@mohasinac/appkit 4.42.18 → 4.44.0

package/dist/server-entry.d.ts

@@ -67,7 +67,7 @@ export { getSearchResults, searchAction, type SearchQuery, } from "./_internal/s
 export { getCategoryForDetail, listRootCategories, listFeaturedCategories, listMenuCategories, getCategoryTree, listSitemapCategories, CATEGORIES_PAGE_SIZE, CATEGORIES_ROOT_TIER, CATEGORIES_MAX_DEPTH, CATEGORIES_SITEMAP_LIMIT, CATEGORIES_FEATURED_LIMIT, CATEGORIES_MENU_LIMIT, } from "./_internal/server/features/categories/index";
 export { getGroupedListingForDetail, getGroupedListingWithItems, listGroupedListings, listFeaturedGroupedListings, listSitemapGroupedListings, getGroupsForProduct, getGroupsWithItemsForProduct, GROUPED_LISTINGS_PAGE_SIZE, GROUPED_LISTINGS_FEATURED_LIMIT, GROUPED_LISTINGS_SITEMAP_LIMIT, buildGroupedListingMetadata, renderGroupedListingOg, type GroupedListingWithItems, type ListGroupedListingsParams, type SitemapGroupedListing, type GroupedListingMetadataOptions, } from "./_internal/server/features/grouped/index";
 export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlacePhonePeOrderAction, previewCheckoutPricing, resolveShippingCost, formatShippingAddress, CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, type CreateCheckoutOrderInput, type VerifyAndPlacePhonePeOrderInput, type CheckoutOrderResult, type CheckoutPaymentMethod, type CheckoutPricingPreviewInput, type CheckoutPricingPreview, } from "./_internal/server/features/checkout/index";
-export { unitPriceFor, lineTotalFor, computePreOrderDepositAmount, } from "./_internal/shared/checkout/order-math";
+export { unitPriceFor, lineTotalFor, sumGroupGst, computePreOrderDepositAmount, type GroupGstSummary, type GstRateSlice, } from "./_internal/shared/checkout/order-math";
 export { processRefundAction, type ProcessRefundInput, } from "./_internal/server/features/refunds/actions";
 export { getSublistingCategoryForDetail } from "./_internal/server/features/sublisting-categories/index";
 export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores, STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, } from "./_internal/server/features/stores/index";

package/dist/server-entry.js

@@ -101,7 +101,12 @@ export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlacePhonePeOr
 // consumer's Razorpay create-order route needs it: that route used to hand-roll
 // the rule and reproduced only the bundle branch, so it captured the LIST price
 // for an accepted offer. Pure math — no Firestore, no server-only imports.
-export { unitPriceFor, lineTotalFor, computePreOrderDepositAmount, } from "./_internal/shared/checkout/order-math";
+// `sumGroupGst` joins them for exactly the same reason, one defect later: that
+// same create-order route decides what the gateway CAPTURES and omitted product
+// GST entirely, so the buyer was shown the tax, charged without it, and the
+// order recorded none — with the verify-side mismatch guard omitting it too, so
+// the three were consistently wrong and the undercharge was undetectable.
+export { unitPriceFor, lineTotalFor, sumGroupGst, computePreOrderDepositAmount, } from "./_internal/shared/checkout/order-math";
 // S-SBUNI-RULES: refund action
 export { processRefundAction, } from "./_internal/server/features/refunds/actions";
 // S3: sublisting categories data layer

package/dist/server.d.ts

@@ -231,6 +231,7 @@ export { POST } from "./features/categories/server";
 export { categoriesGET } from "./features/categories/server";
 export { categoryItemDELETE } from "./features/categories/server";
 export { categoryItemGET } from "./features/categories/server";
+export { categoryDescriptionTemplateGET } from "./features/categories/server";
 export { categoryItemPATCH } from "./features/categories/server";
 export { createCategory } from "./features/categories/server";
 export { deleteCategory } from "./features/categories/server";
@@ -267,7 +268,6 @@ export { getEventPollResults } from "./features/events/server";
 export type { PollResultEntry, SpinResultEntry } from "./features/events/index";
 export { getEventSpinResults } from "./features/events/server";
 export { getUserSpinResultsForEvent } from "./features/events/server";
-export { getBugHunterLeaderboard } from "./features/tester/server";
 export { getPublicEventById } from "./features/events/server";
 export { listPublicEvents } from "./features/events/server";
 export { getRelatedEvents } from "./features/events/server";
@@ -427,6 +427,7 @@ export { removeFromWishlist } from "./features/wishlist/server";
 export { siteSettingsRepository } from "./repositories/index";
 export { storeRepository } from "./repositories/index";
 export { orderRepository } from "./repositories/index";
+export { taxCodesRepository } from "./repositories/index";
 export type { OrderDocument } from "./features/orders/index";
 export type { OrderDocumentItem } from "./features/orders/index";
 export { serverLogger } from "./monitoring/index";
@@ -536,6 +537,8 @@ export type { SitemapOptions, RobotsOptions, ManifestOptions, DefaultOgOptions }
 export { checkActionAllowed } from "./features/admin/utils/checkActionAllowed";
 export { getDisabledRoutes } from "./features/admin/utils/getDisabledRoutes";
 export { getSiteSettingsGlobal } from "./features/admin/utils/getSiteSettingsGlobal";
+export { getHomepageFaqsCached } from "./features/faq/utils/getHomepageFaqsCached";
+export { revalidateTargetsFor, type RevalidateHints, } from "./_internal/shared/cache/revalidate-targets";
 export { getSiteSettingsSafe } from "./_internal/server/features/site-settings/safe-settings";
 export { toPublicSiteSettings, PUBLIC_SITE_SETTINGS_FIELDS, PRIVATE_SITE_SETTINGS_FIELDS, type ToPublicSiteSettingsOptions, } from "./_internal/server/features/site-settings/adapters";
 export { callFirebaseIdentityToolkit } from "./_internal/server/features/auth/firebase-identity";

package/dist/server.js

@@ -665,6 +665,8 @@ export { categoryItemDELETE } from "./features/categories/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // categoryItemGET - Shared export for category item get.
 export { categoryItemGET } from "./features/categories/server";
+// categoryDescriptionTemplateGET - the seller form's inherited-template read.
+export { categoryDescriptionTemplateGET } from "./features/categories/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // categoryItemPATCH - Shared export for category item patch.
 export { categoryItemPATCH } from "./features/categories/server";
@@ -780,8 +782,6 @@ export { getEventSpinResults } from "./features/events/server";
 // getUserSpinResultsForEvent - The CALLER'S OWN spins for an event, unmasked. Companion to the masked public feed above.
 export { getUserSpinResultsForEvent } from "./features/events/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// getBugHunterLeaderboard - Ranks testers by confirmed-bug count.
-export { getBugHunterLeaderboard } from "./features/tester/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getPublicEventById - Helper for get public event by id.
 export { getPublicEventById } from "./features/events/server";
@@ -1248,6 +1248,9 @@ export { siteSettingsRepository } from "./repositories/index";
 export { storeRepository } from "./repositories/index";
 // orderRepository - Shared export for order repository (needed by consumer Firebase Functions, e.g. invoice PDF generation).
 export { orderRepository } from "./repositories/index";
+// taxCodesRepository (B3) — resolved by deriveTaxonomy on every product write
+// that names a taxonomy field, so it is a server-only read on a hot path.
+export { taxCodesRepository } from "./repositories/index";
 // SB-UNI-V — bundlesRepository deleted; use categoriesRepository with categoryType:"bundle".
 // -- Monitoring --------------------------------------------------------------
 // serverLogger - Structured server-side logger.
@@ -1404,6 +1407,12 @@ export { buildSitemap, buildRobots, buildManifest, buildDefaultOgImage, DEFAULT_
 export { checkActionAllowed } from "./features/admin/utils/checkActionAllowed";
 export { getDisabledRoutes } from "./features/admin/utils/getDisabledRoutes";
 export { getSiteSettingsGlobal } from "./features/admin/utils/getSiteSettingsGlobal";
+// Same React.cache dedup, for the FAQ list the homepage reads twice per render
+// (once for the section, once for its JSON-LD).
+export { getHomepageFaqsCached } from "./features/faq/utils/getHomepageFaqsCached";
+// Which PAGE paths a write makes stale — the input to revalidatePath(). Long
+// detail-route TTLs are only safe because this exists.
+export { revalidateTargetsFor, } from "./_internal/shared/cache/revalidate-targets";
 // Null-safe wrapper — returns null on Firestore failure instead of throwing.
 export { getSiteSettingsSafe } from "./_internal/server/features/site-settings/safe-settings";
 // Public site-settings allow-list projection — the ONLY sanctioned shape for

package/dist/styles.css

@@ -7369,6 +7369,46 @@
   background-color: var(--appkit-color-slate-800);
 }
 
+/* ── edit the selected option (C2c) ──
+   Absolutely positioned inside `.appkit-ps` (which is `position: relative`)
+   rather than being a flex sibling of the trigger: the trigger is a
+   full-width button and the pencil has to sit ON it visually while remaining
+   OUTSIDE it in the DOM. A button nested inside a button is invalid HTML and
+   the browser's recovery hoists it out, after which which element receives
+   the click is an engine decision — so the pencil would open the dropdown on
+   some browsers and the editor on others.
+
+   `right` clears the ▾ caret. The hover fill uses the theme-inverting
+   surface-hover token, never a named palette tint: `hover:bg-zinc-50` and
+   friends are the SAME near-white in every theme, which is white-on-white
+   under dark ink (Root Cause #79). */
+.appkit-ps__edit-btn {
+  position: absolute;
+  top: 50%;
+  right: 2rem;
+  transform: translateY(-50%);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.75rem;
+  height: 1.75rem;
+  border-radius: var(--appkit-radius-md, 0.375rem);
+  font-size: 0.875rem;
+  line-height: 1;
+  color: var(--appkit-color-text-muted);
+  transition: background-color 0.1s, color 0.1s;
+}
+
+.appkit-ps__edit-btn:hover {
+  background-color: var(--appkit-color-surface-hover);
+  color: var(--appkit-color-primary);
+}
+
+.appkit-ps__edit-btn:focus-visible {
+  outline: 2px solid var(--appkit-color-focus-ring);
+  outline-offset: 1px;
+}
+
 /* SideDrawer — accessible slide-in panel with focus trap + unsaved-changes */
 
 .appkit-side-drawer__backdrop {

package/dist/ui/components/PaginatedSelect.d.ts

@@ -32,6 +32,20 @@ interface BaseProps<V> {
     createSchema?: import("zod").ZodType<FormValues> | import("zod").ZodType<unknown>;
     onCreateSubmit?: (values: FormValues) => Promise<PaginatedSelectOption<V>>;
     createSubmitLabel?: string;
+    editLabel?: string;
+    editDrawerTitle?: string;
+    renderEditForm?: (props: {
+        value: V;
+        option: PaginatedSelectOption<V> | null;
+        onEdited: (option: PaginatedSelectOption<V>) => void;
+        onCancel: () => void;
+    }) => ReactNode;
+    editFields?: QuickFieldDef[];
+    editSchema?: import("zod").ZodType<FormValues> | import("zod").ZodType<unknown>;
+    /** Seed the quick form from the row being edited. */
+    onEditLoad?: (value: V) => Promise<FormValues>;
+    onEditSubmit?: (value: V, values: FormValues) => Promise<PaginatedSelectOption<V>>;
+    editSubmitLabel?: string;
 }
 interface SingleProps<V> extends BaseProps<V> {
     multiple?: false;

package/dist/ui/components/PaginatedSelect.style.css

@@ -260,3 +260,43 @@
 :is(.dark) .appkit-ps__create-btn:hover {
   background-color: var(--appkit-color-slate-800);
 }
+
+/* ── edit the selected option (C2c) ──
+   Absolutely positioned inside `.appkit-ps` (which is `position: relative`)
+   rather than being a flex sibling of the trigger: the trigger is a
+   full-width button and the pencil has to sit ON it visually while remaining
+   OUTSIDE it in the DOM. A button nested inside a button is invalid HTML and
+   the browser's recovery hoists it out, after which which element receives
+   the click is an engine decision — so the pencil would open the dropdown on
+   some browsers and the editor on others.
+
+   `right` clears the ▾ caret. The hover fill uses the theme-inverting
+   surface-hover token, never a named palette tint: `hover:bg-zinc-50` and
+   friends are the SAME near-white in every theme, which is white-on-white
+   under dark ink (Root Cause #79). */
+.appkit-ps__edit-btn {
+  position: absolute;
+  top: 50%;
+  right: 2rem;
+  transform: translateY(-50%);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.75rem;
+  height: 1.75rem;
+  border-radius: var(--appkit-radius-md, 0.375rem);
+  font-size: 0.875rem;
+  line-height: 1;
+  color: var(--appkit-color-text-muted);
+  transition: background-color 0.1s, color 0.1s;
+}
+
+.appkit-ps__edit-btn:hover {
+  background-color: var(--appkit-color-surface-hover);
+  color: var(--appkit-color-primary);
+}
+
+.appkit-ps__edit-btn:focus-visible {
+  outline: 2px solid var(--appkit-color-focus-ring);
+  outline-offset: 1px;
+}

package/dist/utils/media-url.d.ts

@@ -30,6 +30,32 @@ export declare const MEDIA_URL_MAX_LENGTH = 2048;
  */
 export declare const APPROVED_MEDIA_DOMAINS: readonly string[];
 export declare const MEDIA_URL_MESSAGE = "Must be a stored media reference (/media/<slug>) or a URL on an approved CDN domain";
+/**
+ * Local, static stand-ins for seed photography. Served straight out of
+ * `public/` — no function, no upstream fetch, no sharp pipeline.
+ *
+ * 🛑 This is the single most load-bearing cost control in the app. Every seed
+ * image used to resolve to `/api/media/ext?url=https://placehold.co/…`, i.e. a
+ * Node lambda that fetched a third party (up to 2 × 4 s) and ran a full sharp
+ * decode/watermark/encode — ONE INVOCATION PER IMAGE. Measured 2026-10-09: the
+ * homepage referenced **160** such images at ~49.5 KB each, and
+ * `52.52 GB of Fast Origin Transfer ÷ 49.5 KB ≈ 1.06 M` proxy responses in a
+ * week. That is what suspended the project (HTTP 402).
+ *
+ * Six tiles, because the stored URL already encodes which of the six
+ * `SEED_PHOTO_COLOURS` it was generated with — so the mapping needs no new
+ * data and no migration. The homepage goes 160 images → 6.
+ */
+export declare const SEED_TILE_PREFIX = "/images/seed-tiles/";
+/**
+ * A local tile for `absUrl` when it points at a placeholder host, else undefined.
+ *
+ * placehold.co bakes its colours into the path (`/{w}x{h}/{bg}/{fg}/png`), so the
+ * first 6-hex segment IS the background the fixture was generated with — the
+ * size segment contains an `x` and cannot match, and the foreground comes after
+ * the background, so `.find()` picks the right one.
+ */
+export declare function placeholderTileFor(absUrl: string): string | undefined;
 /**
  * Is `value` something we are willing to PERSIST as a media reference?
  *

package/dist/utils/media-url.js

@@ -38,6 +38,122 @@ export const APPROVED_MEDIA_DOMAINS = [
     "images.unsplash.com",
 ];
 export const MEDIA_URL_MESSAGE = "Must be a stored media reference (/media/<slug>) or a URL on an approved CDN domain";
+/* ── Placeholder imagery ─────────────────────────────────────────────────── */
+/**
+ * Local, static stand-ins for seed photography. Served straight out of
+ * `public/` — no function, no upstream fetch, no sharp pipeline.
+ *
+ * 🛑 This is the single most load-bearing cost control in the app. Every seed
+ * image used to resolve to `/api/media/ext?url=https://placehold.co/…`, i.e. a
+ * Node lambda that fetched a third party (up to 2 × 4 s) and ran a full sharp
+ * decode/watermark/encode — ONE INVOCATION PER IMAGE. Measured 2026-10-09: the
+ * homepage referenced **160** such images at ~49.5 KB each, and
+ * `52.52 GB of Fast Origin Transfer ÷ 49.5 KB ≈ 1.06 M` proxy responses in a
+ * week. That is what suspended the project (HTTP 402).
+ *
+ * Six tiles, because the stored URL already encodes which of the six
+ * `SEED_PHOTO_COLOURS` it was generated with — so the mapping needs no new
+ * data and no migration. The homepage goes 160 images → 6.
+ */
+export const SEED_TILE_PREFIX = "/images/seed-tiles/";
+/**
+ * Must stay in lockstep with `SEED_PHOTO_COLOURS` in
+ * `appkit/src/seed/_helpers/media.ts`, and with the filenames in
+ * `public/images/seed-tiles/`. A colour missing here is not an error — it falls
+ * back to a deterministic pick — so the failure mode is "less variety", never a
+ * broken image.
+ */
+const SEED_TILE_COLOURS = [
+    "1e293b",
+    "334155",
+    "3f3f46",
+    "44403c",
+    "312e81",
+    "164e63",
+];
+/**
+ * Hosts that only ever serve synthetic placeholder imagery.
+ *
+ * These are the four the seed helper documents having cycled through as each
+ * one fell over (picsum 503 on 2026-08-31, placekitten 521, loremflickr too
+ * slow for the proxy's 4 s timeout). Watermarking a generated placeholder is
+ * pointless, and proxying one costs a function invocation plus full origin
+ * transfer for an image we can synthesise locally for free.
+ */
+const PLACEHOLDER_MEDIA_HOSTS = new Set([
+    "placehold.co",
+    "placeholder.com",
+    "via.placeholder.com",
+    "picsum.photos",
+    "fastly.picsum.photos",
+    "placekitten.com",
+    "loremflickr.com",
+    "dummyimage.com",
+]);
+/** Deterministic 32-bit hash — same input, same tile, every render. */
+function tileHash(input) {
+    let h = 2166136261;
+    for (let i = 0; i < input.length; i += 1) {
+        h ^= input.charCodeAt(i);
+        h = Math.imul(h, 16777619);
+    }
+    return h >>> 0;
+}
+/**
+ * The inner `url=` of a stored `/api/media/ext?url=…` value, or null.
+ *
+ * This is what lets the fix reach data that is ALREADY in Firestore. `seedPhoto`
+ * persisted the wrapped form for ~400 assets, and `resolveMediaUrl` used to hand
+ * such a value straight back untouched — `new URL()` throws on the relative path
+ * and the `catch` returns the input — so the proxy was entered on every render.
+ * Unwrapping here fixes every stored row with no migration.
+ */
+function innerExtUrl(value) {
+    if (!value.startsWith(MEDIA_ENDPOINTS.EXT))
+        return null;
+    const q = value.indexOf("?");
+    if (q === -1)
+        return null;
+    try {
+        return new URLSearchParams(value.slice(q + 1)).get("url");
+    }
+    catch (_err) {
+        void normalizeError(_err);
+        return null;
+    }
+}
+/**
+ * A local tile for `absUrl` when it points at a placeholder host, else undefined.
+ *
+ * placehold.co bakes its colours into the path (`/{w}x{h}/{bg}/{fg}/png`), so the
+ * first 6-hex segment IS the background the fixture was generated with — the
+ * size segment contains an `x` and cannot match, and the foreground comes after
+ * the background, so `.find()` picks the right one.
+ */
+export function placeholderTileFor(absUrl) {
+    let parsed;
+    try {
+        parsed = new URL(absUrl);
+    }
+    catch (_err) {
+        void normalizeError(_err);
+        return undefined;
+    }
+    const host = parsed.hostname.replace(/^www\./, "");
+    if (!PLACEHOLDER_MEDIA_HOSTS.has(host))
+        return undefined;
+    const bg = parsed.pathname
+        .split("/")
+        .find((seg) => /^[0-9a-fA-F]{6}$/.test(seg))
+        ?.toLowerCase();
+    if (bg && SEED_TILE_COLOURS.includes(bg))
+        return `${SEED_TILE_PREFIX}${bg}.svg`;
+    // Unknown or absent colour (picsum/placekitten carry none) — pick
+    // deterministically from the path so the same fixture always gets the same
+    // tile and the grid keeps its variety.
+    const fallback = SEED_TILE_COLOURS[tileHash(parsed.pathname) % SEED_TILE_COLOURS.length];
+    return `${SEED_TILE_PREFIX}${fallback}.svg`;
+}
 /**
  * Is `value` something we are willing to PERSIST as a media reference?
  *
@@ -95,6 +211,11 @@ export function isStoredMediaRef(value) {
         return false;
     if (value.startsWith(MEDIA_PROXY_PREFIX))
         return true;
+    // A local seed tile (`/images/seed-tiles/<hex>.svg`). Persistable: it is a
+    // static asset we ship, so unlike the `/api/media/ext?url=` form rejected
+    // below it is not a render-time transform and does not double-wrap.
+    if (value.startsWith(SEED_TILE_PREFIX))
+        return true;
     if (value.startsWith("blob:") || value.startsWith("data:"))
         return false;
     if (value.startsWith(MEDIA_ENDPOINTS.EXT))
@@ -148,6 +269,8 @@ export function resolveMediaUrl(url, opts) {
     }
     if (url.startsWith(PROXY_PREFIX))
         return url;
+    if (url.startsWith(SEED_TILE_PREFIX))
+        return url;
     // A blob:/data: URI is only ever valid in the tab that created it (e.g. a
     // freshly-selected file preview via URL.createObjectURL, or a FileReader
     // data URL fed to a crop modal). Routing it through the external-URL
@@ -155,8 +278,29 @@ export function resolveMediaUrl(url, opts) {
     // rendered directly instead.
     if (url.startsWith("blob:") || url.startsWith("data:"))
         return url;
+    /*
+     * An ALREADY-WRAPPED `/api/media/ext?url=…` value, which is what the seed
+     * catalogue persisted ~400 times. Unwrap and look at what it actually points
+     * at: a placeholder host becomes a local tile (no function, no fetch), and
+     * anything else falls through to the old behaviour of returning the wrapped
+     * value untouched. Without this the branch below is unreachable for stored
+     * data, because `new URL()` throws on the relative path.
+     */
+    const inner = innerExtUrl(url);
+    if (inner) {
+        const innerTile = placeholderTileFor(inner);
+        if (innerTile)
+            return innerTile;
+        return url;
+    }
     try {
         const parsed = new URL(url);
+        // Synthetic placeholder imagery: never worth a function invocation. The
+        // placeholder hosts and our own Storage hosts are disjoint sets, so this
+        // can sit before the own-bucket branches without shadowing a real asset.
+        const tile = placeholderTileFor(url);
+        if (tile)
+            return tile;
         if (parsed.hostname.endsWith(FIREBASE_STORAGE_HOST)) {
             const m = parsed.pathname.match(/\/o\/([^?]+)/);
             if (m)

package/dist/utils/physical-location.d.ts

@@ -0,0 +1,23 @@
+/** The parts a location can have. All optional — see the blank-parts note. */
+export interface PhysicalLocationParts {
+    zone?: string | null;
+    shelf?: string | null;
+    bin?: string | null;
+}
+/**
+ * Render a location as `zone/shelf/bin`, or `undefined` when there is nothing
+ * to show.
+ *
+ * 🛑 Returns `undefined` rather than `"//"` for an all-blank location, and
+ * that case is REACHABLE, not defensive: `PhysicalLocationModal` tells the
+ * user "All fields are optional" while both bulk-location routes only check
+ * `typeof === "string"`, so `{zone:"",shelf:"",bin:""}` saves successfully.
+ * Every caller already branches on falsy before rendering, so returning
+ * `undefined` makes those rows fall through to their em-dash instead of
+ * printing punctuation with no content.
+ *
+ * Partial locations keep their separators (`A//3`) on purpose — the gap is
+ * information, and collapsing it would make "zone A, bin 3" indistinguishable
+ * from "zone A, shelf 3".
+ */
+export declare function formatPhysicalLocation(loc: PhysicalLocationParts | null | undefined): string | undefined;

package/dist/utils/physical-location.js

@@ -0,0 +1,52 @@
+/*
+ * WHY: `physicalLocation` is a `{zone, shelf, bin}` OBJECT on both
+ *      `ProductDocument` and `OrderDocument`, and three surfaces render it.
+ *      Two had hand-written the same `a/b/c` interpolation
+ *      (`SellerProductsView`, `SellerOrdersView`) and the third —
+ *      `PrintCenterView` — declared the field as a `string` and rendered the
+ *      object as a bare React child.
+ *
+ * 🛑 THAT THIRD ONE IS A CRASH. Rendering an object as a React child throws
+ *    "Objects are not valid as a React child", so the Print Centre would die
+ *    the first time any seller used the Set Location bulk action. It is
+ *    LATENT, not live: measured on production, 0 of 72 products and 0 of 67
+ *    orders carry the field, so nobody has used that feature yet. It was
+ *    invisible because BOTH mappers in `PrintCenterPanel` are typed `(p: any)`
+ *    and the products array is passed `as any` — so neither the wrong
+ *    declaration nor the wrong value had anything to trip over.
+ *
+ * WHAT: one formatter. Pure, no imports, structural parameter so a caller can
+ *       pass a `ProductDocument`'s field, an `OrderDocument`'s, or the
+ *       `PhysicalLocation` client type without a cast.
+ *
+ * @tag domain:inventory
+ * @tag layer:util
+ * @tag access:isomorphic
+ * @tag sideEffects:none
+ */
+/**
+ * Render a location as `zone/shelf/bin`, or `undefined` when there is nothing
+ * to show.
+ *
+ * 🛑 Returns `undefined` rather than `"//"` for an all-blank location, and
+ * that case is REACHABLE, not defensive: `PhysicalLocationModal` tells the
+ * user "All fields are optional" while both bulk-location routes only check
+ * `typeof === "string"`, so `{zone:"",shelf:"",bin:""}` saves successfully.
+ * Every caller already branches on falsy before rendering, so returning
+ * `undefined` makes those rows fall through to their em-dash instead of
+ * printing punctuation with no content.
+ *
+ * Partial locations keep their separators (`A//3`) on purpose — the gap is
+ * information, and collapsing it would make "zone A, bin 3" indistinguishable
+ * from "zone A, shelf 3".
+ */
+export function formatPhysicalLocation(loc) {
+    if (!loc)
+        return undefined;
+    const zone = (loc.zone ?? "").trim();
+    const shelf = (loc.shelf ?? "").trim();
+    const bin = (loc.bin ?? "").trim();
+    if (!zone && !shelf && !bin)
+        return undefined;
+    return `${zone}/${shelf}/${bin}`;
+}

package/dist/utils/search-txt-builders.d.ts

@@ -1,4 +1,5 @@
 import type { ProductDocument } from "../features/products/schemas/firestore";
+import type { CategoryDocument } from "../features/categories/schemas/firestore";
 import type { ScammerDocument } from "../features/scams/schemas/firestore";
 import type { StoreDocument } from "../features/stores/schemas/firestore";
 import type { EventDocument } from "../features/events/schemas/firestore";
@@ -9,6 +10,25 @@ import type { CouponDocument } from "../features/promotions/schemas/firestore";
 import type { OfferDocument } from "../features/seller/schemas/firestore";
 /** products — title, description, brand, taxonomy, condition, card/grading, specs. */
 export declare function buildProductSearchTxt(p: Partial<ProductDocument>): string[];
+/**
+ * categories — name, slug, path, ancestor names, item code, editorial copy.
+ *
+ * Covers brand and bundle rows too, since they share the collection: hence
+ * `brandCountry` and `itemCode`, which only one kind ever carries.
+ *
+ * 🛑 `ancestors[].name` is in here deliberately, and it is what makes a leaf
+ * findable by its lineage — typing "burst" reaches `category-lost-longinus`
+ * because Beyblade Burst is one of its ancestors. Without it, the only way to
+ * find a tier-4 model is to already know its exact name.
+ *
+ * `description` is stripped of HTML because `contentBody`-style copy is
+ * keyword-rich markup and the tags are not search terms.
+ *
+ * NOT indexed: `createdBy` (a raw uid), `createdByStoreName` (operator
+ * identity), `position`/`subtreeSize` (internal coordinates), and the
+ * `metrics` counters (numbers nobody searches by).
+ */
+export declare function buildCategorySearchTxt(c: Partial<CategoryDocument>): string[];
 /** stores — name, description, category. No payout details, no contact. */
 export declare function buildStoreSearchTxt(s: Partial<StoreDocument>): string[];
 /** events — title, description, type, tags. */

package/dist/utils/search-txt-builders.js

@@ -46,6 +46,42 @@ export function buildProductSearchTxt(p) {
         p.specifications?.map((s) => `${s.name} ${s.value}`),
     ]);
 }
+/**
+ * categories — name, slug, path, ancestor names, item code, editorial copy.
+ *
+ * Covers brand and bundle rows too, since they share the collection: hence
+ * `brandCountry` and `itemCode`, which only one kind ever carries.
+ *
+ * 🛑 `ancestors[].name` is in here deliberately, and it is what makes a leaf
+ * findable by its lineage — typing "burst" reaches `category-lost-longinus`
+ * because Beyblade Burst is one of its ancestors. Without it, the only way to
+ * find a tier-4 model is to already know its exact name.
+ *
+ * `description` is stripped of HTML because `contentBody`-style copy is
+ * keyword-rich markup and the tags are not search terms.
+ *
+ * NOT indexed: `createdBy` (a raw uid), `createdByStoreName` (operator
+ * identity), `position`/`subtreeSize` (internal coordinates), and the
+ * `metrics` counters (numbers nobody searches by).
+ */
+export function buildCategorySearchTxt(c) {
+    return buildSearchTxt([
+        c.name,
+        c.slug,
+        stripHtml(c.description),
+        c.path,
+        c.itemCode,
+        c.brandCountry,
+        ...(c.ancestors ?? []).map((a) => a.name),
+        /*
+         * B5 — LAST on purpose. `buildSearchTxt` truncates at 600 tokens and does
+         * it silently, so whatever sits at the end of this array is what gets
+         * dropped first. A model leaf's own name and its lineage must survive
+         * ahead of "also known as" spellings.
+         */
+        ...(c.aliases ?? []),
+    ]);
+}
 /** stores — name, description, category. No payout details, no contact. */
 export function buildStoreSearchTxt(s) {
     return buildSearchTxt([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.42.18",
+  "version": "4.44.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/scripts/seed-cli.mjs

@@ -195,7 +195,7 @@ const {
   siteSettingsSeedData, faqSeedData,
   wishlistsSeedData, historySeedData,
   groupedListingsSeedData,
-  scammersSeedData, productFeaturesSeedData,
+  scammersSeedData, productFeaturesSeedData, taxCodesSeedData,
   testerChecklistSeedData, testerResponsesSeedData,
   supportTicketsSeedData, catalogueSeedData,
   shipmentsSeedData, shipmentLotsSeedData, shipmentItemsSeedData,
@@ -210,6 +210,7 @@ const {
   CART_COLLECTION,
   GROUPED_LISTINGS_COLLECTION, SCAMMER_COLLECTION,
   WISHLIST_COLLECTION, HISTORY_COLLECTION, PRODUCT_FEATURES_COLLECTION,
+  TAX_CODES_COLLECTION,
   TESTER_CHECKLIST_ITEM_COLLECTION,
   TESTER_CHECKLIST_RESPONSE_COLLECTION,
   // PII field/index constants (plain data, still in the main barrel — the
@@ -285,6 +286,7 @@ const COLLECTION_MAP = {
   groupedListings: GROUPED_LISTINGS_COLLECTION,
   scammerProfiles: SCAMMER_COLLECTION,
   productFeatures: PRODUCT_FEATURES_COLLECTION,
+  taxCodes: TAX_CODES_COLLECTION,
   testerChecklistItems: TESTER_CHECKLIST_ITEM_COLLECTION,
   /*
    * Tester submissions. DERIVED tier in the tester's own map (wiped at setup so
@@ -370,6 +372,7 @@ const SEED_DATA_MAP = {
   groupedListings: groupedListingsSeedData,
   scammerProfiles: scammersSeedData,
   productFeatures: productFeaturesSeedData,
+  taxCodes: taxCodesSeedData,
   testerChecklistItems: testerChecklistSeedData,
   testerChecklistResponses: testerResponsesSeedData,
 };

package/dist/_internal/server/jobs/handlers/testerSandboxCleanup.d.ts

@@ -1,2 +0,0 @@
-import type { ScheduleHandler } from "../runtime/types";
-export declare const testerSandboxCleanupHandler: ScheduleHandler;

package/dist/_internal/server/jobs/handlers/testerSandboxCleanup.js

@@ -1,2 +0,0 @@
-import { runTesterSandboxCleanup } from "../core/testerSandboxCleanup";
-export const testerSandboxCleanupHandler = (ctx) => runTesterSandboxCleanup(ctx);

package/dist/features/tester/actions/leaderboard-actions.d.ts

@@ -1,3 +0,0 @@
-import type { BugHunterLeaderboardEntry } from "../schemas/firestore";
-/** Ranks testers by confirmed-bug count. Mirrors getEventLeaderboard()'s shape. */
-export declare function getBugHunterLeaderboard(limit?: number): Promise<BugHunterLeaderboardEntry[]>;

package/dist/features/tester/actions/leaderboard-actions.js

@@ -1,5 +0,0 @@
-import { testerChecklistItemRepository } from "../repository/tester-checklist-item.repository";
-/** Ranks testers by confirmed-bug count. Mirrors getEventLeaderboard()'s shape. */
-export async function getBugHunterLeaderboard(limit = 50) {
-    return testerChecklistItemRepository.getBugHunterLeaderboard(limit);
-}