@mohasinac/appkit 4.24.0 → 4.25.0

package/dist/_internal/server/features/checkout/actions.js

@@ -26,7 +26,7 @@ import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../provide
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION } from "../../../../features/products/schemas/firestore";
 import { CART_COLLECTION } from "../../../../features/cart/schemas/index";
 // S-SBUNI-RULES 2026-05-13 — bundle cart-line stock fan-out helpers.
-import { getCartItemMemberIds, getExpandedDecrements, bucketCartItemsByStock, } from "./bundle-expansion";
+import { getCartItemMemberIds, getExpandedDecrements, bucketCartItemsByStock, isMultiMemberLine, } from "./bundle-expansion";
 import { OrderStatusValues, PaymentStatusValues, PaymentMethodValues, OutOfStockPolicyValues, } from "../../../../features/orders/schemas/index";
 import { getDefaultCurrency } from "../../../../core/index";
 import { verifyPaymentSignatureWithKeys, fetchRazorpayOrder, paiseToRupees, } from "../../../../providers/payment-razorpay/index";
@@ -756,8 +756,9 @@ export async function createCheckoutOrderAction(input) {
             const availableItems = [];
             for (const { item, product } of bucketed.available) {
                 // S-SBUNI-RULES 2026-05-13 — sync preflight (prize-pool cap, pre-order
-                // quota) via rule registry. Bundles skip — they bypass the cart path.
-                if (!item.bundleProductIds?.length) {
+                // quota) via rule registry. Multi-member lines skip: their listingType
+                // describes the wrapper, not the members.
+                if (!isMultiMemberLine(item)) {
                     runSyncPreflight([{ item, product }], paymentMethod);
                 }
                 availableItems.push({ item, product });
@@ -1406,8 +1407,8 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
             .map(({ item, product }) => ({ item, product })),
     });
     // S-SBUNI-RULES 2026-05-13 — sync preflight via rule registry.
-    // Bundle items bypass the cart flow so skip the prize-pool cap.
-    const preflightPairs = productChecks.filter((p) => p.product !== null && p.product !== undefined && !p.item.bundleProductIds?.length);
+    // Multi-member lines skip the prize-pool cap, same reasoning as the COD path.
+    const preflightPairs = productChecks.filter((p) => p.product !== null && p.product !== undefined && !isMultiMemberLine(p.item));
     // This whole action is the Razorpay path — paymentMethod is always "online".
     runSyncPreflight(preflightPairs, "online");
     // SB-UNI-O 2026-05-15 — Live-item jurisdiction guard.

package/dist/_internal/server/features/checkout/bundle-expansion.d.ts

@@ -22,19 +22,17 @@
  */
 import type { CartItemDocument } from "../../../../features/cart/schemas";
 import type { ProductDocument } from "../../../../features/products/schemas/firestore";
+export { getCartLineMembers, getCartItemMemberIds, isMultiMemberLine, type CartLineMemberRef, } from "../../../shared/checkout/line-members";
 export interface BundleExpansion {
     /** Unique product ids referenced by any cart item (regular or bundle member). */
     productIds: string[];
     /**
-     * Sum of requested quantities per product id. Bundle members get
-     * `item.quantity` per occurrence (so 2x of a bundle with member X
-     * decrements X by 2, not 1).
+     * Sum of requested quantities per product id, weighted by BOTH the number of
+     * copies of the line and each member's per-copy quantity — so 2 copies of a
+     * selection containing 3× member X decrement X by 6.
      */
     decrements: Map<string, number>;
 }
-/** Resolve the member-product ids for a cart item. Bundle items expand to
- *  `bundleProductIds[]`; regular items collapse to `[productId]`. */
-export declare function getCartItemMemberIds(item: CartItemDocument): string[];
 /** Build the unique-product-id + per-product decrement map for a cart. */
 export declare function getExpandedDecrements(cartItems: CartItemDocument[]): BundleExpansion;
 export interface StockShortfall {

package/dist/_internal/server/features/checkout/bundle-expansion.js

@@ -21,21 +21,21 @@
  * the first's decrement before re-running its own validation.
  */
 import { ProductStatusValues } from "../../../../features/products/schemas/firestore";
-/** Resolve the member-product ids for a cart item. Bundle items expand to
- *  `bundleProductIds[]`; regular items collapse to `[productId]`. */
-export function getCartItemMemberIds(item) {
-    if (item.bundleProductIds && item.bundleProductIds.length > 0) {
-        return item.bundleProductIds;
-    }
-    return [item.productId];
-}
+import { getCartLineMembers } from "../../../shared/checkout/line-members";
+// Re-exported here so the many existing importers of this module keep working;
+// the definitions live in shared/ because `rules/_registry.ts` and
+// `order-math.ts` need them too and cannot import from server/.
+export { getCartLineMembers, getCartItemMemberIds, isMultiMemberLine, } from "../../../shared/checkout/line-members";
 /** Build the unique-product-id + per-product decrement map for a cart. */
 export function getExpandedDecrements(cartItems) {
     const decrements = new Map();
     for (const item of cartItems) {
-        const memberIds = getCartItemMemberIds(item);
-        for (const pid of memberIds) {
-            decrements.set(pid, (decrements.get(pid) ?? 0) + item.quantity);
+        for (const member of getCartLineMembers(item)) {
+            // item.quantity = copies of the line, member.quantity = units per copy.
+            // Multiplying is the whole point: this used to add `item.quantity` alone,
+            // which silently assumed exactly one of each member.
+            const needed = item.quantity * member.quantity;
+            decrements.set(member.productId, (decrements.get(member.productId) ?? 0) + needed);
         }
     }
     return {
@@ -55,15 +55,17 @@ export function getExpandedDecrements(cartItems) {
  * that product, not just this item's slice.
  */
 export function validateCartItemStock(item, productById, decrements) {
-    const memberIds = getCartItemMemberIds(item);
-    for (const pid of memberIds) {
-        const product = productById.get(pid);
+    for (const member of getCartLineMembers(item)) {
+        const product = productById.get(member.productId);
         if (!product || product.status !== ProductStatusValues.PUBLISHED) {
-            return { productId: pid, availableQty: product?.availableQuantity ?? 0 };
+            return { productId: member.productId, availableQty: product?.availableQuantity ?? 0 };
         }
-        const totalNeeded = decrements.get(pid) ?? item.quantity;
+        // The fallback must be member-weighted too. Left as a bare `item.quantity`
+        // it would validate a line needing 3× of a member against demand for 1
+        // whenever the cumulative map didn't happen to carry that product.
+        const totalNeeded = decrements.get(member.productId) ?? item.quantity * member.quantity;
         if (product.availableQuantity < totalNeeded) {
-            return { productId: pid, availableQty: product.availableQuantity };
+            return { productId: member.productId, availableQty: product.availableQuantity };
         }
     }
     return null;

package/dist/_internal/server/features/checkout/stock-restore.js

@@ -1,6 +1,7 @@
 import { ORDER_COLLECTION } from "../../../../features/orders/schemas/firestore";
 import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore";
 import { getListingRule } from "../../../shared/checkout/rules";
+import { getOrderItemMemberRefs } from "../../../shared/checkout/line-members";
 /**
  * Per-product quantity to restore for one order — the inverse of
  * `getExpandedDecrements` (bundle-expansion.ts), but reads from
@@ -15,11 +16,11 @@ function getOrderRestoreMap(order) {
         const remainingQty = item.quantity - (item.cancelledQuantity ?? 0);
         if (remainingQty <= 0)
             continue;
-        const memberIds = item.bundleProductIds && item.bundleProductIds.length > 0
-            ? item.bundleProductIds
-            : [item.productId];
-        for (const pid of memberIds) {
-            map.set(pid, (map.get(pid) ?? 0) + remainingQty);
+        // Must mirror `getExpandedDecrements` exactly, including the per-member
+        // weighting — restoring fewer units than were taken silently leaks stock.
+        for (const member of getOrderItemMemberRefs(item)) {
+            const pid = member.productId;
+            map.set(pid, (map.get(pid) ?? 0) + remainingQty * member.quantity);
         }
     }
     return map;

package/dist/_internal/server/features/products/group-members.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Public projection for a product-group member.
+ *
+ * `GET /api/products/group/[groupId]` previously returned
+ * `sanitizeProductsForPublic(items)`, which is a DELETE-LIST of four
+ * seller-identity keys — every other field of `ProductDocument` went to the
+ * browser, including fields nobody had thought about. Per § "Public Data
+ * Projections", a public payload is built by naming what goes out, never by
+ * spreading a document and removing keys: a denial keyed on today's field list
+ * is structurally blind to the field added tomorrow.
+ *
+ * The member picker needs more than the old response carried (stock, store,
+ * sold state, gstRate), so widening the payload was required either way —
+ * which made this the moment to make it an allow-list rather than a wider
+ * deny-list.
+ */
+import type { ProductDocument } from "../../../../features/products/schemas/firestore";
+import type { ListingType } from "../../../../features/products/types/index";
+/**
+ * Every field the group picker and the group table render. If a field is not
+ * here it does not reach the browser.
+ *
+ * Deliberately absent, with reasons:
+ *  - `sellerId` / `ownerId` / `sellerName` / `sellerEmail` — seller identity;
+ *    public clients see store-scoped identity only.
+ *  - `costPrice`, `profitMargin`, `supplier*`, `adminNotes` — seller-private
+ *    commercial data.
+ *  - `stockQuantity` — the internal figure; `availableQuantity` is the one the
+ *    buyer may act on.
+ */
+export interface PublicGroupMember {
+    id: string;
+    slug?: string;
+    title: string;
+    price: number;
+    currency?: string;
+    /** First image only — the picker renders a thumbnail, never a gallery. */
+    image?: string;
+    condition?: string;
+    listingType: ListingType;
+    isGroupParent?: boolean;
+    groupTitle?: string;
+    /** Drives the stepper's `max`. */
+    availableQuantity: number;
+    storeId: string;
+    storeName?: string;
+    status: string;
+    isSold?: boolean;
+    /** Needed so the picker can show a tax-inclusive hint and the cart line can
+     *  snapshot it for per-member GST proration at checkout. */
+    gstRate?: 0 | 5 | 12 | 18 | 28;
+    hsnCode?: string;
+}
+export declare function toPublicGroupMember(doc: ProductDocument): PublicGroupMember;
+export declare function toPublicGroupMembers(docs: readonly ProductDocument[]): PublicGroupMember[];

package/dist/_internal/server/features/products/group-members.js

@@ -0,0 +1,41 @@
+/**
+ * Public projection for a product-group member.
+ *
+ * `GET /api/products/group/[groupId]` previously returned
+ * `sanitizeProductsForPublic(items)`, which is a DELETE-LIST of four
+ * seller-identity keys — every other field of `ProductDocument` went to the
+ * browser, including fields nobody had thought about. Per § "Public Data
+ * Projections", a public payload is built by naming what goes out, never by
+ * spreading a document and removing keys: a denial keyed on today's field list
+ * is structurally blind to the field added tomorrow.
+ *
+ * The member picker needs more than the old response carried (stock, store,
+ * sold state, gstRate), so widening the payload was required either way —
+ * which made this the moment to make it an allow-list rather than a wider
+ * deny-list.
+ */
+import { normalizeListingType } from "../../../../features/products/utils/listing-type";
+export function toPublicGroupMember(doc) {
+    return {
+        id: doc.id,
+        slug: doc.slug,
+        title: doc.title,
+        price: doc.price,
+        currency: doc.currency,
+        image: doc.images?.[0] ?? doc.mainImage,
+        condition: doc.condition,
+        listingType: normalizeListingType(doc),
+        isGroupParent: doc.isGroupParent,
+        groupTitle: doc.groupTitle,
+        availableQuantity: doc.availableQuantity ?? 0,
+        storeId: doc.storeId,
+        storeName: doc.storeName,
+        status: doc.status,
+        isSold: doc.isSold,
+        gstRate: doc.gstRate,
+        hsnCode: doc.hsnCode,
+    };
+}
+export function toPublicGroupMembers(docs) {
+    return docs.map(toPublicGroupMember);
+}

package/dist/_internal/shared/checkout/line-members.d.ts

@@ -0,0 +1,60 @@
+/**
+ * "What products does this cart line actually consume?" — the one answer.
+ *
+ * Lives in `shared/` rather than `server/features/checkout/` because three
+ * different layers need it and two of them are not server code:
+ *   - `order-math.ts`         (pricing + tax, shared)
+ *   - `rules/_registry.ts`    (preflight skip, shared)
+ *   - `bundle-expansion.ts`   (stock fan-out, server)
+ *   - `stock-restore.ts`      (restore fan-out, server)
+ *
+ * Pure functions, no Firestore, no framework imports.
+ */
+import type { CartItemDocument } from "../../../features/cart/schemas/firestore";
+/** One member of a cart line, with the units required per COPY of that line. */
+export interface CartLineMemberRef {
+    productId: string;
+    quantity: number;
+}
+/**
+ * Resolve a line's members. Three sources, in priority order — never read
+ * `bundleProductIds` directly at a call site:
+ *
+ *  1. `groupMembers` — authoritative, and the only shape that can express
+ *     per-member quantities.
+ *  2. `bundleProductIds` — legacy bundle lines written before `groupMembers`
+ *     existed, resolved at quantity 1 each. This fallback is what makes carts
+ *     that were already in flight behave byte-identically, with no migration.
+ *  3. the line's own `productId` — an ordinary single-product line.
+ *
+ * Keeping this a derivation rather than storing a second array is deliberate: a
+ * hand-maintained mirror drifts the first time one write path forgets it
+ * (Recurrent Root Cause #42).
+ */
+export declare function getCartLineMembers(item: CartItemDocument): CartLineMemberRef[];
+/**
+ * True when the line stands for several products rather than one.
+ *
+ * Replaces the scattered `item.bundleProductIds?.length` tests, which each
+ * meant "is this a bundle" and would all have silently answered "no" for a
+ * `groupMembers`-backed line.
+ */
+export declare function isMultiMemberLine(item: CartItemDocument): boolean;
+/** Just the product ids — see `getCartLineMembers` for the resolution order. */
+export declare function getCartItemMemberIds(item: CartItemDocument): string[];
+/** The order-side shape this module needs. Structural on purpose — it matches
+ *  `OrderDocumentItem` without dragging the orders schema into shared checkout. */
+export interface OrderItemMemberSource {
+    productId: string;
+    bundleProductIds?: string[];
+}
+/**
+ * The order-side twin of `getCartLineMembers`, used by stock restore.
+ *
+ * A LEGACY order row is collapsed: one row standing for a whole bundle, with
+ * its members listed in `bundleProductIds` at one unit each. Rows written after
+ * grouped lines were expanded carry no `bundleProductIds` at all — each row is
+ * already exactly one product — so they fall through to the single-member
+ * branch and need no special case.
+ */
+export declare function getOrderItemMemberRefs(item: OrderItemMemberSource): CartLineMemberRef[];

package/dist/_internal/shared/checkout/line-members.js

@@ -0,0 +1,68 @@
+/**
+ * "What products does this cart line actually consume?" — the one answer.
+ *
+ * Lives in `shared/` rather than `server/features/checkout/` because three
+ * different layers need it and two of them are not server code:
+ *   - `order-math.ts`         (pricing + tax, shared)
+ *   - `rules/_registry.ts`    (preflight skip, shared)
+ *   - `bundle-expansion.ts`   (stock fan-out, server)
+ *   - `stock-restore.ts`      (restore fan-out, server)
+ *
+ * Pure functions, no Firestore, no framework imports.
+ */
+/**
+ * Resolve a line's members. Three sources, in priority order — never read
+ * `bundleProductIds` directly at a call site:
+ *
+ *  1. `groupMembers` — authoritative, and the only shape that can express
+ *     per-member quantities.
+ *  2. `bundleProductIds` — legacy bundle lines written before `groupMembers`
+ *     existed, resolved at quantity 1 each. This fallback is what makes carts
+ *     that were already in flight behave byte-identically, with no migration.
+ *  3. the line's own `productId` — an ordinary single-product line.
+ *
+ * Keeping this a derivation rather than storing a second array is deliberate: a
+ * hand-maintained mirror drifts the first time one write path forgets it
+ * (Recurrent Root Cause #42).
+ */
+export function getCartLineMembers(item) {
+    if (item.groupMembers?.length) {
+        return item.groupMembers.map((m) => ({
+            productId: m.productId,
+            quantity: m.quantity,
+        }));
+    }
+    if (item.bundleProductIds?.length) {
+        return item.bundleProductIds.map((productId) => ({ productId, quantity: 1 }));
+    }
+    return [{ productId: item.productId, quantity: 1 }];
+}
+/**
+ * True when the line stands for several products rather than one.
+ *
+ * Replaces the scattered `item.bundleProductIds?.length` tests, which each
+ * meant "is this a bundle" and would all have silently answered "no" for a
+ * `groupMembers`-backed line.
+ */
+export function isMultiMemberLine(item) {
+    return Boolean(item.groupMembers?.length || item.bundleProductIds?.length);
+}
+/** Just the product ids — see `getCartLineMembers` for the resolution order. */
+export function getCartItemMemberIds(item) {
+    return getCartLineMembers(item).map((m) => m.productId);
+}
+/**
+ * The order-side twin of `getCartLineMembers`, used by stock restore.
+ *
+ * A LEGACY order row is collapsed: one row standing for a whole bundle, with
+ * its members listed in `bundleProductIds` at one unit each. Rows written after
+ * grouped lines were expanded carry no `bundleProductIds` at all — each row is
+ * already exactly one product — so they fall through to the single-member
+ * branch and need no special case.
+ */
+export function getOrderItemMemberRefs(item) {
+    if (item.bundleProductIds?.length) {
+        return item.bundleProductIds.map((productId) => ({ productId, quantity: 1 }));
+    }
+    return [{ productId: item.productId, quantity: 1 }];
+}

package/dist/_internal/shared/checkout/rules/_registry.js

@@ -8,6 +8,7 @@
  *
  * No grep of the consumer codebase needed.
  */
+import { isMultiMemberLine } from "../line-members";
 import { standardRule } from "./standard.rule";
 import { auctionRule } from "./auction.rule";
 import { preOrderRule } from "./preorder.rule";
@@ -77,8 +78,13 @@ export function getSplitKey(item) {
 export function runSyncPreflight(pairs, paymentMethod) {
     const byType = new Map();
     for (const pair of pairs) {
-        if (pair.item.bundleProductIds?.length)
-            continue; // bundles skip — direct checkout
+        // Multi-member lines (bundle or grouped selection) skip the per-listing-type
+        // preflight: their `listingType` describes the wrapper, not the members, so
+        // a per-type rule would be applied to the wrong thing. Tested via the shared
+        // predicate rather than `bundleProductIds?.length`, which answers "is this a
+        // legacy bundle" and would say no for a `groupMembers`-backed line.
+        if (isMultiMemberLine(pair.item))
+            continue;
         const lt = (pair.item.listingType ?? "standard");
         const bucket = byType.get(lt) ?? [];
         bucket.push(pair);

package/dist/client.d.ts

@@ -262,6 +262,8 @@ export type { WishlistCapEventDetail } from "./features/wishlist/hooks/useWishli
 export { getGuestWishlistItems, addToGuestWishlist, removeFromGuestWishlist, isInGuestWishlist, clearGuestWishlist, getGuestWishlistCount, getGuestWishlistByType, } from "./features/wishlist/utils/guest-wishlist";
 export { InteractiveProductCard } from "./features/products/index";
 export type { InteractiveProductCardProps } from "./features/products/index";
+export { GroupMemberPicker } from "./features/products/components/GroupMemberPicker";
+export type { GroupMemberPickerProps, GroupPickerMember, } from "./features/products/components/GroupMemberPicker";
 export { MarketplaceBundleCard } from "./features/products/components/MarketplaceBundleCard";
 export type { MarketplaceBundleCardProps, MarketplaceBundleCardData, MarketplaceBundleCardLabels, } from "./features/products/components/MarketplaceBundleCard";
 export { CompareOverlay } from "./features/products/components/CompareOverlay";

package/dist/client.js

@@ -282,6 +282,7 @@ export { SyncManagerMount } from "./core/components/SyncManagerMount";
 export { useWishlistCount, useWishlistCountWithLimit, WISHLIST_CAP_EVENT } from "./features/wishlist/hooks/useWishlistCount";
 export { getGuestWishlistItems, addToGuestWishlist, removeFromGuestWishlist, isInGuestWishlist, clearGuestWishlist, getGuestWishlistCount, getGuestWishlistByType, } from "./features/wishlist/utils/guest-wishlist";
 export { InteractiveProductCard } from "./features/products/index";
+export { GroupMemberPicker } from "./features/products/components/GroupMemberPicker";
 export { MarketplaceBundleCard } from "./features/products/components/MarketplaceBundleCard";
 export { CompareOverlay } from "./features/products/components/CompareOverlay";
 export { COMPARE_MAX_ITEMS } from "./features/products/constants/action-defs";

package/dist/constants/api-endpoints.d.ts

@@ -239,6 +239,15 @@ export declare const CART_ENDPOINTS: {
     /** Per-store paid add-on selections — the source of truth for what's charged. */
     readonly ADDONS: "/api/cart/addons";
     readonly COUPON: "/api/cart/coupon";
+    /**
+     * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
+     * POST on purpose: that is the hot path behind every product card's
+     * Add-to-cart, and widening its `{productId, quantity}` schema into a
+     * discriminated union would put this feature's blast radius on it.
+     */
+    readonly GROUP: "/api/cart/group";
+    /** Replace a grouped line's member quantities (whole array, not a delta). */
+    readonly GROUP_MEMBERS: (itemId: string) => string;
 };
 export declare const CATEGORY_ENDPOINTS: {
     readonly LIST: "/api/categories";
@@ -695,6 +704,15 @@ export declare const API_ENDPOINTS: {
         /** Per-store paid add-on selections — the source of truth for what's charged. */
         readonly ADDONS: "/api/cart/addons";
         readonly COUPON: "/api/cart/coupon";
+        /**
+         * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
+         * POST on purpose: that is the hot path behind every product card's
+         * Add-to-cart, and widening its `{productId, quantity}` schema into a
+         * discriminated union would put this feature's blast radius on it.
+         */
+        readonly GROUP: "/api/cart/group";
+        /** Replace a grouped line's member quantities (whole array, not a delta). */
+        readonly GROUP_MEMBERS: (itemId: string) => string;
     };
     readonly CATEGORIES: {
         readonly LIST: "/api/categories";
@@ -1153,6 +1171,15 @@ export declare const API_ROUTES: {
         /** Per-store paid add-on selections — the source of truth for what's charged. */
         readonly ADDONS: "/api/cart/addons";
         readonly COUPON: "/api/cart/coupon";
+        /**
+         * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
+         * POST on purpose: that is the hot path behind every product card's
+         * Add-to-cart, and widening its `{productId, quantity}` schema into a
+         * discriminated union would put this feature's blast radius on it.
+         */
+        readonly GROUP: "/api/cart/group";
+        /** Replace a grouped line's member quantities (whole array, not a delta). */
+        readonly GROUP_MEMBERS: (itemId: string) => string;
     };
     readonly CATEGORIES: {
         readonly LIST: "/api/categories";

package/dist/constants/api-endpoints.js

@@ -279,6 +279,15 @@ export const CART_ENDPOINTS = {
     /** Per-store paid add-on selections — the source of truth for what's charged. */
     ADDONS: "/api/cart/addons",
     COUPON: "/api/cart/coupon",
+    /**
+     * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
+     * POST on purpose: that is the hot path behind every product card's
+     * Add-to-cart, and widening its `{productId, quantity}` schema into a
+     * discriminated union would put this feature's blast radius on it.
+     */
+    GROUP: "/api/cart/group",
+    /** Replace a grouped line's member quantities (whole array, not a delta). */
+    GROUP_MEMBERS: (itemId) => `/api/cart/${encodeURIComponent(itemId)}/members`,
 };
 // ---------------------------------------------------------------------------
 // Categories

package/dist/features/admin/schemas/firestore.d.ts

@@ -54,32 +54,16 @@ export declare const NOTIFICATION_FIELDS: {
     readonly RELATED_TYPE: "relatedType";
     readonly CREATED_AT: "createdAt";
     readonly UPDATED_AT: "updatedAt";
-    readonly TYPE_VALUES: {
-        readonly ORDER_PLACED: NotificationType;
-        readonly ORDER_CONFIRMED: NotificationType;
-        readonly ORDER_SHIPPED: NotificationType;
-        readonly ORDER_DELIVERED: NotificationType;
-        readonly ORDER_CANCELLED: NotificationType;
-        readonly BID_PLACED: NotificationType;
-        readonly BID_OUTBID: NotificationType;
-        readonly BID_WON: NotificationType;
-        readonly BID_LOST: NotificationType;
-        readonly AUCTION_ENDED: NotificationType;
-        readonly REVIEW_APPROVED: NotificationType;
-        readonly REVIEW_REPLIED: NotificationType;
-        readonly PRODUCT_AVAILABLE: NotificationType;
-        readonly PROMOTION: NotificationType;
-        readonly SYSTEM: NotificationType;
-        readonly WELCOME: NotificationType;
-        readonly OFFER_RECEIVED: NotificationType;
-        readonly OFFER_RESPONDED: NotificationType;
-        readonly OFFER_EXPIRED: NotificationType;
-        readonly OFFER_COUNTER_ACCEPTED: NotificationType;
-        readonly REFUND_INITIATED: NotificationType;
-        readonly ACCOUNT_ACTION: NotificationType;
-        readonly PRIZE_WON: NotificationType;
-        readonly PRIZE_REVEAL_EXPIRED: NotificationType;
-    };
+    /**
+     * SCREAMING_SNAKE accessors, DERIVED from `NOTIFICATION_TYPE_VALUES`.
+     *
+     * This was a fifth hand-written copy of the union — 24 of the 28 values,
+     * missing `emi_installment_due_soon`, `emi_installment_overdue`,
+     * `payment_review` and `catalogue_images_stale` — and every entry carried an
+     * `as NotificationType` cast, which is precisely the assertion that lets a
+     * wrong string through. Built from the array now, so it cannot be short.
+     */
+    readonly TYPE_VALUES: { [K in NotificationType as Uppercase<K>]: K; };
     readonly PRIORITY_VALUES: {
         readonly LOW: NotificationPriority;
         readonly NORMAL: NotificationPriority;

package/dist/features/admin/schemas/firestore.js

@@ -110,32 +110,16 @@ export const NOTIFICATION_FIELDS = {
     RELATED_TYPE: "relatedType",
     CREATED_AT: "createdAt",
     UPDATED_AT: "updatedAt",
-    TYPE_VALUES: {
-        ORDER_PLACED: "order_placed",
-        ORDER_CONFIRMED: "order_confirmed",
-        ORDER_SHIPPED: "order_shipped",
-        ORDER_DELIVERED: "order_delivered",
-        ORDER_CANCELLED: "order_cancelled",
-        BID_PLACED: "bid_placed",
-        BID_OUTBID: "bid_outbid",
-        BID_WON: "bid_won",
-        BID_LOST: "bid_lost",
-        AUCTION_ENDED: "auction_ended",
-        REVIEW_APPROVED: "review_approved",
-        REVIEW_REPLIED: "review_replied",
-        PRODUCT_AVAILABLE: "product_available",
-        PROMOTION: "promotion",
-        SYSTEM: "system",
-        WELCOME: "welcome",
-        OFFER_RECEIVED: "offer_received",
-        OFFER_RESPONDED: "offer_responded",
-        OFFER_EXPIRED: "offer_expired",
-        OFFER_COUNTER_ACCEPTED: "offer_counter_accepted",
-        REFUND_INITIATED: "refund_initiated",
-        ACCOUNT_ACTION: "account_action",
-        PRIZE_WON: "prize_won",
-        PRIZE_REVEAL_EXPIRED: "prize_reveal_expired",
-    },
+    /**
+     * SCREAMING_SNAKE accessors, DERIVED from `NOTIFICATION_TYPE_VALUES`.
+     *
+     * This was a fifth hand-written copy of the union — 24 of the 28 values,
+     * missing `emi_installment_due_soon`, `emi_installment_overdue`,
+     * `payment_review` and `catalogue_images_stale` — and every entry carried an
+     * `as NotificationType` cast, which is precisely the assertion that lets a
+     * wrong string through. Built from the array now, so it cannot be short.
+     */
+    TYPE_VALUES: Object.fromEntries(NOTIFICATION_TYPE_VALUES.map((v) => [v.toUpperCase(), v])),
     PRIORITY_VALUES: {
         LOW: "low",
         NORMAL: "normal",

package/dist/features/cart/actions/cart-actions.d.ts

@@ -4,7 +4,7 @@
  * Pure business functions — auth, rate-limiting, and Next.js specifics
  * are handled by the calling server action in the consumer.
  */
-import type { AddToCartInput, CartDocument, UpdateCartItemInput } from "../schemas";
+import type { AddToCartInput, CartDocument, CartGroupSource, UpdateCartItemInput, UpdateCartGroupMembersInput } from "../schemas";
 /**
  * Lane gate. While a higher-obligation lane (a won auction, then an accepted
  * offer) is outstanding, no NEW shopping may be added — otherwise the buyer can
@@ -24,6 +24,30 @@ export declare function assertCanAddNewItems(userId: string): Promise<CartDocume
 export declare function addItemToCart(userId: string, input: AddToCartInput): Promise<CartDocument>;
 /** Error code the client maps to a lane-aware message. */
 export declare const CART_LANE_BLOCKED = "CART_LANE_BLOCKED";
+/** Max members one grouped line may hold. Keeps the batch read bounded (Rule #6). */
+export declare const GROUP_LINE_MAX_MEMBERS = 20;
+export interface AddGroupLineToCartInput {
+    /** `product.groupId` for a product group, or the `groupedListings` doc id. */
+    groupId: string;
+    groupSource: CartGroupSource;
+    /** Ids and quantities ONLY — every other field is re-resolved server-side. */
+    members: Array<{
+        productId: string;
+        quantity: number;
+    }>;
+}
+/**
+ * Add a buyer-assembled selection of group members as ONE cart line.
+ *
+ * The client sends ids and quantities and nothing else. Accepting a price, a
+ * title or an image from the browser would be a ₹1-group exploit; every
+ * snapshot below is read from Firestore here.
+ *
+ * A rejected member fails the WHOLE request, naming the offender. Silently
+ * dropping it would hand the buyer a line that quietly isn't what they picked —
+ * the "wrong data, no error" failure nobody can report.
+ */
+export declare function addGroupLineToCart(userId: string, input: AddGroupLineToCartInput): Promise<CartDocument>;
 /**
  * Won-auction lines are non-removable and fixed-quantity — the buyer committed
  * to the purchase by bidding, and letting them delete it would turn every
@@ -34,6 +58,12 @@ export declare const CART_LANE_BLOCKED = "CART_LANE_BLOCKED";
  * and the offer simply lapses at its `checkoutDeadline`.
  */
 export declare function updateCartItem(userId: string, itemId: string, input: UpdateCartItemInput): Promise<CartDocument>;
+/**
+ * Replace a grouped line's member quantities. A member set to 0 is dropped;
+ * dropping the last one removes the line (enforced in the repository so a
+ * forgetful caller can't leave an empty ghost line behind).
+ */
+export declare function updateCartGroupMembers(userId: string, itemId: string, input: UpdateCartGroupMembersInput): Promise<CartDocument>;
 export declare function removeCartItem(userId: string, itemId: string): Promise<CartDocument>;
 export declare function clearCart(userId: string): Promise<CartDocument>;
 export declare function mergeGuestCart(userId: string, items: Array<{