@mohasinac/appkit 4.27.0 → 4.29.0

package/dist/features/auctions/actions/bid-actions.js

@@ -12,6 +12,7 @@ import { bidRepository } from "../repository/bid.repository";
 import { productRepository } from "../../products/repository/products.repository";
 import { isAuctionListing } from "../../products/utils/listing-type";
 import { userRepository } from "../../auth/repository/user.repository";
+import { isSoftBanned } from "../../auth/server/checkSoftBan";
 import { unitOfWork } from "../../../core/unit-of-work";
 import { storeRepository } from "../../stores/repository/store.repository";
 import { siteSettingsRepository } from "../../../repositories";
@@ -28,6 +29,29 @@ import { cartRepository } from "../../cart/repository/cart.repository";
 import { AUCTION_BUYOUT_WINDOW_MINUTES, AUCTION_BUYOUT_WINDOW_MS, AUCTION_CHECKOUT_URL, } from "../../../_internal/shared/checkout/lanes";
 import { resolveDate } from "../../../utils";
 // --- Domain Functions ----------------------------------------------------------
+/**
+ * Load the bidder's profile and refuse if they carry an active `place_bids`
+ * soft ban. Returns the profile so the caller pays for exactly one read.
+ *
+ * 🛑 This belongs in the DOMAIN function, not in a route.
+ *
+ * Admins can issue a `place_bids` soft ban and `BID_ERROR_CODES.USER_BANNED`
+ * has always existed with a display-map entry and client copy — but nothing
+ * ever threw it. The only `isSoftBanned(user, "place_bids")` call in the
+ * codebase sat in `POST /api/auctions/[id]/buy-now`, a route with zero callers,
+ * while the live path (the `placeBidAction` / `buyNowAction` server actions)
+ * checked nothing. A banned user could bid and buy out freely. Enforcing it
+ * here means every caller — action, route, or job — is covered by
+ * construction.
+ */
+async function assertCanBid(userId) {
+    const profile = await userRepository.findById(userId);
+    if (profile && isSoftBanned(profile, "place_bids")) {
+        const ban = profile.softBans?.find((b) => b.action === "place_bids");
+        throw new AuthorizationError(`Your account is restricted from bidding. Reason: ${ban?.reason ?? "Policy violation"}.`, { code: BID_ERROR_CODES.USER_BANNED });
+    }
+    return profile ?? null;
+}
 export async function placeBid(userId, userEmail, input) {
     const { productId, bidAmount, autoMaxBid } = input;
     const product = await productRepository.findById(productId);
@@ -50,6 +74,9 @@ export async function placeBid(userId, userEmail, input) {
             throw new AuthorizationError(ERROR_MESSAGES.BID.OWN_AUCTION);
         }
     }
+    // Before any write. The profile is reused below for the bid's denormalised
+    // userName/userEmail, so the ban check costs no extra read.
+    const profile = await assertCanBid(userId);
     // An auction with no bids yet prices off its starting bid, and that starting
     // bid is itself acceptable — see ResolveMinBidOptions.hasBids.
     const hasBids = (product.currentBid ?? 0) > 0 || (product.bidCount ?? 0) > 0;
@@ -122,7 +149,6 @@ export async function placeBid(userId, userEmail, input) {
         visibleBid = newCap;
         bumpedPreviousVisible = Math.min(prevCap, target);
     }
-    const profile = await userRepository.findById(userId);
     const bid = await bidRepository.create({
         productId,
         productTitle: product.title,
@@ -229,12 +255,24 @@ export async function placeBid(userId, userEmail, input) {
     return { bid };
 }
 export async function buyNowAuction(userId, userName, userEmail, input) {
-    const { productId } = input;
-    const product = await productRepository.findById(productId);
+    const { productId: productRef } = input;
+    // Auction URLs are slug-based, and this action is reachable from a route
+    // param, so accept either. Deliberately id-FIRST rather than
+    // `findByIdOrSlug`, which queries by slug first and would therefore cost two
+    // reads on the common id path (Rule #6) — here the fallback query only runs
+    // when the id lookup actually misses.
+    //
+    // This was masked because every seeded auction has `slug === id`. Any auction
+    // whose slug differs threw NotFoundError, which the caller then swallowed.
+    const product = (await productRepository.findById(productRef)) ??
+        (await productRepository.findBySlug(productRef));
     if (!product)
         throw new NotFoundError(ERROR_MESSAGES.BID.AUCTION_NOT_FOUND);
     if (!isAuctionListing(product))
         throw new ValidationError(ERROR_MESSAGES.BID.NOT_AN_AUCTION);
+    // 🛑 Every downstream write (the bid, the locked cart line, the notification)
+    // must key on the canonical document id, never on the ref the caller passed.
+    const productId = String(product.id);
     if (product.isSold) {
         throw new ValidationError(ERROR_MESSAGES.BID.AUCTION_ENDED, { code: BID_ERROR_CODES.AUCTION_ENDED });
     }
@@ -250,6 +288,10 @@ export async function buyNowAuction(userId, userName, userEmail, input) {
             throw new AuthorizationError(ERROR_MESSAGES.BID.OWN_AUCTION);
         }
     }
+    // Same guard as `placeBid` — a buyout IS a bid (it writes a real
+    // `BidDocument` with `isBuyout: true`), so a `place_bids` ban must block it.
+    // The profile is reused for the bid's denormalised name/email below.
+    const profile = await assertCanBid(userId);
     const buyNowPrice = typeof product.buyNowPrice === "number" ? product.buyNowPrice : null;
     if (buyNowPrice === null || buyNowPrice <= 0) {
         throw new ValidationError(ERROR_MESSAGES.BID.BUY_NOW_NO_PRICE, { code: BID_ERROR_CODES.BUY_NOW_NO_PRICE });
@@ -286,7 +328,6 @@ export async function buyNowAuction(userId, userName, userEmail, input) {
     // The product's own currency, not the site default — the cart line, the bid
     // and the listing all have to agree, and settlement uses the bid's currency.
     const currency = product.currency || getDefaultCurrency();
-    const profile = await userRepository.findById(userId);
     // A real bid at the buy-now price — this is what "the bid placed is the
     // buyout price by the buyer" means. It starts `active`/`isWinning: false`
     // like any other bid (bidRepository.create forces both) and is promoted to

package/dist/features/auctions/components/AuctionBottomActions.d.ts

@@ -1,8 +1,23 @@
-export interface AuctionBottomActionsProps {
-    currentBid: number;
-    currency: string;
+import { type PlaceBidFormClientProps } from "./PlaceBidFormClient";
+export interface AuctionBottomActionsProps extends PlaceBidFormClientProps {
     bidCount: number;
-    isEnded: boolean;
-    auctionEndDate: Date | null;
 }
-export declare function AuctionBottomActions({ currentBid, currency, bidCount, isEnded, auctionEndDate, }: AuctionBottomActionsProps): null;
+/**
+ * Mobile/after-scroll CTA bar for an auction.
+ *
+ * 🛑 It owns its own modal rather than pointing at one.
+ *
+ * Two defects lived here. (a) The single Place Bid action ran
+ * `getElementById("auction-bid-form")?.scrollIntoView(...)` — but that id is
+ * set inside `renderBidForm`, which `AuctionDetailView` wraps in
+ * `hidden lg:block`. On mobile the target is `display:none`, so the bar's only
+ * action did nothing on the only viewport the bar exists for. A DOM id is not
+ * a contract; the element it names can be hidden, moved or removed without any
+ * signal here. (b) There was no Buy Now action at all, even though
+ * `MOBILE_PRIMARY_ACTIONS.auction` has declared `[PLACE_BID, BUY_NOW_AUCTION]`
+ * for a long time — a declared CTA nothing rendered (Root Cause #8's shape).
+ *
+ * Both actions now open the real form, which is the only place the Buy Now
+ * button can report an error or route to `/checkout?lane=auction`.
+ */
+export declare function AuctionBottomActions(props: AuctionBottomActionsProps): import("react").JSX.Element;

package/dist/features/auctions/components/AuctionBottomActions.js

@@ -1,8 +1,13 @@
 "use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useState } from "react";
 import { useBottomActions } from "../../layout/hooks/useBottomActions";
 import { formatCurrency } from "../../../utils/number.formatter";
 import { ACTION_ID, ACTION_META } from "../../products/constants/action-defs";
 import { useCountdown } from "../../../react";
+import { Modal } from "../../../ui";
+import { isBuyNowAvailable } from "../../../_internal/shared/features/auctions/config";
+import { PlaceBidFormClient, } from "./PlaceBidFormClient";
 function formatCountdownLabel(remaining) {
     if (!remaining)
         return undefined;
@@ -13,25 +18,51 @@ function formatCountdownLabel(remaining) {
         return `Ends in ${hours}h ${minutes}m ${seconds}s`;
     return `Ends in ${minutes}m ${seconds}s`;
 }
-export function AuctionBottomActions({ currentBid, currency, bidCount, isEnded, auctionEndDate, }) {
-    const placeBidMeta = ACTION_META[ACTION_ID.PLACE_BID];
+/**
+ * Mobile/after-scroll CTA bar for an auction.
+ *
+ * 🛑 It owns its own modal rather than pointing at one.
+ *
+ * Two defects lived here. (a) The single Place Bid action ran
+ * `getElementById("auction-bid-form")?.scrollIntoView(...)` — but that id is
+ * set inside `renderBidForm`, which `AuctionDetailView` wraps in
+ * `hidden lg:block`. On mobile the target is `display:none`, so the bar's only
+ * action did nothing on the only viewport the bar exists for. A DOM id is not
+ * a contract; the element it names can be hidden, moved or removed without any
+ * signal here. (b) There was no Buy Now action at all, even though
+ * `MOBILE_PRIMARY_ACTIONS.auction` has declared `[PLACE_BID, BUY_NOW_AUCTION]`
+ * for a long time — a declared CTA nothing rendered (Root Cause #8's shape).
+ *
+ * Both actions now open the real form, which is the only place the Buy Now
+ * button can report an error or route to `/checkout?lane=auction`.
+ */
+export function AuctionBottomActions(props) {
+    const { currentBid, currency, bidCount, isEnded, auctionEndDate, buyNowPrice } = props;
+    const [open, setOpen] = useState(false);
     const remaining = useCountdown(auctionEndDate ?? undefined);
+    const placeBidMeta = ACTION_META[ACTION_ID.PLACE_BID];
+    const buyNowMeta = ACTION_META[ACTION_ID.BUY_NOW_AUCTION];
+    // Same single predicate the form and the card use. `!!props.onBuyNow` matters
+    // because the preview/demo mount passes no action.
+    const buyNowAvailable = isBuyNowAvailable({ buyNowPrice, currentBid, isEnded }) && !!props.onBuyNow;
     useBottomActions(isEnded
         ? {}
         : {
             actions: [
-                {
-                    ...placeBidMeta,
-                    onClick: () => {
-                        document
-                            .getElementById("auction-bid-form")
-                            ?.scrollIntoView({ behavior: "smooth" });
-                    },
-                },
+                { ...placeBidMeta, onClick: () => setOpen(true) },
+                ...(buyNowAvailable && buyNowPrice !== null
+                    ? [
+                        {
+                            ...buyNowMeta,
+                            label: `Buy Now — ${formatCurrency(buyNowPrice, currency)}`,
+                            onClick: () => setOpen(true),
+                        },
+                    ]
+                    : []),
             ],
             secondaryLabel: formatCountdownLabel(remaining),
             infoLabel: `${formatCurrency(currentBid, currency)} · ${bidCount} bid${bidCount !== 1 ? "s" : ""}`,
             desktop: "after-scroll",
         });
-    return null;
+    return (_jsx(Modal, { isOpen: open, onClose: () => setOpen(false), size: "md", title: "Place your bid", children: _jsx(PlaceBidFormClient, { ...props }) }));
 }

package/dist/features/auctions/components/AuctionDetailPageView.d.ts

@@ -1,5 +1,5 @@
 import type { ProductFeatureDocument } from "../../products/schemas/product-features";
-import type { PlaceBidInput } from "./PlaceBidFormClient";
+import type { PlaceBidInput, BidActionEnvelope, BuyNowSuccess } from "./PlaceBidFormClient";
 export interface AuctionDetailPageViewProps {
     id: string;
     /**
@@ -9,8 +9,13 @@ export interface AuctionDetailPageViewProps {
      * When absent, falls back to fetching by slug/id (backward compat).
      */
     initialAuction?: import("../../products/schemas/firestore").ProductDocument | null;
-    onPlaceBid?: (input: PlaceBidInput) => Promise<unknown>;
-    onBuyNow?: () => Promise<unknown>;
+    /**
+     * Typed against the single `ActionResult` envelope — see the note on
+     * `BidActionEnvelope`. `Promise<unknown>` here is what let a doubly-wrapped
+     * result flow through to a client that read the wrong `ok`.
+     */
+    onPlaceBid?: (input: PlaceBidInput) => Promise<BidActionEnvelope<unknown>>;
+    onBuyNow?: () => Promise<BidActionEnvelope<BuyNowSuccess>>;
     /** SSR-loaded productFeatures (platform + store-scope). See ProductDetailPageView for semantics. */
     productFeatures?: ProductFeatureDocument[];
 }

package/dist/features/auctions/components/AuctionDetailPageView.js

@@ -46,7 +46,7 @@ function toDescriptionHtml(raw) {
 }
 function renderAuctionInfoPanel(props) {
     const { productId, title, currentBid, currency, bidCount, isEnded, endDate, buyNowPrice, buyNowAvailable, featured, freeShipping, condition, category, categoryName, brand, brandSlug, productFeatures, features, descriptionHtml, safeSeller, storeHref } = props;
-    return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_LIVE_BADGE, children: "\uD83C\uDFF7\uFE0F Live Auction" }), isEnded ? (_jsx(Span, { color: "error", surface: "danger-surface", size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", children: "Ended" })) : (_jsx(Span, { color: "success", surface: "success-surface", size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", children: "Active" }))] }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-0.5", color: "muted", size: "xs", children: "Current bid" }), _jsx(LiveBidPrice, { productId: productId, currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "2xl", badgeSize: "sm" }), endDate && !isEnded && (_jsxs(Text, { className: "mt-1.5", color: "muted", size: "sm", children: ["Ends in ", _jsx(Span, { weight: "medium", color: "muted", children: _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" }) })] })), endDate && _jsxs(Text, { className: "mt-0.5", color: "faint", size: "xs", children: [isEnded ? "Ended" : "Ends", " ", endDate.toLocaleString()] })] }), buyNowAvailable && buyNowPrice !== null && (_jsxs(Row, { align: "center", gap: "sm", className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)] bg-primary-50 dark:bg-primary-900/20", padding: "inlineSm", rounded: "lg", children: [_jsx(Span, { size: "xs", color: "muted", children: "Buy Now:" }), _jsx(Span, { size: "base", weight: "bold", className: "text-primary-700 dark:text-primary-300", children: formatCurrency(buyNowPrice, currency) })] })), _jsx(ProductFeatureBadges, { featured: featured, freeShipping: freeShipping, condition: condition ?? undefined, labels: { featured: "Featured", fasterDelivery: "Faster Delivery", ratedSeller: "Rated Seller", condition: "Condition", conditionNew: "New", conditionUsed: "Used", conditionBroken: "For Parts", conditionRefurbished: "Refurbished", returnable: "Returnable", freeShipping: "Free Shipping", codAvailable: "Cash on Delivery", emiAvailable: "EMI Available", wishlistCount: (n) => `${n} wishlisted`, categoryProductCount: (n, cat) => `${n} in ${cat}` } }), (categoryName || category || brand) && (_jsxs(Row, { gap: "sm", wrap: true, children: [category && _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-50 hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:bg-primary-900/20 dark:hover:text-primary-400", children: categoryName || category }), !category && categoryName && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: categoryName }), brand && brandSlug && _jsx(Link, { href: String(ROUTES.PUBLIC.BRAND_DETAIL(brandSlug)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-50 hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:bg-primary-900/20 dark:hover:text-primary-400", children: brand }), brand && !brandSlug && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: brand })] })), productFeatures && features.length > 0 && _jsx(FeatureBadgeList, { productFeatureIds: features, features: productFeatures }), !productFeatures && features.length > 0 && (_jsxs(Div, { border: "subtle", surface: "muted", padding: "inline", rounded: "xl", children: [_jsx(Text, { className: "mb-2 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "About this item" }), _jsx(Ul, { spacing: "comfortable", size: "sm", color: "primary", children: features.map((f, i) => _jsxs(Li, { layout: "flex-start", gap: "2", children: [_jsx(Span, { className: "mt-0.5 flex-shrink-0 text-primary-500", children: "\u2022" }), f] }, i)) })] })), descriptionHtml && _jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" }), safeSeller && (_jsx(Div, { className: `${__P.p3}`, border: "subtle", rounded: "xl", surface: "muted", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Listed by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && _jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" })] }) }))] }));
+    return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_LIVE_BADGE, children: "\uD83C\uDFF7\uFE0F Live Auction" }), isEnded ? (_jsx(Span, { color: "error", surface: "danger-surface", size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", children: "Ended" })) : (_jsx(Span, { color: "success", surface: "success-surface", size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", children: "Active" }))] }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-0.5", color: "muted", size: "xs", children: "Current bid" }), _jsx(LiveBidPrice, { productId: productId, currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "2xl", badgeSize: "sm" }), endDate && !isEnded && (_jsxs(Text, { className: "mt-1.5", color: "muted", size: "sm", children: ["Ends in ", _jsx(Span, { weight: "medium", color: "muted", children: _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" }) })] })), endDate && _jsxs(Text, { className: "mt-0.5", color: "faint", size: "xs", children: [isEnded ? "Ended" : "Ends", " ", endDate.toLocaleString()] })] }), buyNowAvailable && buyNowPrice !== null && (_jsxs(Row, { align: "center", gap: "sm", className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)] bg-primary-50 dark:bg-primary-900/20", padding: "inlineSm", rounded: "lg", children: [_jsx(Span, { size: "xs", color: "muted", children: "Buy Now:" }), _jsx(Span, { size: "base", weight: "bold", className: "text-primary-700 dark:text-primary-300", children: formatCurrency(buyNowPrice, currency) }), _jsx(Span, { size: "xs", color: "faint", children: "\u2014 in \u201CPlace a bid\u201D" })] })), _jsx(ProductFeatureBadges, { featured: featured, freeShipping: freeShipping, condition: condition ?? undefined, labels: { featured: "Featured", fasterDelivery: "Faster Delivery", ratedSeller: "Rated Seller", condition: "Condition", conditionNew: "New", conditionUsed: "Used", conditionBroken: "For Parts", conditionRefurbished: "Refurbished", returnable: "Returnable", freeShipping: "Free Shipping", codAvailable: "Cash on Delivery", emiAvailable: "EMI Available", wishlistCount: (n) => `${n} wishlisted`, categoryProductCount: (n, cat) => `${n} in ${cat}` } }), (categoryName || category || brand) && (_jsxs(Row, { gap: "sm", wrap: true, children: [category && _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: categoryName || category }), !category && categoryName && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: categoryName }), brand && brandSlug && _jsx(Link, { href: String(ROUTES.PUBLIC.BRAND_DETAIL(brandSlug)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: brand }), brand && !brandSlug && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: brand })] })), productFeatures && features.length > 0 && _jsx(FeatureBadgeList, { productFeatureIds: features, features: productFeatures }), !productFeatures && features.length > 0 && (_jsxs(Div, { border: "subtle", surface: "muted", padding: "inline", rounded: "xl", children: [_jsx(Text, { className: "mb-2 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "About this item" }), _jsx(Ul, { spacing: "comfortable", size: "sm", color: "primary", children: features.map((f, i) => _jsxs(Li, { layout: "flex-start", gap: "2", children: [_jsx(Span, { className: "mt-0.5 flex-shrink-0 text-primary-500", children: "\u2022" }), f] }, i)) })] })), descriptionHtml && _jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" }), safeSeller && (_jsx(Div, { className: `${__P.p3}`, border: "subtle", rounded: "xl", surface: "muted", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Listed by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && _jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" })] }) }))] }));
 }
 /**
  * Store reviews for the auction's seller.
@@ -204,5 +204,5 @@ export async function AuctionDetailPageView({ id, initialAuction, onPlaceBid, on
                                 slug: typeof r.slug === "string" ? r.slug : undefined,
                             }));
                             return (_jsxs(Stack, { gap: "xl", children: [related.length > 0 && (_jsx(RelatedProducts, { labels: { title: "Similar Auctions" }, renderGrid: () => (_jsx(MarketplaceAuctionGrid, { auctions: related, gridClassName: "grid grid-cols-2 gap-[var(--appkit-space-4)] sm:grid-cols-3 lg:grid-cols-4" })) })), _jsx(GroupedListingsCarousel, { groups: groups }), _jsx(RelatedItemsSection, { relatedItems: relatedItems, relatedByBrand: relatedByBrand, relatedByTags: relatedByTags, relatedByStore: relatedByStore, categoryLabel: categoryName || category || undefined, brandLabel: brand || undefined, storeLabel: storeName || undefined })] }));
-                        } }), renderAuctionStoreReviews(storeId), _jsx(AuctionBottomActions, { currentBid: currentBid, currency: currency, bidCount: bidCount, isEnded: isEnded, auctionEndDate: endDate })] })] }));
+                        } }), renderAuctionStoreReviews(storeId), onPlaceBid && (_jsx(AuctionBottomActions, { productId: String(product.id), currentBid: currentBid, startingBid: startingBid, tiers: bidIncrementTiers, minBidIncrementOverride: minBidIncrementOverride, currency: currency, isEnded: isEnded, auctionEndDate: endDate, buyNowPrice: buyNowPrice, bidCount: bidCount, tags: tags, onPlaceBid: onPlaceBid, onBuyNow: onBuyNow }))] })] }));
 }

package/dist/features/auctions/components/MarketplaceAuctionCard.js

@@ -3,7 +3,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { normalizeError } from "../../../errors/normalize";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useRouter } from "next/navigation";
-import { Clock, Gavel, Heart, Play, ShoppingBag, Star } from "lucide-react";
+import { Clock, Gavel, Play, ShoppingBag, Star } from "lucide-react";
+import { WishlistHeartButton } from "../../wishlist/components/WishlistHeartButton";
 import { useLongPress } from "../../../react/hooks/useLongPress";
 import { MediaImage } from "../../media";
 import { useWishlistToggle } from "../../wishlist";
@@ -17,19 +18,17 @@ const CLS_STAR_ICON = "h-5 w-5 fill-warning text-warning";
 const CLS_LIVE_BADGE = "rounded-full bg-error-solid px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] text-error-on-solid";
 const CLS_ENDING_BADGE = "rounded-full bg-warning-solid px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] text-warning-on-solid";
 const CLS_RESERVE_BADGE = "inline-flex items-center gap-[var(--appkit-space-1)] rounded-full bg-warning-solid px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] text-warning-on-solid";
-const CLS_HEART_ON = "fill-error text-error";
-const CLS_HEART_OFF = "text-zinc-400";
 function renderAuctionCardHero(props) {
     const { product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect } = props;
     return (_jsxs(BaseListingCard.Hero, { aspect: "square", variant: "grid", onMouseEnter: () => setHovered(true), onMouseLeave: () => setHovered(false), children: [_jsx(TextLink, { href: auctionHref ?? "#", className: "absolute inset-0 block", children: _jsx(MediaImage, { src: currentSrc, alt: product.title, size: "card", fallback: "Auction image", className: `transition-transform duration-500 ${hovered && images.length > 1 ? "scale-105" : "scale-100"}` }) }), hasVideo && imageIndex === 0 ? (_jsx(Div, { className: "absolute right-2 top-2", children: _jsx(Span, { surface: "overlay-sm", layout: "flex-center", color: "inverse", className: "h-8 w-8", rounded: "full", children: _jsx(Play, { className: "h-4 w-4", "aria-label": mergedLabels.videoLabel }) }) })) : null, images.length > 1 ? (_jsx(Row, { gap: "xs", className: "pointer-events-none absolute bottom-2 left-1/2 -translate-x-1/2", children: images.map((_, index) => (_jsx(Span, { className: `transition-all duration-200 ${index === imageIndex ? "h-1.5 w-3 bg-[white]" : "h-1.5 w-1.5 bg-[white]/60"}`, rounded: "full" }, `${product.id}-image-${index}`))) })) : null, product.featured ? (_jsx(Div, { className: "pointer-events-none absolute left-2 top-2 z-10", children: _jsx(Star, { className: CLS_STAR_ICON }) })) : null, onSelect && (_jsx(BaseListingCard.Checkbox, { selected: isSelected, onSelect: handleSelect, label: isSelected ? mergedLabels.deselectItem : mergedLabels.selectItem, className: selectable || isSelected ? "opacity-100" : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto transition-opacity" })), _jsxs(Stack, { className: `absolute left-2 z-10 ${product.featured ? "top-8" : "top-2"}`, gap: "xs", children: [!isEnded ? _jsx(Span, { size: "xs", weight: "bold", className: CLS_LIVE_BADGE, children: mergedLabels.liveBadge }) : null, isEndingSoon ? _jsx(Span, { size: "xs", weight: "bold", className: CLS_ENDING_BADGE, children: mergedLabels.endingSoon }) : null, isEnded ? _jsx(Span, { color: "inverse", size: "xs", weight: "bold", surface: "overlay-lg", rounded: "full", padding: "pill-xs", children: mergedLabels.ended }) : null, product.status === "sold" ? _jsx(Span, { color: "inverse", size: "xs", weight: "bold", surface: "overlay-xl", rounded: "full", padding: "pill-xs", children: mergedLabels.sold }) : null] }), _jsx(Div, { className: "pointer-events-none absolute bottom-2 right-2 z-10", children: _jsxs(Span, { size: "xs", weight: "semibold", className: CLS_RESERVE_BADGE, children: [_jsx(Gavel, { className: "h-3 w-3" }), mergedLabels.typeBadge] }) })] }));
 }
 function renderAuctionCardInfoList(props) {
     const { product, auctionHref, displayBid, bidCount, isEnded, remaining, inWishlist, wishlistLoading, wishlistActions, countdownClass, mergedLabels, handleWishlist, handleNavigate } = props;
-    return (_jsxs(_Fragment, { children: [_jsxs(Row, { className: "min-w-0", align: "start", justify: "between", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: `flex-1 leading-snug transition-colors hover:text-primary`, color: "primary", truncate: 2, size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(Button, { rounded: "full", type: "button", variant: "ghost", onClick: handleWishlist, disabled: wishlistLoading, "aria-label": inWishlist ? mergedLabels.removeFromWishlist : mergedLabels.addToWishlist, className: "shrink-0 p-[0.25rem]", children: _jsx(Heart, { className: `h-3.5 w-3.5 ${inWishlist ? CLS_HEART_ON : CLS_HEART_OFF}` }) })) : null] }), _jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Text, { className: "text-primary", size: "sm", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), _jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", className: `items-[center] py-[0.125rem] text-[11px] ${countdownClass}`, padding: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-2.5 w-2.5" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), bidCount > 0 && _jsx(Caption, { className: "text-[11px]", children: mergedLabels.totalBids(bidCount) })] }), !isEnded && (_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", className: "self-start px-[0.625rem] mt-0.5", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }))] }));
+    return (_jsxs(_Fragment, { children: [_jsxs(Row, { className: "min-w-0", align: "start", justify: "between", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: `flex-1 leading-snug transition-colors hover:text-primary`, color: "primary", truncate: 2, size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(WishlistHeartButton, { size: "inline", inWishlist: inWishlist, isLoading: wishlistLoading, addLabel: mergedLabels.addToWishlist, removeLabel: mergedLabels.removeFromWishlist, onToggle: handleWishlist })) : null] }), _jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Text, { className: "text-primary", size: "sm", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), _jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", className: `items-[center] py-[0.125rem] text-[11px] ${countdownClass}`, padding: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-2.5 w-2.5" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), bidCount > 0 && _jsx(Caption, { className: "text-[11px]", children: mergedLabels.totalBids(bidCount) })] }), !isEnded && (_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", className: "self-start px-[0.625rem] mt-0.5", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }))] }));
 }
 function renderAuctionCardInfoGrid(props) {
     const { product, auctionHref, displayBid, bidCount, hasCurrentBid, isEnded, remaining, resolvedBuyoutPrice, inWishlist, wishlistLoading, wishlistActions, countdownClass, mergedLabels, handleWishlist, handleNavigate } = props;
-    return (_jsxs(_Fragment, { children: [_jsxs(Row, { align: "start", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: "min-w-0 flex-1 leading-snug transition-colors hover:text-primary", color: "primary", size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(Button, { rounded: "full", type: "button", variant: "ghost", onClick: handleWishlist, disabled: wishlistLoading, "aria-label": inWishlist ? mergedLabels.removeFromWishlist : mergedLabels.addToWishlist, className: "-mt-0.5 p-[0.25rem]", children: _jsx(Heart, { className: `h-4 w-4 ${inWishlist ? CLS_HEART_ON : CLS_HEART_OFF}` }) })) : null] }), _jsxs(Div, { children: [_jsx(Caption, { children: isEnded && hasCurrentBid ? mergedLabels.winningBid : hasCurrentBid ? mergedLabels.currentBid : mergedLabels.startingBid }), _jsx(Text, { className: "leading-none text-primary", size: "base", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), isEnded && product.winnerDisplayName && (_jsxs(Caption, { className: "mt-0.5", color: "muted", children: [mergedLabels.wonBy, ": ", maskDisplayName(product.winnerDisplayName)] }))] }), _jsxs(Row, { wrap: true, justify: "between", gap: "sm", className: "gap-x-2 gap-y-1", children: [_jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", textSize: "xs", className: `items-[center] ${countdownClass}`, paddingY: "y-2xs", paddingX: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-3 w-3" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), _jsx(Caption, { children: mergedLabels.totalBids(bidCount) })] }), _jsx(Row, { wrap: true, gap: "xs", className: "mt-auto", children: isEnded ? (_jsx(Button, { gap: "xs", type: "button", variant: "ghost", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1 cursor-not-allowed opacity-60", disabled: true, children: _jsx(Span, { children: mergedLabels.ended }) })) : (_jsxs(_Fragment, { children: [_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }), resolvedBuyoutPrice ? (
+    return (_jsxs(_Fragment, { children: [_jsxs(Row, { align: "start", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: "min-w-0 flex-1 leading-snug transition-colors hover:text-primary", color: "primary", size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(WishlistHeartButton, { size: "inline", inWishlist: inWishlist, isLoading: wishlistLoading, addLabel: mergedLabels.addToWishlist, removeLabel: mergedLabels.removeFromWishlist, onToggle: handleWishlist })) : null] }), _jsxs(Div, { children: [_jsx(Caption, { children: isEnded && hasCurrentBid ? mergedLabels.winningBid : hasCurrentBid ? mergedLabels.currentBid : mergedLabels.startingBid }), _jsx(Text, { className: "leading-none text-primary", size: "base", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), isEnded && product.winnerDisplayName && (_jsxs(Caption, { className: "mt-0.5", color: "muted", children: [mergedLabels.wonBy, ": ", maskDisplayName(product.winnerDisplayName)] }))] }), _jsxs(Row, { wrap: true, justify: "between", gap: "sm", className: "gap-x-2 gap-y-1", children: [_jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", textSize: "xs", className: `items-[center] ${countdownClass}`, paddingY: "y-2xs", paddingX: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-3 w-3" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), _jsx(Caption, { children: mergedLabels.totalBids(bidCount) })] }), _jsx(Row, { wrap: true, gap: "xs", className: "mt-auto", children: isEnded ? (_jsx(Button, { gap: "xs", type: "button", variant: "ghost", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1 cursor-not-allowed opacity-60", disabled: true, children: _jsx(Span, { children: mergedLabels.ended }) })) : (_jsxs(_Fragment, { children: [_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }), resolvedBuyoutPrice ? (
                         /* `secondary`, not `danger` — this button only navigates to the
                            PDP, and `danger` is reserved for destructive actions (Rule #7
                            kinds). ACTIONS.AUCTION["buy-it-now"] is itself `secondary`. */

package/dist/features/auctions/components/PlaceBidFormClient.d.ts

@@ -5,6 +5,31 @@ export interface PlaceBidInput {
     bidAmount: number;
     autoMaxBid?: number;
 }
+/**
+ * The `ActionResult` envelope every server action in this app returns.
+ *
+ * 🛑 Exactly ONE level. `onPlaceBid`/`onBuyNow` used to be typed
+ * `Promise<unknown>`, and the consumer's actions returned a *doubly*-wrapped
+ * `{ ok: true, data: { ok: false, error } }`. Reading the outer `ok` therefore
+ * saw `true` for every possible outcome — including every failure — so Buy Now
+ * placed a real bid and a real locked cart line and then silently
+ * `router.refresh()`ed a page that renders nothing from the cart. Typing these
+ * props is what makes a re-introduced second envelope a compile error rather
+ * than a silent no-op button.
+ */
+export type BidActionEnvelope<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: string;
+    code?: string;
+    issues?: unknown[];
+};
+/** The subset of `BuyNowAuctionResult` this component actually consumes. */
+export interface BuyNowSuccess {
+    checkoutUrl?: string;
+}
 export interface PlaceBidFormClientProps {
     productId: string;
     currentBid: number;
@@ -17,8 +42,8 @@ export interface PlaceBidFormClientProps {
     buyNowPrice: number | null;
     bidCount: number;
     tags?: string[];
-    onPlaceBid: (input: PlaceBidInput) => Promise<unknown>;
-    onBuyNow?: () => Promise<unknown>;
+    onPlaceBid: (input: PlaceBidInput) => Promise<BidActionEnvelope<unknown>>;
+    onBuyNow?: () => Promise<BidActionEnvelope<BuyNowSuccess>>;
 }
 export declare function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, startingBid, tiers, minBidIncrementOverride, currency, isEnded, auctionEndDate, buyNowPrice, bidCount: ssrBidCount, tags, onPlaceBid, onBuyNow, }: PlaceBidFormClientProps): React.JSX.Element;
 /**

package/dist/features/auctions/components/PlaceBidFormClient.js

@@ -48,6 +48,12 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
     const [isBuyNowPending, startBuyNowTransition] = useTransition();
     const [success, setSuccess] = useState(false);
     const [showLoginModal, setShowLoginModal] = useState(false);
+    /**
+     * Buy Now has no field to hang an error off — it is a standalone button, not
+     * a form input — so it needs its own slot. Without one, every domain failure
+     * (`AUCTION_ENDED`, `BUY_NOW_UNAVAILABLE`, rate-limit) was silent.
+     */
+    const [buyNowError, setBuyNowError] = useState(null);
     /** Last amount the form itself wrote — see `seedAmount` below. */
     const lastSeeded = useRef(minBid);
     /**
@@ -140,43 +146,59 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
         }
     }
     function bidErrorMessage(result) {
-        if (!result || typeof result !== "object" || !("ok" in result))
-            return null;
-        const r = result;
-        if (r.ok !== false)
+        if (result.ok)
             return null;
-        return (r.code && BID_ERROR_DISPLAY[r.code]) ?? r.error ?? "Failed to place bid. Please try again.";
+        return ((result.code && BID_ERROR_DISPLAY[result.code]) ??
+            result.error ??
+            "Failed to place bid. Please try again.");
+    }
+    /**
+     * Show a Buy Now failure.
+     *
+     * Every failure used to be indistinguishable from success and was discarded.
+     * An auth failure never THROWS across a server-action boundary — it arrives
+     * as a code — so `isAuthError` in the catch below could never fire for it.
+     *
+     * ONLY `UNAUTHENTICATED` (401) means "sign in". `FORBIDDEN` (403) is "signed
+     * in, but not allowed" — bidding on your own auction, or an active
+     * `place_bids` soft ban. A login prompt for those tells the buyer to fix
+     * something that is not the problem.
+     */
+    function reportBuyNowFailure(code, message) {
+        if (code === "UNAUTHENTICATED") {
+            setShowLoginModal(true);
+            return;
+        }
+        setBuyNowError((code && BID_ERROR_DISPLAY[code]) ??
+            message ??
+            "Buy Now failed. Please try again.");
     }
     function handleBuyNow() {
         if (!onBuyNow)
             return;
         setSuccess(false);
+        setBuyNowError(null);
         startBuyNowTransition(async () => {
             try {
                 const result = await onBuyNow();
-                if (result &&
-                    typeof result === "object" &&
-                    "ok" in result &&
-                    result.ok === false) {
-                    setSuccess(false);
+                if (!result.ok) {
+                    reportBuyNowFailure(result.code, result.error);
                     return;
                 }
                 setSuccess(true);
                 // Buy-Now writes a locked cart line, so send the buyer straight to the
-                // auction checkout lane to pay for it. This used to just call
-                // `router.refresh()` and discard the action's result entirely, leaving
-                // the buyer on the product page with no indication that anything was
-                // owed — the action returned an orderId nobody ever used.
-                const checkoutUrl = result?.checkoutUrl;
-                if (checkoutUrl)
-                    router.push(checkoutUrl);
+                // auction checkout lane to pay for it. `buyNowAuction` deliberately
+                // never touches the product document, so falling through to
+                // `router.refresh()` re-renders a byte-identical page — which is
+                // exactly what "the button does nothing" looked like.
+                if (result.data.checkoutUrl)
+                    router.push(result.data.checkoutUrl);
                 else
                     router.refresh();
             }
             catch (err) {
                 void normalizeError(err);
-                if (isAuthError(err))
-                    setShowLoginModal(true);
+                reportBuyNowFailure(isAuthError(err) ? "UNAUTHENTICATED" : undefined, err instanceof Error ? err.message : undefined);
             }
         });
     }
@@ -212,7 +234,7 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
                                     return applyZodIssues(parsed.error.issues, setFieldError);
                                 setSuccess(false);
                                 startTransition(() => submitBid(parsed.data.bidAmount, setFieldError));
-                            }, children: isEnded ? "Auction Ended" : "Place Bid" }), buyNowAvailable && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "secondary", size: "md", className: "w-full", type: "button", disabled: isBuyNowPending || isPending, isLoading: isBuyNowPending, onClick: handleBuyNow, children: `Buy Now — ${formatCurrency(buyNowPrice, currency)}` }), _jsxs(Text, { align: "center", size: "xs", color: "muted", children: ["Skips the bidding. The auction stays live until you pay \u2014 complete checkout within ", AUCTION_BUYOUT_WINDOW_MINUTES, " minutes."] })] }))] })) }), tags.length > 0 && (_jsx(Div, { border: "default", className: "border-t", padding: "t-md", children: _jsx(Row, { wrap: true, gap: "xs", children: tags.map((tag) => (_jsx(Span, { rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", size: "xs", children: tag }, tag))) }) }))] }));
+                            }, children: isEnded ? "Auction Ended" : "Place Bid" }), buyNowAvailable && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "secondary", size: "md", className: "w-full", type: "button", disabled: isBuyNowPending || isPending, isLoading: isBuyNowPending, onClick: handleBuyNow, children: `Buy Now — ${formatCurrency(buyNowPrice, currency)}` }), buyNowError && (_jsx(Text, { align: "center", size: "xs", variant: "error", role: "alert", children: buyNowError })), _jsxs(Text, { align: "center", size: "xs", color: "muted", children: ["Skips the bidding. The auction stays live until you pay \u2014 complete checkout within ", AUCTION_BUYOUT_WINDOW_MINUTES, " minutes."] })] }))] })) }), tags.length > 0 && (_jsx(Div, { border: "default", className: "border-t", padding: "t-md", children: _jsx(Row, { wrap: true, gap: "xs", children: tags.map((tag) => (_jsx(Span, { rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", size: "xs", children: tag }, tag))) }) }))] }));
 }
 /**
  * `PlaceBidModalButton` — opens a modal that hosts the same PlaceBidFormClient.

package/dist/features/auth/components/SocialAuthButtons.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Button, Div, Row, Span } from "../../../ui";
 export function SocialAuthButtons({ onGoogle, disabled, dividerLabel, googleLabel, }) {
-    return (_jsxs(_Fragment, { children: [_jsxs(Div, { className: "relative", children: [_jsx(Row, { className: "absolute inset-0", align: "center", children: _jsx(Div, { className: "w-full border-t border-neutral-200" }) }), _jsx(Row, { textSize: "sm", className: "relative", justify: "center", children: _jsx(Span, { padding: "x-xs", surface: "default", color: "muted", children: dividerLabel }) })] }), _jsx(Div, { layout: "grid", gap: "3", className: "grid-cols-1", children: _jsxs(Button, { rounded: "md", type: "button", onClick: onGoogle, disabled: disabled, variant: "outline", paddingX: "md", paddingY: "sm", textSize: "sm", weight: "medium", className: "inline- justify-[center] border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface)] text-[var(--appkit-color-text)] dark:text-[var(--appkit-color-text)] hover:bg-neutral-50 hover:bg-[var(--appkit-color-surface-elevated)] disabled:cursor-not-allowed disabled:opacity-50", children: [_jsxs("svg", { className: "mr-2 h-5 w-5", viewBox: "0 0 24 24", "aria-hidden": "true", children: [_jsx("path", { fill: "currentColor", d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" }), _jsx("path", { fill: "currentColor", d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" }), _jsx("path", { fill: "currentColor", d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" }), _jsx("path", { fill: "currentColor", d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" })] }), googleLabel] }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs(Div, { className: "relative", children: [_jsx(Row, { className: "absolute inset-0", align: "center", children: _jsx(Div, { className: "w-full border-t border-neutral-200" }) }), _jsx(Row, { textSize: "sm", className: "relative", justify: "center", children: _jsx(Span, { padding: "x-xs", surface: "default", color: "muted", children: dividerLabel }) })] }), _jsx(Div, { layout: "grid", gap: "3", className: "grid-cols-1", children: _jsxs(Button, { rounded: "md", type: "button", onClick: onGoogle, disabled: disabled, variant: "outline", paddingX: "md", paddingY: "sm", textSize: "sm", weight: "medium", className: "inline- justify-[center] border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface)] text-[var(--appkit-color-text)] dark:text-[var(--appkit-color-text)] hover:bg-surface-hover disabled:cursor-not-allowed disabled:opacity-50", children: [_jsxs("svg", { className: "mr-2 h-5 w-5", viewBox: "0 0 24 24", "aria-hidden": "true", children: [_jsx("path", { fill: "currentColor", d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" }), _jsx("path", { fill: "currentColor", d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" }), _jsx("path", { fill: "currentColor", d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" }), _jsx("path", { fill: "currentColor", d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" })] }), googleLabel] }) })] }));
 }

package/dist/features/auth/hooks/useAuth.d.ts

@@ -74,10 +74,32 @@ export declare function useVerifyEmail(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, VerifyEmailData, unknown>;
+/**
+ * Re-send the verification email — Firebase-native, like the send that
+ * happens at registration.
+ *
+ * ## What this used to do, and why it could not work
+ *
+ * It POSTed `/api/auth/resend-verification`, a route **deleted** in the
+ * Firebase-native auth migration. Root Cause #54 is the reason it can never
+ * come back: the Admin SDK cannot send email at all — it only *generates*
+ * action links — so the only way to deliver a verification mail without
+ * routing it through Resend is the CLIENT SDK's own
+ * `sendEmailVerification()`, which uses Firebase's hosted template.
+ *
+ * So every call 404'd, and `useRegister` above says in as many words that
+ * "the user can re-request verification later" — a documented recovery path
+ * that did not exist. Found by `audit-client-verb-match`'s NO_ROUTE rule.
+ *
+ * `ResendVerificationData.email` is accepted and unused: the client SDK
+ * re-sends for the CURRENTLY signed-in user and takes no address, so honouring
+ * an arbitrary email here would be a lie about what happens. Kept in the
+ * signature so the two existing call shapes stay source-compatible.
+ */
 export declare function useResendVerification(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
-}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResendVerificationData, unknown>;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, void | ResendVerificationData, unknown>;
 export declare function useForgotPassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -337,9 +337,35 @@ export function useVerifyEmail(options) {
         onError: options?.onError,
     });
 }
+/**
+ * Re-send the verification email — Firebase-native, like the send that
+ * happens at registration.
+ *
+ * ## What this used to do, and why it could not work
+ *
+ * It POSTed `/api/auth/resend-verification`, a route **deleted** in the
+ * Firebase-native auth migration. Root Cause #54 is the reason it can never
+ * come back: the Admin SDK cannot send email at all — it only *generates*
+ * action links — so the only way to deliver a verification mail without
+ * routing it through Resend is the CLIENT SDK's own
+ * `sendEmailVerification()`, which uses Firebase's hosted template.
+ *
+ * So every call 404'd, and `useRegister` above says in as many words that
+ * "the user can re-request verification later" — a documented recovery path
+ * that did not exist. Found by `audit-client-verb-match`'s NO_ROUTE rule.
+ *
+ * `ResendVerificationData.email` is accepted and unused: the client SDK
+ * re-sends for the CURRENTLY signed-in user and takes no address, so honouring
+ * an arbitrary email here would be a lie about what happens. Kept in the
+ * signature so the two existing call shapes stay source-compatible.
+ */
 export function useResendVerification(options) {
     return useMutation({
-        mutationFn: (data) => apiClient.post(AUTH_ENDPOINTS.RESEND_VERIFICATION, data),
+        mutationFn: async () => {
+            const authProvider = getClientAuthProvider();
+            await authProvider.sendEmailVerification();
+            return { success: true };
+        },
         onSuccess: options?.onSuccess,
         onError: options?.onError,
     });

package/dist/features/auth/permissions/constants.d.ts

@@ -11,7 +11,7 @@
  * Permission naming: admin:resource:action
  * Ban action naming: plain verb phrase — write_reviews, place_bids, etc.
  */
-export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:offers:read" | "admin:offers:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:shipments:read" | "admin:shipments:write" | "admin:catalogue:read" | "admin:catalogue:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
+export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:offers:read" | "admin:offers:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:shipments:read" | "admin:shipments:write" | "admin:catalogue:read" | "admin:catalogue:write" | "admin:grouped-listings:read" | "admin:grouped-listings:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
 /**
  * Granular user actions that can be soft-banned individually.
  * A user may have multiple simultaneous soft bans of different types.

package/dist/features/auth/permissions/constants.js

@@ -126,6 +126,8 @@ export const PERMISSION_GROUPS = {
     ],
     catalog_manager: [
         "admin:dashboard:view",
+        "admin:grouped-listings:read",
+        "admin:grouped-listings:write",
         "admin:categories:read",
         "admin:categories:write",
         "admin:categories:delete",
@@ -277,6 +279,7 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/audit-log": "admin:audit-log:read",
     "/admin/shipments": "admin:shipments:read",
     "/admin/catalogue-approvals": "admin:catalogue:read",
+    "/admin/grouped-listings": "admin:grouped-listings:read",
     "/admin/categories": "admin:categories:read",
     "/admin/brands": "admin:brands:read",
     "/admin/coupons": "admin:coupons:read",