@mohasinac/appkit 4.11.1 → 4.11.3

package/dist/_internal/server/features/checkout/actions.d.ts

@@ -44,6 +44,10 @@ export declare function resolveShippingCost(storeId: string | undefined): Promis
     storeEmiEnabled: boolean;
     storeState: string | undefined;
 }>;
+export interface DroppedCoupon {
+    code: string;
+    reason: string;
+}
 /**
  * Place order(s) from the user's cart in a single Firestore transaction.
  *

package/dist/_internal/server/features/checkout/actions.js

@@ -13,10 +13,13 @@ import { ORDER_FIELDS } from "../../../../constants/field-names";
 import { serverLogger } from "../../../../monitoring";
 import { unitOfWork, siteSettingsRepository, userRepository, storeRepository, couponsRepository, claimedCouponsRepository, addressesRepository, productRepository, } from "../../../../repositories";
 import { calculateGst } from "../../../shared/fees/calculator";
-import { computePreOrderDepositAmount } from "../../../shared/checkout/order-math";
+import { computePreOrderDepositAmount, unitPriceFor } from "../../../shared/checkout/order-math";
 import { failedCheckoutRepository } from "../../../../features/checkout/repository/failed-checkout.repository";
 import { sendOrderConfirmationEmail } from "../../../../features/contact/server";
 import { splitCartIntoOrderGroups } from "../../../../features/orders/index";
+import { resolveCouponCategorySlugs } from "../../../../features/promotions/actions/coupon-actions";
+import { assertCheckoutLane, assertLockedLinesStillValid, finalizeLockedLines, } from "./locked-lines";
+import { activeLane, laneOf } from "../../../shared/checkout/lanes";
 import { computeCodHandlingFee, computeWhatsAppNotifyFee, computeGiftWrapFee, computeShipmentProtectionFee, } from "../../../shared/fees/calculator";
 import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase";
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION } from "../../../../features/products/schemas/firestore";
@@ -236,6 +239,90 @@ function buildStockUpdatePayload(product, qtyDelta) {
         ...rule.stockDecrementExtras(product, qtyDelta),
     };
 }
+/**
+ * Re-checks every coupon persisted on the cart against the items actually
+ * being ordered, immediately before pricing.
+ *
+ * A cart can sit for days, so the `discountAmount` frozen onto
+ * `cart.appliedCoupons` at apply-time may since have become wrong or
+ * unearned — the coupon may have expired, hit its total/per-user limit, been
+ * deactivated, or had its eligible items removed from the cart. Trusting the
+ * stored amount let all of those redeem anyway.
+ *
+ * Invalid coupons are DROPPED (and reported back to the caller) rather than
+ * failing the whole checkout: the buyer is on the payment step and cannot fix
+ * a lapsed coupon from there, so killing an otherwise-valid order is hostile.
+ *
+ * One parallel round of reads for at most a handful of coupons (the stacking
+ * rule caps it at one per store plus one platform-wide), so this stays inside
+ * the Vercel Hobby round-trip budget.
+ */
+async function revalidateAppliedCoupons(appliedCoupons, available, uid) {
+    if (appliedCoupons.length === 0)
+        return { coupons: [], dropped: [] };
+    const cartItems = available.map(({ item, product }) => ({
+        productId: item.productId,
+        storeId: item.storeId,
+        price: unitPriceFor(item, product),
+        quantity: item.quantity,
+        listingType: (item.listingType ?? "standard"),
+    }));
+    const results = await Promise.all(appliedCoupons.map(async (coupon) => {
+        try {
+            const check = await couponsRepository.validateCouponForCart(coupon.code, uid, cartItems, { resolveCategorySlugs: resolveCouponCategorySlugs });
+            if (!check.valid) {
+                return {
+                    dropped: {
+                        code: coupon.code,
+                        reason: check.message ?? "This coupon is no longer valid",
+                    },
+                };
+            }
+            // Re-derive the amount and the eligible lines from the CURRENT cart —
+            // the stored values were computed against whatever was in the cart at
+            // apply-time.
+            const applicableItemIds = check.eligibleProductIds
+                ? available
+                    .filter(({ item }) => check.eligibleProductIds.includes(item.productId))
+                    .map(({ item }) => item.itemId)
+                : undefined;
+            return {
+                coupon: {
+                    ...coupon,
+                    discountAmount: check.discountAmount ?? 0,
+                    scope: check.scope ?? coupon.scope,
+                    storeId: check.storeId ?? coupon.storeId,
+                    applicableItemIds,
+                },
+            };
+        }
+        catch (err) {
+            void normalizeError(err);
+            // A lookup failure must not silently grant the discount.
+            return {
+                dropped: {
+                    code: coupon.code,
+                    reason: "This coupon could not be verified",
+                },
+            };
+        }
+    }));
+    const coupons = [];
+    const dropped = [];
+    for (const r of results) {
+        if (r.coupon)
+            coupons.push(r.coupon);
+        else if (r.dropped)
+            dropped.push(r.dropped);
+    }
+    if (dropped.length > 0) {
+        serverLogger.info("Dropped invalid coupons at checkout", {
+            uid,
+            codes: dropped.map((d) => d.code).join(","),
+        });
+    }
+    return { coupons, dropped };
+}
 async function flushCouponUsageAccumulator(accumulator, uid) {
     if (accumulator.size === 0)
         return;
@@ -272,14 +359,6 @@ function dispatchOrderConfirmationEmails(emailsToSend) {
         return;
     Promise.all(emailsToSend.map((e) => sendOrderConfirmationEmail(e))).catch((err) => serverLogger.error("Order confirmation email error:", err));
 }
-// SB-UNI-5 2026-05-13 — bundle cart-lines use item.price (locked bundle price
-// at add-time); regular lines use product.price (current Firestore). Prevents
-// stale cart-cached prices from being charged on COD/UPI orders.
-function unitPriceFor(item, product) {
-    return item.bundleCategorySlug && item.bundleProductIds?.length
-        ? item.price
-        : product.price;
-}
 /**
  * Places one order for one seller-group of the checkout cart — fee math
  * (COD deposit/handling, EMI schedule), coupon apportionment, order-doc
@@ -461,6 +540,11 @@ async function createOrderForGroup(group, orderType, ctx) {
         ...extraOrderFields,
     });
     orderIds.push(order.id);
+    // Close the loop on any locked line this order settled: flip the offer to
+    // "paid" (its terminal status had NO server-side writer before 2026-08-21,
+    // so an accepted offer could be re-added and re-ordered) and back-link the
+    // winning bid to the order it became.
+    await finalizeLockedLines(group.map(({ item }) => item), order.id);
     // SB-UNI-N — claim a digital code for digital-code orders (fire-and-forget,
     // order is already persisted so a claim failure is logged, not thrown).
     if ((group[0]?.product?.listingType ?? "standard") === "digital-code") {
@@ -541,6 +625,9 @@ export async function createCheckoutOrderAction(input) {
     if (cartItems.length === 0) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.CART_EMPTY);
     }
+    // Lane priority + locked-line revalidation, before any money math runs.
+    assertCheckoutLane(cart.items, cartItems);
+    await assertLockedLinesStillValid(cartItems, uid);
     // Tier PP — OTP gate for high-value checkouts. Evaluated against the
     // WHOLE checkout batch's total (not each resulting per-seller order),
     // otherwise a buyer could dodge it by splitting a big cart across
@@ -699,7 +786,7 @@ export async function createCheckoutOrderAction(input) {
             .catch((logErr) => { void normalizeError(logErr); serverLogger.warn(AUDIT_LOG_FAIL_MSG, { error: logErr instanceof Error ? logErr.message : String(logErr) }); });
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK);
     }
-    const appliedCoupons = cart.appliedCoupons ?? [];
+    const { coupons: appliedCoupons, dropped: droppedCoupons } = await revalidateAppliedCoupons(cart.appliedCoupons ?? [], available, uid);
     const orderGroups = splitCartIntoOrderGroups(available);
     // Admin-bypass orders are immediately paid and processing; generate a shared
     // transaction reference for all orders in this checkout batch.
@@ -751,6 +838,7 @@ export async function createCheckoutOrderAction(input) {
         total,
         itemCount: orderIds.length,
         ...(unavailable.length > 0 ? { unavailableItems: unavailable } : {}),
+        ...(droppedCoupons.length > 0 ? { droppedCoupons } : {}),
     };
 }
 const EMPTY_PRICING_PREVIEW = {
@@ -780,7 +868,12 @@ export async function previewCheckoutPricing(input) {
     const cart = await unitOfWork.carts.getOrCreate(uid);
     const excludedSet = new Set(excludedProductIds);
     const selectedSet = cart.selectedItemIds?.length ? new Set(cart.selectedItemIds) : null;
-    const cartItems = (cart.items ?? []).filter((item) => !excludedSet.has(item.productId) && (!selectedSet || selectedSet.has(item.itemId)));
+    const previewLane = activeLane(cart.items ?? []);
+    const cartItems = (cart.items ?? []).filter((item) => !excludedSet.has(item.productId) &&
+        (!selectedSet || selectedSet.has(item.itemId)) &&
+        // A preview never throws — it just shows the lane the buyer can actually
+        // check out, matching what the checkout page's active tab displays.
+        (!previewLane || laneOf(item) === previewLane));
     if (cartItems.length === 0)
         return EMPTY_PRICING_PREVIEW;
     // Best-effort product lookup — a preview never throws on a since-unpublished
@@ -795,11 +888,12 @@ export async function previewCheckoutPricing(input) {
         resolvedAddress =
             addressDoc && addressDoc.ownerType === "user" && addressDoc.ownerId === uid ? addressDoc : null;
     }
-    const unitPriceFor = (item, product) => item.bundleCategorySlug && item.bundleProductIds?.length ? item.price : (product?.price ?? item.price);
     const checks = cartItems.map((item) => ({ item, product: productById.get(item.productId) ?? null }));
     const orderGroups = splitCartIntoOrderGroups(checks);
     const cartSubtotal = orderGroups.reduce((s, { items: g }) => s + g.reduce((gs, { item, product }) => gs + unitPriceFor(item, product) * item.quantity, 0), 0);
-    const appliedCoupons = cart.appliedCoupons ?? [];
+    // Same re-validation the real order placement runs, so the preview never
+    // shows a discount the order won't actually honour.
+    const { coupons: appliedCoupons } = await revalidateAppliedCoupons(cart.appliedCoupons ?? [], checks, uid);
     let shippingFee = 0;
     let codHandlingFee = 0;
     let whatsappNotifyFeeTotal = 0;
@@ -970,13 +1064,7 @@ async function refundDroppedItemsForRazorpayCheckout(input) {
  * from the inline version this replaced.
  */
 async function createRazorpayGroupOrder(group, orderType, ctx) {
-    const { appliedCoupons, cartSubtotal, platformFeePercent, gstPercent, whatsappNotifyFee, giftWrapFee, giftWrapMessage, shipmentProtectionAddon, siteSettings, uid, userName, userEmail, razorpay_order_id, razorpay_payment_id, razorpay_signature, shippingAddress, notes, outOfStockPolicy, unavailablePaid, orderIds, emailsToSend, } = ctx;
-    // SB-UNI-5 2026-05-13 — bundle cart-lines use item.price (locked bundle
-    // price); regular lines use product.price. The helper keeps the math
-    // local to this block.
-    const unitPriceFor = (item, product) => item.bundleCategorySlug && item.bundleProductIds?.length
-        ? item.price
-        : product.price;
+    const { appliedCoupons, cartSubtotal, platformFeePercent, gstPercent, whatsappNotifyFee, giftWrapFee, giftWrapMessage, shipmentProtectionAddon, siteSettings, uid, userName, userEmail, razorpay_order_id, razorpay_payment_id, razorpay_signature, shippingAddress, notes, outOfStockPolicy, unavailablePaid, orderIds, emailsToSend, couponUsageAccumulator, } = ctx;
     const firstItem = group[0].item;
     const groupTotal = group.reduce((sum, { item, product }) => sum + unitPriceFor(item, product) * item.quantity, 0);
     // Reuses the same store/seller lookup as the COD/UPI path above instead
@@ -985,6 +1073,16 @@ async function createRazorpayGroupOrder(group, orderType, ctx) {
     const { shippingFee, storeOwnerId } = await resolveShippingCost(firstItem.storeId);
     const groupLines = group.map(({ item, product }) => ({ itemId: item.itemId, lineTotal: unitPriceFor(item, product) * item.quantity }));
     const { couponDiscount, appliedDiscounts } = computeGroupCouponDiscount(appliedCoupons, groupLines, groupTotal, cartSubtotal, firstItem.storeId);
+    // Mirrors createOrderForGroup — without this the online-payment path wrote
+    // the discount onto the order but never incremented usage.currentUsage or
+    // the per-user counter, so limits were unenforceable for Razorpay orders.
+    const groupCouponCodes = new Set();
+    for (const discount of appliedDiscounts) {
+        if (discount.couponId) {
+            accumulateCouponUsage(couponUsageAccumulator, discount.code, discount.couponId, discount.discountAmount);
+            groupCouponCodes.add(discount.code);
+        }
+    }
     const rawPlatformFee = roundRupees(groupTotal * (platformFeePercent / 100));
     const gstOnFee = roundRupees(rawPlatformFee * (gstPercent / 100));
     const platformFee = rawPlatformFee + gstOnFee;
@@ -1089,6 +1187,11 @@ async function createRazorpayGroupOrder(group, orderType, ctx) {
         ...extraOrderFields,
     });
     orderIds.push(order.id);
+    // Close the loop on any locked line this order settled: flip the offer to
+    // "paid" (its terminal status had NO server-side writer before 2026-08-21,
+    // so an accepted offer could be re-added and re-ordered) and back-link the
+    // winning bid to the order it became.
+    await finalizeLockedLines(group.map(({ item }) => item), order.id);
     // SB-UNI-N — claim a digital code for digital-code orders (fire-and-forget,
     // order is already persisted so a claim failure is logged, not thrown).
     if ((group[0]?.product?.listingType ?? "standard") === "digital-code") {
@@ -1098,6 +1201,11 @@ async function createRazorpayGroupOrder(group, orderType, ctx) {
             productTitle: firstItem.productTitle,
         }).catch((e) => serverLogger.error("claimDigitalCode", e));
     }
+    for (const code of groupCouponCodes) {
+        const entry = couponUsageAccumulator.get(code);
+        if (entry)
+            entry.orderIds.push(order.id);
+    }
     if (userEmail) {
         emailsToSend.push({
             to: userEmail,
@@ -1150,6 +1258,11 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     if (!cart.items || cart.items.length === 0) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.CART_EMPTY);
     }
+    // Same lane priority + locked-line revalidation the manual/COD path runs.
+    // The Razorpay path settles the whole cart (no selectedItemIds), so the
+    // "selected" set is the cart itself.
+    assertCheckoutLane(cart.items, cart.items);
+    await assertLockedLinesStillValid(cart.items, uid);
     const isDigitalCartRazorpay = cartIsDigitalOnly(cart.items);
     let shippingAddress;
     let resolvedAddressRzp = null;
@@ -1272,7 +1385,7 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
         }
     }
-    const appliedCoupons = cart.appliedCoupons ?? [];
+    const { coupons: appliedCoupons, dropped: droppedCoupons } = await revalidateAppliedCoupons(cart.appliedCoupons ?? [], bucketedPaid.available, uid);
     // "skip_items" (or an all-available cart under any policy) — build order
     // groups from the available bucket only. Dropped items are never ordered;
     // their value is refunded below since Razorpay already captured payment
@@ -1281,14 +1394,9 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     const orderIds = [];
     let total = 0;
     const emailsToSend = [];
-    // SB-UNI-5 2026-05-13 — bundle cart-lines use item.price (locked bundle
-    // price); regular lines use product.price. The helper keeps the math
-    // local to this block.
-    const unitPriceFor = (item, product) => item.bundleCategorySlug && item.bundleProductIds?.length
-        ? item.price
-        : product.price;
     const cartSubtotal = orderGroups.reduce((s, { items: g }) => s +
         g.reduce((gs, { item, product }) => gs + unitPriceFor(item, product) * item.quantity, 0), 0);
+    const couponUsageAccumulator = new Map();
     for (const { items: group, orderType } of orderGroups) {
         total += await createRazorpayGroupOrder(group, orderType, {
             appliedCoupons,
@@ -1312,8 +1420,10 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             unavailablePaid,
             orderIds,
             emailsToSend,
+            couponUsageAccumulator,
         });
     }
+    await flushCouponUsageAccumulator(couponUsageAccumulator, uid);
     // SB-UNI-5 2026-05-13 — bundle-aware batch decrement. We iterate the
     // cumulative `decrements` map (one entry per unique member product) so a
     // bundle's members + any sibling cart line touching the same product
@@ -1362,5 +1472,6 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
         total,
         itemCount: orderIds.length,
         ...(unavailablePaid.length > 0 ? { unavailableItems: unavailablePaid } : {}),
+        ...(droppedCoupons.length > 0 ? { droppedCoupons } : {}),
     };
 }

package/dist/_internal/server/features/checkout/data.d.ts

@@ -10,4 +10,14 @@ export interface CheckoutOrderResult {
         requestedQty: number;
         availableQty: number;
     }[];
+    /**
+     * Coupons that were on the cart but failed re-validation at placement time
+     * (expired, limit reached, no longer any eligible items). They were removed
+     * and the order priced without them — surfaced so the UI can tell the buyer
+     * rather than silently charging more than the cart showed.
+     */
+    droppedCoupons?: {
+        code: string;
+        reason: string;
+    }[];
 }

package/dist/_internal/server/features/checkout/locked-lines.d.ts

@@ -0,0 +1,30 @@
+import type { CartItemDocument } from "../../../../features/cart/schemas/firestore";
+/**
+ * Refuse a checkout that isn't the cart's active lane.
+ *
+ * The client scopes its selection to one lane's tab, but a selection is just a
+ * list of item ids in a request body — nothing stopped a caller from checking
+ * out their ₹200 standard items while a ₹30,000 auction win they already
+ * committed to sat unpaid. Priority is enforced here, on the server, over the
+ * WHOLE cart, not over the caller-supplied subset.
+ */
+export declare function assertCheckoutLane(allCartItems: readonly CartItemDocument[], selectedItems: readonly CartItemDocument[]): void;
+/** Error code the client maps to a lane-aware message. */
+export declare const CHECKOUT_LANE_BLOCKED = "CHECKOUT_LANE_BLOCKED";
+/**
+ * Re-validate every locked line immediately before the order is written.
+ *
+ * `checkoutOffer()` already checks status/deadline/stock when the line is ADDED
+ * to the cart, but nothing re-checked at order time — so a buyer could add an
+ * accepted offer, wait out the 48h window, and still be charged the locked
+ * price. Throws on the first invalid line; the caller's transaction aborts.
+ */
+export declare function assertLockedLinesStillValid(items: readonly CartItemDocument[], buyerUid: string): Promise<void>;
+/**
+ * Close the loop after the order exists.
+ *
+ * Best-effort by design: the order is already persisted and paid-for, so a
+ * failure here must be logged rather than thrown — losing the back-link is a
+ * bookkeeping problem, refusing a completed order is a customer-facing one.
+ */
+export declare function finalizeLockedLines(items: readonly CartItemDocument[], orderId: string): Promise<void>;

package/dist/_internal/server/features/checkout/locked-lines.js

@@ -0,0 +1,116 @@
+/*
+ * WHY: A "locked line" is a cart line whose price was fixed outside the listing —
+ *      an accepted offer or a won auction. Two things were missing before
+ *      2026-08-21: the offer/bid was never re-checked at ORDER time (only at
+ *      add-to-cart time, so a line could sit in the cart past its deadline and
+ *      still check out), and nothing ever closed the loop afterwards — the
+ *      offer stayed "accepted" forever and could be re-added and re-ordered,
+ *      and a won bid had no link to the order it became.
+ * WHAT: `assertLockedLinesStillValid` (pre-order-creation guard) and
+ *       `finalizeLockedLines` (post-order-creation close-out). Both are called
+ *       from every order-creation path so the manual/COD and Razorpay flows
+ *       cannot diverge.
+ *
+ * EXPORTS:
+ *   assertLockedLinesStillValid, finalizeLockedLines
+ *
+ * @tag domain:checkout,offers,auctions
+ * @tag layer:server-action
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:checkout/actions.ts
+ * @tag sideEffects:firestore-write
+ */
+import { offerRepository } from "../../../../features/seller/repository/offer.repository";
+import { bidRepository } from "../../../../repositories";
+import { OfferStatusValues } from "../../../../features/seller/schemas";
+import { ValidationError } from "../../../../errors";
+import { serverLogger } from "../../../../monitoring/server-logger";
+import { normalizeError } from "../../../../errors/normalize";
+import { activeLane, laneOf, laneBlockReason } from "../../../shared/checkout/lanes";
+/**
+ * Refuse a checkout that isn't the cart's active lane.
+ *
+ * The client scopes its selection to one lane's tab, but a selection is just a
+ * list of item ids in a request body — nothing stopped a caller from checking
+ * out their ₹200 standard items while a ₹30,000 auction win they already
+ * committed to sat unpaid. Priority is enforced here, on the server, over the
+ * WHOLE cart, not over the caller-supplied subset.
+ */
+export function assertCheckoutLane(allCartItems, selectedItems) {
+    const active = activeLane(allCartItems);
+    if (!active)
+        return;
+    const offLane = selectedItems.filter((item) => laneOf(item) !== active);
+    if (offLane.length === 0)
+        return;
+    throw new ValidationError(laneBlockReason(allCartItems, laneOf(offLane[0])) ??
+        "Please complete your outstanding items first.", { code: CHECKOUT_LANE_BLOCKED });
+}
+/** Error code the client maps to a lane-aware message. */
+export const CHECKOUT_LANE_BLOCKED = "CHECKOUT_LANE_BLOCKED";
+/**
+ * Re-validate every locked line immediately before the order is written.
+ *
+ * `checkoutOffer()` already checks status/deadline/stock when the line is ADDED
+ * to the cart, but nothing re-checked at order time — so a buyer could add an
+ * accepted offer, wait out the 48h window, and still be charged the locked
+ * price. Throws on the first invalid line; the caller's transaction aborts.
+ */
+export async function assertLockedLinesStillValid(items, buyerUid) {
+    const now = new Date();
+    for (const item of items) {
+        if (!item.offerId)
+            continue;
+        const offer = await offerRepository.findById(item.offerId);
+        if (!offer) {
+            throw new ValidationError("The offer for one of your items no longer exists. Remove it and try again.");
+        }
+        if (offer.buyerUid !== buyerUid) {
+            throw new ValidationError("This offer belongs to a different account.");
+        }
+        if (offer.status !== OfferStatusValues.ACCEPTED) {
+            throw new ValidationError(offer.status === OfferStatusValues.PAID
+                ? "This offer has already been used for an order."
+                : "This offer is no longer accepted. Remove it from your cart and make a new offer.");
+        }
+        if (offer.checkoutDeadline && now > offer.checkoutDeadline) {
+            throw new ValidationError("The checkout window for this accepted offer has expired. Please make a new offer.");
+        }
+    }
+}
+/**
+ * Close the loop after the order exists.
+ *
+ * Best-effort by design: the order is already persisted and paid-for, so a
+ * failure here must be logged rather than thrown — losing the back-link is a
+ * bookkeeping problem, refusing a completed order is a customer-facing one.
+ */
+export async function finalizeLockedLines(items, orderId) {
+    for (const item of items) {
+        if (item.offerId) {
+            try {
+                await offerRepository.markPaid(item.offerId, orderId);
+            }
+            catch (err) {
+                void normalizeError(err);
+                serverLogger.error("finalizeLockedLines: markPaid failed", {
+                    offerId: item.offerId,
+                    orderId,
+                });
+            }
+        }
+        if (item.bidId) {
+            try {
+                await bidRepository.attachOrder(item.bidId, orderId);
+            }
+            catch (err) {
+                void normalizeError(err);
+                serverLogger.error("finalizeLockedLines: attachOrder failed", {
+                    bidId: item.bidId,
+                    orderId,
+                });
+            }
+        }
+    }
+}

package/dist/_internal/server/features/orders/adapters.js

@@ -50,12 +50,19 @@ export function orderDocumentToOrder(doc) {
         address,
         orderStatus: doc.status,
         paymentStatus: doc.paymentStatus,
+        // Which checkout lane produced this order (standard / auction / offer /
+        // preorder / prize-draw). Drives the lane tabs on /user/orders. Absent on
+        // orders written before `orderType` existed — every reader must treat a
+        // missing value as "standard" rather than filtering it out.
+        orderType: doc.orderType,
+        offerId: doc.offerId,
         subtotal,
         shippingCost: shippingCost || undefined,
         discount: discount || undefined,
         total: doc.totalPrice,
         currency: doc.currency,
         couponCode: doc.couponCode,
+        appliedDiscounts: doc.appliedDiscounts,
         trackingNumber: doc.trackingNumber,
         shippingCarrier: doc.shippingCarrier,
         trackingUrl: doc.trackingUrl,

package/dist/_internal/server/features/products/data.d.ts

@@ -4,15 +4,24 @@ import type { ProductDocument } from "../../../../features/products/schemas/fire
 import type { ListingType } from "../../../../features/products/types";
 import type { ProductItem } from "../../../../features/products/types";
 import type { FirestoreDocument } from "../../../../schemas/types";
-import type { Review } from "../../../../features/reviews/types";
+import type { Review, ReviewListResponse } from "../../../../features/reviews/types";
 /** Fetch a single product by slug or id, deduped per request. */
 export declare const getProductForDetail: (slugOrId: string) => Promise<ProductDocument | null>;
 /** Fetch the first page of approved reviews for a product, deduped per request. */
-export declare const getReviewsForProduct: (productId: string) => Promise<unknown[]>;
+export declare const getReviewsForProduct: (productId: string, limit?: number) => Promise<unknown[]>;
 /** Firestore review doc → client Review shape. Shared by every listing-type detail page's reviews tab. */
 export declare function toReview(doc: FirestoreDocument): Review;
 /** Fetch + map approved reviews for a product straight to the client Review shape, deduped per request. */
-export declare const getReviewItemsForProduct: (productId: string) => Promise<Review[]>;
+export declare const getReviewItemsForProduct: (productId: string, limit?: number) => Promise<Review[]>;
+/**
+ * Page 1 of a product's approved reviews, shaped exactly like `GET /api/reviews?productId=`
+ * so it can seed `<ReviewsListingPanel initialData>` without a client round-trip.
+ *
+ * The defaults here MUST match the panel's bare (unfiltered, page-1) query defaults —
+ * `staleTime: Infinity` freezes whatever `initialData` is handed over, so a mismatch would
+ * pin the wrong rows into the cache (Recurrent Root Cause #30).
+ */
+export declare const getReviewPageForProduct: (productId: string, pageSize?: number) => Promise<ReviewListResponse>;
 /** Minimal product fields needed for sitemap generation. */
 export interface SitemapProduct {
     slugOrId: string;

package/dist/_internal/server/features/products/data.js

@@ -13,6 +13,8 @@ import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firest
 import { PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config";
 import { PRODUCT_FIELDS } from "../../../../constants/field-names";
 import { SIEVE_OP, sieveAnd, sieveFilter, sortBy } from "../../../../utils/sieve-builder";
+import { REVIEW_FIELDS } from "../../../../constants/field-names";
+import { REVIEWS_DETAIL_PAGE_SIZE } from "../../../shared/features/reviews/config";
 // ---------------------------------------------------------------------------
 // Request-scoped cache — each function is deduplicated per RSC render tree.
 // Both generateMetadata() and the page component get the same promise.
@@ -26,8 +28,8 @@ export const getProductForDetail = cache(async (slugOrId) => {
     return product;
 });
 /** Fetch the first page of approved reviews for a product, deduped per request. */
-export const getReviewsForProduct = cache(async (productId) => {
-    return reviewRepository.findApprovedByProduct(productId).catch(() => []);
+export const getReviewsForProduct = cache(async (productId, limit = REVIEWS_DETAIL_PAGE_SIZE) => {
+    return reviewRepository.findApprovedByProduct(productId, limit).catch(() => []);
 });
 /** Firestore review doc → client Review shape. Shared by every listing-type detail page's reviews tab. */
 export function toReview(doc) {
@@ -57,10 +59,59 @@ export function toReview(doc) {
     };
 }
 /** Fetch + map approved reviews for a product straight to the client Review shape, deduped per request. */
-export const getReviewItemsForProduct = cache(async (productId) => {
-    const docs = await reviewRepository.findApprovedByProduct(productId).catch(() => []);
+export const getReviewItemsForProduct = cache(async (productId, limit = REVIEWS_DETAIL_PAGE_SIZE) => {
+    const docs = await reviewRepository
+        .findApprovedByProduct(productId, limit)
+        .catch(() => []);
     return docs.map(toReview);
 });
+/**
+ * Page 1 of a product's approved reviews, shaped exactly like `GET /api/reviews?productId=`
+ * so it can seed `<ReviewsListingPanel initialData>` without a client round-trip.
+ *
+ * The defaults here MUST match the panel's bare (unfiltered, page-1) query defaults —
+ * `staleTime: Infinity` freezes whatever `initialData` is handed over, so a mismatch would
+ * pin the wrong rows into the cache (Recurrent Root Cause #30).
+ */
+export const getReviewPageForProduct = cache(async (productId, pageSize = REVIEWS_DETAIL_PAGE_SIZE) => {
+    const empty = {
+        items: [],
+        total: 0,
+        page: 1,
+        pageSize,
+        totalPages: 1,
+        hasMore: false,
+        averageRating: 0,
+        ratingDistribution: {},
+        totalApproved: 0,
+    };
+    try {
+        const [summary, result] = await Promise.all([
+            reviewRepository.getApprovedRatingSummary(productId),
+            reviewRepository.listForProduct(productId, {
+                filters: sieveFilter(REVIEW_FIELDS.STATUS, SIEVE_OP.EQ, "approved"),
+                sorts: sortBy(REVIEW_FIELDS.CREATED_AT),
+                page: 1,
+                pageSize,
+            }),
+        ]);
+        return {
+            items: result.items.map(toReview),
+            total: result.total,
+            page: result.page,
+            pageSize: result.pageSize,
+            totalPages: result.totalPages,
+            hasMore: result.hasMore,
+            averageRating: summary.averageRating,
+            ratingDistribution: summary.ratingDistribution,
+            totalApproved: summary.total,
+        };
+    }
+    catch (err) {
+        void normalizeError(err);
+        return empty;
+    }
+});
 /** List all published products for sitemap generation. */
 export async function listSitemapProducts() {
     try {

package/dist/_internal/server/features/products/index.d.ts

@@ -1,4 +1,5 @@
-export { getProductForDetail, getReviewsForProduct, listSitemapProducts, type SitemapProduct, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, type RelatedItemsResult, } from "./data";
+export { getProductForDetail, getReviewsForProduct, listSitemapProducts, type SitemapProduct, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, getReviewPageForProduct, type RelatedItemsResult, } from "./data";
+export { listPublicProducts, parsePublicProductParams, PUBLIC_PRODUCT_MAX_PAGE_SIZE, type PublicProductListInput, type PublicProductListResult, type PublicProductListOptions, type PublicProductExecutor, type PublicProductQuery, type ExecutorResult, } from "./list-public";
 export { assertProductOwnership, assertStatusTransition, assertInStock, effectivePrice, isAvailableForPurchase, } from "./service";
 export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions";
 export { PRODUCTS_PAGE_SIZE, PRODUCTS_FEATURED_LIMIT, PRODUCTS_RELATED_LIMIT, PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config";

package/dist/_internal/server/features/products/index.js

@@ -1,4 +1,5 @@
-export { getProductForDetail, getReviewsForProduct, listSitemapProducts, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, } from "./data";
+export { getProductForDetail, getReviewsForProduct, listSitemapProducts, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, getReviewPageForProduct, } from "./data";
+export { listPublicProducts, parsePublicProductParams, PUBLIC_PRODUCT_MAX_PAGE_SIZE, } from "./list-public";
 export { assertProductOwnership, assertStatusTransition, assertInStock, effectivePrice, isAvailableForPurchase, } from "./service";
 export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions";
 export { PRODUCTS_PAGE_SIZE, PRODUCTS_FEATURED_LIMIT, PRODUCTS_RELATED_LIMIT, PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config";