : {}),
+        };
         const order = await unitOfWork.orders.create({
             productId: firstItem.productId,
             productTitle: firstItem.productTitle,
@@ -697,7 +754,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             couponDiscount: couponDiscount > 0 ? couponDiscount : undefined,
             appliedDiscounts: appliedDiscounts.length > 0 ? appliedDiscounts : undefined,
             imageUrls: imageUrls.length > 0 ? imageUrls : undefined,
-            ...prizeDrawFields,
+            ...extraOrderFields,
         });
         orderIds.push(order.id);
         if (userEmail) {
@@ -723,18 +780,20 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             paid: true,
         });
     }
+    // SB-UNI-5 2026-05-13 — bundle-aware batch decrement. We iterate the
+    // cumulative `decrements` map (one entry per unique member product) so a
+    // bundle's members + any sibling cart line touching the same product
+    // collapse into ONE update per product.
     await unitOfWork.runBatch((batch) => {
-        for (const { item, product } of productChecks) {
+        for (const [pid, qtyDelta] of expansionPaid.decrements) {
+            const product = productByIdPaid.get(pid);
             if (!product)
                 continue;
-            const prizeBump = product.listingType === "prize-draw"
-                ? {
-                    prizeCurrentEntries: (product.prizeCurrentEntries ?? 0) + item.quantity,
-                }
-                : {};
-            unitOfWork.products.updateInBatch(batch, item.productId, {
-                availableQuantity: product.availableQuantity - item.quantity,
-                ...prizeBump,
+            const lt = (product.listingType ?? "standard");
+            const batchRule = getListingRule(lt);
+            unitOfWork.products.updateInBatch(batch, pid, {
+                availableQuantity: product.availableQuantity - qtyDelta,
+                ...batchRule.stockDecrementExtras(product, qtyDelta),
             });
         }
         unitOfWork.carts.updateInBatch(batch, uid, {

package/dist/_internal/server/features/checkout/bundle-expansion.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Bundle cart-item expansion helpers — S-SBUNI-5 2026-05-13.
+ *
+ * Checkout treats each cart item as one OrderItem row (bundles stay grouped
+ * in the order) but stock decrement has to fan out to the bundle's member
+ * products. These helpers do that fan-out without breaking the existing
+ * per-cart-item validation loops.
+ *
+ * Two-step model:
+ *  1. `getExpandedDecrements(cartItems)` — returns the unique product-id set
+ *     to fetch + a per-product total-quantity map. Multiple cart items that
+ *     touch the same product (e.g. two bundles sharing one member, or a
+ *     bundle + a regular item) get summed.
+ *  2. `validateCartItemStock(item, productById)` — for one cart item, looks
+ *     up every required product (bundle members OR the single productId) +
+ *     returns the worst-case shortfall: `null` if all OK, or the first
+ *     unavailable member's id + availableQty.
+ *
+ * Note: validation in-tx is still subject to product writes from a parallel
+ * checkout — the Firestore transaction guarantees the second checkout sees
+ * the first's decrement before re-running its own validation.
+ */
+import type { CartItemDocument } from "../../../../features/cart/schemas";
+import type { ProductDocument } from "../../../../features/products/schemas/firestore";
+export interface BundleExpansion {
+    /** Unique product ids referenced by any cart item (regular or bundle member). */
+    productIds: string[];
+    /**
+     * Sum of requested quantities per product id. Bundle members get
+     * `item.quantity` per occurrence (so 2x of a bundle with member X
+     * decrements X by 2, not 1).
+     */
+    decrements: Map<string, number>;
+}
+/** Resolve the member-product ids for a cart item. Bundle items expand to
+ *  `bundleProductIds[]`; regular items collapse to `[productId]`. */
+export declare function getCartItemMemberIds(item: CartItemDocument): string[];
+/** Build the unique-product-id + per-product decrement map for a cart. */
+export declare function getExpandedDecrements(cartItems: CartItemDocument[]): BundleExpansion;
+export interface StockShortfall {
+    /** The member product id that ran out (or never existed). */
+    productId: string;
+    /** Quantity Firestore still has for that product. */
+    availableQty: number;
+}
+/**
+ * For a single cart item: returns `null` when every required product is
+ * published + has enough stock, or the first shortfall encountered. The
+ * caller supplies a `productById` lookup populated from the in-tx fetch
+ * (so the same query runs once for the whole cart).
+ *
+ * `decrements` lets the caller account for OTHER cart items touching the
+ * same product — pass the cumulative map from `getExpandedDecrements` so
+ * the available quantity is compared against the WHOLE cart's demand for
+ * that product, not just this item's slice.
+ */
+export declare function validateCartItemStock(item: CartItemDocument, productById: Map<string, ProductDocument>, decrements: Map<string, number>): StockShortfall | null;

package/dist/_internal/server/features/checkout/bundle-expansion.js

@@ -0,0 +1,70 @@
+/**
+ * Bundle cart-item expansion helpers — S-SBUNI-5 2026-05-13.
+ *
+ * Checkout treats each cart item as one OrderItem row (bundles stay grouped
+ * in the order) but stock decrement has to fan out to the bundle's member
+ * products. These helpers do that fan-out without breaking the existing
+ * per-cart-item validation loops.
+ *
+ * Two-step model:
+ *  1. `getExpandedDecrements(cartItems)` — returns the unique product-id set
+ *     to fetch + a per-product total-quantity map. Multiple cart items that
+ *     touch the same product (e.g. two bundles sharing one member, or a
+ *     bundle + a regular item) get summed.
+ *  2. `validateCartItemStock(item, productById)` — for one cart item, looks
+ *     up every required product (bundle members OR the single productId) +
+ *     returns the worst-case shortfall: `null` if all OK, or the first
+ *     unavailable member's id + availableQty.
+ *
+ * Note: validation in-tx is still subject to product writes from a parallel
+ * checkout — the Firestore transaction guarantees the second checkout sees
+ * the first's decrement before re-running its own validation.
+ */
+import { ProductStatusValues } from "../../../../features/products/schemas/firestore";
+/** Resolve the member-product ids for a cart item. Bundle items expand to
+ *  `bundleProductIds[]`; regular items collapse to `[productId]`. */
+export function getCartItemMemberIds(item) {
+    if (item.bundleProductIds && item.bundleProductIds.length > 0) {
+        return item.bundleProductIds;
+    }
+    return [item.productId];
+}
+/** Build the unique-product-id + per-product decrement map for a cart. */
+export function getExpandedDecrements(cartItems) {
+    const decrements = new Map();
+    for (const item of cartItems) {
+        const memberIds = getCartItemMemberIds(item);
+        for (const pid of memberIds) {
+            decrements.set(pid, (decrements.get(pid) ?? 0) + item.quantity);
+        }
+    }
+    return {
+        productIds: [...decrements.keys()],
+        decrements,
+    };
+}
+/**
+ * For a single cart item: returns `null` when every required product is
+ * published + has enough stock, or the first shortfall encountered. The
+ * caller supplies a `productById` lookup populated from the in-tx fetch
+ * (so the same query runs once for the whole cart).
+ *
+ * `decrements` lets the caller account for OTHER cart items touching the
+ * same product — pass the cumulative map from `getExpandedDecrements` so
+ * the available quantity is compared against the WHOLE cart's demand for
+ * that product, not just this item's slice.
+ */
+export function validateCartItemStock(item, productById, decrements) {
+    const memberIds = getCartItemMemberIds(item);
+    for (const pid of memberIds) {
+        const product = productById.get(pid);
+        if (!product || product.status !== ProductStatusValues.PUBLISHED) {
+            return { productId: pid, availableQty: product?.availableQuantity ?? 0 };
+        }
+        const totalNeeded = decrements.get(pid) ?? item.quantity;
+        if (product.availableQuantity < totalNeeded) {
+            return { productId: pid, availableQty: product.availableQuantity };
+        }
+    }
+    return null;
+}

package/dist/_internal/server/features/checkout/prize-bundle-gates.d.ts

@@ -1,9 +1,10 @@
 /**
- * Prize-draw + bundle + maxPerUser gates for the checkout pipeline (SB6-C, SB8-A).
+ * maxPerUser gate + prize reveal deadline helper for the checkout pipeline
+ * (SB6-C, SB8-A).
  *
- * Shared helper used by both `createCheckoutOrderAction` (COD/UPI-manual path)
- * and `verifyAndPlaceRazorpayOrderAction` (Razorpay path). Pulled out here so
- * the two transactional flows enforce the same rules.
+ * `enforcePrizePoolCap` was removed in S-SBUNI-RULES (2026-05-13) — the
+ * equivalent check now lives in `prizeDrawRule.preflightChecks` in the rule
+ * registry and is invoked via `runSyncPreflight`.
  */
 import type { ProductDocument } from "../../../../features/products/schemas/firestore";
 import type { CartItemDocument } from "../../../../features/cart/schemas/firestore";
@@ -46,14 +47,3 @@ export declare function enforceMaxPerUserForCart(args: {
  * Returns `undefined` if the product lacks the prize-draw fields.
  */
 export declare function computePrizeRevealDeadline(product: Pick<ProductDocument, "prizeRevealWindowStart" | "prizeRevealWindowEnd" | "prizeRevealDeadlineDays">, now?: Date): Date | undefined;
-/**
- * Inside the existing checkout transaction, validate the prize-pool cap for
- * each prize-draw line. Caller must pass the fresh product snapshot read
- * within the transaction (so `prizeCurrentEntries` is up-to-date).
- *
- * Throws ValidationError if any item would overflow the pool.
- */
-export declare function enforcePrizePoolCap(args: {
-    productSnapshot: ProductDocument;
-    requestedQuantity: number;
-}): void;