@mohasinac/appkit 4.12.1 → 4.12.3

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -899,6 +899,12 @@ const rawTesterChecklistItems = [
                     description: "Repeat on COD, UPI-manual and Razorpay. Acceptance test for the whole pricing change — if any two of those four disagree, something is reading a different source than it charges from.",
                     href: "/checkout",
                 },
+                {
+                    key: "addons-follow-cart-not-checkout-request",
+                    label: "Add-on fees are charged strictly according to the per-store checkboxes on the cart page — leaving the cart and returning, or re-entering checkout, never adds or drops an add-on on its own",
+                    description: "Hardened 2026-08-21. The add-on booleans used to be accepted in the checkout request body as well as being stored per-store on the cart, so two sources could disagree about what the buyer had actually selected — and the cart's selection is the only one the buyer ever saw. The request body no longer carries them at all. To test: tick gift wrap for seller A only, go to checkout and note the Total, press Back to the cart, then return to checkout — the same single gift-wrap fee must still be there, for seller A only, with an unchanged Total. Repeat having ticked nothing and confirm no add-on line ever appears.",
+                    href: "/cart",
+                },
             ],
         },
         {
@@ -2470,8 +2476,8 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "admin-decided-order-no-live-buttons",
-                    label: "An order already rejected as fraud, or already sent back for re-upload, shows that state instead of offering live Verify / Reject buttons again",
-                    description: "Previously only the payment status was consulted, so a decided order still rendered as a fresh \"please verify\" and could be actioned a second time. Reject one order as fraud, reopen it, and confirm it now reads as rejected with no action buttons.",
+                    label: "An order already rejected as fraud, or already sent back for re-upload, shows that state instead of offering live Verify / Reject buttons again — on BOTH the row drawer and the full /admin/orders/[id]/view page",
+                    description: "Previously only the payment status was consulted, so a decided order still rendered as a fresh \"please verify\" and could be actioned a second time. Reject one order as fraud, reopen it, and confirm it now reads as rejected with no action buttons. Check both surfaces separately: as of 2026-08-21 the full-page variant did not receive paymentReviewOutcome at all, so it kept offering live Verify/Reject on an already-decided order even once the drawer had been fixed — a double-action risk visible only if you open the standalone page rather than the drawer.",
                     href: "/admin/orders",
                 },
                 {

package/dist/providers/db-firebase/sieve.js

@@ -136,7 +136,16 @@ export async function applySieveToFirestore(params) {
     const merged = { ...SIEVE_DEFAULTS, ...rest };
     const effective = withAliasesExpanded(model, aliases);
     const processor = new SieveProcessorBase({
-        adapter: createFirebaseAdapter(),
+        // MUST be the enhanced adapter, not the stock one. This is the path
+        // `BaseRepository.sieveQuery` delegates to, so it is what ProductRepository
+        // and most other repositories actually run — only `FirebaseSieveRepository`
+        // used the enhanced adapter, and nothing extends that. With the stock
+        // adapter a same-field OR group (`listingType==art|stickers`, i.e. every
+        // multi-select facet in the app) became a `whereOr` call the Admin SDK does
+        // not implement; `throwExceptions: false` then swallowed it and the clause
+        // vanished, returning the ENTIRE collection instead of the selected subset.
+        // See __tests__/sieve-or-group.test.ts.
+        adapter: createEnhancedFirebaseAdapter(),
         autoLoadConfig: false,
         options: merged,
         fields,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.12.1",
+  "version": "4.12.3",
   "license": "MIT",
   "publishConfig": {
     "access": "public"