@mohasinac/appkit 4.53.0 → 4.53.1

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.53.0",
-  "head": "78e72eb24243b0ee3afea21614fbbadee45d2b51",
+  "version": "4.53.1",
+  "head": "d45b9f65d4b73c4c4a079a8ee5553600ddd0c251",
   "branch": "main",
   "dirty": false,
-  "builtAt": "2026-10-19T12:44:44.499Z"
+  "builtAt": "2026-10-19T21:36:59.723Z"
 }

package/dist/_internal/client/scaffolds/AppShell.js

@@ -6,5 +6,5 @@ export function AppShell({ children, slotHeader, slotFooter, slotSidebar, render
     const header = renderHeader ? renderHeader(ctx) : slotHeader;
     const footer = renderFooter ? renderFooter(ctx) : slotFooter;
     const sidebar = renderSidebar ? renderSidebar(ctx) : slotSidebar;
-    return (_jsxs(Stack, { className: `appkit-app-shell min-h-screen ${className ?? ""}`, children: [header ? (_jsx(BlockHeader, { className: "sticky top-0 z-30 w-full", "data-appshell-slot": "header", children: header })) : null, _jsxs(Div, { layout: "flex", className: "flex-1", children: [sidebar ? (_jsx(Aside, { className: "hidden lg:block lg:w-64 lg:shrink-0", "data-appshell-slot": "sidebar", children: sidebar })) : null, _jsx(Main, { className: "min-w-0 flex-1", "data-appshell-slot": "main", children: children })] }), footer ? (_jsx(BlockFooter, { className: "w-full", "data-appshell-slot": "footer", children: footer })) : null] }));
+    return (_jsxs(Stack, { className: `min-h-screen ${className ?? ""}`, children: [header ? (_jsx(BlockHeader, { className: "sticky top-0 z-30 w-full", "data-appshell-slot": "header", children: header })) : null, _jsxs(Div, { layout: "flex", className: "flex-1", children: [sidebar ? (_jsx(Aside, { className: "hidden lg:block lg:w-64 lg:shrink-0", "data-appshell-slot": "sidebar", children: sidebar })) : null, _jsx(Main, { className: "min-w-0 flex-1", "data-appshell-slot": "main", children: children })] }), footer ? (_jsx(BlockFooter, { className: "w-full", "data-appshell-slot": "footer", children: footer })) : null] }));
 }

package/dist/_internal/server/features/auctions/og.d.ts

@@ -8,7 +8,9 @@ interface AuctionDocLike {
     title?: string | null;
     auctionEndDate?: Date | string | null;
     mainImage?: string | null;
-    images?: (string | null | undefined)[] | null;
+    images?: ({
+        url: string;
+    } | string | null | undefined)[] | null;
 }
 /** High-level OG renderer — accepts the raw auction document from `getAuctionForDetail`. */
 export declare function renderAuctionOg(doc: AuctionDocLike | null | undefined, opts: {

package/dist/_internal/server/features/auctions/og.js

@@ -14,7 +14,9 @@ export function renderAuctionOg(doc, opts) {
     return renderAuctionOgImage({
         title: doc?.title ?? "Live Auction",
         endsLabel,
-        imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
+        imageUrl: resolveOgImageUrl(doc?.mainImage ||
+            (typeof doc?.images?.[0] === "string" ? doc.images[0] : doc?.images?.[0]?.url) ||
+            null, opts.baseUrl),
     }, opts.siteName);
 }
 export function renderAuctionOgImage(data, siteName) {

package/dist/_internal/server/features/bundles/actions.js

@@ -68,7 +68,7 @@ quantity = 1) {
         quantity: 1,
         unitPrice: p.price,
         title: p.title,
-        image: p.images?.[0] ?? p.mainImage,
+        image: p.images?.[0]?.url ?? p.mainImage,
         gstRate: p.gstRate,
         hsnCode: p.hsnCode,
         listingType: normalizeListingType(p),

package/dist/_internal/server/features/business-documents/download.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Reads a statutory business document — GST certificate, Udyam registration,
+ * bank passbook — and decrypts it for an admin.
+ *
+ * 🛑 WHY THIS EXISTS rather than a `/media/{slug}` URL. Same two facts that
+ * forced `digital-code/download.ts` into the same shape, and either alone is
+ * enough:
+ *
+ *   1. `storage.rules` grants `allow read: if true` on EVERY object in the
+ *      bucket. All real access goes through the Admin SDK, so that is an
+ *      acceptable safety net — but it means Storage itself protects nothing.
+ *   2. `GET /api/media/[...slug]` performs NO authentication. It is a bare
+ *      handler with no session read, deliberately, because its job is public
+ *      product photography.
+ *
+ * So the bytes live under a private prefix that mints no `mediaAssets` row —
+ * and the row IS the public slug, so no row means no public URL — and are read
+ * only from here, after the route has checked the caller is an admin.
+ *
+ * On top of that, and unlike the digital-code case, these objects are stored
+ * ENCRYPTED: a bank passbook sitting in plaintext in a bucket whose rules say
+ * `read: if true` would depend entirely on nobody ever minting a slug for it.
+ */
+export interface BusinessDocumentResolution {
+    ok: boolean;
+    status?: number;
+    message?: string;
+    buffer?: Buffer;
+    contentType?: string;
+    fileName?: string;
+}
+/**
+ * Resolve, download and decrypt the document with id `documentId`.
+ *
+ * The caller is responsible for the authorization check — the route wraps this
+ * in `createRouteHandler({ roles: ROLES_ADMIN_ONLY, permission: "settings:write" })`.
+ * This function deliberately takes no viewer: there is no per-row ownership to
+ * evaluate, so inventing a `viewerUid` parameter it never reads would imply a
+ * check that is not happening here.
+ */
+export declare function resolveBusinessDocument(documentId: string): Promise<BusinessDocumentResolution>;

package/dist/_internal/server/features/business-documents/download.js

@@ -0,0 +1,91 @@
+/**
+ * Reads a statutory business document — GST certificate, Udyam registration,
+ * bank passbook — and decrypts it for an admin.
+ *
+ * 🛑 WHY THIS EXISTS rather than a `/media/{slug}` URL. Same two facts that
+ * forced `digital-code/download.ts` into the same shape, and either alone is
+ * enough:
+ *
+ *   1. `storage.rules` grants `allow read: if true` on EVERY object in the
+ *      bucket. All real access goes through the Admin SDK, so that is an
+ *      acceptable safety net — but it means Storage itself protects nothing.
+ *   2. `GET /api/media/[...slug]` performs NO authentication. It is a bare
+ *      handler with no session read, deliberately, because its job is public
+ *      product photography.
+ *
+ * So the bytes live under a private prefix that mints no `mediaAssets` row —
+ * and the row IS the public slug, so no row means no public URL — and are read
+ * only from here, after the route has checked the caller is an admin.
+ *
+ * On top of that, and unlike the digital-code case, these objects are stored
+ * ENCRYPTED: a bank passbook sitting in plaintext in a bucket whose rules say
+ * `read: if true` would depend entirely on nobody ever minting a slug for it.
+ */
+import { getAdminStorage } from "../../../../providers/db-firebase/index.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { decryptBuffer, isBufferEncrypted } from "../../../../security/settings-encryption.js";
+import { businessDocumentsRepository } from "../../../../features/business-documents/repository/business-documents.repository.js";
+/**
+ * Resolve, download and decrypt the document with id `documentId`.
+ *
+ * The caller is responsible for the authorization check — the route wraps this
+ * in `createRouteHandler({ roles: ROLES_ADMIN_ONLY, permission: "settings:write" })`.
+ * This function deliberately takes no viewer: there is no per-row ownership to
+ * evaluate, so inventing a `viewerUid` parameter it never reads would imply a
+ * check that is not happening here.
+ */
+export async function resolveBusinessDocument(documentId) {
+    const record = await businessDocumentsRepository.findById(documentId);
+    if (!record) {
+        return { ok: false, status: 404, message: "Document not found" };
+    }
+    let stored;
+    try {
+        const file = getAdminStorage().bucket().file(record.storagePath);
+        const [buffer] = await file.download();
+        stored = buffer;
+    }
+    catch (err) {
+        void normalizeError(err);
+        return { ok: false, status: 404, message: "Document is no longer available" };
+    }
+    /*
+     * Branch on the RECORDED flag, never on sniffing the buffer.
+     *
+     * `isBufferEncrypted` is used only to catch disagreement: a row that claims
+     * encryption over an object that has none means the upload half-failed or
+     * the object was replaced by hand, and handing those bytes back as though
+     * nothing were wrong is how a plaintext passbook gets served while every log
+     * line says it was encrypted. Refuse and say which way the mismatch runs.
+     */
+    if (record.encrypted !== isBufferEncrypted(stored)) {
+        return {
+            ok: false,
+            status: 500,
+            message: record.encrypted
+                ? "Stored document is not encrypted but its record says it is — refusing to serve it."
+                : "Stored document is encrypted but its record says it is not — refusing to guess.",
+        };
+    }
+    let plaintext;
+    if (record.encrypted) {
+        try {
+            plaintext = decryptBuffer(stored);
+        }
+        catch (err) {
+            // A GCM auth failure means the wrong key or a tampered object. Both are
+            // worth a 500 and a log; neither is worth telling the caller which.
+            void normalizeError(err);
+            return { ok: false, status: 500, message: "Document could not be decrypted" };
+        }
+    }
+    else {
+        plaintext = stored;
+    }
+    return {
+        ok: true,
+        buffer: plaintext,
+        contentType: record.contentType || "application/octet-stream",
+        fileName: record.fileName || "document",
+    };
+}

package/dist/_internal/server/features/categories/adapters.d.ts

@@ -31,7 +31,7 @@ import type { CategoryItem } from "../../../../features/categories/types/index";
  * the object literal in `toCategoryListItem` — the audit asserts both
  * directions.
  */
-export declare const PUBLIC_CATEGORY_FIELDS: readonly ["id", "name", "slug", "description", "rootId", "parentIds", "childrenIds", "tier", "path", "order", "isLeaf", "ancestors", "categoryType", "itemCode", "isFeatured", "featuredPriority", "seo", "display", "isActive", "highlights", "faqs", "brandWebsite", "brandCountry", "brandFounded", "metrics", "createdAt", "updatedAt"];
+export declare const PUBLIC_CATEGORY_FIELDS: readonly ["id", "name", "slug", "description", "rootId", "parentIds", "childrenIds", "tier", "path", "order", "isLeaf", "ancestors", "categoryType", "itemCode", "isFeatured", "featuredPriority", "seo", "display", "isActive", "highlights", "faqs", "brandWebsite", "brandCountry", "brandFounded", "hasbroName", "hasbroCoverImage", "metrics", "createdAt", "updatedAt"];
 /**
  * Fields withheld, each with the reason. Never remove one without replacing
  * the reason — "it seemed unused" is how a field ends up public by accident.

package/dist/_internal/server/features/categories/adapters.js

@@ -37,6 +37,14 @@ export const PUBLIC_CATEGORY_FIELDS = [
     "brandWebsite",
     "brandCountry",
     "brandFounded",
+    /*
+     * The Hasbro alternate name and its cover, rendered as "Also known as" by
+     * `CategoryDetailPageView`. Public because the whole point of the field is
+     * that a buyer who only knows the Hasbro season name can SEE the
+     * correspondence — a name on a toy box is not sensitive.
+     */
+    "hasbroName",
+    "hasbroCoverImage",
     // Rollup counts only — see `metrics` in the private list.
     "metrics",
     "createdAt",
@@ -217,6 +225,8 @@ export function toCategoryListItem(doc) {
         brandWebsite: doc.brandWebsite,
         brandCountry: doc.brandCountry,
         brandFounded: doc.brandFounded,
+        hasbroName: doc.hasbroName,
+        hasbroCoverImage: doc.hasbroCoverImage,
         metrics: toPublicMetrics(doc.metrics),
         // 🛑 `CategoryDocument` stores Dates; `CategoryItem` declares strings —
         // this projection is also the serialisation boundary. Converting here

package/dist/_internal/server/features/checkout/actions.d.ts

@@ -39,6 +39,20 @@ export declare function resolveShippingCost(storeId: string | undefined): Promis
     storeState: string | undefined;
     /** C5b — the resolved policy, so a caller can quote with the cart in hand. */
     shippingPolicy: StoreShippingPolicy;
+    /**
+     * The seller's own tax registration, from the store read this function
+     * already performs.
+     *
+     * Returned here rather than re-fetched in `createOrderForGroup` so the
+     * checkout path pays no extra Firestore read for data already in scope
+     * (Rule #6). Raw fields, not a resolved identity — the seller-vs-platform
+     * decision belongs to `resolveSupplierIdentity` alone.
+     */
+    storeTaxIdentity: {
+        gstin?: string;
+        legalName?: string;
+        registeredAddress?: string;
+    } | undefined;
     /**
      * 🛑 True when the mode is `estimate` and no carrier rate was supplied.
      *

package/dist/_internal/server/features/checkout/actions.js

@@ -38,11 +38,13 @@ import { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_DEFAULT_EMI_SETTINGS } from "../
 import { checkEmiEligibility, computeEmiSchedule } from "../../../shared/features/emi/schedule.js";
 import { formatShippingAddress } from "./data.js";
 import { enforceMaxPerUserForCart } from "./prize-bundle-gates.js";
-import { getListingRule, runSyncPreflight, } from "../../../shared/checkout/rules/index.js";
+import { getListingRule, runSyncPreflight, assertPaymentMethodAllowed, } from "../../../shared/checkout/rules/index.js";
+import { revalidateGroupLines } from "./group-rule-revalidation.js";
 import { cartIsDigitalOnly } from "../../../shared/listing-types/cart-shipping.js";
 import { processRefundAction } from "../refunds/actions.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { resolveDisplayedUpiId } from "./upi-resolution.js";
+import { resolveSupplierIdentity } from "./supplier-identity.js";
 import { PAYMENT_WINDOW_MS } from "../../../../features/orders/constants/payment-window.js";
 import { isCheckoutValueOtpVerified } from "../../../../features/checkout/actions/checkout-value-otp-actions.js";
 const AUDIT_LOG_FAIL_MSG = "checkout: audit log failed (non-critical)";
@@ -193,6 +195,9 @@ export async function resolveShippingCost(storeId) {
             shippingPolicy: DEFAULT_STORE_SHIPPING_POLICY,
             shippingUnavailable: false,
             storeProtections: { shipping: false, sale: false },
+            // No store, so no seller registration — the caller falls back to the
+            // platform's via resolveSupplierIdentity.
+            storeTaxIdentity: undefined,
         };
     }
     const store = await storeRepository.findById(storeId);
@@ -246,6 +251,25 @@ export async function resolveShippingCost(storeId) {
             shipping: store?.supportsShippingProtection === true,
             sale: store?.supportsSaleProtection === true,
         },
+        /*
+         * The seller's own tax registration, returned from the store read this
+         * function ALREADY does.
+         *
+         * Deliberately not a second `storeRepository.findById` in
+         * `createOrderForGroup`: that would add one Firestore read per order group
+         * to the checkout path for data already sitting in this scope, against
+         * Rule #6's round-trip budget. Returning the three raw fields rather than
+         * the resolved identity keeps the decision in one place —
+         * `resolveSupplierIdentity` — instead of splitting it across a shipping
+         * helper and a checkout action.
+         */
+        storeTaxIdentity: store
+            ? {
+                gstin: store.gstin,
+                legalName: store.legalName,
+                registeredAddress: store.registeredAddress,
+            }
+            : undefined,
     };
 }
 /**
@@ -475,7 +499,17 @@ async function createOrderForGroup(group, orderType, ctx) {
         return expandCartLineToOrderRows(item, product, ctx.productById).map((baseLine) => itemRule.decorateOrderItem(baseLine, product));
     });
     const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
-    const { shippingFee, storeOwnerId, storeEmiEnabled, storeState, storeProtections } = await resolveShippingCost(firstItem.storeId);
+    const { shippingFee, storeOwnerId, storeEmiEnabled, storeState, storeProtections, storeTaxIdentity } = await resolveShippingCost(firstItem.storeId);
+    /*
+     * Who issues this invoice — the seller if they have their own GSTIN, the
+     * platform otherwise. ONE function decides, and it is the only place that
+     * knows the order (Root Cause #75: a money rule reachable by copy-paste
+     * gets copied, and the copies miss branches added later).
+     *
+     * Snapshot below and never recomputed: `OrderDocument`'s own comment is
+     * that these are the registration "as it stood at the moment of supply".
+     */
+    const supplier = resolveSupplierIdentity(storeTaxIdentity, gstSettings ? { gst: gstSettings } : undefined);
     // P-8 GST — sum per-line-item tax (each product may carry its own gstRate),
     // then split the group total into a single cgst/sgst/igst breakdown for the
     // order document. Skipped entirely when GST is off or the buyer's state is
@@ -671,12 +705,17 @@ async function createOrderForGroup(group, orderType, ctx) {
          * `taxableAmount` so the taxed base stays the base the tax was charged on,
          * and recorded here so the invoice's columns can reconcile. */
         exemptAmount: gstBreakdown?.exemptAmount || undefined,
-        /* Our registration AS IT STANDS NOW. A tax invoice without the supplier's
-         * GSTIN is not a tax invoice, and the invoice page cannot read it from
-         * site settings — `gst` is in PRIVATE_SITE_FIELDS. See the schema. */
-        supplierGstin: gstSettings?.enabled ? gstSettings.gstin || undefined : undefined,
-        supplierLegalName: gstSettings?.enabled ? gstSettings.legalName || undefined : undefined,
-        supplierAddress: gstSettings?.enabled ? gstSettings.address || undefined : undefined,
+        /* The supplier of record AS IT STANDS NOW. A tax invoice without the
+         * supplier's GSTIN is not a tax invoice, and the invoice page cannot read
+         * it from site settings — `gst` is in PRIVATE_SITE_FIELDS. See the schema.
+         *
+         * 🛑 This was `gstSettings.gstin` unconditionally — the PLATFORM's
+         * registration on every order ever placed, with no way for a seller to
+         * invoice under their own, while the seeded FAQ told buyers otherwise.
+         * It now resolves seller-first via `resolveSupplierIdentity`. */
+        supplierGstin: supplier.gstin,
+        supplierLegalName: supplier.legalName,
+        supplierAddress: supplier.address,
         /* Per-rate, for Rule 46. Computed by `sumGroupGst` rather than re-derived
          * downstream — a mixed 5%+18% order cannot produce a compliant invoice
          * from the aggregate triple alone. */
@@ -873,6 +912,23 @@ export async function createCheckoutOrderAction(input) {
             preTxProductById.set(preTxLookup.productIds[i], snap.data());
         }
     }
+    /*
+     * Payment-method gate — before `enforceMaxPerUserForCart`, which runs count
+     * queries, because this answer needs no reads at all.
+     *
+     * 🛑 `preTxProductById` is the right map and `preTxPairs` below is NOT: that
+     * pairing keeps only `getCartItemMemberIds(item)[0]`, so a bundle or grouped
+     * line contributes one member and the rest are invisible. The gate walks
+     * every member of every line against this map.
+     *
+     * 🛑 This ONE call site is complete coverage, and that is worth stating so
+     * nobody adds a second. Only `cod`/`cash`/`emi` are ever blocked (auction,
+     * bundle, prize-draw) and all three arrive here; the Razorpay path is always
+     * `"online"`, which no rule blocks — and a throw there would land AFTER
+     * capture, taking the buyer's money and then refusing the order. Pre-capture
+     * is the only safe place for this, and the method is decided here.
+     */
+    assertPaymentMethodAllowed(cartItems, preTxProductById, paymentMethod);
     const preTxPairs = cartItems
         .map((item) => {
         const [firstMember] = getCartItemMemberIds(item);
@@ -982,6 +1038,28 @@ export async function createCheckoutOrderAction(input) {
         throw new ValidationError(ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK);
     }
     const { coupons: appliedCoupons, dropped: droppedCoupons } = await revalidateAppliedCoupons(cart.appliedCoupons ?? [], available, uid);
+    /*
+     * The THIRD group-rule enforcement point: the picker mirrors the rules,
+     * `addGroupLineToCart` enforces them at add time, and this re-checks them at
+     * placement. Without it a rule edited after a line was already in a cart is
+     * never re-checked at all, and a quoted discount percentage outlives the rule
+     * it was copied from.
+     *
+     * 🛑 Runs AFTER the stock bucketing, over `available` rather than the whole
+     * cart — a line already dropped for being out of stock does not need its
+     * group rules adjudicated too, and reporting both about one line would be two
+     * explanations for one outcome.
+     *
+     * A blocked line THROWS: its selection is no longer valid and no price is
+     * right for it. A repriced one is surfaced, which is `droppedCoupons`'
+     * discipline — the buyer is on the payment step and cannot fix a seller's
+     * rule change from there.
+     */
+    const groupRecheck = await revalidateGroupLines(available.map(({ item }) => item));
+    if (groupRecheck.blocked.length > 0) {
+        const first = groupRecheck.blocked[0];
+        throw Object.assign(new ValidationError(`"${first.groupTitle}" can no longer be bought as selected. ${first.reason} Update that line in your cart and try again.`), { code: "GROUP_RULES_CHANGED" });
+    }
     const orderGroups = splitCartIntoOrderGroups(available);
     // Admin-bypass orders are immediately paid and processing; generate a shared
     // transaction reference for all orders in this checkout batch.
@@ -1039,6 +1117,15 @@ export async function createCheckoutOrderAction(input) {
         itemCount: orderIds.length,
         ...(unavailable.length > 0 ? { unavailableItems: unavailable } : {}),
         ...(droppedCoupons.length > 0 ? { droppedCoupons } : {}),
+        ...(groupRecheck.repriced.length > 0
+            ? {
+                repricedGroupLines: groupRecheck.repriced.map((r) => ({
+                    groupTitle: r.groupTitle,
+                    previousPercent: r.previousPercent,
+                    currentPercent: r.currentPercent,
+                })),
+            }
+            : {}),
     };
 }
 const EMPTY_PRICING_PREVIEW = {
@@ -1387,7 +1474,14 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     // Reuses the same store/seller lookup as the COD/UPI path above instead
     // of re-implementing it inline — was two sequential findById calls per
     // seller group here, duplicated from resolveShippingCost.
-    const { shippingFee, storeOwnerId, storeState } = await resolveShippingCost(firstItem.storeId);
+    const { shippingFee, storeOwnerId, storeState, storeTaxIdentity } = await resolveShippingCost(firstItem.storeId);
+    /*
+     * Same supplier-of-record rule as `createOrderForGroup`, through the same
+     * function. This path (PhonePe verify / webhook) is the SECOND place an
+     * order is created, and the two have drifted before — add-on fees, and the
+     * whole tax breakdown, were both missing here until C0c defect 1.
+     */
+    const supplier = resolveSupplierIdentity(storeTaxIdentity, siteSettings ? { gst: siteSettings.gst } : undefined);
     const groupLines = group.map(({ item, product }) => ({ itemId: item.itemId, lineTotal: lineTotalFor(item, product) }));
     const { couponDiscount, appliedDiscounts } = computeGroupCouponDiscount(appliedCoupons, groupLines, groupTotal, cartSubtotal, firstItem.storeId);
     // Mirrors createOrderForGroup — without this the online-payment path wrote
@@ -1543,9 +1637,9 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         exemptAmount: phonepeGst?.exemptAmount || undefined,
         // Our registration at the moment of supply — see the schema. Mirrors the
         // COD/UPI path so both produce an invoiceable order.
-        supplierGstin: siteSettings?.gst?.enabled ? siteSettings.gst.gstin || undefined : undefined,
-        supplierLegalName: siteSettings?.gst?.enabled ? siteSettings.gst.legalName || undefined : undefined,
-        supplierAddress: siteSettings?.gst?.enabled ? siteSettings.gst.address || undefined : undefined,
+        supplierGstin: supplier.gstin,
+        supplierLegalName: supplier.legalName,
+        supplierAddress: supplier.address,
         gstByRate: phonepeGst?.byRate.length ? phonepeGst.byRate : undefined,
         gstAmount: (phonepeGst?.gstAmount ?? 0) + platformFeeGst || undefined,
         cgst: phonepeGst?.cgst || undefined,

package/dist/_internal/server/features/checkout/bundle-expansion.js

@@ -60,6 +60,23 @@ export function validateCartItemStock(item, productById, decrements) {
         if (!product || product.status !== ProductStatusValues.PUBLISHED) {
             return { productId: member.productId, availableQty: product?.availableQuantity ?? 0 };
         }
+        /*
+         * 🛑 Made to order: skip the stock CHECK for this member.
+         *
+         * There is nothing to be short of — the thing is printed or built when the
+         * order arrives. `availableQuantity` on such a row goes negative by design
+         * and that negative IS the production queue, which is why the check is
+         * bypassed here and `getExpandedDecrements` above is deliberately left
+         * alone: it still counts, the decrement still lands, and
+         * `stock-restore.ts` can still mirror it exactly on a cancellation. Skip
+         * the decrement instead and a cancelled order restores stock that was
+         * never taken.
+         *
+         * Placed AFTER the published-status check on purpose: a draft or archived
+         * listing is unbuyable whatever its production model.
+         */
+        if (product.madeToOrder === true)
+            continue;
         // The fallback must be member-weighted too. Left as a bare `item.quantity`
         // it would validate a line needing 3× of a member against demand for 1
         // whenever the cumulative map didn't happen to carry that product.

package/dist/_internal/server/features/checkout/data.d.ts

@@ -35,4 +35,26 @@ export interface CheckoutOrderResult {
         code: string;
         reason: string;
     }[];
+    /**
+     * Grouped lines whose group DISCOUNT had changed since they were added. The
+     * order is priced at the group's current rule and the change surfaced here,
+     * for the same reason `droppedCoupons` exists: honouring the stale percent
+     * would charge less than the seller now offers, and changing a total the
+     * buyer has read without telling them is worse than either.
+     */
+    repricedGroupLines?: {
+        groupTitle: string;
+        previousPercent: number;
+        currentPercent: number;
+    }[];
+    /**
+     * Grouped lines whose selection no longer satisfies the group's rules — the
+     * seller tightened them after the line was added. REPORTED rather than
+     * repriced: "this group now requires item X" cannot be fixed by adjusting a
+     * number, so the line is not silently bought.
+     */
+    blockedGroupLines?: {
+        groupTitle: string;
+        reason: string;
+    }[];
 }

package/dist/_internal/server/features/checkout/group-rule-revalidation.d.ts

@@ -0,0 +1,34 @@
+import type { CartItemDocument } from "../../../../features/cart/schemas/firestore";
+export interface GroupLineRepriced {
+    itemId: string;
+    groupTitle: string;
+    /** What the line was quoted at. */
+    previousPercent: number;
+    /** What the group's rule says now. */
+    currentPercent: number;
+}
+export interface GroupLineBlocked {
+    itemId: string;
+    groupTitle: string;
+    /** Buyer-facing, from `checkGroupRules`. */
+    reason: string;
+}
+export interface GroupRuleRevalidation {
+    repriced: GroupLineRepriced[];
+    blocked: GroupLineBlocked[];
+}
+/**
+ * Re-validate every multi-member line in the checkout batch.
+ *
+ * 🛑 A null `rules` — the group is gone, or the read failed — is treated as
+ * UNRESTRICTED and the line is left exactly as it is. Failing open is right in
+ * both cases: a transient Firestore error must not block a payment, and a
+ * deleted group is not a reason to refuse a selection the buyer already made
+ * and already had priced.
+ *
+ * 🛑 Bundle lines are deliberately skipped. A bundle is all-or-nothing with its
+ * own locked price — `unitPriceFor`'s bundle branch runs BEFORE its members
+ * branch precisely so the discount that IS the bundle is not recomputed from
+ * list prices — so self-assembly rules have nothing to say about one.
+ */
+export declare function revalidateGroupLines(items: readonly CartItemDocument[]): Promise<GroupRuleRevalidation>;

package/dist/_internal/server/features/checkout/group-rule-revalidation.js

@@ -0,0 +1,124 @@
+/*
+ * WHY: A group's rules and its discount are seller-editable, and a cart can sit
+ *      for days. `addGroupLineToCart` checked both at add time and nothing
+ *      re-checked them — so a rule tightened afterwards was never applied, and
+ *      a line kept quoting a discount percentage the seller had since changed.
+ * WHAT: The third enforcement point — re-validate every multi-member line
+ *       against its group's CURRENT rules, immediately before pricing.
+ *
+ * 🛑 IT REPORTS, IT DOES NOT SILENTLY RESOLVE. A changed discount is the
+ * delicate case and it has two wrong answers: honouring the stale percent
+ * charges less than the seller now offers, and re-deriving silently changes a
+ * total the buyer has already read and agreed to. So the line is repriced to
+ * the current rule AND the change is handed back to the caller to surface —
+ * exactly what `revalidateAppliedCoupons` does with a lapsed coupon, for the
+ * same reason: the buyer is on the payment step and cannot fix a seller's rule
+ * change from there, so failing the whole checkout is hostile.
+ *
+ * 🛑 A rule VIOLATION is different from a repriced discount and is treated
+ * differently. "This group now requires item X" cannot be fixed by adjusting a
+ * number — the selection itself is no longer valid — so that line is reported
+ * as blocked rather than quietly bought.
+ *
+ * EXPORTS: GroupLineRepriced, GroupLineBlocked, GroupRuleRevalidation,
+ *          revalidateGroupLines
+ *
+ * @tag domain:checkout
+ * @tag layer:server
+ * @tag pattern:none
+ * @tag access:server
+ * @tag consumers:checkout/actions
+ * @tag sideEffects:firestore
+ */
+import { safeRead } from "../../../../errors/safe-read.js";
+import { serverLogger } from "../../../../monitoring/server-logger.js";
+import { productRepository } from "../../../../repositories/index.js";
+import { groupedListingsRepository } from "../../../../features/grouped/repository/grouped-listings.repository.js";
+import { checkGroupRules, readGroupRules, } from "../../../shared/features/products/group-rules.js";
+import { isMultiMemberLine } from "../../../shared/checkout/line-members.js";
+/** One group's rules, from whichever of the two homes owns them. */
+async function rulesFor(item) {
+    const groupId = item.groupId;
+    if (!groupId)
+        return null;
+    if (item.groupSource === "grouped-listing") {
+        const doc = await safeRead(() => groupedListingsRepository.findById(groupId), {
+            route: "/checkout",
+            key: "groupedListings.rules",
+            fallback: null,
+        });
+        return doc ? readGroupRules(doc) : null;
+    }
+    /*
+     * A product group's rules live on the PARENT product, and `groupId` IS the
+     * parent's slug (`startGroup` sets `groupId = slug`, and products are pure
+     * slugs), so this resolves directly.
+     */
+    const parent = await safeRead(() => productRepository.findById(groupId), {
+        route: "/checkout",
+        key: "products.groupParentRules",
+        fallback: null,
+    });
+    return parent ? readGroupRules(parent) : null;
+}
+/**
+ * Re-validate every multi-member line in the checkout batch.
+ *
+ * 🛑 A null `rules` — the group is gone, or the read failed — is treated as
+ * UNRESTRICTED and the line is left exactly as it is. Failing open is right in
+ * both cases: a transient Firestore error must not block a payment, and a
+ * deleted group is not a reason to refuse a selection the buyer already made
+ * and already had priced.
+ *
+ * 🛑 Bundle lines are deliberately skipped. A bundle is all-or-nothing with its
+ * own locked price — `unitPriceFor`'s bundle branch runs BEFORE its members
+ * branch precisely so the discount that IS the bundle is not recomputed from
+ * list prices — so self-assembly rules have nothing to say about one.
+ */
+export async function revalidateGroupLines(items) {
+    const repriced = [];
+    const blocked = [];
+    const lines = items.filter((i) => isMultiMemberLine(i) && !i.bundleCategorySlug && i.lineKind === "group");
+    if (lines.length === 0)
+        return { repriced, blocked };
+    for (const item of lines) {
+        const rules = await rulesFor(item);
+        if (!rules)
+            continue;
+        const members = item.groupMembers ?? [];
+        const violations = checkGroupRules(rules, members.map((m) => ({
+            productId: m.productId,
+            quantity: m.quantity,
+            title: m.title,
+        })));
+        if (violations.length > 0) {
+            blocked.push({
+                itemId: item.itemId,
+                groupTitle: item.groupTitle ?? item.productTitle,
+                reason: violations[0].message,
+            });
+            /*
+             * Reported and NOT repriced. A blocked line's price is irrelevant — the
+             * caller is about to refuse it — and repricing it first would leave a
+             * stored price for a line that never sold.
+             */
+            continue;
+        }
+        const quoted = item.groupDiscountPercent ?? 0;
+        const current = Math.min(100, Math.max(0, rules.groupDiscountPercent ?? 0));
+        if (quoted !== current) {
+            repriced.push({
+                itemId: item.itemId,
+                groupTitle: item.groupTitle ?? item.productTitle,
+                previousPercent: quoted,
+                currentPercent: current,
+            });
+            serverLogger.info("checkout: group discount changed since add-to-cart", {
+                itemId: item.itemId,
+                quoted,
+                current,
+            });
+        }
+    }
+    return { repriced, blocked };
+}