@mohasinac/appkit 4.33.1 → 4.34.1

package/dist/seed/products-preorders-seed-data.js

@@ -22,6 +22,7 @@
 import { PRODUCT_FIELDS } from "../constants/field-names";
 import { buildSearchTxt } from "../utils/search-txt";
 import { seedPhoto } from "./_helpers/media";
+import { withFinalSale } from "./_helpers/final-sale-fixtures";
 const _rawPreordersSeedData = [
     {
         id: "preorder-beyblade-x-bx-08-wave",
@@ -296,7 +297,7 @@ const _rawPreordersSeedData = [
         updatedAt: new Date("2026-08-24"),
     },
 ];
-export const productsPreordersSeedData = _rawPreordersSeedData.map((p) => ({
+export const productsPreordersSeedData = _rawPreordersSeedData.map((p) => withFinalSale({
     tags: [],
     stockQuantity: p.availableQuantity ?? 1,
     mainImage: p.images?.[0] ?? "",

package/dist/seed/products-prize-draws-seed-data.js

@@ -22,6 +22,7 @@ import { withProductSearchTxt } from "./_helpers/product-search-txt";
 import { PRODUCT_FIELDS } from "../constants/field-names";
 import { buildSearchTxt } from "../utils/search-txt";
 import { seedPhoto } from "./_helpers/media";
+import { withFinalSale } from "./_helpers/final-sale-fixtures";
 const _rawproductsPrizeDrawsSeedData = [
     {
         id: "prizedraw-beyblade-mystery-box",
@@ -408,4 +409,4 @@ const _rawproductsPrizeDrawsSeedData = [
  * the bottom of the array cannot ship without it — which is exactly how the
  * sold/depleted fixture in this file ended up unsearchable.
  */
-export const productsPrizeDrawsSeedData = _rawproductsPrizeDrawsSeedData.map(withProductSearchTxt);
+export const productsPrizeDrawsSeedData = _rawproductsPrizeDrawsSeedData.map(withProductSearchTxt).map(withFinalSale);

package/dist/seed/products-standard-seed-data.js

@@ -25,6 +25,7 @@
 import { PRODUCT_FIELDS } from "../constants/field-names";
 import { buildSearchTxt } from "../utils/search-txt";
 import { seedPhoto } from "./_helpers/media";
+import { withFinalSale } from "./_helpers/final-sale-fixtures";
 /*
  * Real Beyblade attributes per fixture — Root Cause #6 (standard was the
  * "richest" seed file by fixture count but never exercised customFields/
@@ -648,4 +649,4 @@ export const productsStandardSeedData = [
         ...(p.id ? SPEC_OVERRIDES[p.id] : undefined),
         listingType: PRODUCT_FIELDS.LISTING_TYPE_VALUES.STANDARD,
     })),
-];
+].map(withFinalSale);

package/dist/seed/products-stickers-seed-data.js

@@ -19,7 +19,8 @@
 import { PRODUCT_FIELDS } from "../constants/field-names";
 import { buildSearchTxt } from "../utils/search-txt";
 import { seedPhoto } from "./_helpers/media";
-export const productsStickersSeedData = [
+import { withFinalSale } from "./_helpers/final-sale-fixtures";
+const _rawProductsStickersSeedData = [
     {
         id: "stickers-beyblade-original-classic-sheet",
         slug: "stickers-beyblade-original-classic-sheet",
@@ -264,3 +265,10 @@ export const productsStickersSeedData = [
         ]),
     },
 ];
+/*
+ * This file had no export wrapper at all — every other product seed file maps
+ * its raw array through one, and these two were the exception. Adding it here
+ * so the final-sale opt-outs are applied the same way everywhere rather than
+ * being hand-written into two records that reviewers would have to find.
+ */
+export const productsStickersSeedData = _rawProductsStickersSeedData.map(withFinalSale);

package/dist/seed/users-seed-data.js

@@ -1,11 +1,16 @@
 /*
- * WHY: Provides 18 seed user accounts covering all marketplace roles and demographics.
- * WHAT: Exports 18 UserDocument partials — 1 admin, 2 sellers (store owners, one of which
- *       is also the dedicated isTester QA account), 15 buyers.
+ * WHY: Provides 21 seed user accounts covering all marketplace roles and demographics.
+ * WHAT: Exports 21 UserDocument partials — 1 admin, 2 sellers (store owners, one of which
+ *       is also the dedicated isTester QA account), 15 buyers, 1 automated tester
+ *       (`user-claude-tester`, isBot), and 2 employees on contrasting permission presets.
  *       All passwords are TempPass123! in the Firebase Auth emulator. UIDs match slugs.
  *
+ *       🛑 seed-cli sets that password ONLY when it creates the Auth record. A re-seed
+ *       never resets an existing password, so an account whose password was changed
+ *       stays changed and must be reset explicitly.
+ *
  * EXPORTS:
- *   usersSeedData — array of 18 Partial<UserDocument> objects for the seed runner
+ *   usersSeedData — array of 21 Partial<UserDocument> objects for the seed runner
  *
  * @tag domain:users,auth
  * @tag layer:seed
@@ -15,6 +20,7 @@
  * @tag sideEffects:none
  */
 import { getDefaultPhonePrefix } from "./seed-market-config";
+import { PERMISSION_GROUPS } from "../features/auth/permissions/constants";
 import { USER_FIELDS } from "../constants/field-names";
 import { seedPhoto } from "./_helpers/media";
 const _ph = getDefaultPhonePrefix();
@@ -522,4 +528,101 @@ export const usersSeedData = [
         createdAt: daysAgo(1),
         updatedAt: daysAgo(1),
     },
+    // ── Automated tester (the Claude-driven checklist runner answers as this account) ──
+    // `canTestAdmin` is REQUIRED, not decorative: 116 checklist cases are adminOnly and
+    // GET/PUT /api/user/tester-checklist 404s them for a caller without it, so the runner
+    // would silently see a shorter catalog than a human tester does.
+    // `isBot` keeps it off the public Bug Hunters leaderboard — see getBugHunterLeaderboard().
+    {
+        uid: "user-claude-tester",
+        email: "claude-tester@letitrip.in",
+        phoneNumber: `${_ph}9999900019`,
+        phoneVerified: true,
+        displayName: "Claude (automated)",
+        photoURL: seedPhoto("user-avatar-claude-tester-20260101", 400, 400),
+        role: USER_FIELDS.ROLE_VALUES.SELLER,
+        isTester: true,
+        canTestAdmin: true,
+        isBot: true,
+        emailVerified: true,
+        disabled: false,
+        storeId: "store-tester-qa-seller",
+        storeSlug: "store-tester-qa-seller",
+        storeStatus: "approved",
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Automated tester. Works the tester checklist against a freshly seeded catalog and records a verdict per case.",
+            location: "Bengaluru, Karnataka",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(1), creationTime: daysAgo(1).toISOString(), loginCount: 1 },
+        createdAt: daysAgo(1),
+        updatedAt: daysAgo(1),
+    },
+    // ── Employees: two contrasting permission presets ───────────────────────────
+    // These exist so the sidebar-scoping checklist cases can be tested AT ALL. Before
+    // this the seed had no `role: "employee"` account anywhere, so the case the
+    // checklist itself marks "🛑 THE BIG ONE" — an employee must see only what their
+    // permissions allow, not all 91 admin entries — had nothing to sign in as.
+    //
+    // `permissions` is the load-bearing field (it is what the RBAC checks read);
+    // `permissionGroup` is display-only. Both are set from the same preset so they
+    // cannot disagree. Two presets on purpose: one narrow, one broad — a scoping bug
+    // that happens to produce the right count for one group is caught by the other.
+    {
+        uid: "user-employee-blog",
+        email: "employee-blog@letitrip.in",
+        phoneNumber: `${_ph}9999900020`,
+        phoneVerified: true,
+        displayName: "Mock Employee 1",
+        photoURL: seedPhoto("user-avatar-employee-blog-20260101", 400, 400),
+        role: USER_FIELDS.ROLE_VALUES.EMPLOYEE,
+        permissionGroup: "blog_poster",
+        permissions: [...PERMISSION_GROUPS.blog_poster],
+        emailVerified: true,
+        disabled: false,
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Content employee — blog and media only.",
+            location: "Pune, Maharashtra",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(2), creationTime: daysAgo(30).toISOString(), loginCount: 12 },
+        createdAt: daysAgo(30),
+        updatedAt: daysAgo(2),
+    },
+    {
+        uid: "user-employee-trust",
+        email: "employee-trust@letitrip.in",
+        phoneNumber: `${_ph}9999900021`,
+        phoneVerified: true,
+        displayName: "Mock Employee 2",
+        photoURL: seedPhoto("user-avatar-employee-trust-20260101", 400, 400),
+        role: USER_FIELDS.ROLE_VALUES.EMPLOYEE,
+        permissionGroup: "trust_and_safety",
+        permissions: [...PERMISSION_GROUPS.trust_and_safety],
+        emailVerified: true,
+        disabled: false,
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Trust & Safety employee — users, bans, reviews and reports.",
+            location: "Chennai, Tamil Nadu",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(2), creationTime: daysAgo(60).toISOString(), loginCount: 40 },
+        createdAt: daysAgo(60),
+        updatedAt: daysAgo(2),
+    },
 ];

package/dist/server.d.ts

@@ -8,7 +8,7 @@ export { wrapAction, isOk, unwrap, } from "./_internal/shared/types/action-resul
 export type { ActionResult } from "./_internal/shared/types/action-result";
 export { setActionErrorReporter, hasActionErrorReporter, } from "./_internal/shared/types/action-error-reporter";
 export type { ActionErrorReport, ActionErrorReporter, } from "./_internal/shared/types/action-error-reporter";
-export { attachPaymentProofAction, adminVerifyPaymentAction, adminRequestProofReuploadAction, adminRejectPaymentAsFraudAction, raiseOrderDisputeAction, } from "./_internal/server/features/orders/actions";
+export { attachPaymentProofAction, adminVerifyPaymentAction, adminRequestProofReuploadAction, adminRejectPaymentAsFraudAction, raiseOrderDisputeAction, requestReturnAction, } from "./_internal/server/features/orders/actions";
 export { wrapJobHandler, wrapScheduleHandler, wrapTriggerHandler, wrapCallableHandler, } from "./_internal/server/jobs/core/wrapJobHandler";
 export { analyzeLogs } from "./_internal/server/features/maintenance/analyze";
 export type { AnalyzeOptions, AnalyzeReport, } from "./_internal/server/features/maintenance/analyze";
@@ -530,7 +530,7 @@ export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_
 export type { ListingTypePlugin } from "./_internal/shared/listing-types/_registry";
 export { applyMediaContextGuards, CONTEXT_LIMITS, } from "./_internal/server/features/media/contextGuards";
 export type { GuardResult, GuardError, GuardSuccess } from "./_internal/server/features/media/contextGuards";
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 export type { MediaKind, AllowedImageMime, AllowedVideoMime, AllowedDocMime, AllowedMime, } from "./_internal/shared/media/limits";
 export { getServerPermissions, checkPermission, checkAnyPermission, makeAdminSectionLayout, } from "./_internal/server/features/auth/permissions";
 export type { ResolvedPermissions, AdminSectionLayoutOpts, } from "./_internal/server/features/auth/permissions";
@@ -581,3 +581,7 @@ export { validateActionIndexEntry, normaliseRoute, } from "./features/search/act
 export type { ActionIndexValidationContext, ActionIndexValidationIssue, } from "./features/search/action-index/validate-entry";
 export { ActionIndexRepository, actionIndexRepository, } from "./features/search/action-index/repository";
 export type { ActionIndexDocument } from "./features/search/action-index/repository";
+export { REFUND_COPY } from "./_internal/shared/features/orders/refund-copy";
+export { RETURN_REASON, FINAL_SALE_EXEMPT_REASONS, RETURN_REASON_LABEL, RETURN_REASON_GROUP_LABEL, isFinalSaleExempt, isReturnReason, selectableReturnReasons, } from "./_internal/shared/features/orders/return-reasons";
+export type { ReturnReason } from "./_internal/shared/features/orders/return-reasons";
+export { draftToProductInput, productToDraft, } from "./features/seller/utils/product-draft-mapping";

package/dist/server.js

@@ -17,7 +17,11 @@ export { wrapAction, isOk, unwrap, } from "./_internal/shared/types/action-resul
 // server-side rather than from a client bootstrap.
 export { setActionErrorReporter, hasActionErrorReporter, } from "./_internal/shared/types/action-error-reporter";
 // [SERVER-ONLY] P-1 manual payment proof server actions.
-export { attachPaymentProofAction, adminVerifyPaymentAction, adminRequestProofReuploadAction, adminRejectPaymentAsFraudAction, raiseOrderDisputeAction, } from "./_internal/server/features/orders/actions";
+export { attachPaymentProofAction, adminVerifyPaymentAction, adminRequestProofReuploadAction, adminRejectPaymentAsFraudAction, raiseOrderDisputeAction, 
+// Buyer return request. Was reachable only through `server-entry.ts`, which
+// is the bare `@mohasinac/appkit` specifier — not `/server`, where every
+// other order action lives and where a consumer would look for it.
+requestReturnAction, } from "./_internal/server/features/orders/actions";
 // [SERVER-ONLY] Cloud Function handler wrappers — persist exceptions to
 // serverErrors (source: "function") before re-throwing so retry semantics
 // are preserved. Apply at the consumer's runtime adapter boundary.
@@ -1389,7 +1393,7 @@ export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_
 // Media context guards — shared by /api/media/sign + legacy /api/media/upload.
 export { applyMediaContextGuards, CONTEXT_LIMITS, } from "./_internal/server/features/media/contextGuards";
 // Media upload limits — shared by /api/media/sign + /api/media/finalize + /api/media/upload.
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 // ── RBAC server helpers ───────────────────────────────────────────────────────
 // getServerPermissions, checkPermission, makeAdminSectionLayout
 export { getServerPermissions, checkPermission, checkAnyPermission, makeAdminSectionLayout, } from "./_internal/server/features/auth/permissions";
@@ -1452,3 +1456,12 @@ export { COUNTRIES, COUNTRY_CODES, DEFAULT_COUNTRY, countryFor, postalPatternFor
 export { SUBDIVISIONS, subdivisionsFor } from "./constants/geo/subdivisions";
 export { validateActionIndexEntry, normaliseRoute, } from "./features/search/action-index/validate-entry";
 export { ActionIndexRepository, actionIndexRepository, } from "./features/search/action-index/repository";
+export { REFUND_COPY } from "./_internal/shared/features/orders/refund-copy";
+// Return / refund reasons — the closed enum the final-sale gate branches on.
+// See the module docstring for why the exempt set is "seller or carrier fault"
+// rather than "serious reasons".
+export { RETURN_REASON, FINAL_SALE_EXEMPT_REASONS, RETURN_REASON_LABEL, RETURN_REASON_GROUP_LABEL, isFinalSaleExempt, isReturnReason, selectableReturnReasons, } from "./_internal/shared/features/orders/return-reasons";
+// Seller listing form draft <-> product write payload. The flat form keys and
+// the nested document blocks are different shapes, and nothing translated
+// between them — see the module docstring.
+export { draftToProductInput, productToDraft, } from "./features/seller/utils/product-draft-mapping";