@mohasinac/appkit 4.32.4 → 4.32.6

package/dist/features/blog/actions/blog-actions.js

@@ -4,6 +4,7 @@ import { mediaUrlSchema } from "../../../validation/schemas";
 import { serverLogger } from "../../../monitoring";
 import { blogRepository } from "../repository/blog.repository";
 import { coerceMediaField, getMediaUrl } from "../../../utils";
+import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility";
 import { finalizeStagedMediaField, finalizeStagedMediaObject, finalizeStagedMediaObjectArray, } from "../../media/finalize";
 // --- Schemas --------------------------------------------------------------
 const singleImageMediaSchema = z
@@ -104,7 +105,7 @@ export async function listBlogPosts(params) {
 }
 export async function getFeaturedBlogPosts(count = 3) {
     const result = await blogRepository.listPublished({ featuredOnly: true }, { sorts: sortBy("publishedAt", "DESC"), page: 1, pageSize: count });
-    return result.items;
+    return hidePublicTestData(result.items);
 }
 export async function getLatestBlogPosts(count = 5) {
     const result = await blogRepository.listPublished({}, { sorts: sortBy("publishedAt", "DESC"), page: 1, pageSize: count });

package/dist/features/categories/actions/category-actions.js

@@ -1,5 +1,6 @@
 import { serverLogger } from "../../../monitoring";
 import { categoriesRepository } from "../repository/categories.repository";
+import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility";
 export async function createCategory(input, createdBy) {
     const categoryData = {
         ...input,
@@ -40,14 +41,16 @@ export async function listCategories(params) {
 }
 export async function listTopLevelCategories(limit = 12) {
     const all = await categoriesRepository.getCategoriesByTier(0);
-    return all
+    return hidePublicTestData(all)
         .filter((c) => c.isActive !== false)
         .sort((a, b) => (a.order ?? 0) - (b.order ?? 0))
         .slice(0, limit);
 }
 export async function listBrandCategories(limit = 12) {
     const brands = await categoriesRepository.getBrandCategories();
-    return brands.filter((c) => c.isActive !== false).slice(0, limit);
+    return hidePublicTestData(brands)
+        .filter((c) => c.isActive !== false)
+        .slice(0, limit);
 }
 export async function getCategoryById(id) {
     return categoriesRepository.findById(id);

package/dist/features/categories/components/BundlesListView.js

@@ -26,6 +26,6 @@ export async function BundlesListView({ searchParams = {}, onBuyNow, }) {
     const visible = hidePublicTestData(all);
     const bundles = storeId
         ? visible.filter((c) => c.createdByStoreId === storeId)
-        : all;
+        : visible;
     return (_jsx(Main, { children: _jsx(Section, { padding: "y-2xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, className: "mb-2", color: "primary", size: "3xl", weight: "semibold", children: "Collectible Bundles" }), _jsx(Text, { className: "mb-6 text-[var(--appkit-color-text-muted)]", size: "sm", children: "Curated multi-product bundles \u2014 Pok\u00E9mon starter sets, Beyblade tournament packs, Hot Wheels collector boxes and more. One price, one checkout, one shipment." }), _jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-6" }), _jsx(CategoryBundlesListing, { initialBundles: bundles, onBuyNow: onBuyNow }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] }) }) }));
 }

package/dist/features/events/actions/event-actions.js

@@ -15,6 +15,7 @@ import { hashGuestIdentity } from "../../../security/rate-limit";
 const ERR_EVENT_NOT_FOUND = "Event not found";
 import { coerceMediaField, getMediaUrl } from "../../../utils";
 import { finalizeStagedMediaField, finalizeStagedMediaObject, finalizeStagedMediaObjectArray, } from "../../media/finalize";
+import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility";
 // --- Admin: Create Event --------------------------------------------------
 export async function createEvent(adminId, input) {
     const finalizedCoverUrl = await finalizeStagedMediaField(getMediaUrl(input.coverImage) ??
@@ -130,12 +131,14 @@ export async function listPublicEvents(params) {
         pageSize = params.pageSize ?? 20;
     }
     const base = "status==active";
-    return eventRepository.list({
+    const result = await eventRepository.list({
         filters: filters ? `${base},${filters}` : base,
         sorts: sorts ?? "startsAt",
         page,
         pageSize,
     });
+    // PUBLIC by name — it backs the homepage strip and /events.
+    return { ...result, items: hidePublicTestData(result.items) };
 }
 export async function getPublicEventById(id) {
     const event = await eventRepository.findByIdOrSlug(id);

package/dist/features/events/components/EventRafflesSection.js

@@ -11,6 +11,7 @@ import { sortBy } from "../../../constants/sort";
 import { Container, Grid, Heading, Section, Stack, Text } from "../../../ui";
 import { eventRepository } from "../repository/events.repository";
 import { EventCard } from "./EventCard";
+import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility";
 /**
  * Renders a live-raffle/spin-wheel strip on the homepage.
  * W1-38 (2026-05-23): fetches events with hasRaffle=true and renders the EventCard grid.
@@ -26,7 +27,7 @@ export async function EventRafflesSection({ config, }) {
             sorts: sortBy("startsAt", "DESC"),
             pageSize: limit,
         });
-        events = (result.items ?? []);
+        events = hidePublicTestData(result.items ?? []);
     }
     catch (_err) {
         void normalizeError(_err);

package/dist/features/products/actions/product-actions.js

@@ -4,6 +4,7 @@ import { listPublicProducts } from "../../../_internal/server/features/products/
 import { AVAILABILITY_VALUES, PRODUCT_FIELDS } from "../../../constants/field-names";
 import { productRepository } from "../repository/products.repository";
 import { ProductStatusValues } from "../schemas";
+import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility";
 /**
  * Reusable Sieve clauses. Single source of truth for the listing-type
  * discriminator across every action helper in this file. SB1-G (S21 2026-05-12)
@@ -31,7 +32,14 @@ export async function listProducts(params = {}) {
         page,
         pageSize,
     };
-    return productRepository.list(sieve, { categoriesIn });
+    /*
+     * Fail-closed. This is reachable as a SERVER ACTION — invocable straight from
+     * a browser — so it is a public surface whoever happens to call it today.
+     * `getFeaturedProducts` and friends already route through
+     * `listPublicProducts`, which filters; this generic path did not.
+     */
+    const result = await productRepository.list(sieve, { categoriesIn });
+    return { ...result, items: hidePublicTestData(result.items) };
 }
 export async function getProductById(id) {
     return productRepository.findById(id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.32.4",
+  "version": "4.32.6",
   "license": "MIT",
   "publishConfig": {
     "access": "public"