@mohasinac/appkit 4.36.0 → 4.37.1

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -37,9 +37,9 @@ import type { PublicSiteSettings } from "../../../shared/features/site-settings/
  * was traced to a call site; anything without one belongs in the private list,
  * because an unused public field is pure attack surface.
  */
-export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark"];
+export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark", "disabledRoutes"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "disabledRoutes", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging"];
+export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging"];
 export interface ToPublicSiteSettingsOptions {
     /**
      * The resolved marker → wordmark → text watermark chain. Injected because

package/dist/_internal/server/features/site-settings/adapters.js

@@ -13,6 +13,26 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
     "actionConfig", // useAuthGate
     "background", // DashboardLayoutClient (background.light / .dark)
     "watermark", // MediaVideo, as the fallback behind effectiveWatermark
+    /*
+     * src/proxy.ts — the admin "disable a nav item and that route 404s" gate.
+     *
+     * 🛑 It was PRIVATE until 2026-09-13, justified by "read by
+     * app/[locale]/layout.tsx (RSC)". That was true once and stopped being true in
+     * Root Cause #82, which moved the gate OUT of the root layout (a dynamic API
+     * there made every page on the site uncacheable) and into the proxy. The
+     * proxy cannot do a Firestore read on the Edge, so it fetches
+     * /api/site-settings over HTTP — where a private field simply does not exist.
+     *
+     * The gate has therefore been a silent no-op ever since: getDisabledRoutes()
+     * reads `body.data.disabledRoutes`, gets undefined, and returns []. It fails
+     * OPEN, so nothing 404s that should not; the admin capability just does
+     * nothing. The stale comment on the private entry was the only trace.
+     *
+     * Publishing it is the right call rather than reverting the move: it is a
+     * list of route paths an admin has switched off, not a secret, and the
+     * alternative is putting a per-request Firestore read back on the Edge.
+     */
+    "disabledRoutes",
 ];
 /** Everything else, with the reason it stays server-side. */
 export const PRIVATE_SITE_SETTINGS_FIELDS = [
@@ -30,7 +50,6 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
     "integrations", // analytics/tag IDs are injected server-side into markup, not fetched by the client
     "platformLimits", // server-enforced caps; no client reader
     "auctionConfig", // read by AuctionDetailPageView, a Server Component doing its own settings read
-    "disabledRoutes", // read by app/[locale]/layout.tsx (RSC) to gate routing
     "siteName", // delivered as an SSR prop / rendered server-side
     "tagline", // admin chrome only
     "motto", // rendered server-side
@@ -81,6 +100,11 @@ export function toPublicSiteSettings(doc, opts) {
         actionConfig: doc.actionConfig,
         background: doc.background,
         watermark: doc.watermark,
+        // Defaulted to [] rather than passed through: src/proxy.ts fails OPEN on a
+        // missing value, so an absent field and an empty list already behave the
+        // same — but emitting `undefined` would drop the key from the JSON entirely
+        // and leave the next person wondering whether the projection ran at all.
+        disabledRoutes: doc.disabledRoutes ?? [],
         effectiveWatermark: opts?.effectiveWatermark,
     };
 }

package/dist/_internal/shared/features/site-settings/types.d.ts

@@ -44,6 +44,18 @@ export interface PublicSiteSettings {
     actionConfig?: SiteSettingsDocument["actionConfig"];
     background?: SiteSettingsDocument["background"];
     watermark?: SiteSettingsDocument["watermark"];
+    /**
+     * Routes an admin has switched off. Read by `src/proxy.ts`, which rewrites a
+     * disabled path to the 404 page.
+     *
+     * 🛑 Not optional, and always emitted (defaulted to `[]`). The proxy fetches
+     * this over HTTP and fails OPEN on a missing value, so the difference between
+     * "no routes disabled" and "the field never arrived" is invisible at runtime —
+     * which is exactly how this capability sat dead after Root Cause #82 moved the
+     * gate out of the root layout. A key that is always present makes the two
+     * distinguishable from the wire alone.
+     */
+    disabledRoutes: string[];
     /** Derived, not a stored field — the resolved marker → wordmark → text chain. */
     effectiveWatermark?: MediaVideoWatermark;
 }

package/dist/features/tester/seed-data/_money-flows.js

@@ -155,16 +155,24 @@ export const moneyFlowsPages = [
     {
         pageKey: "auction-win-to-payment",
         pageLabel: "Win an auction → get notified → pay",
-        href: "/auctions/auction-tester-sandbox-cycle-1",
+        href: "/auctions/auction-money-flows-closing",
         cases: [
             {
                 key: "winning-bid-recorded",
                 label: "Placing the highest bid on a closing auction records you as the winner",
                 roles: ["buyer"],
-                startPage: "/auctions/auction-tester-sandbox-cycle-1",
+                // Batch-scoped fixture, seeded by
+                // seed-data/fixtures/money-flows__auction-win-to-payment.mjs and closing
+                // ~3 minutes after this batch starts.
+                //
+                // It used to cite auction-tester-sandbox-cycle-1, which 46 OTHER
+                // citations need LIVE — one fixture with two contradictory
+                // requirements, so this case could never pass its final step and the
+                // rig notes recorded it as unpassable-by-design.
+                startPage: "/auctions/auction-money-flows-closing",
                 steps: [
                     STEP_SIGNIN_BUYER,
-                    "Open /auctions/auction-tester-sandbox-cycle-1, which starts at ₹15,000 with a ₹1,000 increment.",
+                    "Open /auctions/auction-money-flows-closing, which starts at ₹15,000 with a ₹1,000 increment and closes about three minutes from now.",
                     "Note the current bid and the end time.",
                     "Enter 16000 as the bid amount.",
                     "Click 'Place Bid'.",
@@ -180,7 +188,7 @@ export const moneyFlowsPages = [
                 roles: ["buyer"],
                 startPage: "/user/notifications",
                 steps: [
-                    "Sign in as the buyer who won auction-tester-sandbox-cycle-1.",
+                    "Sign in as the buyer who won auction-money-flows-closing.",
                     "Open the notifications bell in the header.",
                     "Find the auction-won notification.",
                     "Read its text.",
@@ -197,7 +205,7 @@ export const moneyFlowsPages = [
                 roles: ["buyer"],
                 startPage: "/user/orders",
                 steps: [
-                    "Sign in as the buyer who won auction-tester-sandbox-cycle-1.",
+                    "Sign in as the buyer who won auction-money-flows-closing.",
                     "Open /user/orders.",
                     "Locate the won auction.",
                     "Click its payment call to action.",

package/dist/features/tester/seed-data/index.d.ts

@@ -9,3 +9,4 @@ export { bidsTesterSeedData } from "./bids-tester-seed-data";
 export { cartsTesterSeedData } from "./carts-tester-seed-data";
 export { ordersTesterSeedData } from "./orders-tester-seed-data";
 export { offersTesterSeedData } from "./offers-tester-seed-data";
+export { testerResponsesSeedData } from "./tester-responses-seed-data";

package/dist/features/tester/seed-data/index.js

@@ -9,3 +9,4 @@ export { bidsTesterSeedData } from "./bids-tester-seed-data";
 export { cartsTesterSeedData } from "./carts-tester-seed-data";
 export { ordersTesterSeedData } from "./orders-tester-seed-data";
 export { offersTesterSeedData } from "./offers-tester-seed-data";
+export { testerResponsesSeedData } from "./tester-responses-seed-data";

package/dist/features/tester/seed-data/tester-responses-seed-data.d.ts

@@ -0,0 +1,2 @@
+import type { TesterChecklistResponseDocument } from "../schemas/firestore";
+export declare const testerResponsesSeedData: Partial<TesterChecklistResponseDocument>[];

package/dist/features/tester/seed-data/tester-responses-seed-data.js

@@ -0,0 +1,95 @@
+/*
+ * WHY: Three `admin/bug-hunter-rewards` cases need a tester submission that
+ *      ALREADY EXISTS before the tester arrives — you cannot test "confirm this
+ *      reported bug" or "reopen this confirmed case" against an empty inbox.
+ *
+ *      `testerChecklistResponses` is DERIVED tier, so a run wipes it at setup
+ *      and on a fresh project there are genuinely zero submissions. That is
+ *      correct — stale verdicts from a previous run must not leak into the next
+ *      one — but it left those three cases permanently unrunnable. Measured
+ *      2026-09-11: 0 pass / 0 fail / 5 blocked on that page, with both
+ *      calibration controls answered correctly, so the batch was trustworthy and
+ *      the emptiness was real.
+ *
+ *      The fix is NOT to stop wiping the collection. It is to restore these
+ *      fixtures after the wipe — `SEED_TRANSACTIONAL` in
+ *      tester/scripts/lib/collections.mjs is a RESTORE list, orthogonal to the
+ *      delete tiers, so a collection can be both wiped and re-seeded.
+ *
+ * WHAT: Two response documents against the two demo-fixture checklist items that
+ *       already live in the catalogue.
+ *
+ * 🛑 THE DOC ID IS DETERMINISTIC: `${testerId}__${checklistItemId}`.
+ *    That is the same id the live answer path computes, and it is what makes an
+ *    answer an UPSERT rather than a duplicate — `set({merge:true})`, never
+ *    `add()`. Generating a random id here would (a) create a second, competing
+ *    response for the same (tester, case) pair the moment a real tester answers,
+ *    and (b) break idempotency, so every `appkit-seed load` would pile up
+ *    another copy — Root Cause #25 exactly.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag access:server-only
+ * @tag consumers:appkit/scripts/seed-cli.mjs, seed/manifest.ts
+ * @tag sideEffects:none
+ */
+/** The seeded QA persona that the demo fixtures credit as "Mock User 18". */
+const TESTER_ID = "user-tester-qa";
+const TESTER_NAME = "Mock User 18";
+/** Same shape the answer route computes — see the callout above. */
+const responseId = (testerId, checklistItemId) => `${testerId}__${checklistItemId}`;
+const DEMO_V1 = "checklist-admin-bug-hunter-rewards-demo-fixture";
+const DEMO_V2 = "checklist-admin-bug-hunter-rewards-demo-fixture-v2";
+const seededAt = new Date("2026-08-18T09:30:00.000Z");
+export const testerResponsesSeedData = [
+    /*
+     * The ALREADY-CONFIRMED submission. The v1 catalogue item carries
+     * bugConfirmed:true / bugHunterId:"user-tester-qa" / bugHunterName:"Mock User
+     * 18", and until now there was no response row behind that credit — so
+     * /admin/tester-feedback showed "No feedback submitted yet" while the
+     * leaderboard showed a confirmed bug. This is the missing half.
+     *
+     * Backs: confirm-bug-idempotent (needs a row that is already confirmed) and
+     * reopen-case (needs the v1 credit to be visible from a real submission).
+     *
+     * `status: "reviewed"` because an admin has already acted on it.
+     */
+    {
+        id: responseId(TESTER_ID, DEMO_V1),
+        testerId: TESTER_ID,
+        testerDisplayName: TESTER_NAME,
+        checklistItemId: DEMO_V1,
+        groupKey: "admin",
+        pageKey: "bug-hunter-rewards",
+        phase: 1,
+        answer: "no",
+        comment: "Seed fixture — the reported bug behind the v1 demo case. Already confirmed and credited, then reopened as v2. Exists so an admin can see what a confirmed submission looks like without waiting for a real tester to file one.",
+        status: "reviewed",
+        createdAt: seededAt,
+        updatedAt: seededAt,
+    },
+    /*
+     * The UNCONFIRMED submission, against the active v2 retest. This is the row
+     * "Mark as Bug" is meant to be tried on end-to-end.
+     *
+     * 🛑 status MUST stay "new" and the case MUST stay un-confirmed, or the
+     * confirm-bug case has nothing left to do — it would open an already-confirmed
+     * row and correctly report that it could not perform its own steps. A fixture
+     * that pre-completes the thing under test is worse than no fixture, because it
+     * looks like coverage.
+     */
+    {
+        id: responseId(TESTER_ID, DEMO_V2),
+        testerId: TESTER_ID,
+        testerDisplayName: TESTER_NAME,
+        checklistItemId: DEMO_V2,
+        groupKey: "admin",
+        pageKey: "bug-hunter-rewards",
+        phase: 1,
+        answer: "no",
+        comment: "Seed fixture — a fresh 'No' on the reopened v2 case, deliberately NOT yet confirmed. This is the row to try Mark as Bug against.",
+        status: "new",
+        createdAt: seededAt,
+        updatedAt: seededAt,
+    },
+];

package/dist/index.d.ts

@@ -594,6 +594,7 @@ export { eventEntriesSeedData } from "./seed/index";
 export { eventsSeedData } from "./seed/index";
 export { faqSeedData } from "./seed/index";
 export { testerChecklistSeedData } from "./seed/index";
+export { testerResponsesSeedData } from "./seed/index";
 export { storesTesterSeedData } from "./seed/index";
 export { categoriesTesterSeedData } from "./seed/index";
 export { productsTesterSeedData } from "./seed/index";

package/dist/index.js

@@ -1189,6 +1189,8 @@ export { faqSeedData } from "./seed/index";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // testerChecklistSeedData - Model for tester checklist seed data.
 export { testerChecklistSeedData } from "./seed/index";
+// testerResponsesSeedData - Seeded tester submissions behind the bug-hunter demo fixtures.
+export { testerResponsesSeedData } from "./seed/index";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // storesTesterSeedData - Model for the shared tester sandbox store seed data.
 export { storesTesterSeedData } from "./seed/index";

package/dist/seed/index.d.ts

@@ -78,7 +78,7 @@ export { historySeedData } from "./history-seed-data";
 export { groupedListingsSeedData } from "./grouped-listings-seed-data";
 export { scammersSeedData } from "./scammers-seed-data";
 export { supportTicketsSeedData } from "./support-tickets-seed-data";
-export { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, cartsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
+export { testerChecklistSeedData, testerResponsesSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, cartsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
 export { productFeaturesSeedData } from "./product-features-seed-data";
 export { offersSeedData } from "./offers-seed-data";
 export { payoutMethodsSeedData, shippingConfigsSeedData, analyticsCardsSeedData, analyticsAlertsSeedData, storeCategoriesSeedData, listingTemplatesSeedData, moderationQueueSeedData, reportsSeedData, itemRequestsSeedData, storeWhatsAppConfigSeedData, storeGoogleConfigSeedData, } from "./store-extensions-seed-data";

package/dist/seed/index.js

@@ -69,7 +69,12 @@ export { scammersSeedData } from "./scammers-seed-data";
 export { supportTicketsSeedData } from "./support-tickets-seed-data";
 // Tester sandbox seed fixtures live in ../features/tester/seed-data (isolated from this
 // folder on purpose) — re-exported here so every other seed consumer keeps one import surface.
-export { testerChecklistSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, cartsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
+export { testerChecklistSeedData, 
+// 🛑 Adding a tester seed export means FOUR hops, not one: the tester barrel,
+// THIS re-export, appkit/src/index.ts, and seed-cli's own import. Missing the
+// middle two is silent — seed-cli logs "no seed data, skipping" and the run
+// continues, which is exactly what happened on the first attempt here.
+testerResponsesSeedData, storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData, blogTesterSeedData, eventsTesterSeedData, couponsTesterSeedData, bidsTesterSeedData, cartsTesterSeedData, ordersTesterSeedData, } from "../features/tester/seed-data";
 export { productFeaturesSeedData } from "./product-features-seed-data";
 export { offersSeedData } from "./offers-seed-data";
 // S-STORE Extensions (Tier S-STORE) — 11 new collections

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.36.0",
+  "version": "4.37.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/scripts/seed-cli.mjs

@@ -192,7 +192,7 @@ const {
   wishlistsSeedData, historySeedData,
   groupedListingsSeedData,
   scammersSeedData, productFeaturesSeedData,
-  testerChecklistSeedData, cartsTesterSeedData, offersTesterSeedData,
+  testerChecklistSeedData, testerResponsesSeedData, cartsTesterSeedData, offersTesterSeedData,
   supportTicketsSeedData, catalogueSeedData,
   shipmentsSeedData, shipmentLotsSeedData, shipmentItemsSeedData,
   storesTesterSeedData, categoriesTesterSeedData, productsTesterSeedData,
@@ -210,6 +210,7 @@ const {
   GROUPED_LISTINGS_COLLECTION, SCAMMER_COLLECTION,
   WISHLIST_COLLECTION, HISTORY_COLLECTION, PRODUCT_FEATURES_COLLECTION,
   TESTER_CHECKLIST_ITEM_COLLECTION,
+  TESTER_CHECKLIST_RESPONSE_COLLECTION,
   // PII field/index constants (plain data, still in the main barrel — the
   // crypto functions themselves come from appkitServer above)
   USER_PII_FIELDS, USER_PII_INDEX_MAP,
@@ -266,6 +267,17 @@ const COLLECTION_MAP = {
   scammerProfiles: SCAMMER_COLLECTION,
   productFeatures: PRODUCT_FEATURES_COLLECTION,
   testerChecklistItems: TESTER_CHECKLIST_ITEM_COLLECTION,
+  /*
+   * Tester submissions. DERIVED tier in the tester's own map (wiped at setup so
+   * a prior run's verdicts never leak into the next), AND listed in
+   * SEED_TRANSACTIONAL so these two demo fixtures are restored afterwards —
+   * that list is a RESTORE list, orthogonal to the delete tiers.
+   *
+   * Without the fixtures, three admin/bug-hunter-rewards cases have nothing to
+   * confirm or reopen and can only report blocked. Measured 2026-09-11:
+   * 0 pass / 0 fail / 5 blocked, both controls correct.
+   */
+  testerChecklistResponses: TESTER_CHECKLIST_RESPONSE_COLLECTION,
 };
 
 const SEED_DATA_MAP = {
@@ -325,6 +337,7 @@ const SEED_DATA_MAP = {
   scammerProfiles: scammersSeedData,
   productFeatures: productFeaturesSeedData,
   testerChecklistItems: testerChecklistSeedData,
+  testerChecklistResponses: testerResponsesSeedData,
 };
 
 const ALL_COLLECTIONS = Object.keys(COLLECTION_MAP);