@mohasinac/appkit 4.42.3 → 4.42.5

package/dist/client.d.ts

@@ -229,6 +229,15 @@ export { PERMISSION_GROUPS, PERMISSION_DOMAINS, getPermissionsForDomain, formatP
 export { Details, Summary } from "./ui/components/Details";
 export { ADMIN_ENDPOINTS } from "./constants/index";
 export { SELLER_ENDPOINTS } from "./constants/index";
+/**
+ * The buyer-portal endpoint map. Its admin and seller siblings were already
+ * here; this one was reachable only from `index.ts`, so a Client Component
+ * needing a /api/user/* URL had to either hardcode the path (blocked by
+ * audit-hardcoded-api-routes) or import the bare entry (the firebase-admin
+ * client-bundle leak audit-client-server-only-leak blocks). Added for
+ * BidDetailPageClient — checklist-page-wiring-detail-pages-detail-page-matches-list-modal.
+ */
+export { ACCOUNT_ENDPOINTS } from "./constants/index";
 export { TourProvider, useTour } from "./_internal/client/features/tour/TourProvider";
 export type { TourContextValue, TourRole } from "./_internal/client/features/tour/TourProvider";
 export { apiClient, ApiClientError } from "./http/index";

package/dist/client.js

@@ -280,6 +280,15 @@ export { PERMISSION_GROUPS, PERMISSION_DOMAINS, getPermissionsForDomain, formatP
 export { Details, Summary } from "./ui/components/Details";
 export { ADMIN_ENDPOINTS } from "./constants/index";
 export { SELLER_ENDPOINTS } from "./constants/index";
+/**
+ * The buyer-portal endpoint map. Its admin and seller siblings were already
+ * here; this one was reachable only from `index.ts`, so a Client Component
+ * needing a /api/user/* URL had to either hardcode the path (blocked by
+ * audit-hardcoded-api-routes) or import the bare entry (the firebase-admin
+ * client-bundle leak audit-client-server-only-leak blocks). Added for
+ * BidDetailPageClient — checklist-page-wiring-detail-pages-detail-page-matches-list-modal.
+ */
+export { ACCOUNT_ENDPOINTS } from "./constants/index";
 // P-16 — Tour system (driver.js-backed onboarding walkthrough).
 export { TourProvider, useTour } from "./_internal/client/features/tour/TourProvider";
 export { apiClient, ApiClientError } from "./http/index";

package/dist/features/categories/schemas/bundle-form.d.ts

@@ -13,8 +13,8 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
     priceRupees: z.ZodEffects<z.ZodString, string, string>;
     description: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
     ruleType: z.ZodEnum<["static", "dynamic"]>;
-    productIds: z.ZodArray<z.ZodString, "many">;
-    dynamicRule: z.ZodObject<{
+    productIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    dynamicRule: z.ZodOptional<z.ZodObject<{
         type: z.ZodLiteral<"dynamic">;
         filter: z.ZodObject<{
             categorySlug: z.ZodOptional<z.ZodString>;
@@ -54,17 +54,20 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
         };
         limit: number;
         orderBy?: "price-asc" | "price-desc" | "createdAt-desc" | undefined;
-    }>;
+    }>>;
     coverImage: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
     brandSlug: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
     isActive: z.ZodBoolean;
 }, "strip", z.ZodTypeAny, {
     name: string;
     isActive: boolean;
-    productIds: string[];
     priceRupees: string;
     ruleType: "static" | "dynamic";
-    dynamicRule: {
+    brandSlug?: string | undefined;
+    description?: string | undefined;
+    coverImage?: string | undefined;
+    productIds?: string[] | undefined;
+    dynamicRule?: {
         type: "dynamic";
         filter: {
             listingType?: "standard" | "pre-order" | "prize-draw" | undefined;
@@ -74,17 +77,17 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
         };
         limit: number;
         orderBy?: "price-asc" | "price-desc" | "createdAt-desc" | undefined;
-    };
-    brandSlug?: string | undefined;
-    description?: string | undefined;
-    coverImage?: string | undefined;
+    } | undefined;
 }, {
     name: string;
     isActive: boolean;
-    productIds: string[];
     priceRupees: string;
     ruleType: "static" | "dynamic";
-    dynamicRule: {
+    brandSlug?: string | undefined;
+    description?: string | undefined;
+    coverImage?: string | undefined;
+    productIds?: string[] | undefined;
+    dynamicRule?: {
         type: "dynamic";
         filter: {
             listingType?: "standard" | "pre-order" | "prize-draw" | undefined;
@@ -94,17 +97,17 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
         };
         limit: number;
         orderBy?: "price-asc" | "price-desc" | "createdAt-desc" | undefined;
-    };
-    brandSlug?: string | undefined;
-    description?: string | undefined;
-    coverImage?: string | undefined;
+    } | undefined;
 }>, {
     name: string;
     isActive: boolean;
-    productIds: string[];
     priceRupees: string;
     ruleType: "static" | "dynamic";
-    dynamicRule: {
+    brandSlug?: string | undefined;
+    description?: string | undefined;
+    coverImage?: string | undefined;
+    productIds?: string[] | undefined;
+    dynamicRule?: {
         type: "dynamic";
         filter: {
             listingType?: "standard" | "pre-order" | "prize-draw" | undefined;
@@ -114,17 +117,17 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
         };
         limit: number;
         orderBy?: "price-asc" | "price-desc" | "createdAt-desc" | undefined;
-    };
-    brandSlug?: string | undefined;
-    description?: string | undefined;
-    coverImage?: string | undefined;
+    } | undefined;
 }, {
     name: string;
     isActive: boolean;
-    productIds: string[];
     priceRupees: string;
     ruleType: "static" | "dynamic";
-    dynamicRule: {
+    brandSlug?: string | undefined;
+    description?: string | undefined;
+    coverImage?: string | undefined;
+    productIds?: string[] | undefined;
+    dynamicRule?: {
         type: "dynamic";
         filter: {
             listingType?: "standard" | "pre-order" | "prize-draw" | undefined;
@@ -134,9 +137,6 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
         };
         limit: number;
         orderBy?: "price-asc" | "price-desc" | "createdAt-desc" | undefined;
-    };
-    brandSlug?: string | undefined;
-    description?: string | undefined;
-    coverImage?: string | undefined;
+    } | undefined;
 }>;
 export type BundleFormValues = z.infer<typeof bundleFormSchema>;

package/dist/features/categories/schemas/bundle-form.js

@@ -95,12 +95,12 @@ export const bundleFormSchema = z
      * because an empty picker on a DYNAMIC bundle is correct — the resolver
      * fills the mirror. A flat `.min(3)` would block every dynamic save.
      */
-    productIds: annotate(z.array(z.string()), {
+    productIds: annotate(z.array(z.string()).optional(), {
         section: "members", order: 2, row: "full", kind: "list",
         label: `${BUNDLE_COPY.adminEditor.ruleTypeStatic} (${BUNDLE_MIN_ITEMS}–${BUNDLE_MAX_ITEMS})`,
         when: (v) => v.ruleType !== "dynamic",
     }),
-    dynamicRule: annotate(dynamicRuleSchema, {
+    dynamicRule: annotate(dynamicRuleSchema.optional(), {
         section: "members", order: 3, row: "full",
         label: BUNDLE_COPY.adminEditor.dynamic.title,
         help: BUNDLE_COPY.adminEditor.dynamic.hint,
@@ -130,20 +130,44 @@ export const bundleFormSchema = z
      * them — a two-member bundle saved, and `listBundleMembers` rendered it as
      * a "bundle" of two.
      */
+    /*
+     * 🛑 Both member sources are `.optional()` because a hidden control is not
+     * SENT, and the two are mutually hidden by `ruleType`. Declaring either as
+     * required made the branch that hides it impossible to save: a static
+     * bundle submitted no `dynamicRule`, zod raised `invalid_type`, and
+     * `zodErrorMap` rendered it as "Bundle members: This field is required" on
+     * a form whose picker visibly held three products. Admin bundle CREATION
+     * was impossible in both directions. Found by
+     * `money-flows/blockers--admin` → `cross-store-group-refused`, which could
+     * not reach the cross-store guard it exists to test.
+     *
+     * Requiredness therefore lives HERE, per branch, where `ruleType` is known.
+     */
+    if (v.ruleType === "dynamic") {
+        if (!v.dynamicRule) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["dynamicRule"],
+                message: "Describe the query that resolves this bundle's members.",
+            });
+        }
+        return;
+    }
     if (v.ruleType !== "static")
         return;
-    if (v.productIds.length < BUNDLE_MIN_ITEMS) {
+    const productIds = v.productIds ?? [];
+    if (productIds.length < BUNDLE_MIN_ITEMS) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             path: ["productIds"],
-            message: `Select at least ${BUNDLE_MIN_ITEMS} products (currently ${v.productIds.length}).`,
+            message: `Select at least ${BUNDLE_MIN_ITEMS} products (currently ${productIds.length}).`,
         });
     }
-    else if (v.productIds.length > BUNDLE_MAX_ITEMS) {
+    else if (productIds.length > BUNDLE_MAX_ITEMS) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             path: ["productIds"],
-            message: `Maximum ${BUNDLE_MAX_ITEMS} products allowed (currently ${v.productIds.length}).`,
+            message: `Maximum ${BUNDLE_MAX_ITEMS} products allowed (currently ${productIds.length}).`,
         });
     }
 });

package/dist/features/events/repository/events.repository.js

@@ -114,7 +114,31 @@ class EventRepository extends BaseRepository {
                 createdAt: now,
                 updatedAt: now,
             });
-            const ref = await this.getCollection().add(data);
+            /*
+             * 🛑 This used to be `.add(data)` — a raw write that ran NEITHER half of
+             * the repository's own contract, and broke two things at once:
+             *
+             *  1. `applyWriteHooks` never fired, so `buildSearchTxtFor` never wrote
+             *     SEARCH_TXT — and `list()` filters on
+             *     `where(SEARCH_TXT, "array-contains", head)`. Every event created
+             *     through the UI was therefore invisible to admin event search,
+             *     permanently, while seeded events (whose tokens the seeder writes)
+             *     searched fine. The hook's docstring above claims it is derived on
+             *     every write path; it was not derived on this one.
+             *  2. `.add()` mints a Firestore auto-id, so the document id was e.g.
+             *     `SJHlHFAs5BHMLQwH8MdM` while every seeded event uses its slug.
+             *     Events are "pure slugs (id === slug)" per the slug table, and the
+             *     public URL and any slug lookup depend on it.
+             *
+             * `.create()` rather than `.set()`: it REJECTS an existing id, so a
+             * duplicate title surfaces as a conflict instead of silently
+             * overwriting someone else's event.
+             *
+             * Found by tester run-3 batch 98, page-wiring/reachability--admin →
+             * lottery-can-be-created-without-seeding. Root Cause #9's shape.
+             */
+            const ref = this.getCollection().doc(slug);
+            await ref.create(this.applyWriteHooks(data));
             const created = await ref.get();
             serverLogger.info("Event created", { eventId: ref.id, type: input.type });
             return this.mapDoc(created);

package/dist/seed/users-seed-data.js

@@ -553,4 +553,45 @@ export const usersSeedData = [
         createdAt: daysAgo(60),
         updatedAt: daysAgo(2),
     },
+    /*
+     * ── Disabled buyer: the ONLY account with `disabled: true` ──
+     *
+     * 🛑 This persona exists so that cases about a banned/disabled login are
+     * testable WITHOUT disabling a real one. Measured 2026-10-01: of the 19
+     * seeded users, `disabled: true` occurred ZERO times, so every such case was
+     * permanently unrunnable — `users` is PRESERVE-tier (never wiped, never
+     * restored, merge-write on reseed), making "disable someone to test it" the
+     * one piece of permanent damage a test run can do.
+     *
+     * Nothing but a sign-in attempt should ever touch it: no orders, no store,
+     * no public profile. Keep `disabled: true` — flipping it to false silently
+     * removes the only fixture these cases have.
+     *
+     * Needed by money-flows/blockers--guest → banned-account-blocked, and the
+     * soft-ban cases declined for the same reason. Same class as Root Cause #90:
+     * a case reports "nothing here" because its fixture was never seeded.
+     */
+    {
+        uid: "user-qa-disabled",
+        email: "qa.disabled@letitrip.in",
+        phoneNumber: `${_ph}9999900099`,
+        phoneVerified: false,
+        displayName: "QA Disabled Account",
+        role: USER_FIELDS.ROLE_VALUES.USER,
+        emailVerified: true,
+        disabled: true,
+        publicProfile: {
+            isPublic: false,
+            showEmail: false,
+            showPhone: false,
+            showOrders: false,
+            showWishlist: false,
+            bio: "Fixture account — deliberately disabled so ban/disabled-login cases are testable.",
+            location: "Indore, Madhya Pradesh",
+        },
+        stats: { totalOrders: 0, auctionsWon: 0, itemsSold: 0, reviewsCount: 0 },
+        metadata: { lastSignInTime: daysAgo(30), creationTime: daysAgo(90).toISOString(), loginCount: 1 },
+        createdAt: daysAgo(90),
+        updatedAt: daysAgo(30),
+    },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.42.3",
+  "version": "4.42.5",
   "license": "MIT",
   "publishConfig": {
     "access": "public"