@mohasinac/appkit 4.42.5 → 4.42.7

package/dist/features/addresses/repository/addresses.repository.d.ts

@@ -19,6 +19,19 @@ export declare class AddressesRepository extends BaseRepository<AddressDocument>
     createWithId(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;
     update(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;
     listByOwner(ownerType: AddressOwnerType, ownerId: string): Promise<AddressDocument[]>;
+    /**
+     * 🛑 Requires the composite index `(ownerType ASC, createdAt DESC)`.
+     *
+     * The pre-existing `(ownerType, ownerId, createdAt DESC)` index does NOT serve
+     * this query: Firestore matches an index by its field sequence, and `ownerId`
+     * sits between the equality and the sort, so a query that filters on
+     * `ownerType` alone and orders by `createdAt` has no usable prefix. Without the
+     * two-field index this throws FAILED_PRECONDITION, which `mapToHttpError`
+     * renders as a **409** — and `/admin/address-clusters` then showed "Failed to
+     * load clusters." *and* "No shared addresses found." at the same time, so the
+     * page read as "there are no clusters" rather than as an error. Added
+     * 2026-10-02; see Recurrent Root Cause #2.
+     */
     listByOwnerType(ownerType: AddressOwnerType, limit?: number): Promise<AddressDocument[]>;
     countByOwner(ownerType: AddressOwnerType, ownerId: string): Promise<number>;
     createForOwner(ownerType: AddressOwnerType, ownerId: string, input: AddressCreateInput): Promise<AddressDocument>;

package/dist/features/addresses/repository/addresses.repository.js

@@ -60,6 +60,19 @@ export class AddressesRepository extends BaseRepository {
             throw new DatabaseError(`Failed to list addresses for ${ownerType}:${ownerId}`, error);
         }
     }
+    /**
+     * 🛑 Requires the composite index `(ownerType ASC, createdAt DESC)`.
+     *
+     * The pre-existing `(ownerType, ownerId, createdAt DESC)` index does NOT serve
+     * this query: Firestore matches an index by its field sequence, and `ownerId`
+     * sits between the equality and the sort, so a query that filters on
+     * `ownerType` alone and orders by `createdAt` has no usable prefix. Without the
+     * two-field index this throws FAILED_PRECONDITION, which `mapToHttpError`
+     * renders as a **409** — and `/admin/address-clusters` then showed "Failed to
+     * load clusters." *and* "No shared addresses found." at the same time, so the
+     * page read as "there are no clusters" rather than as an error. Added
+     * 2026-10-02; see Recurrent Root Cause #2.
+     */
     async listByOwnerType(ownerType, limit = 500) {
         try {
             const snapshot = await this.getCollection()

package/dist/features/admin/components/AdminBundleEditorView.js

@@ -91,8 +91,27 @@ export function AdminBundleEditorView({ bundleId, onSaved, onDeleted, scope = "a
     const brandsQuery = useQuery({
         queryKey: ["admin", "brands", "picker"],
         queryFn: async () => {
+            /*
+             * 🛑 `res.items`, NOT `res.data.items` — `apiClient` ALREADY unwraps the
+             * envelope (`ApiClient.ts` ends `return data.data as T`), so what arrives
+             * here is `{ items, total, page, pageSize, totalPages, hasMore }` and
+             * there is no second `.data` to reach through.
+             *
+             * This read was `res?.data?.items ?? []` behind a hand-written
+             * `as { data?: { items?: CategoryDocument[] } }`. The cast cannot be wrong
+             * at runtime — it only silenced the one check that would have caught it —
+             * and `?? []` turned the miss into an empty list rather than an error. So
+             * the Brand select offered ONLY "No specific brand", for every admin,
+             * forever: verified in production 2026-10-02 by polling the live
+             * `<select name="brandSlug">` for 15s (optionCount stayed 1) while
+             * `GET /api/admin/brands` returned 200 with 5 brand rows in `data.items`.
+             *
+             * Nothing was wrong with the endpoint, the query, the memo or its
+             * dependency array — I checked each before concluding. Root Cause #98's
+             * family: a cast at a boundary asserting a shape that is not there.
+             */
             const res = (await apiClient.get(ADMIN_ENDPOINTS.BRANDS));
-            return res?.data?.items ?? [];
+            return res?.items ?? [];
         },
     });
     const brandOptions = React.useMemo(() => [
@@ -105,8 +124,28 @@ export function AdminBundleEditorView({ bundleId, onSaved, onDeleted, scope = "a
     const bundleQuery = useQuery({
         queryKey: ["bundle", scope, bundleId],
         queryFn: async () => {
+            /*
+             * 🛑 The response IS the bundle — do not reach through a second `.data`.
+             *
+             * Same defect as `brandsQuery` above and far more dangerous. This was
+             * `res?.data ?? null` behind `as { data?: CategoryDocument }`, so every
+             * edit of an existing bundle resolved to `null`, `bundleToForm(null)`
+             * returned `EMPTY_FORM`, and the editor rendered BLANK — then saving it
+             * would have written that blank over a live bundle.
+             *
+             * Verified in production 2026-10-02: /admin/bundles/
+             * bundle-every-generation-starter-pack/edit polled for 14s with
+             * `input[name="name"]` and `input[name="priceRupees"]` both `""` and no
+             * member count, while `GET /api/admin/bundles/{id}` returned 200 with the
+             * real bundle (`{ success, data: <bundle> }`, no nested `data`). I did not
+             * press Save.
+             *
+             * Root Cause #98: an `ActionResult`/envelope spread as if it were the
+             * payload, where the destructive half is the status field silently
+             * defaulting on the way back out.
+             */
             const res = (await apiClient.get(endpoints.byId(encodeURIComponent(bundleId))));
-            return res?.data ?? null;
+            return res ?? null;
         },
         enabled: isEdit,
     });

package/dist/features/categories/schemas/bundle-form.d.ts

@@ -10,7 +10,7 @@ export declare const BUNDLE_RULE_TYPE_OPTIONS: {
  */
 export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
-    priceRupees: z.ZodEffects<z.ZodString, string, string>;
+    priceRupees: z.ZodEffects<z.ZodNumber, number, number>;
     description: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
     ruleType: z.ZodEnum<["static", "dynamic"]>;
     productIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -61,7 +61,7 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     isActive: boolean;
-    priceRupees: string;
+    priceRupees: number;
     ruleType: "static" | "dynamic";
     brandSlug?: string | undefined;
     description?: string | undefined;
@@ -81,7 +81,7 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
 }, {
     name: string;
     isActive: boolean;
-    priceRupees: string;
+    priceRupees: number;
     ruleType: "static" | "dynamic";
     brandSlug?: string | undefined;
     description?: string | undefined;
@@ -101,7 +101,7 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
 }>, {
     name: string;
     isActive: boolean;
-    priceRupees: string;
+    priceRupees: number;
     ruleType: "static" | "dynamic";
     brandSlug?: string | undefined;
     description?: string | undefined;
@@ -121,7 +121,7 @@ export declare const bundleFormSchema: z.ZodEffects<z.ZodObject<{
 }, {
     name: string;
     isActive: boolean;
-    priceRupees: string;
+    priceRupees: number;
     ruleType: "static" | "dynamic";
     brandSlug?: string | undefined;
     description?: string | undefined;

package/dist/features/categories/schemas/bundle-form.js

@@ -73,10 +73,39 @@ export const bundleFormSchema = z
         section: "basics", sectionLabel: "Bundle", sectionRequired: true,
         quick: true, order: 1, row: "pair", label: "Name",
     }),
-    priceRupees: annotate(z
-        .string()
-        .regex(/^\d+(\.\d{1,2})?$/, BUNDLE_COPY.adminEditor.errors.priceInvalid)
-        .refine((v) => Number(v) > 0, BUNDLE_COPY.adminEditor.errors.priceInvalid), {
+    /*
+     * 🛑 `z.coerce.number()`, NOT `z.string()`, because `kind: "number"` below
+     * decides the runtime type and the schema does not get a vote.
+     *
+     * `build-sections.tsx`'s number control is
+     * `onChange={(v) => set(v === "" ? undefined : Number(v))}` — it writes a
+     * NUMBER into the draft on every keystroke. This field used to be
+     * `z.string().regex(...)`, so a save with 1500 visibly in the box was
+     * refused with "This field is required" sitting directly under it, and the
+     * summary read "Bundle: This field is required" — naming the section and no
+     * field. A bundle therefore could not be created at all. Verified in
+     * production 2026-10-02 by walking up from the role=alert element to its
+     * owner, `input[name="priceRupees"]`.
+     *
+     * Do NOT "fix" this by removing the coercion in `build-sections.tsx`:
+     * ~10 of the 30 `kind: "number"` fields are plain `z.number()` and depend on
+     * it. Two other fields still declare `z.string()` under the same control and
+     * have the same latent defect — `purchasedItemNumber` (admin-user-form) and
+     * `maxBudget` (item-request-create-form); neither is driven by a test yet,
+     * so neither was changed blind.
+     *
+     * `coerce` keeps every existing caller working: `EMPTY_FORM.priceRupees` is
+     * `""` (→ the control sends `undefined` → "This field is required", which is
+     * the right message for an empty price), `bundleToForm` supplies a string,
+     * and the submit still does `Number(form.priceRupees)`.
+     *
+     * The two-decimal rule is kept as a refine over `String(n)` rather than
+     * `multipleOf(0.01)`, which is not float-safe.
+     */
+    priceRupees: annotate(z.coerce
+        .number({ message: BUNDLE_COPY.adminEditor.errors.priceInvalid })
+        .positive(BUNDLE_COPY.adminEditor.errors.priceInvalid)
+        .refine((n) => Number.isFinite(n) && /^\d+(\.\d{1,2})?$/.test(String(n)), BUNDLE_COPY.adminEditor.errors.priceInvalid), {
         section: "basics", quick: true, order: 2, row: "pair",
         kind: "number", label: "Bundle price (₹)",
         help: "What the buyer pays for the whole bundle — normally less than the members' total.",

package/dist/features/layout/NavbarLayout.js

@@ -4,6 +4,7 @@ import { useRef, useState, useEffect, useCallback } from "react";
 import Link from "next/link";
 import { Div, Li, Nav, Row, Span, Ul } from "../../ui";
 import { NavbarChevron } from "../../ui/components/NavbarChevron";
+import { findActiveNavItem } from "../../_internal/client/features/layout/navActive";
 const __O = {
     hidden: "overflow-hidden",
 };
@@ -48,8 +49,28 @@ export function NavbarLayout({ items, activeHref, id = "main-navbar", ariaLabel
         };
     }, [updateArrows, items]);
     const scroll = (dir) => scrollRef.current?.scrollBy({ left: dir === "left" ? -240 : 240, behavior: "smooth" });
+    // 🛑 Resolve the active item with `findActiveNavItem`, NOT `activeHref === item.href`.
+    //
+    // Strict equality is what this used, and it meant the top navbar marked
+    // nothing at all on any detail page: /products marked "Products", but
+    // /products/product-beyblade-original-dranzer-s marked nothing — verified in
+    // production 2026-10-02, where the Products and Home links had byte-identical
+    // computed styles (colour rgb(91,91,99), weight 500, transparent background,
+    // 0px bottom border), so there was no visual marker either. A visitor who
+    // drills from a listing into an item loses their place in the navigation.
+    //
+    // The sidebars and the mobile drawer were always correct, because they
+    // already called this helper — which is why the mobile bottom nav highlighted
+    // "Auctions" on /auctions while the desktop navbar above it highlighted
+    // nothing. One algorithm, four surfaces.
+    //
+    // `findActiveNavItem` prefix-matches (`activeHref.startsWith(`${href}/`)`) and
+    // resolves ties by LONGEST href, so a root entry like "/" cannot light up on
+    // every page and a more specific entry always beats a shorter one.
+    const activeItem = findActiveNavItem(items, activeHref);
+    const isItemActive = (item) => activeItem?.href === item.href;
     if (inline) {
-        return (_jsx(Ul, { "aria-label": ariaLabel, className: "hidden xl:flex items-center justify-center gap-[var(--appkit-space-0-5)] xl:gap-[var(--appkit-space-1)] w-full", children: items.map((item) => (_jsx(Li, { children: renderItem ? (renderItem(item, activeHref === item.href)) : (_jsx(DefaultNavItem, { item: item, isActive: activeHref === item.href })) }, item.href))) }));
+        return (_jsx(Ul, { "aria-label": ariaLabel, className: "hidden xl:flex items-center justify-center gap-[var(--appkit-space-0-5)] xl:gap-[var(--appkit-space-1)] w-full", children: items.map((item) => (_jsx(Li, { children: renderItem ? (renderItem(item, isItemActive(item))) : (_jsx(DefaultNavItem, { item: item, isActive: isItemActive(item) })) }, item.href))) }));
     }
-    return (_jsx(Nav, { border: "subtle", id: id, "aria-label": ariaLabel, className: "hidden lg:block bg-[var(--appkit-color-bg)]/95 backdrop-blur-md border-b", children: _jsxs(Row, { className: "container mx-auto sm:px-[var(--appkit-space-6)] lg:px-[var(--appkit-space-8)] max-w-[1920px] h-10", padding: "x-md", align: "center", reverse: "hand", children: [_jsxs(Div, { className: `relative flex-1 ${__O.hidden}`, children: [canScrollLeft && (_jsx(NavbarChevron, { direction: "left", onClick: () => scroll("left") })), _jsx(Ul, { ref: scrollRef, className: "flex items-center justify-center gap-[var(--appkit-space-0-5)] lg:gap-[var(--appkit-space-1)] overflow-x-auto [&::-webkit-scrollbar]:hidden [-ms-overflow-style:none] [scrollbar-width:none]", children: items.map((item) => (_jsx(Li, { className: "shrink-0", children: renderItem ? (renderItem(item, activeHref === item.href)) : (_jsx(DefaultNavItem, { item: item, isActive: activeHref === item.href })) }, item.href))) }), canScrollRight && (_jsx(NavbarChevron, { direction: "right", onClick: () => scroll("right") }))] }), rightSlot && _jsx(Div, { className: "shrink-0", children: rightSlot })] }) }));
+    return (_jsx(Nav, { border: "subtle", id: id, "aria-label": ariaLabel, className: "hidden lg:block bg-[var(--appkit-color-bg)]/95 backdrop-blur-md border-b", children: _jsxs(Row, { className: "container mx-auto sm:px-[var(--appkit-space-6)] lg:px-[var(--appkit-space-8)] max-w-[1920px] h-10", padding: "x-md", align: "center", reverse: "hand", children: [_jsxs(Div, { className: `relative flex-1 ${__O.hidden}`, children: [canScrollLeft && (_jsx(NavbarChevron, { direction: "left", onClick: () => scroll("left") })), _jsx(Ul, { ref: scrollRef, className: "flex items-center justify-center gap-[var(--appkit-space-0-5)] lg:gap-[var(--appkit-space-1)] overflow-x-auto [&::-webkit-scrollbar]:hidden [-ms-overflow-style:none] [scrollbar-width:none]", children: items.map((item) => (_jsx(Li, { className: "shrink-0", children: renderItem ? (renderItem(item, isItemActive(item))) : (_jsx(DefaultNavItem, { item: item, isActive: isItemActive(item) })) }, item.href))) }), canScrollRight && (_jsx(NavbarChevron, { direction: "right", onClick: () => scroll("right") }))] }), rightSlot && _jsx(Div, { className: "shrink-0", children: rightSlot })] }) }));
 }

package/dist/features/media/messages/en.json

@@ -1,63 +1,67 @@
-{
-  "mediaEditor": {
-    "cropTitle": "Crop Image",
-    "cropInstruction": "Drag to reposition. Use the zoom slider or +/- keys to zoom.",
-    "cropPreviewAlt": "Preview",
-    "cropZoom": "Zoom",
-    "cropZoomIn": "Zoom in",
-    "cropZoomOut": "Zoom out",
-    "cropWarningTitle": "Low zoom",
-    "cropWarningMessage": "Zoom in for better quality.",
-    "cropPosition": "Position",
-    "cropReset": "Reset",
-    "cropSave": "Save Crop",
-    "cropCancel": "Cancel",
-    "trimTitle": "Trim Video",
-    "trimInstruction": "Set the start and end times, then click Trim.",
-    "trimStart": "Start",
-    "trimEnd": "End",
-    "trimDuration": "Duration: {duration}s",
-    "trimQuality": "Quality",
-    "trimQualityLow": "Low",
-    "trimQualityMedium": "Medium",
-    "trimQualityHigh": "High",
-    "trimSave": "Trim Video",
-    "trimSkip": "Skip",
-    "trimming": "Trimming\u2026",
-    "thumbnailTitle": "Select Thumbnail",
-    "thumbnailInstruction": "Seek to the frame you want to use as the thumbnail.",
-    "thumbnailCapture": "Use This Frame",
-    "thumbnailSkip": "Skip",
-    "thumbnailCapturing": "Capturing\u2026",
-    "thumbnailUploading": "Uploading\u2026",
-    "cropSuccess": "Image cropped",
-    "trimSuccess": "Video trimmed",
-    "thumbnailSuccess": "Thumbnail saved",
-    "cropError": "Failed to crop image",
-    "trimError": "Failed to trim video",
-    "thumbnailError": "Failed to capture thumbnail",
-    "editImage": "Edit / Crop",
-    "editVideo": "Trim / Thumbnail"
-  },
-  "camera": {
-    "takePhoto": "Take Photo",
-    "startRecording": "Start Recording",
-    "stopRecording": "Stop Recording",
-    "flipCamera": "Flip Camera",
-    "switchToCamera": "Use Camera",
-    "switchToUpload": "Upload File",
-    "cameraError": "Camera unavailable",
-    "permissionDenied": "Camera permission denied. Please allow access in your browser settings.",
-    "notSupported": "Camera is not supported on this device",
-    "starting": "Starting camera..."
-  },
-  "upload": {
-    "change": "Change",
-    "remove": "Remove",
-    "clickToUpload": "Click to upload",
-    "uploading": "Uploading\u2026",
-    "uploadingProgress": "Uploading {progress}%\u2026",
-    "replaceFile": "Replace file",
-    "chooseFile": "Choose file to upload"
-  }
-}
+{
+  "mediaEditor": {
+    "cropTitle": "Crop Image",
+    "cropInstruction": "Drag to reposition. Use the zoom slider or +/- keys to zoom.",
+    "cropPreviewAlt": "Preview",
+    "cropZoom": "Zoom",
+    "cropZoomIn": "Zoom in",
+    "cropZoomOut": "Zoom out",
+    "cropRotateLeft": "Rotate left 90°",
+    "cropRotateRight": "Rotate right 90°",
+    "cropFlipH": "Flip horizontally",
+    "cropFlipV": "Flip vertically",
+    "cropWarningTitle": "Low zoom",
+    "cropWarningMessage": "Zoom in for better quality.",
+    "cropPosition": "Position",
+    "cropReset": "Reset",
+    "cropSave": "Save Crop",
+    "cropCancel": "Cancel",
+    "trimTitle": "Trim Video",
+    "trimInstruction": "Set the start and end times, then click Trim.",
+    "trimStart": "Start",
+    "trimEnd": "End",
+    "trimDuration": "Duration: {duration}s",
+    "trimQuality": "Quality",
+    "trimQualityLow": "Low",
+    "trimQualityMedium": "Medium",
+    "trimQualityHigh": "High",
+    "trimSave": "Trim Video",
+    "trimSkip": "Skip",
+    "trimming": "Trimming…",
+    "thumbnailTitle": "Select Thumbnail",
+    "thumbnailInstruction": "Seek to the frame you want to use as the thumbnail.",
+    "thumbnailCapture": "Use This Frame",
+    "thumbnailSkip": "Skip",
+    "thumbnailCapturing": "Capturing…",
+    "thumbnailUploading": "Uploading…",
+    "cropSuccess": "Image cropped",
+    "trimSuccess": "Video trimmed",
+    "thumbnailSuccess": "Thumbnail saved",
+    "cropError": "Failed to crop image",
+    "trimError": "Failed to trim video",
+    "thumbnailError": "Failed to capture thumbnail",
+    "editImage": "Edit / Crop",
+    "editVideo": "Trim / Thumbnail"
+  },
+  "camera": {
+    "takePhoto": "Take Photo",
+    "startRecording": "Start Recording",
+    "stopRecording": "Stop Recording",
+    "flipCamera": "Flip Camera",
+    "switchToCamera": "Use Camera",
+    "switchToUpload": "Upload File",
+    "cameraError": "Camera unavailable",
+    "permissionDenied": "Camera permission denied. Please allow access in your browser settings.",
+    "notSupported": "Camera is not supported on this device",
+    "starting": "Starting camera..."
+  },
+  "upload": {
+    "change": "Change",
+    "remove": "Remove",
+    "clickToUpload": "Click to upload",
+    "uploading": "Uploading…",
+    "uploadingProgress": "Uploading {progress}%…",
+    "replaceFile": "Replace file",
+    "chooseFile": "Choose file to upload"
+  }
+}

package/dist/utils/media-url.js

@@ -64,6 +64,33 @@ export const MEDIA_URL_MESSAGE = "Must be a stored media reference (/media/<slug
  * validated before stops validating now.
  */
 export function isStoredMediaRef(value) {
+    /*
+     * 🛑 Type-guard first: this predicate is reached through `.refine()` from two
+     * schemas and from several hand-written call sites, so it receives whatever
+     * the document actually holds — not whatever the signature says.
+     *
+     * Without this line a non-string reached `value.startsWith(...)` and threw
+     * `TypeError: e.startsWith is not a function`, which killed the whole render
+     * of the panel it was validating. Measured on production 2026-10-02: expanding
+     * the Branding section of /admin/site threw exactly that and the section body
+     * never appeared — so the Site Settings editor looked like it rendered no
+     * fields for ANY section, and five checklist cases were blocked behind what
+     * read as a missing feature.
+     *
+     * `!value` already caught null/undefined/"" and 0; an object or an array is
+     * truthy with `length === undefined`, so `undefined > MAX` is false and
+     * execution fell straight through to `.startsWith`.
+     *
+     * A VALIDATOR MUST REJECT, NEVER THROW. Returning false is the correct answer
+     * for a non-string, and the warn keeps the real defect findable — some caller
+     * is passing the wrong shape (a `{ url }` object where its `.url` was meant
+     * is the obvious candidate) and that is a separate fix at the call site.
+     */
+    if (typeof value !== "string") {
+        // eslint-disable-next-line no-console -- client-side; the server path has its own recorder
+        console.warn("[isStoredMediaRef] expected a string, received", Object.prototype.toString.call(value));
+        return false;
+    }
     if (!value || value.length > MEDIA_URL_MAX_LENGTH)
         return false;
     if (value.startsWith(MEDIA_PROXY_PREFIX))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.42.5",
+  "version": "4.42.7",
   "license": "MIT",
   "publishConfig": {
     "access": "public"