@mohasinac/appkit 4.41.5 → 4.41.7

package/dist/_internal/client/features/digital-code/DigitalContentPoolManager.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { IMAGE_ACCEPT_ATTR } from "../../../shared/media/limits";
 import { useCallback, useEffect, useState } from "react";
 import { normalizeError } from "../../../../errors/normalize";
 import { Alert, Button, Div, Row, Span, Stack, Text } from "../../../../ui";
@@ -63,5 +64,5 @@ export function DigitalContentPoolManager({ productId, api, canUploadFiles = fal
                                 await api.addCodes(productId, codes);
                                 setBulk("");
                             });
-                        }, children: "Add codes" }), _jsx(FilePickerButton, { variant: "secondary", size: "sm", disabled: busy, accept: canUploadFiles ? undefined : "image/*", onFile: (file) => void run(() => api.addAsset(productId, file)), children: canUploadFiles ? "Upload QR or file" : "Upload QR image" })] }), _jsx(Div, { children: entries === null ? (_jsx(Text, { size: "sm", color: "muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx(Text, { size: "sm", color: "muted", children: "Nothing in the pool yet." })) : (_jsx(Stack, { gap: "xs", children: entries.map((e) => (_jsxs(Row, { gap: "sm", align: "center", justify: "between", children: [_jsxs(Text, { size: "sm", children: [KIND_LABEL[e.contentKind], e.fileName ? ` — ${e.fileName}` : "", _jsxs(Span, { color: "muted", children: [" \u00B7 ", e.status] })] }), e.status !== "claimed" && (_jsx(Button, { type: "button", variant: "ghost", size: "sm", disabled: busy, onClick: () => void run(() => api.remove(productId, e.id)), children: "Remove" }))] }, e.id))) })) })] }));
+                        }, children: "Add codes" }), _jsx(FilePickerButton, { variant: "secondary", size: "sm", disabled: busy, accept: canUploadFiles ? undefined : IMAGE_ACCEPT_ATTR, onFile: (file) => void run(() => api.addAsset(productId, file)), children: canUploadFiles ? "Upload QR or file" : "Upload QR image" })] }), _jsx(Div, { children: entries === null ? (_jsx(Text, { size: "sm", color: "muted", children: "Loading\u2026" })) : entries.length === 0 ? (_jsx(Text, { size: "sm", color: "muted", children: "Nothing in the pool yet." })) : (_jsx(Stack, { gap: "xs", children: entries.map((e) => (_jsxs(Row, { gap: "sm", align: "center", justify: "between", children: [_jsxs(Text, { size: "sm", children: [KIND_LABEL[e.contentKind], e.fileName ? ` — ${e.fileName}` : "", _jsxs(Span, { color: "muted", children: [" \u00B7 ", e.status] })] }), e.status !== "claimed" && (_jsx(Button, { type: "button", variant: "ghost", size: "sm", disabled: busy, onClick: () => void run(() => api.remove(productId, e.id)), children: "Remove" }))] }, e.id))) })) })] }));
 }

package/dist/_internal/server/features/events/adapters.d.ts

@@ -0,0 +1,46 @@
+import type { LotteryConfig, ClientLotteryConfig } from "../../../../features/lottery/types";
+/** A spin prize as a public visitor may see it: what it is, not what it is worth. */
+export interface ClientSpinPrize {
+    id: string;
+    label: string;
+    isActive: boolean;
+}
+/** Allow-list, not a spread: `weight` and `couponId` are deliberately absent. */
+export declare function toClientSpinPrize(prize: {
+    id: string;
+    label: string;
+    isActive?: boolean;
+}): ClientSpinPrize;
+/**
+ * The three fields this projection touches; every other field passes through.
+ *
+ * 🛑 `lotteryConfig` accepts EITHER shape, and that is not laxness — it is the
+ * reason this leak survived review. `EventItem.lotteryConfig` is declared as
+ * `ClientLotteryConfig`, i.e. the already-projected type, while the repository
+ * hands back the STORED document with `price`, `weight` and `bookedByUserId`
+ * still on every slot. The type asserted the projection had happened; nothing
+ * had performed it. Accepting both means the adapter can be applied to a value
+ * whose type is lying, which is precisely where it is needed.
+ */
+export interface PublicEventInput {
+    createdBy?: string;
+    lotteryConfig?: LotteryConfig | ClientLotteryConfig;
+    spinPrizes?: {
+        id: string;
+        label: string;
+        isActive?: boolean;
+    }[];
+}
+/** What a caller gets back: `createdBy` gone, the two nested shapes narrowed. */
+export type PublicEvent<T extends PublicEventInput> = Omit<T, "createdBy" | "lotteryConfig" | "spinPrizes"> & {
+    lotteryConfig?: ClientLotteryConfig;
+    spinPrizes?: ClientSpinPrize[];
+};
+/**
+ * Project one stored event into its public shape.
+ *
+ * The return TYPE is narrowed too, not just the runtime value — so a caller
+ * that goes looking for `slot.weight` on the result gets a compile error rather
+ * than `undefined` at runtime, and the next projection bug is caught by tsc.
+ */
+export declare function toPublicEvent<T extends PublicEventInput>(event: T): PublicEvent<T>;

package/dist/_internal/server/features/events/adapters.js

@@ -0,0 +1,51 @@
+/**
+ * Events adapters — the public projection for an event document.
+ *
+ * 🛑 An event is published by two separate routes (appkit's own `eventIdGET`
+ * and the consumer's `/api/events` list), and both previously built their
+ * payload by SPREADING the stored document and deleting `createdBy`. A
+ * deny-list keyed on a handful of remembered field names publishes everything
+ * nobody thought to delete — see § Public Data Projections and Root Cause #70.
+ *
+ * Two nested structures on `EventDocument` carry fields that decide outcomes
+ * and must never leave the server:
+ *
+ *   - `lotteryConfig.slots[]` — per-slot `price` and `weight` (the weighting IS
+ *     the odds), plus the internal `bookedByUserId`.
+ *   - `spinPrizes[]`         — per-prize `weight` (again, the odds) and
+ *     `couponId` (an internal coupon document id).
+ *
+ * `SpinWheelView` reads `id`, `label` and `isActive` and nothing else, so
+ * dropping the other two costs the client nothing. The prize a spin actually
+ * wins is resolved server-side in `assignSpinPrize` and returned as a coupon
+ * CODE on the entry, never as the coupon's document id.
+ *
+ * Both routes call `toPublicEvent` so the two can no longer disagree
+ * (Root Cause #75 — a rule reachable by copy-paste gets copied, and the copy
+ * never learns about the branch added later).
+ */
+import { toClientLotteryConfig } from "../lottery/adapters";
+/** Allow-list, not a spread: `weight` and `couponId` are deliberately absent. */
+export function toClientSpinPrize(prize) {
+    return {
+        id: prize.id,
+        label: prize.label,
+        isActive: prize.isActive !== false,
+    };
+}
+/**
+ * Project one stored event into its public shape.
+ *
+ * The return TYPE is narrowed too, not just the runtime value — so a caller
+ * that goes looking for `slot.weight` on the result gets a compile error rather
+ * than `undefined` at runtime, and the next projection bug is caught by tsc.
+ */
+export function toPublicEvent(event) {
+    const { createdBy: _createdBy, lotteryConfig, spinPrizes, ...rest } = event;
+    const out = rest;
+    if (lotteryConfig)
+        out.lotteryConfig = toClientLotteryConfig(lotteryConfig);
+    if (Array.isArray(spinPrizes))
+        out.spinPrizes = spinPrizes.map(toClientSpinPrize);
+    return out;
+}

package/dist/_internal/server/features/lottery/adapters.d.ts

@@ -3,7 +3,13 @@
  * before any slot/config data leaves the server.
  */
 import type { LotteryConfig, LotterySlot, ClientLotteryConfig, ClientLotterySlot } from "../../../../features/lottery/types";
-/** Strip price and weight from a single slot for client consumption. */
-export declare function toClientLotterySlot(slot: LotterySlot): ClientLotterySlot;
+/**
+ * Strip price and weight from a single slot for client consumption.
+ *
+ * Takes the loose shape rather than `LotterySlot` so it can be applied to a
+ * value already TYPED as projected but not actually projected — which is the
+ * state `EventItem.lotteryConfig` is in when it comes off the repository.
+ */
+export declare function toClientLotterySlot(slot: LotterySlot | ClientLotterySlot): ClientLotterySlot;
 /** Strip price/weight from the entire config for client consumption. */
-export declare function toClientLotteryConfig(config: LotteryConfig): ClientLotteryConfig;
+export declare function toClientLotteryConfig(config: LotteryConfig | ClientLotteryConfig): ClientLotteryConfig;

package/dist/_internal/server/features/lottery/adapters.js

@@ -1,4 +1,10 @@
-/** Strip price and weight from a single slot for client consumption. */
+/**
+ * Strip price and weight from a single slot for client consumption.
+ *
+ * Takes the loose shape rather than `LotterySlot` so it can be applied to a
+ * value already TYPED as projected but not actually projected — which is the
+ * state `EventItem.lotteryConfig` is in when it comes off the repository.
+ */
 export function toClientLotterySlot(slot) {
     // Allow-list, not a spread: every field named here is a deliberate public
     // exposure with a known reader (§ Public Data Projections). `image` is read

package/dist/_internal/server/features/products/service.d.ts

@@ -18,6 +18,17 @@ export declare function assertPrizeDrawNotLocked(product: Pick<ProductDocument,
  * seller from swapping in a cheaper item after a buyer has already won.
  */
 export declare function assertPrizeDrawWonItemsImmutable(currentProduct: Pick<ProductDocument, "prizeDrawItems">, input: unknown): void;
+/**
+ * Anti-scam guard — an auction's economic terms (starting bid, reserve, close
+ * time) stop being editable the moment a real bid exists. Moving the goalposts
+ * under a live bidder is the one auction edit that must never pass.
+ *
+ * 🛑 It compares VALUES, not key presence. The seller editor round-trips the
+ * whole draft, so every save resubmits `startingBid` and `auctionEndDate`
+ * unchanged — rejecting on presence alone would make a live auction entirely
+ * unsaveable, and the seller could no longer fix so much as a typo.
+ */
+export declare function assertAuctionTermsMutable(existing: Pick<ProductDocument, "listingType" | "bidsHaveStarted" | "bidCount" | "startingBid" | "reservePrice" | "auctionEndDate">, input: unknown): void;
 /** Assert the product has available stock for a purchase. */
 export declare function assertInStock(product: ProductDocument, quantity?: number): void;
 /** Derive effective price (respects currentBid for auctions, base price otherwise). */

package/dist/_internal/server/features/products/service.js

@@ -66,6 +66,43 @@ export function assertPrizeDrawWonItemsImmutable(currentProduct, input) {
         }
     }
 }
+/**
+ * Anti-scam guard — an auction's economic terms (starting bid, reserve, close
+ * time) stop being editable the moment a real bid exists. Moving the goalposts
+ * under a live bidder is the one auction edit that must never pass.
+ *
+ * 🛑 It compares VALUES, not key presence. The seller editor round-trips the
+ * whole draft, so every save resubmits `startingBid` and `auctionEndDate`
+ * unchanged — rejecting on presence alone would make a live auction entirely
+ * unsaveable, and the seller could no longer fix so much as a typo.
+ */
+export function assertAuctionTermsMutable(existing, input) {
+    if ((existing.listingType ?? "standard") !== "auction")
+        return;
+    const bidding = existing.bidsHaveStarted === true || (existing.bidCount ?? 0) > 0;
+    if (!bidding)
+        return;
+    if (typeof input !== "object" || input === null)
+        return;
+    const patch = input;
+    const time = (v) => {
+        if (v == null)
+            return null;
+        const d = v instanceof Date ? v : new Date(v);
+        return Number.isNaN(d.getTime()) ? null : d.getTime();
+    };
+    const changed = [];
+    if ("startingBid" in patch && patch.startingBid !== existing.startingBid)
+        changed.push("starting bid");
+    if ("reservePrice" in patch && patch.reservePrice !== existing.reservePrice)
+        changed.push("reserve price");
+    if ("auctionEndDate" in patch &&
+        time(patch.auctionEndDate) !== time(existing.auctionEndDate))
+        changed.push("end date");
+    if (changed.length > 0) {
+        throw new ValidationError(`Bidding has already started on this auction, so its ${changed.join(" and ")} can no longer be changed. Everything else on the listing is still editable.`);
+    }
+}
 /** Assert the product has available stock for a purchase. */
 export function assertInStock(product, quantity = 1) {
     if ((product.availableQuantity ?? 0) < quantity) {

package/dist/_internal/shared/actions/action-registry.js

@@ -1527,6 +1527,17 @@ export const ACTIONS = {
             description: "Approve a return request and initiate the refund flow.",
             kind: "primary",
             permissions: ["admin", "moderator"],
+            // Required by Rule #7 — approving starts a real refund, which is money
+            // leaving the platform and is not undoable from this screen. Its absence
+            // also CRASHED /admin/return-requests outright: the view reads
+            // `confirmation!.title`, so a missing block threw "Cannot read properties
+            // of undefined (reading 'title')" during render and the page never painted.
+            confirmation: {
+                title: "Approve return request?",
+                body: "The order will be marked Refunded, the buyer will be notified, and the refund process will begin. This cannot be undone from here.",
+                confirmLabel: "Approve return",
+                confirmKind: "primary",
+            },
         },
         "reject-return": {
             iconKey: "reject",

package/dist/_internal/shared/features/products/schema.d.ts

@@ -1,181 +1,20 @@
 import { z } from "zod";
-export declare const productInputSchema: z.ZodObject<{
-    title: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    category: z.ZodString;
-    brandSlug: z.ZodOptional<z.ZodString>;
-    price: z.ZodNumber;
-    currency: z.ZodDefault<z.ZodString>;
-    stockQuantity: z.ZodDefault<z.ZodNumber>;
-    availableQuantity: z.ZodDefault<z.ZodNumber>;
-    mainImage: z.ZodEffects<z.ZodString, string, string>;
-    images: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    condition: z.ZodOptional<z.ZodEnum<["new", "like_new", "good", "fair", "poor", "used", "refurbished", "broken"]>>;
-    tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    seoTitle: z.ZodOptional<z.ZodString>;
-    seoDescription: z.ZodOptional<z.ZodString>;
-    seoKeywords: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    shippingInfo: z.ZodOptional<z.ZodString>;
-    returnPolicy: z.ZodOptional<z.ZodString>;
-    finalSale: z.ZodOptional<z.ZodBoolean>;
-    shippingPaidBy: z.ZodOptional<z.ZodEnum<["seller", "buyer"]>>;
-    insurance: z.ZodOptional<z.ZodBoolean>;
-    insuranceCost: z.ZodOptional<z.ZodNumber>;
-    allowOffers: z.ZodOptional<z.ZodBoolean>;
-    minOfferPercent: z.ZodOptional<z.ZodNumber>;
-    features: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+export declare const productInputSchema: z.ZodObject<{} & {
+    [x: string]: z.ZodOptional<z.ZodUnknown>;
 }, "strip", z.ZodTypeAny, {
-    currency: string;
-    title: string;
-    price: number;
-    category: string;
-    stockQuantity: number;
-    availableQuantity: number;
-    mainImage: string;
-    images: string[];
-    tags: string[];
-    brandSlug?: string | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
 }, {
-    title: string;
-    price: number;
-    category: string;
-    mainImage: string;
-    currency?: string | undefined;
-    brandSlug?: string | undefined;
-    stockQuantity?: number | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    availableQuantity?: number | undefined;
-    images?: string[] | undefined;
-    tags?: string[] | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
 }>;
 export declare const productUpdateSchema: z.ZodObject<{
-    title: z.ZodOptional<z.ZodString>;
-    description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    category: z.ZodOptional<z.ZodString>;
-    brandSlug: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    price: z.ZodOptional<z.ZodNumber>;
-    currency: z.ZodOptional<z.ZodDefault<z.ZodString>>;
-    stockQuantity: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-    availableQuantity: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
-    mainImage: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    images: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>>;
-    condition: z.ZodOptional<z.ZodOptional<z.ZodEnum<["new", "like_new", "good", "fair", "poor", "used", "refurbished", "broken"]>>>;
-    tags: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString, "many">>>;
-    seoTitle: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    seoDescription: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    seoKeywords: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
-    shippingInfo: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    returnPolicy: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-    finalSale: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
-    shippingPaidBy: z.ZodOptional<z.ZodOptional<z.ZodEnum<["seller", "buyer"]>>>;
-    insurance: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
-    insuranceCost: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
-    allowOffers: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
-    minOfferPercent: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
-    features: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    [x: string]: z.ZodOptional<z.ZodOptional<z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
-    currency?: string | undefined;
-    title?: string | undefined;
-    price?: number | undefined;
-    category?: string | undefined;
-    brandSlug?: string | undefined;
-    stockQuantity?: number | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    availableQuantity?: number | undefined;
-    mainImage?: string | undefined;
-    images?: string[] | undefined;
-    tags?: string[] | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
 }, {
-    currency?: string | undefined;
-    title?: string | undefined;
-    price?: number | undefined;
-    category?: string | undefined;
-    brandSlug?: string | undefined;
-    stockQuantity?: number | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    availableQuantity?: number | undefined;
-    mainImage?: string | undefined;
-    images?: string[] | undefined;
-    tags?: string[] | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
 }>;
 export declare const auctionInputSchema: z.ZodObject<{
-    title: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    category: z.ZodString;
-    brandSlug: z.ZodOptional<z.ZodString>;
-    price: z.ZodNumber;
-    currency: z.ZodDefault<z.ZodString>;
-    stockQuantity: z.ZodDefault<z.ZodNumber>;
-    availableQuantity: z.ZodDefault<z.ZodNumber>;
-    mainImage: z.ZodEffects<z.ZodString, string, string>;
-    images: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    condition: z.ZodOptional<z.ZodEnum<["new", "like_new", "good", "fair", "poor", "used", "refurbished", "broken"]>>;
-    tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    seoTitle: z.ZodOptional<z.ZodString>;
-    seoDescription: z.ZodOptional<z.ZodString>;
-    seoKeywords: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    shippingInfo: z.ZodOptional<z.ZodString>;
-    returnPolicy: z.ZodOptional<z.ZodString>;
-    finalSale: z.ZodOptional<z.ZodBoolean>;
-    shippingPaidBy: z.ZodOptional<z.ZodEnum<["seller", "buyer"]>>;
-    insurance: z.ZodOptional<z.ZodBoolean>;
-    insuranceCost: z.ZodOptional<z.ZodNumber>;
-    allowOffers: z.ZodOptional<z.ZodBoolean>;
-    minOfferPercent: z.ZodOptional<z.ZodNumber>;
-    features: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    [x: string]: z.ZodOptional<z.ZodUnknown>;
 } & {
     listingType: z.ZodLiteral<"auction">;
     startingBid: z.ZodNumber;
@@ -187,99 +26,30 @@ export declare const auctionInputSchema: z.ZodObject<{
     auctionExtensionMinutes: z.ZodOptional<z.ZodNumber>;
     auctionShippingPaidBy: z.ZodOptional<z.ZodEnum<["seller", "winner"]>>;
 }, "strip", z.ZodTypeAny, {
-    currency: string;
-    title: string;
-    price: number;
-    listingType: "auction";
-    category: string;
-    stockQuantity: number;
-    availableQuantity: number;
-    mainImage: string;
-    images: string[];
-    tags: string[];
-    auctionEndDate: string;
-    startingBid: number;
-    autoExtendable: boolean;
-    brandSlug?: string | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    reservePrice?: number | undefined;
-    buyNowPrice?: number | undefined;
-    minBidIncrement?: number | undefined;
-    auctionExtensionMinutes?: number | undefined;
-    auctionShippingPaidBy?: "seller" | "winner" | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
+    listingType?: unknown;
+    startingBid?: unknown;
+    reservePrice?: unknown;
+    buyNowPrice?: unknown;
+    minBidIncrement?: unknown;
+    auctionEndDate?: unknown;
+    autoExtendable?: unknown;
+    auctionExtensionMinutes?: unknown;
+    auctionShippingPaidBy?: unknown;
 }, {
-    title: string;
-    price: number;
-    listingType: "auction";
-    category: string;
-    mainImage: string;
-    auctionEndDate: string;
-    startingBid: number;
-    currency?: string | undefined;
-    brandSlug?: string | undefined;
-    stockQuantity?: number | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    availableQuantity?: number | undefined;
-    images?: string[] | undefined;
-    tags?: string[] | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    reservePrice?: number | undefined;
-    buyNowPrice?: number | undefined;
-    minBidIncrement?: number | undefined;
-    autoExtendable?: boolean | undefined;
-    auctionExtensionMinutes?: number | undefined;
-    auctionShippingPaidBy?: "seller" | "winner" | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
+    listingType?: unknown;
+    startingBid?: unknown;
+    reservePrice?: unknown;
+    buyNowPrice?: unknown;
+    minBidIncrement?: unknown;
+    auctionEndDate?: unknown;
+    autoExtendable?: unknown;
+    auctionExtensionMinutes?: unknown;
+    auctionShippingPaidBy?: unknown;
 }>;
 export declare const preOrderInputSchema: z.ZodObject<{
-    title: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    category: z.ZodString;
-    brandSlug: z.ZodOptional<z.ZodString>;
-    price: z.ZodNumber;
-    currency: z.ZodDefault<z.ZodString>;
-    stockQuantity: z.ZodDefault<z.ZodNumber>;
-    availableQuantity: z.ZodDefault<z.ZodNumber>;
-    mainImage: z.ZodEffects<z.ZodString, string, string>;
-    images: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    condition: z.ZodOptional<z.ZodEnum<["new", "like_new", "good", "fair", "poor", "used", "refurbished", "broken"]>>;
-    tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    seoTitle: z.ZodOptional<z.ZodString>;
-    seoDescription: z.ZodOptional<z.ZodString>;
-    seoKeywords: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    shippingInfo: z.ZodOptional<z.ZodString>;
-    returnPolicy: z.ZodOptional<z.ZodString>;
-    finalSale: z.ZodOptional<z.ZodBoolean>;
-    shippingPaidBy: z.ZodOptional<z.ZodEnum<["seller", "buyer"]>>;
-    insurance: z.ZodOptional<z.ZodBoolean>;
-    insuranceCost: z.ZodOptional<z.ZodNumber>;
-    allowOffers: z.ZodOptional<z.ZodBoolean>;
-    minOfferPercent: z.ZodOptional<z.ZodNumber>;
-    features: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    [x: string]: z.ZodOptional<z.ZodUnknown>;
 } & {
     listingType: z.ZodLiteral<"pre-order">;
     preOrderDeliveryDate: z.ZodString;
@@ -288,67 +58,21 @@ export declare const preOrderInputSchema: z.ZodObject<{
     preOrderProductionStatus: z.ZodDefault<z.ZodEnum<["upcoming", "in_production", "ready_to_ship"]>>;
     preOrderCancellable: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    currency: string;
-    title: string;
-    price: number;
-    listingType: "pre-order";
-    category: string;
-    stockQuantity: number;
-    availableQuantity: number;
-    mainImage: string;
-    images: string[];
-    tags: string[];
-    preOrderDeliveryDate: string;
-    preOrderProductionStatus: "upcoming" | "in_production" | "ready_to_ship";
-    preOrderCancellable: boolean;
-    brandSlug?: string | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    preOrderDepositPercent?: number | undefined;
-    preOrderMaxQuantity?: number | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
+    listingType?: unknown;
+    preOrderDeliveryDate?: unknown;
+    preOrderDepositPercent?: unknown;
+    preOrderMaxQuantity?: unknown;
+    preOrderProductionStatus?: unknown;
+    preOrderCancellable?: unknown;
 }, {
-    title: string;
-    price: number;
-    listingType: "pre-order";
-    category: string;
-    mainImage: string;
-    preOrderDeliveryDate: string;
-    currency?: string | undefined;
-    brandSlug?: string | undefined;
-    stockQuantity?: number | undefined;
-    features?: string[] | undefined;
-    description?: string | undefined;
-    availableQuantity?: number | undefined;
-    images?: string[] | undefined;
-    tags?: string[] | undefined;
-    shippingInfo?: string | undefined;
-    returnPolicy?: string | undefined;
-    condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
-    insurance?: boolean | undefined;
-    insuranceCost?: number | undefined;
-    shippingPaidBy?: "buyer" | "seller" | undefined;
-    preOrderDepositPercent?: number | undefined;
-    preOrderMaxQuantity?: number | undefined;
-    preOrderProductionStatus?: "upcoming" | "in_production" | "ready_to_ship" | undefined;
-    preOrderCancellable?: boolean | undefined;
-    seoTitle?: string | undefined;
-    seoDescription?: string | undefined;
-    seoKeywords?: string[] | undefined;
-    finalSale?: boolean | undefined;
-    allowOffers?: boolean | undefined;
-    minOfferPercent?: number | undefined;
+    [x: string]: unknown;
+    listingType?: unknown;
+    preOrderDeliveryDate?: unknown;
+    preOrderDepositPercent?: unknown;
+    preOrderMaxQuantity?: unknown;
+    preOrderProductionStatus?: unknown;
+    preOrderCancellable?: unknown;
 }>;
 export declare const setFeaturedSchema: z.ZodObject<{
     productId: z.ZodString;

package/dist/_internal/shared/features/products/schema.js

@@ -1,9 +1,10 @@
 import { z } from "zod";
 import { mediaUrlSchema } from "../../../../validation/schemas";
 import { PRODUCT_MAX_IMAGES } from "../../media/limits";
+import { PRODUCT_UPDATABLE_FIELDS } from "../../../../features/products/schemas/firestore";
 const priceSchema = z.number().min(0, "Price must be non-negative");
 const conditionSchema = z.enum(["new", "like_new", "good", "fair", "poor", "used", "refurbished", "broken"]);
-export const productInputSchema = z.object({
+const productBaseShape = z.object({
     title: z.string().min(3, "Title must be at least 3 characters").max(200),
     description: z.string().max(10000).optional(),
     category: z.string().min(1, "Category is required"),
@@ -30,6 +31,44 @@ export const productInputSchema = z.object({
     minOfferPercent: z.number().min(0).max(100).optional(),
     features: z.array(z.string()).max(50).optional(),
 });
+/**
+ * Every other field a seller legitimately owns on their own listing.
+ *
+ * 🛑 Declared, never `.passthrough()`. `sellerUpdateProduct` hands its parsed
+ * input straight to `productRepository.updateProduct` with no field filter, so
+ * passthrough would let a seller forge `currentBid` / `bidCount` / `viewCount`
+ * or reassign `storeId` to another store. The three sibling product-update
+ * routes DO use `.passthrough()`; they get away with it because they are
+ * admin-gated. This one is not.
+ *
+ * Derived from `PRODUCT_UPDATABLE_FIELDS` — the codebase's existing declaration
+ * of what a seller may change — so the two cannot drift (Root Cause #61).
+ *
+ * Why this exists: `productInputSchema` declared 24 fields while that constant
+ * lists 55, and `z.object()` SILENTLY STRIPS whatever it does not declare. The
+ * parse SUCCEEDED, so nothing surfaced anywhere — the seller saw a success
+ * toast and 38 fields were discarded on the way to Firestore, including
+ * `status` (so Publish wrote nothing at all), `listingType`, and all four
+ * per-type blocks that `draftToProductInput` had just carefully assembled.
+ * Update-side sibling of Root Cause #101.
+ */
+const EXTRA_WRITABLE_FIELDS = [
+    ...PRODUCT_UPDATABLE_FIELDS,
+    // Absent from that constant, but plainly the seller's own listing data —
+    // their media, their tax codes. Omitting them is an oversight in the list,
+    // not a policy: there is no integrity risk in a seller setting either.
+    "video",
+    "gstRate",
+    "hsnCode",
+    // Auction terms. Writable while the listing is still a draft; once a real
+    // bid exists, `sellerUpdateProduct` refuses them — changing the starting bid
+    // or the end date under a live bidder is the one case that must not pass.
+    "startingBid",
+    "auctionEndDate",
+];
+const declaredKeys = new Set(Object.keys(productBaseShape.shape));
+const extraWritableShape = Object.fromEntries(EXTRA_WRITABLE_FIELDS.filter((field) => !declaredKeys.has(field)).map((field) => [field, z.unknown().optional()]));
+export const productInputSchema = productBaseShape.extend(extraWritableShape);
 export const productUpdateSchema = productInputSchema.partial();
 export const auctionInputSchema = productInputSchema.extend({
     // SB1-G — canonical discriminator. Locked to "auction" via literal.

package/dist/_internal/shared/media/limits.d.ts

@@ -37,6 +37,18 @@ export type AllowedImageMime = (typeof ALLOWED_IMAGE_MIMES)[number];
 export type AllowedVideoMime = (typeof ALLOWED_VIDEO_MIMES)[number];
 export type AllowedDocMime = (typeof ALLOWED_DOC_MIMES)[number];
 export type AllowedMime = (typeof ALLOWED_MIMES)[number];
+/**
+ * The `accept` attribute for an image picker.
+ *
+ * 🛑 Never `image/*` — that wildcard matches `image/svg+xml`, which
+ * `ALLOWED_IMAGE_MIMES` deliberately excludes as an XSS surface. The server
+ * does reject it (`classifyMime` returns null and `/api/media/finalize` 422s),
+ * but only AFTER the picker has accepted it and the crop editor has opened on
+ * it — so the user frames and crops an image that was never going to upload,
+ * and the refusal arrives at the end looking like a failure rather than a rule.
+ * Deriving the attribute from the allowlist makes the picker refuse it first.
+ */
+export declare const IMAGE_ACCEPT_ATTR: string;
 export declare const ALLOWED_TYPES_LABEL = "JPEG, PNG, GIF, WebP, MP4, WebM, QuickTime, 3GP, MKV, PDF";
 export declare const MIME_TO_EXT: Record<string, string>;
 export declare function classifyMime(mime: string): MediaKind | null;

package/dist/_internal/shared/media/limits.js

@@ -76,6 +76,18 @@ export const ALLOWED_MIMES = [
     ...ALLOWED_VIDEO_MIMES,
     ...ALLOWED_DOC_MIMES,
 ];
+/**
+ * The `accept` attribute for an image picker.
+ *
+ * 🛑 Never `image/*` — that wildcard matches `image/svg+xml`, which
+ * `ALLOWED_IMAGE_MIMES` deliberately excludes as an XSS surface. The server
+ * does reject it (`classifyMime` returns null and `/api/media/finalize` 422s),
+ * but only AFTER the picker has accepted it and the crop editor has opened on
+ * it — so the user frames and crops an image that was never going to upload,
+ * and the refusal arrives at the end looking like a failure rather than a rule.
+ * Deriving the attribute from the allowlist makes the picker refuse it first.
+ */
+export const IMAGE_ACCEPT_ATTR = ALLOWED_IMAGE_MIMES.join(",");
 export const ALLOWED_TYPES_LABEL = "JPEG, PNG, GIF, WebP, MP4, WebM, QuickTime, 3GP, MKV, PDF";
 // Server-detected MIME → canonical filename extension. The browser-supplied
 // File.type is untrusted; the server picks the ext from the detected MIME.

package/dist/client.d.ts

@@ -402,7 +402,7 @@ export type { ListingTypeCapability } from "./_internal/shared/listing-types/cap
 export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_internal/shared/listing-types/_registry";
 export type { ListingTypePlugin } from "./_internal/shared/listing-types/_registry";
 export type { ListingType } from "./features/products/types/index";
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 export type { MediaKind, AllowedImageMime, AllowedVideoMime, AllowedDocMime, AllowedMime, } from "./_internal/shared/media/limits";
 export { ScamAwarenessModal } from "./features/scams/components/ScamAwarenessModal";
 export type { ScamAwarenessModalProps } from "./features/scams/components/ScamAwarenessModal";

package/dist/client.js

@@ -416,7 +416,7 @@ export { DashboardLayoutClient, RoleGuard } from "./_internal/client/features/la
 export { LISTING_TYPE_CAPABILITIES, capabilityFor, canAddToCart, canBid, supportsShipping, requiresVendorVerified, requiresJurisdictionCheck, hasInstantFulfillment, assertNever, } from "./_internal/shared/listing-types/capabilities";
 export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_internal/shared/listing-types/_registry";
 // Media upload limits — shared by client uploaders + server sign/finalize routes.
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 export { ScamAwarenessModal } from "./features/scams/components/ScamAwarenessModal";
 export { SellerTrustBadge } from "./features/scams/components/SellerTrustBadge";
 // [CLIENT-ONLY] — Admin panel components for action/nav permission management.

package/dist/features/blog/components/BlogPostForm.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { IMAGE_ACCEPT_ATTR } from "../../../_internal/shared/media/limits";
 import { Div, Input, Label, RichTextEditor, Select, Stack, TagInput, Text, Textarea, } from "../../../ui";
 import { Checkbox } from "../../forms/index";
 import { MediaUploadField, MediaUploadList } from "../../media/index";
@@ -11,7 +12,7 @@ function renderBlogPostMetaFields(props) {
 }
 function renderBlogPostMediaFields(props) {
     const { update, isReadonly, labels, onUploadCover, onUploadContentImage, onUploadAdditionalImage, onAbort, coverImageUrl, contentImages, additionalImages } = props;
-    return (_jsxs(_Fragment, { children: [_jsx(MediaUploadField, { label: labels.coverImage, value: coverImageUrl || "", onChange: (url) => update({ coverImage: url ? { url, type: "image" } : null }), onChangeField: (media) => update({ coverImage: media }), onUpload: onUploadCover, onAbort: onAbort, accept: "image/*", maxSizeMB: 10, disabled: isReadonly, helperText: labels.coverImageHelper }), _jsx(MediaUploadList, { label: labels.contentImages, value: contentImages, onChange: (media) => update({ contentImages: media }), onUpload: onUploadContentImage, onAbort: onAbort, accept: "image/*,video/*", maxItems: 10, maxSizeMB: 10, disabled: isReadonly, helperText: labels.contentImagesHelper }), _jsx(MediaUploadList, { label: labels.additionalImages, value: additionalImages, onChange: (media) => update({ additionalImages: media }), onUpload: onUploadAdditionalImage, onAbort: onAbort, accept: "image/*,video/*", maxItems: 5, maxSizeMB: 10, disabled: isReadonly, helperText: labels.additionalImagesHelper }), isReadonly && coverImageUrl && _jsx(Text, { size: "xs", variant: "secondary", children: coverImageUrl })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(MediaUploadField, { label: labels.coverImage, value: coverImageUrl || "", onChange: (url) => update({ coverImage: url ? { url, type: "image" } : null }), onChangeField: (media) => update({ coverImage: media }), onUpload: onUploadCover, onAbort: onAbort, accept: IMAGE_ACCEPT_ATTR, maxSizeMB: 10, disabled: isReadonly, helperText: labels.coverImageHelper }), _jsx(MediaUploadList, { label: labels.contentImages, value: contentImages, onChange: (media) => update({ contentImages: media }), onUpload: onUploadContentImage, onAbort: onAbort, accept: "image/*,video/*", maxItems: 10, maxSizeMB: 10, disabled: isReadonly, helperText: labels.contentImagesHelper }), _jsx(MediaUploadList, { label: labels.additionalImages, value: additionalImages, onChange: (media) => update({ additionalImages: media }), onUpload: onUploadAdditionalImage, onAbort: onAbort, accept: "image/*,video/*", maxItems: 5, maxSizeMB: 10, disabled: isReadonly, helperText: labels.additionalImagesHelper }), isReadonly && coverImageUrl && _jsx(Text, { size: "xs", variant: "secondary", children: coverImageUrl })] }));
 }
 export function BlogPostForm({ value, onChange, categoryOptions, statusOptions, labels, onUploadCover, onUploadContentImage, onUploadAdditionalImage, onAbort, isReadonly = false, renderContentField, renderContentReadonly, }) {
     const coverImageUrl = getMediaUrl(value.coverImage) ?? null;

package/dist/features/catalogue/components/CatalogueItemEditorView.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { IMAGE_ACCEPT_ATTR } from "../../../_internal/shared/media/limits";
 /**
  * Add or edit an item in a user's personal catalogue.
  *
@@ -82,7 +83,7 @@ export function CatalogueItemEditorView({ item, onSaved }) {
                     // `mainImage` is derived, so it moves with the gallery rather
                     // than pointing at a photo the user has since removed.
                     onChange({ images: urls, mainImage: urls[0] ?? "" });
-                }, onUpload: handleUpload, accept: "image/*", maxItems: 8, helperText: "Photos older than 30 days must be refreshed before this item can be listed." })),
+                }, onUpload: handleUpload, accept: IMAGE_ACCEPT_ATTR, maxItems: 8, helperText: "Photos older than 30 days must be refreshed before this item can be listed." })),
             categorySlugs: ({ values, onChange }) => (
             // Explicit `<string>`: with `multiple`, `value` is `V[]`, so an
             // inferred V reads the array itself as the option type.

package/dist/features/events/api/[id]/route.js

@@ -18,7 +18,7 @@ import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts";
 import { EVENT_FIELDS } from "../../schemas";
 import { normalizeError } from "../../../../errors/normalize";
-import { toClientLotteryConfig } from "../../../../_internal/server/features/lottery/adapters";
+import { toPublicEvent } from "../../../../_internal/server/features/events/adapters";
 // --- GET /api/events/[id] -----------------------------------------------------
 export async function GET(_request, context) {
     try {
@@ -34,22 +34,12 @@ export async function GET(_request, context) {
             event.status === EVENT_FIELDS.STATUS_VALUES.PAUSED) {
             return NextResponse.json({ success: false, error: "Event not found" }, { status: 404 });
         }
-        // Strip internal field.
-        //
-        // 🛑 This is a deny-list spread, so anything NOT named here is published by
-        // default — which is how a lottery event's stored `lotteryConfig` reached
-        // anonymous callers whole. `toClientLotteryConfig` is the allow-list that
-        // belongs on this boundary: it drops the per-slot `price` and `weight` (the
-        // weighting is how the odds are set) and the internal `bookedByUserId`,
-        // while deliberately keeping `bookedByDisplayName` and
-        // `bookedByUserLotteryNumber`, which the public slot grid renders.
-        const { createdBy: _createdBy, ...rawPublicEvent } = event;
-        const publicEvent = rawPublicEvent.lotteryConfig
-            ? {
-                ...rawPublicEvent,
-                lotteryConfig: toClientLotteryConfig(rawPublicEvent.lotteryConfig),
-            }
-            : rawPublicEvent;
+        // 🛑 Do not hand-roll this projection here. `toPublicEvent` drops
+        // `createdBy` AND allow-lists the two nested structures that decide
+        // outcomes — `lotteryConfig.slots[]` (price / weight / bookedByUserId) and
+        // `spinPrizes[]` (weight / couponId). Both were published to anonymous
+        // callers by the deny-list spread that used to live here.
+        const publicEvent = toPublicEvent(event);
         const entriesRepo = db.getRepository("eventEntries");
         // For poll events with resultsVisibility='always': compute live vote tallies
         let pollResults = [];

package/dist/features/homepage/components/CharacterHotspotForm.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { IMAGE_ACCEPT_ATTR } from "../../../_internal/shared/media/limits";
 import { normalizeError } from "../../../errors/normalize";
 import { useEffect, useState, useRef } from "react";
 import { z } from "zod";
@@ -159,7 +160,7 @@ export function CharacterHotspotForm({ initial, onUploadImage, onSave, onAfterSa
                                 className: "mt-1 text-center text-[10px]", style: { color: "var(--color-muted)" }, children: s.label })] }, s.key))) }), step === "image" && (_jsxs(Div, { className: CLS_STEP, style: {
                         borderColor: "var(--border-ink)",
                         background: "var(--surface-elevated)",
-                    }, children: [_jsx(Heading, { level: 2, size: "lg", weight: "bold", children: "Upload Background Image" }), _jsx(Text, { style: { color: "var(--color-muted)" }, size: "sm", children: "Choose a wide panoramic image that shows all the characters. You will place pins on it in the next step." }), _jsxs(Label, { layout: "flex-col-center", gap: "md", rounded: "lg", padding: "xl", className: "cursor-pointer border-2 border-dashed transition-colors hover:opacity-80", style: { borderColor: "var(--border-ink)" }, children: [_jsx(Span, { size: "3xl", children: "\uD83D\uDDBC" }), _jsx(Span, { weight: "medium", children: uploading ? "Uploading…" : "Click to choose image" }), _jsx(Span, { size: "xs", style: { color: "var(--color-muted)" }, children: "JPG, PNG, WebP \u2014 wide landscape images work best" }), _jsx(Input, { type: "file", accept: "image/*", className: "hidden", onChange: handleImageUpload, disabled: uploading })] }), imageUrl && (_jsxs(Stack, { gap: "xs", children: [_jsx(Div, { className: CLS_IMG_WRAP, style: { paddingTop: "37.5%" }, children: _jsx(Image, { src: resolveMediaUrl(imageUrl), alt: imageAlt, fill: true, className: "object-cover", sizes: "680px" }) }), _jsx(Text, { className: CLS_SUCCESS_TEXT, children: "\u2713 Image uploaded" })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { size: "sm", weight: "bold", children: "Image Alt Text" }), _jsx(Input, { type: "text", value: imageAlt, onChange: (e) => setImageAlt(e.target.value), placeholder: "DC, Marvel and Anime characters", className: CLS_INPUT, style: {
+                    }, children: [_jsx(Heading, { level: 2, size: "lg", weight: "bold", children: "Upload Background Image" }), _jsx(Text, { style: { color: "var(--color-muted)" }, size: "sm", children: "Choose a wide panoramic image that shows all the characters. You will place pins on it in the next step." }), _jsxs(Label, { layout: "flex-col-center", gap: "md", rounded: "lg", padding: "xl", className: "cursor-pointer border-2 border-dashed transition-colors hover:opacity-80", style: { borderColor: "var(--border-ink)" }, children: [_jsx(Span, { size: "3xl", children: "\uD83D\uDDBC" }), _jsx(Span, { weight: "medium", children: uploading ? "Uploading…" : "Click to choose image" }), _jsx(Span, { size: "xs", style: { color: "var(--color-muted)" }, children: "JPG, PNG, WebP \u2014 wide landscape images work best" }), _jsx(Input, { type: "file", accept: IMAGE_ACCEPT_ATTR, className: "hidden", onChange: handleImageUpload, disabled: uploading })] }), imageUrl && (_jsxs(Stack, { gap: "xs", children: [_jsx(Div, { className: CLS_IMG_WRAP, style: { paddingTop: "37.5%" }, children: _jsx(Image, { src: resolveMediaUrl(imageUrl), alt: imageAlt, fill: true, className: "object-cover", sizes: "680px" }) }), _jsx(Text, { className: CLS_SUCCESS_TEXT, children: "\u2713 Image uploaded" })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { size: "sm", weight: "bold", children: "Image Alt Text" }), _jsx(Input, { type: "text", value: imageAlt, onChange: (e) => setImageAlt(e.target.value), placeholder: "DC, Marvel and Anime characters", className: CLS_INPUT, style: {
                                         borderColor: "var(--border-ink)",
                                         background: "var(--surface-elevated)",
                                         color: "var(--color-black)",
@@ -319,7 +320,7 @@ export function CharacterHotspotForm({ initial, onUploadImage, onSave, onAfterSa
                                             }, children: "+" }), pin.name && (_jsx(Div, { textWeight: "bold", className: "pointer-events-none absolute left-8 top-1/2 -translate-y-1/2 whitespace-nowrap text-[9px] text-white", rounded: "default", style: { paddingInline: "0.375rem", paddingBlock: "0.125rem", background: "black" }, children: pin.name }))] }, pin.id)))] }), pins.length > 0 ? (_jsx(Ul, { rounded: "lg", className: "divide-y border", style: { borderColor: "var(--border-ink)" }, children: pins.map((pin, i) => (_jsx(Li, { padding: "inline", children: _jsxs(Row, { gap: "sm", children: [_jsx(Span, { layout: "flex-center", color: "inverse", className: "h-6 w-6 shrink-0", rounded: "full", size: "xs", weight: "bold", style: { background: pin.accent || DEFAULT_ACCENT_HEX }, children: i + 1 }), _jsxs(Div, { className: "min-w-0 flex-1", children: [_jsx(Text, { className: "truncate", size: "sm", weight: "bold", children: pin.name || (_jsx(Span, { className: "italic", style: { color: "var(--color-muted)" }, children: "Unnamed" })) }), _jsxs(Text, { style: { color: "var(--color-muted)" }, size: "xs", children: [pin.universe, " \u00B7 ", pin.xPct.toFixed(0), "%,", " ", pin.yPct.toFixed(0), "%"] })] }), _jsx(Button, { type: "button", onClick: () => deletePin(pin.id), variant: "ghost", className: CLS_DELETE_PIN, title: "Remove pin", children: "\u2715" })] }) }, pin.id))) })) : (_jsx(Div, { textSize: "sm", className: "border-2 border-dashed text-left", rounded: "lg", padding: "xl", style: {
                                 borderColor: "var(--border-ink)",
                                 color: "var(--color-muted)",
-                            }, children: "No pins yet \u2014 add some using the button below." })), _jsxs(Details, { rounded: "lg", padding: "md", className: "border", style: { borderColor: "var(--border-ink)" }, children: [_jsx(Summary, { size: "sm", weight: "medium", children: "Image Settings" }), _jsxs(Stack, { className: "mt-3", gap: "3", children: [_jsxs(Label, { layout: "inline-flex", gap: "md", rounded: "default", padding: "toolbar", className: "cursor-pointer border-2 border-dashed transition-colors hover:opacity-80", size: "sm", weight: "medium", style: { borderColor: "var(--border-ink)" }, children: [uploading ? "Uploading…" : "Replace Image", _jsx(Input, { type: "file", accept: "image/*", className: "hidden", onChange: handleImageUpload, disabled: uploading })] }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { size: "sm", weight: "bold", children: "Image Alt Text" }), _jsx(Input, { type: "text", value: imageAlt, onChange: (e) => setImageAlt(e.target.value), className: CLS_INPUT, style: {
+                            }, children: "No pins yet \u2014 add some using the button below." })), _jsxs(Details, { rounded: "lg", padding: "md", className: "border", style: { borderColor: "var(--border-ink)" }, children: [_jsx(Summary, { size: "sm", weight: "medium", children: "Image Settings" }), _jsxs(Stack, { className: "mt-3", gap: "3", children: [_jsxs(Label, { layout: "inline-flex", gap: "md", rounded: "default", padding: "toolbar", className: "cursor-pointer border-2 border-dashed transition-colors hover:opacity-80", size: "sm", weight: "medium", style: { borderColor: "var(--border-ink)" }, children: [uploading ? "Uploading…" : "Replace Image", _jsx(Input, { type: "file", accept: IMAGE_ACCEPT_ATTR, className: "hidden", onChange: handleImageUpload, disabled: uploading })] }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { size: "sm", weight: "bold", children: "Image Alt Text" }), _jsx(Input, { type: "text", value: imageAlt, onChange: (e) => setImageAlt(e.target.value), className: CLS_INPUT, style: {
                                                         borderColor: "var(--border-ink)",
                                                         background: "var(--surface-elevated)",
                                                         color: "var(--color-black)",

package/dist/features/media/AvatarUpload.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { IMAGE_ACCEPT_ATTR } from "../../_internal/shared/media/limits";
 import { useEffect, useRef, useState } from "react";
 import { Alert, Button, Div, Input, Progress, Row, Stack, Text, useToast } from "../../ui";
 import { useMediaUpload } from "./hooks/useMedia";
@@ -131,6 +132,6 @@ export function AvatarUpload({ currentPhotoURL, currentCropData, userId, display
             fileInputRef.current.value = "";
     };
     const hasPending = pendingCropData !== null && pendingUploadFile !== null;
-    return (_jsxs(_Fragment, { children: [_jsxs(Stack, { gap: "md", children: [_jsxs(Row, { align: "start", gap: "lg", children: [_jsx(Div, { className: "shrink-0", children: _jsx(AvatarDisplay, { cropData: hasPending ? pendingCropData : cropData, size: "2xl", className: `border-4 ${hasPending ? "border-primary/60 ring-2 ring-primary/20" : "border-[var(--appkit-color-border)]"}`, displayName: displayName }) }), _jsxs(Stack, { className: "flex-1", gap: "3", children: [_jsx(Text, { variant: "secondary", size: "xs", children: "JPG, PNG, WEBP or GIF up to 10MB." }), isUploading ? (_jsx(Progress, { value: 50, variant: "primary", size: "sm", label: t.uploading })) : null, hasPending && !isUploading ? (_jsxs(Stack, { gap: "sm", children: [_jsx(Text, { variant: "secondary", className: "text-primary", size: "xs", children: t.readyToSave }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { type: "button", onClick: handleConfirmSave, size: "sm", children: t.saveAvatar }), _jsx(Button, { type: "button", variant: "secondary", size: "sm", onClick: handleCancelPending, children: t.cancelChange })] })] })) : null, !hasPending && !isUploading ? (_jsxs(Row, { gap: "3", children: [_jsx(Button, { type: "button", onClick: () => fileInputRef.current?.click(), size: "sm", children: previewUrl ? t.changePhoto : t.chooseImage }), previewUrl ? (_jsx(Button, { type: "button", variant: "secondary", size: "sm", onClick: handleRemovePhoto, children: t.removePhoto })) : null] })) : null, _jsx(Input, { ref: fileInputRef, bare: true, type: "file", accept: "image/*", onChange: handleFileSelect, className: "hidden", "aria-label": t.changePhoto })] })] }), uploadApiError ? (_jsx(Alert, { variant: "error", children: uploadApiError.message })) : null] }), showCropModal && tempImageUrl ? (_jsx(ImageCropModal, { isOpen: showCropModal, imageUrl: tempImageUrl, onClose: handleCropCancel, onSave: handleCropSave, initialCropData: cropData || undefined })) : null] }));
+    return (_jsxs(_Fragment, { children: [_jsxs(Stack, { gap: "md", children: [_jsxs(Row, { align: "start", gap: "lg", children: [_jsx(Div, { className: "shrink-0", children: _jsx(AvatarDisplay, { cropData: hasPending ? pendingCropData : cropData, size: "2xl", className: `border-4 ${hasPending ? "border-primary/60 ring-2 ring-primary/20" : "border-[var(--appkit-color-border)]"}`, displayName: displayName }) }), _jsxs(Stack, { className: "flex-1", gap: "3", children: [_jsx(Text, { variant: "secondary", size: "xs", children: "JPG, PNG, WEBP or GIF up to 10MB." }), isUploading ? (_jsx(Progress, { value: 50, variant: "primary", size: "sm", label: t.uploading })) : null, hasPending && !isUploading ? (_jsxs(Stack, { gap: "sm", children: [_jsx(Text, { variant: "secondary", className: "text-primary", size: "xs", children: t.readyToSave }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { type: "button", onClick: handleConfirmSave, size: "sm", children: t.saveAvatar }), _jsx(Button, { type: "button", variant: "secondary", size: "sm", onClick: handleCancelPending, children: t.cancelChange })] })] })) : null, !hasPending && !isUploading ? (_jsxs(Row, { gap: "3", children: [_jsx(Button, { type: "button", onClick: () => fileInputRef.current?.click(), size: "sm", children: previewUrl ? t.changePhoto : t.chooseImage }), previewUrl ? (_jsx(Button, { type: "button", variant: "secondary", size: "sm", onClick: handleRemovePhoto, children: t.removePhoto })) : null] })) : null, _jsx(Input, { ref: fileInputRef, bare: true, type: "file", accept: IMAGE_ACCEPT_ATTR, onChange: handleFileSelect, className: "hidden", "aria-label": t.changePhoto })] })] }), uploadApiError ? (_jsx(Alert, { variant: "error", children: uploadApiError.message })) : null] }), showCropModal && tempImageUrl ? (_jsx(ImageCropModal, { isOpen: showCropModal, imageUrl: tempImageUrl, onClose: handleCropCancel, onSave: handleCropSave, initialCropData: cropData || undefined })) : null] }));
 }
 export default AvatarUpload;

package/dist/features/media/upload/ImageUpload.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { IMAGE_ACCEPT_ATTR } from "../../../_internal/shared/media/limits";
 import { normalizeError } from "../../../errors/normalize";
 /**
  * ImageUpload — canonical image upload component for @mohasinac/feat-media.
@@ -185,5 +186,5 @@ export function ImageUpload({ currentImage, onUpload, onChange, accept = "image/
     };
     return (_jsxs(Stack, { gap: "3", children: [label && (_jsx(Label, { className: "block", color: "muted", size: "sm", weight: "medium", children: label })), _jsx(Div, { className: "relative", children: preview ? (_jsxs(Stack, { gap: "sm", children: [_jsxs(Div, { className: `relative h-32 max-w-xs mx-auto ${__O.hidden}`, rounded: "lg", border: "default", children: [_jsx(MediaImage, { src: preview, alt: "Preview", size: "card" }), uploading && progress > 0 && (_jsx(Div, { className: "absolute inset-x-0 bottom-0", children: _jsx(Progress, { value: progress, size: "sm" }) }))] }), !uploading && (_jsxs(Row, { wrap: true, gap: "sm", children: [(enableCrop || enableAdvancedCrop) && (_jsx(Button, { type: "button", onClick: () => openEditor(preview), variant: "secondary", size: "sm", children: tMediaEditor("editImage") })), _jsx(Button, { type: "button", onClick: () => fileInputRef.current?.click(), variant: "outline", size: "sm", children: tUpload("change") }), _jsx(Button, { type: "button", onClick: handleRemove, variant: "danger", size: "sm", children: tUpload("remove") })] }))] })) : (_jsxs(_Fragment, { children: [showCamera && isCameraSupported && (_jsx(CameraCapture, { mode: "photo", facingMode: "environment", onCapture: handleCameraCapture, onError: setError })), !showCamera && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Row, { gap: "sm", wrap: true, children: [showFileInput && (_jsx(Button, { type: "button", onClick: () => fileInputRef.current?.click(), disabled: uploading, variant: "outline", size: "sm", children: uploading ? tUpload("uploading") : tUpload("clickToUpload") })), captureSource !== "file-only" && isCameraSupported && (_jsx(Button, { type: "button", onClick: () => setCaptureMode("camera"), disabled: uploading, variant: "ghost", size: "sm", children: t("switchToCamera") })), captureSource !== "file-only" && !isCameraSupported && (_jsx(Button, { type: "button", onClick: () => mobileCaptureRef.current?.click(), disabled: uploading, variant: "ghost", size: "sm", children: t("switchToCamera") }))] }), _jsxs(Text, { size: "xs", variant: "secondary", children: [accept === "image/*"
                                             ? `JPG PNG GIF WebP`
-                                            : accept.split(",").map((a) => a.split("/")[1]?.toUpperCase() ?? a).join(" "), " ", "\u2014 max ", maxSizeMB, "MB"] })] }))] })) }), _jsx("input", { ref: fileInputRef, type: "file", accept: accept, onChange: handleFileChange, className: "hidden", "aria-hidden": "true", "data-testid": "media-upload-input" }), showCamera && !isCameraSupported && (_jsx("input", { ref: mobileCaptureRef, type: "file", accept: "image/*", capture: "environment", onChange: handleFileChange, className: "hidden", "aria-hidden": "true", "data-testid": "media-upload-capture-input" })), helperText && !error && (_jsx(Text, { variant: "secondary", size: "xs", children: helperText })), error && _jsx(Alert, { variant: "error", children: error }), uploading && (_jsxs(Row, { gap: "sm", children: [_jsx(Spinner, { size: "sm" }), _jsx(Text, { size: "sm", variant: "secondary", children: tUpload("uploadingProgress", { progress }) })] })), cropPreviewUrl && !enableAdvancedCrop && (_jsx(ImageCropModal, { isOpen: showCropModal, imageUrl: cropPreviewUrl, onClose: handleCropClose, onSave: handleCropSave })), cropPreviewUrl && enableAdvancedCrop && (_jsx(ImageEditor, { isOpen: showAdvancedEditor, imageUrl: cropPreviewUrl, onClose: handleAdvancedEditorClose, onSave: handleAdvancedEditorSave, aspectRatio: cropAspectRatio }))] }));
+                                            : accept.split(",").map((a) => a.split("/")[1]?.toUpperCase() ?? a).join(" "), " ", "\u2014 max ", maxSizeMB, "MB"] })] }))] })) }), _jsx("input", { ref: fileInputRef, type: "file", accept: accept, onChange: handleFileChange, className: "hidden", "aria-hidden": "true", "data-testid": "media-upload-input" }), showCamera && !isCameraSupported && (_jsx("input", { ref: mobileCaptureRef, type: "file", accept: IMAGE_ACCEPT_ATTR, capture: "environment", onChange: handleFileChange, className: "hidden", "aria-hidden": "true", "data-testid": "media-upload-capture-input" })), helperText && !error && (_jsx(Text, { variant: "secondary", size: "xs", children: helperText })), error && _jsx(Alert, { variant: "error", children: error }), uploading && (_jsxs(Row, { gap: "sm", children: [_jsx(Spinner, { size: "sm" }), _jsx(Text, { size: "sm", variant: "secondary", children: tUpload("uploadingProgress", { progress }) })] })), cropPreviewUrl && !enableAdvancedCrop && (_jsx(ImageCropModal, { isOpen: showCropModal, imageUrl: cropPreviewUrl, onClose: handleCropClose, onSave: handleCropSave })), cropPreviewUrl && enableAdvancedCrop && (_jsx(ImageEditor, { isOpen: showAdvancedEditor, imageUrl: cropPreviewUrl, onClose: handleAdvancedEditorClose, onSave: handleAdvancedEditorSave, aspectRatio: cropAspectRatio }))] }));
 }

package/dist/features/seller/actions/seller-actions.js

@@ -17,7 +17,7 @@ import { userRepository } from "../../auth/repository/user.repository";
 import { storeRepository } from "../../stores/repository/store.repository";
 import { productRepository } from "../../products/repository/products.repository";
 import { ProductStatusValues } from "../../products/schemas";
-import { assertPrizeDrawNotLocked, assertPrizeDrawWonItemsImmutable, } from "../../../_internal/server/features/products/service";
+import { assertPrizeDrawNotLocked, assertPrizeDrawWonItemsImmutable, assertAuctionTermsMutable, } from "../../../_internal/server/features/products/service";
 import { orderRepository } from "../../orders/repository/orders.repository";
 import { OrderStatusValues } from "../../orders/schemas";
 import { payoutRepository } from "../../payments/repository/payout.repository";
@@ -561,6 +561,7 @@ export async function sellerUpdateProduct(userId, userRole, productId, input) {
         assertPrizeDrawNotLocked(existing, "unpublished or archived");
     }
     assertPrizeDrawWonItemsImmutable(existing, input.prizeDrawItems);
+    assertAuctionTermsMutable(existing, input);
     const finalizedData = await finalizeProductMediaReferences(input);
     const updated = await productRepository.updateProduct(productId, finalizedData);
     serverLogger.info("sellerUpdateProduct", { userId, productId });

package/dist/index.d.ts

@@ -3140,7 +3140,7 @@ export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_
 export type { ListingTypePlugin } from "./_internal/shared/listing-types/_registry";
 export { getListingRule, getCategoryRule, pickOrderType, getSplitKey, runSyncPreflight, CHECKOUT_RULES, CATEGORY_CHECKOUT_RULES, CHECKOUT_MAX_ORDERS_PER_TX, PRIZE_DRAW_MAX_REVEALS_PER_ORDER, BUNDLE_MAX_QTY_PER_TX, STANDARD_MAX_QTY_PER_LINE, } from "./_internal/shared/checkout/rules";
 export type { ListingCheckoutRule, CategoryCheckoutRule, CartItemProductPair, OrderItemInput, RefundPolicy, } from "./_internal/shared/checkout/rules";
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 export type { MediaKind, AllowedImageMime, AllowedVideoMime, AllowedDocMime, AllowedMime, } from "./_internal/shared/media/limits";
 export { PRODUCT_FIELDS, PRODUCT_STATUS_TRANSITIONS, ORDER_FIELDS, REVIEW_FIELDS, BID_FIELDS, AD_FIELDS, AD_TRACKED_FIELDS, BLOG_FIELDS, BRAND_FIELDS, WISHLIST_FIELDS, HISTORY_FIELDS, COUPON_USAGE_FIELDS, CAROUSEL_FIELDS, FAQ_FIELDS, HOMEPAGE_SECTION_FIELDS, SITE_SETTINGS_FIELDS, COMMON_FIELDS, OAUTH_STATE_VALUES, SCHEMA_DEFAULTS, } from "./constants/field-names";
 export { SORT_DIR, sortBy } from "./constants/sort";

package/dist/index.js

@@ -5509,7 +5509,7 @@ export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_
 // Checkout rule registry â€" pure TS, safe in both client and server bundles.
 export { getListingRule, getCategoryRule, pickOrderType, getSplitKey, runSyncPreflight, CHECKOUT_RULES, CATEGORY_CHECKOUT_RULES, CHECKOUT_MAX_ORDERS_PER_TX, PRIZE_DRAW_MAX_REVEALS_PER_ORDER, BUNDLE_MAX_QTY_PER_TX, STANDARD_MAX_QTY_PER_LINE, } from "./_internal/shared/checkout/rules";
 // Media upload limits â€" pure constants, safe in both client and server bundles.
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 // ── Field name constants — canonical source of truth for all Firestore field names ──
 // NOTE: STORE_FIELDS, CATEGORY_FIELDS, EVENT_FIELDS, EVENT_ENTRY_FIELDS, PAYOUT_FIELDS,
 // COUPON_FIELDS, CART_FIELDS, USER_FIELDS, ADDRESS_FIELDS, NOTIFICATION_FIELDS,

package/dist/server.d.ts

@@ -528,7 +528,7 @@ export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_
 export type { ListingTypePlugin } from "./_internal/shared/listing-types/_registry";
 export { applyMediaContextGuards, CONTEXT_LIMITS, } from "./_internal/server/features/media/contextGuards";
 export type { GuardResult, GuardError, GuardSuccess } from "./_internal/server/features/media/contextGuards";
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 export type { MediaKind, AllowedImageMime, AllowedVideoMime, AllowedDocMime, AllowedMime, } from "./_internal/shared/media/limits";
 export { getServerPermissions, checkPermission, checkAnyPermission, makeAdminSectionLayout, } from "./_internal/server/features/auth/permissions";
 export type { ResolvedPermissions, AdminSectionLayoutOpts, } from "./_internal/server/features/auth/permissions";
@@ -566,6 +566,8 @@ export { renderLiveItemOg, renderLiveItemOgImage, renderLiveItemOgFromDoc, type
 export { getLotteryEventCached, listLotteryEvents, getLotteryEntriesForAdmin, getLotteryEntriesForUser } from "./_internal/server/features/lottery/data";
 export type { LotteryEventClient } from "./_internal/server/features/lottery/data";
 export { toClientLotterySlot, toClientLotteryConfig } from "./_internal/server/features/lottery/adapters";
+export { toPublicEvent, toClientSpinPrize } from "./_internal/server/features/events/adapters";
+export type { ClientSpinPrize } from "./_internal/server/features/events/adapters";
 export { buildLotteryMetadata } from "./_internal/server/features/lottery/metadata";
 export { submitLotteryPullAction, flagLotteryEntryAction, reopenLotterySlotAction, createLotteryEventAction, updateLotteryEventAction, setProductLotteryModeAction, } from "./_internal/server/features/lottery/actions";
 export { lotteryEntryRepository } from "./features/lottery/repository/lottery-entry.repository";

package/dist/server.js

@@ -1407,7 +1407,7 @@ export { LISTING_TYPE_REGISTRY, pluginFor, detectListingTypeFromSlug } from "./_
 // Media context guards — shared by /api/media/sign + legacy /api/media/upload.
 export { applyMediaContextGuards, CONTEXT_LIMITS, } from "./_internal/server/features/media/contextGuards";
 // Media upload limits — shared by /api/media/sign + /api/media/finalize + /api/media/upload.
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 // ── RBAC server helpers ───────────────────────────────────────────────────────
 // getServerPermissions, checkPermission, makeAdminSectionLayout
 export { getServerPermissions, checkPermission, checkAnyPermission, makeAdminSectionLayout, } from "./_internal/server/features/auth/permissions";
@@ -1464,6 +1464,7 @@ export { renderLiveItemOg, renderLiveItemOgImage, renderLiveItemOgFromDoc } from
 // ── Lottery feature — server data + adapters + actions ──────────────────────────
 export { getLotteryEventCached, listLotteryEvents, getLotteryEntriesForAdmin, getLotteryEntriesForUser } from "./_internal/server/features/lottery/data";
 export { toClientLotterySlot, toClientLotteryConfig } from "./_internal/server/features/lottery/adapters";
+export { toPublicEvent, toClientSpinPrize } from "./_internal/server/features/events/adapters";
 export { buildLotteryMetadata } from "./_internal/server/features/lottery/metadata";
 export { submitLotteryPullAction, flagLotteryEntryAction, reopenLotterySlotAction, createLotteryEventAction, updateLotteryEventAction, setProductLotteryModeAction, } from "./_internal/server/features/lottery/actions";
 export { lotteryEntryRepository } from "./features/lottery/repository/lottery-entry.repository";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.41.5",
+  "version": "4.41.7",
   "license": "MIT",
   "publishConfig": {
     "access": "public"