@mohasinac/appkit 4.41.13 → 4.41.15

package/dist/_internal/server/features/auctions/actions.js

@@ -8,7 +8,7 @@ import { assertAuctionActive, assertBidAmount, assertNotAuctionOwner, shouldAuto
 import { ValidationError } from "../../../shared/errors/index";
 export async function placeBidAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = placeBidActionSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid bid input");

package/dist/_internal/server/features/cart/actions.js

@@ -7,7 +7,7 @@ import { upsertCartItem, mergeGuestItems } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 export async function addToCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = addToCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid cart input");
@@ -17,7 +17,7 @@ export async function addToCartAction(input) {
 }
 export async function removeFromCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = removeFromCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -27,14 +27,14 @@ export async function removeFromCartAction(input) {
 }
 export async function clearCartAction() {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await cartRepository.clearCart(user.uid);
         return { success: true };
     });
 }
 export async function mergeGuestCartAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = mergeGuestCartSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid cart data");

package/dist/_internal/server/features/events/actions.js

@@ -36,7 +36,7 @@ export async function updateEventAction(eventId, input) {
 }
 export async function registerForEventAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = registerForEventSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid registration input");
@@ -72,7 +72,7 @@ export async function registerForEventAction(input) {
 }
 export async function cancelEventRegistrationAction(entryId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const entry = await eventEntryRepository.findById(entryId);
         if (!entry || entry.userId !== user.uid) {
             throw new ValidationError("Registration not found or does not belong to you");

package/dist/_internal/server/features/history/actions.js

@@ -4,7 +4,7 @@ import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { historyRepository, } from "../../../../repositories";
 export async function trackProductViewAction(productId, productType, productSnapshot) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await historyRepository.track(user.uid, {
             productId,
             productType,
@@ -14,7 +14,7 @@ export async function trackProductViewAction(productId, productType, productSnap
 }
 export async function mergeGuestHistoryAction(guestItems) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         return historyRepository.merge(user.uid, guestItems);
     });
 }

package/dist/_internal/server/features/lottery/actions.js

@@ -28,7 +28,7 @@ function isDrawWindowOpen(config) {
 export async function submitLotteryPullAction(input) {
     return wrapAction(async () => {
         // Auth — must be logged in
-        const user = await requireRoleUser(["buyer", "seller", "admin", "moderator", "employee"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin", "moderator", "employee"]);
         const parsed = submitLotteryPullSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid lottery pull input");

package/dist/_internal/server/features/orders/actions.js

@@ -18,7 +18,7 @@ import { normalizeError } from "../../../../errors/normalize";
 import { serverLogger } from "../../../../monitoring";
 export async function createOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = createOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid order input");
@@ -31,7 +31,7 @@ export async function createOrderAction(input) {
 }
 export async function cancelOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = cancelOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -50,7 +50,7 @@ export async function cancelOrderAction(input) {
  */
 export async function requestReturnAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = returnRequestSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -161,7 +161,7 @@ function notifyAdminsOfPaymentProof(order) {
 }
 export async function attachPaymentProofAction(orderId, proof) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const order = await orderRepository.findById(orderId);
         if (!order)
             throw new OrderNotFoundError(orderId);
@@ -350,7 +350,7 @@ export async function adminRejectPaymentAsFraudAction(orderId, note) {
  */
 export async function raiseOrderDisputeAction(orderId, reason) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         if (!reason.trim())
             throw new ValidationError(REASON_REQUIRED_MSG);
         const order = await orderRepository.findById(orderId);

package/dist/_internal/server/features/pre-orders/actions.js

@@ -7,7 +7,7 @@ import { assertPreOrderAvailable, computeDeposit } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 export async function reservePreOrderAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = reservePreOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid reservation input");

package/dist/_internal/server/features/promotions/actions.js

@@ -9,7 +9,7 @@ import { ValidationError } from "../../../shared/errors/index";
 const ERR_INVALID_COUPON_INPUT = "Invalid coupon input";
 export async function applyCouponAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = applyCouponSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);

package/dist/_internal/server/features/reviews/actions.js

@@ -8,7 +8,7 @@ import { createReviewSchema, replyToReviewSchema, deleteReviewSchema, } from "..
 import { assertNotDuplicateReview, assertReviewOwnership, getReviewOrThrow, } from "./service";
 export async function createReviewAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = createReviewSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -54,7 +54,7 @@ export async function replyToReviewAction(input) {
 }
 export async function deleteReviewAction(input) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const parsed = deleteReviewSchema.safeParse(input);
         if (!parsed.success) {
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
@@ -71,7 +71,7 @@ export async function deleteReviewAction(input) {
 }
 export async function markReviewHelpfulAction(reviewId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await getReviewOrThrow(reviewId);
         // Keyed on the voter so a repeated call is a no-op rather than another +1.
         return reviewRepository.voteHelpful(reviewId, user.uid);

package/dist/_internal/server/features/wishlist/actions.js

@@ -7,7 +7,7 @@ import { WISHLIST_MAX } from "../../../shared/features/wishlist/config";
 import { WishlistCapError } from "../../../shared/features/wishlist/errors";
 export async function addToWishlistAction(productId, extras) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         try {
             return await wishlistRepository.addItem(user.uid, productId, extras);
         }
@@ -21,13 +21,13 @@ export async function addToWishlistAction(productId, extras) {
 }
 export async function removeFromWishlistAction(productId) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         await wishlistRepository.removeItem(user.uid, productId);
     });
 }
 export async function mergeGuestWishlistAction(guestItems) {
     return wrapAction(async () => {
-        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
         const merged = [];
         for (const item of guestItems) {
             try {

package/dist/features/faq/components/FAQPageContent.d.ts

@@ -26,6 +26,8 @@ interface FAQPageContentProps {
         resultCount: (count: number) => string;
         inCategory: (categoryLabel: string) => string;
         loading: string;
+        emptyTitle?: string;
+        emptyDescription?: string;
         contactTitle: string;
         contactDescription: string;
         contactEmailUs: string;

package/dist/features/faq/components/FAQPageContent.js

@@ -1,6 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Alert, Div, Heading, Input, SlottedListingView, Text } from "../../../ui";
+import { Alert, Div, EmptyState, Heading, Input, SlottedListingView, Text } from "../../../ui";
 import { sortBy } from "../../../constants/sort";
 import { FAQCategorySidebar } from "./FAQCategorySidebar";
 import { FAQSortDropdown } from "./FAQSortDropdown";
@@ -69,7 +69,24 @@ export function FAQPageContent({ initialCategory = "all", categories, routeHelpe
                                  * Saying so costs nothing and makes the next index gap
                                  * self-reporting rather than a phantom empty state.
                                  */
-                                _jsx(Alert, { variant: "error", title: "Couldn't load questions", children: "Something went wrong fetching these FAQs. Try a different sort or reload the page." })) : renderAccordion ? (renderAccordion(faqs)) : (_jsx(FAQAccordion, { faqs: faqs })), renderPagination: () => renderPagination?.(total) ?? null, total: total, isLoading: isLoading }), faqs.length > 0 ? (_jsx(Div, { className: "mt-12", children: _jsx(ContactCTA, { email: contact.email, phone: contact.phone, contactHref: routeHelpers.contactHref, labels: {
+                                _jsx(Alert, { variant: "error", title: "Couldn't load questions", children: "Something went wrong fetching these FAQs. Try a different sort or reload the page." })) : faqs.length === 0 ? (
+                                /*
+                                 * 🛑 AN EXPLICIT EMPTY BRANCH — without it the page rendered a
+                                 * BARE WHITE AREA.
+                                 *
+                                 * The chain fell through to <FAQAccordion faqs={[]} />, which
+                                 * renders nothing at all. Measured on /faqs?q=zzzznope: the
+                                 * page showed "0 questions", the search box, a divider, and
+                                 * then blank space — no message anywhere in the DOM.
+                                 *
+                                 * A blank region is the worst possible answer here because it
+                                 * is indistinguishable from a page that failed to load, which
+                                 * is exactly the confusion the isError branch above exists to
+                                 * prevent. Three states, three distinct renderings: loading,
+                                 * failed, and genuinely nothing found.
+                                 */
+                                _jsx(EmptyState, { title: labels.emptyTitle ?? "No questions found", description: labels.emptyDescription ??
+                                        "Try a different search term, or pick another category from the list." })) : renderAccordion ? (renderAccordion(faqs)) : (_jsx(FAQAccordion, { faqs: faqs })), renderPagination: () => renderPagination?.(total) ?? null, total: total, isLoading: isLoading }), faqs.length > 0 ? (_jsx(Div, { className: "mt-12", children: _jsx(ContactCTA, { email: contact.email, phone: contact.phone, contactHref: routeHelpers.contactHref, labels: {
                                         title: labels.contactTitle,
                                         description: labels.contactDescription,
                                         emailUs: labels.contactEmailUs,

package/dist/features/homepage/components/AnnouncementBar.js

@@ -55,8 +55,32 @@ export function AnnouncementBar({ message, link, className = "", onDismiss, over
     }, [message, userAlreadyDismissed]);
     if (dismissed)
         return null;
+    /*
+     * 🛑 THE OVERLAY IS md AND UP ONLY — IT PAINTED OVER THE HERO HEADING ON
+     * EVERY PHONE WIDTH.
+     *
+     * `absolute` reserves no space, which is the whole point of the overlay: the
+     * hero's own top padding is sized to sit a ONE-LINE banner over it. A real
+     * announcement wraps on a narrow screen, grows downward, and there is
+     * nothing to stop it.
+     *
+     * Measured on production against the live announcement, against the <h1>:
+     *
+     *   320px → 30px overlap      768px → 10px clear
+     *   390px → 10px overlap     1280px → 10px clear
+     *   430px → 10px overlap
+     *
+     * So it was every phone width and no tablet or desktop width — which is why
+     * it survived: the breakpoints people check it at are the ones where the
+     * message still fits on one line.
+     *
+     * Below `md` it is an ordinary in-flow bar that pushes the hero down, with a
+     * SOLID background (the translucent + blur treatment only reads as
+     * deliberate when there is artwork behind it). From `md` up, the designed
+     * overlay is unchanged.
+     */
     const positionCls = overlay
-        ? "absolute inset-x-0 top-0 z-20 bg-primary-700/85 backdrop-blur-sm"
+        ? "relative md:absolute inset-x-0 top-0 z-20 bg-primary-700 md:bg-primary-700/85 md:backdrop-blur-sm"
         : "relative left-1/2 right-1/2 w-screen -translate-x-1/2 bg-primary-700";
     return (_jsx(Div, { className: `${positionCls} transition-opacity duration-200 ${mounted ? "opacity-100" : "opacity-0"} ${className}`, role: "banner", children: _jsx(Div, { paddingX: "x-page", className: "container mx-auto max-w-[1920px]", children: _jsxs(Row, { textWeight: "medium", textSize: "sm", className: "relative text-left text-white", padding: "y-xs", align: "center", justify: "start", children: [link ? (_jsx(TextLink, { href: link, className: "text-white underline", children: message })) : (_jsx(Span, { children: message })), _jsx(IconButton, { type: "button", onClick: () => {
                             saveLocalDismissal(message);

package/dist/features/tester/seed-data/authored/buying__order-detail-actions.js

@@ -73,15 +73,29 @@ export const authored = {
         roles: ["buyer"],
         startPage: "/user/orders",
         steps: [
-            "Sign in as vivaan.kapoor@gmail.com / TempPass123! — this persona owns the seeded DELIVERED orders, and a return can only be requested on one.",
-            "Open /user/orders and open order-1-20251107-11joon, which is delivered.",
+            /*
+             * 🛑 rehan, NOT vivaan — and the order changed with it.
+             *
+             * This said vivaan.kapoor@gmail.com (user-seto-kaiba), who does own
+             * order-1-20251107-11joon. But TWO other cases in this same batch use
+             * that order as a FOREIGN one, and a batch browses as exactly one
+             * identity — so the page could not be worked as authored: the same
+             * order had to be both owned and not-owned by the signed-in user.
+             *
+             * rehan.sheikh@gmail.com (user-yugi-muto) is the harness's `main`
+             * identity, and order-1-20260818-stdctx is one of its delivered orders.
+             * That makes the whole batch coherent under one session and leaves the
+             * access-control cases genuinely foreign.
+             */
+            "Sign in as rehan.sheikh@gmail.com / TempPass123! — this persona owns the order below, and a return can only be requested on a delivered one.",
+            "Open /user/orders and open order-1-20260818-stdctx, which is delivered.",
             "Use the Return action.",
             "Give the reason: item not as described.",
             "Submit the request.",
             "Reload the order.",
             "Open /user/returns and look for it.",
         ],
-        inputs: { orderId: "order-1-20251107-11joon", reason: "item not as described" },
+        inputs: { orderId: "order-1-20260818-stdctx", reason: "item not as described" },
         expectedBehaviour: "A return request moves the order into Return Requested and appears on the returns surface. That status is deliberately an ACTIVE one — it is the seller's next action item, not a closed state — so the order must not disappear from the active list.",
         expectedUiState: "The order's status reads Return Requested, and the same order is listed under /user/returns.",
         expectedData: { statusAfterReturn: "return_requested" },

package/dist/seed/orders-seed-data.js

@@ -545,7 +545,25 @@ const acquisitionOrders = [
         shippingCarrier: "Delhivery",
         orderDate: daysAgo(12),
         shippingDate: daysAgo(9),
-        deliveryDate: daysAgo(6),
+        /*
+         * 🛑 TWO DAYS, NOT SIX — THIS IS THE RETURN-WINDOW FIXTURE.
+         *
+         * A return can only be requested on a DELIVERED order inside the 7-day
+         * window, and you cannot reach "delivered" by buying in a test: it needs
+         * seller action. So the return flow is testable only if a seeded delivered
+         * order sits inside the window — and until now none did for the harness's
+         * own identity. Every candidate was 6, 7, 8, 20, 29 days old, so
+         * /user/orders/{id}/return answered 'The 7-day return window for this
+         * order has closed.' and the case could never be worked.
+         *
+         * Six days would have been inside the window today and OUTSIDE it
+         * tomorrow — a fixture that passes on Monday and fails on Tuesday is worse
+         * than one that always fails, because the failure looks like a regression.
+         * Two days leaves five days of margin.
+         *
+         * Do not raise this without checking RETURN_WINDOW_DAYS.
+         */
+        deliveryDate: daysAgo(2),
         createdAt: daysAgo(12),
         updatedAt: daysAgo(6),
         sourceContext: { path: "standard", listPrice: 999 },