apps/web/lib/types.ts (1)

247-247: Align DomainProps.deepviewData type with API/DB usage

Upstream schemas use .nullish() and the DB stores JSON. To avoid TS/runtime mismatches when null is returned, make this string | null (still serialized JSON on the client).

-  deepviewData?: string;
+  deepviewData?: string | null;

packages/prisma/schema/domain.prisma (1)

14-15: Default {} on optional JSON can conflict with caller expectations

New rows won’t be null, while older rows are backfilled. If callers (e.g., UI/schema) expect “missing” to be falsy, consider either removing the default or ensuring all reads use a safe validator instead of .parse(). At minimum, document this semantic difference from appleAppSiteAssociation/assetLinks.

apps/web/lib/api/domains/transform-domain.ts (1)

19-21: Avoid returning "{}" for unset Deep View config

If deepviewData defaults to {}, this will serialize to "{}" and look “configured” to clients. Align with assetLinks/appleAppSiteAssociation by treating empty objects as null.

Apply:

-    deepviewData: domain.deepviewData
-      ? JSON.stringify(domain.deepviewData)
-      : null,
+    deepviewData:
+      domain.deepviewData &&
+      typeof domain.deepviewData === "object" &&
+      Object.keys(domain.deepviewData as Record<string, unknown>).length > 0
+        ? JSON.stringify(domain.deepviewData)
+        : null,

Confirm whether the intended default is “unset” (null) vs “empty config” ({}). If the latter, keep as-is and ensure downstream UI handles "{}" gracefully.

apps/web/lib/zod/schemas/deep-links.ts (1)

3-8: Tighten schema: replace z.any() with safer types

z.any() defeats validation. Prefer permissive-but-safe shapes or unknown with passthrough.

Apply:

 export const deepViewDataSchema = z
   .object({
-    ios: z.any(),
-    android: z.any(),
+    // If exact shapes are not finalized, accept arbitrary key/values safely.
+    ios: z.record(z.string(), z.unknown()).optional(),
+    android: z.record(z.string(), z.unknown()).optional(),
   })
   .nullish();

Optionally, refine to require at least one platform:

.refine((v) => !v || v.ios || v.android, { message: "Provide iOS or Android config" })

Does the deep link page parse JSON and validate with this schema after JSON.parse? If not, add parsing before validation to avoid validating raw strings.

apps/web/ui/modals/add-edit-domain-modal.tsx (2)

33-35: Restore semantic heading inside sticky header

Use an h2 for accessibility while preserving the sticky container.

Apply:

-      <div className="sticky top-0 z-10 border-b border-neutral-200 bg-white px-4 py-4 text-lg font-medium sm:px-6">
-        {props ? "Update" : "Add"} Domain
-      </div>
+      <div className="sticky top-0 z-10 border-b border-neutral-200 bg-white px-4 py-4 sm:px-6">
+        <h2 className="text-lg font-medium">
+          {props ? "Update" : "Add"} Domain
+        </h2>
+      </div>

---

36-44: Ensure modal body remains scrollable on small viewports

Removing the previous overflow-auto container can trap content beyond viewport height. Add vertical scrolling to the body wrapper.

Apply:

-      <div className="bg-neutral-50">
+      <div className="bg-neutral-50 overflow-y-auto">
         <AddEditDomainForm

Manually test on a 320×568 viewport with long forms to confirm the sticky header + body scroll behave correctly.

apps/web/app/api/domains/route.ts (1)

100-101: Consider bounding deepviewData size at schema level

To prevent oversized payloads, enforce a reasonable byte/length limit in createDomainBodySchema (via parseJsonSchema or z.string().max(N)) before parsing.

Confirm whether parseJsonSchema already enforces size; if not, add a max (e.g., 50KB) and mirror in updateDomainBodySchema.

apps/web/lib/zod/schemas/domains.ts (1)

75-78: Optional: align null handling and examples.

Consider .nullable().default(null) for consistency with assetLinks/appleAppSiteAssociation, and add an OpenAPI example clarifying this is a JSON string in responses (while API accepts JSON object on input).

apps/web/ui/domains/add-edit-domain-form.tsx (3)

165-177: No-op effect due to double-spread; simplify initialization.

{ ...prev, x:false, ...prev } restores prior values, making the effect inert.

Apply:

 useEffect(() => {
-  setShowOptionStates((prev) => ({
-    ...prev,
-    appleAppSiteAssociation: false,
-    assetLinks: false,
-    logo: false,
-    expiredUrl: false,
-    notFoundUrl: false,
-    placeholder: false,
-    deepviewData: false,
-    ...prev,
-  }));
+  setShowOptionStates((prev) => ({
+    appleAppSiteAssociation: prev.appleAppSiteAssociation ?? false,
+    assetLinks: prev.assetLinks ?? false,
+    logo: prev.logo ?? false,
+    expiredUrl: prev.expiredUrl ?? false,
+    notFoundUrl: prev.notFoundUrl ?? false,
+    placeholder: prev.placeholder ?? false,
+    deepviewData: prev.deepviewData ?? false,
+  }));
 }, []);

---

219-221: Enter-to-submit can hijack newlines in JSON textareas—gate on Cmd/Ctrl+Enter.

Prevent accidental submits while editing JSON.

Apply:

-const { handleKeyDown } = useEnterSubmit(formRef);
+const { handleKeyDown } = useEnterSubmit(formRef);

And for the textarea:

-  onKeyDown={handleKeyDown}
+  onKeyDown={(e) => {
+    if ((e.metaKey || e.ctrlKey) && e.key === "Enter") {
+      handleKeyDown(e);
+    }
+  }}

Also applies to: 553-554

---

288-296: Wire label to input for a11y.

label htmlFor="domain" doesn't target the input (no id). Add an id.

Apply:

-<label htmlFor="domain" className="flex items-center gap-x-2">
+<label htmlFor="domain" className="flex items-center gap-x-2">
   ...
-  <input
+  <input
+    id="domain"
     {...register("slug", {
       onChange: (e) => {
         setDomainStatus("idle");
         debouncedValidateDomain(e.target.value);
       },
     })}

Also applies to: 331-341

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/tests/domains/index.test.ts (1)

32-32: Make JSON assertion resilient

In apps/web/tests/domains/index.test.ts:32, avoid brittle string equality for JSON serialization:

-  deepviewData: "{}",
+  deepviewData: expect.stringMatching(/^\{\}$/),

Optional: the codebase currently uses both deepviewData and deepViewData variants—consider unifying casing for consistency.

apps/web/ui/layout/sidebar/app-sidebar-nav.tsx (1)

462-478: Deduplicate the enabled condition into a single const.

You repeat the same Boolean for three hooks; hoisting reduces drift risk and improves readability.

   const { payoutsCount: pendingPayoutsCount } = usePayoutsCount<
     number | undefined
   >({
     eligibility: "eligible",
     status: "pending",
-    enabled: Boolean(currentArea === "program" && defaultProgramId),
+    enabled: programEnabled,
   });

-  const applicationsCount = useProgramApplicationsCount({
-    enabled: Boolean(currentArea === "program" && defaultProgramId),
-  });
+  const applicationsCount = useProgramApplicationsCount({
+    enabled: programEnabled,
+  });

   const { submissionsCount } = useBountySubmissionsCount<
     SubmissionsCountByStatus[]
   >({
-    enabled: Boolean(currentArea === "program" && defaultProgramId),
+    enabled: programEnabled,
   });

And define once:

   }, [slug, pathname]);
 
+  const programEnabled = currentArea === "program" && Boolean(defaultProgramId);

apps/web/lib/swr/use-payouts-count.ts (1)

10-13: Avoid leaking enabled into the query and fix loading when disabled.

• enabled currently lives in opts which is spread into getQueryString; depending on its behavior, this can add ?enabled=true to the URL. Strip it out explicitly.
• When disabled, loading should be false to avoid spinner flicker.

-export default function usePayoutsCount<T>(
-  opts: z.input<typeof payoutsCountQuerySchema> & { enabled?: boolean } = {
-    enabled: true,
-  },
-) {
+type UsePayoutsCountOpts = z.input<typeof payoutsCountQuerySchema> & {
+  enabled?: boolean;
+};
+
+export default function usePayoutsCount<T>(
+  opts: UsePayoutsCountOpts = { enabled: true },
+) {
   const { id: workspaceId, defaultProgramId } = useWorkspace();
   const { getQueryString } = useRouterStuff();
 
-  const { data: payoutsCount, error } = useSWR<PayoutsCount[]>(
+  const { enabled = true, ...query } = opts || {};
+
+  const { data: payoutsCount, error } = useSWR<PayoutsCount[]>(
     workspaceId &&
       defaultProgramId &&
-      opts.enabled &&
+      enabled &&
       `/api/programs/${defaultProgramId}/payouts/count${getQueryString(
-        {
-          ...opts,
-          workspaceId,
-        },
-        {
-          include: ["status", "partnerId"],
-        },
+        { ...query, workspaceId },
+        { include: ["status", "partnerId"] },
       )}`,
     fetcher,
   );
 
   return {
     payoutsCount: payoutsCount as T,
     error,
-    loading: payoutsCount === undefined && !error,
+    loading: enabled ? payoutsCount === undefined && !error : false,
   };
 }

Also applies to: 20-21, 33-37

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/web/lib/zod/schemas/domains.ts (1)

166-168: Validate deepviewData is JSON (or accept parsed object).

Right now any string passes; add JSON validation to prevent bad payloads, or parse into an object.

Apply:

-export const createDomainBodySchemaExtended = createDomainBodySchema.extend({
-  deepviewData: z.string().nullish(),
-});
+export const createDomainBodySchemaExtended = createDomainBodySchema.extend({
+  deepviewData: z
+    .string()
+    .nullish()
+    .refine(
+      (s) => {
+        if (!s) return true;
+        try {
+          JSON.parse(s);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      { message: "deepviewData must be valid JSON." },
+    ),
+});

Alternative: accept object post-preprocess

+// Alternative:
+// deepviewData: z.preprocess((v) => (typeof v === "string" ? JSON.parse(v) : v), z.record(z.any()).nullish()),

apps/web/app/api/domains/[domain]/route.ts (1)

149-160: Nice: conditional spreads avoid clobbering omitted fields.

Only updating keys when present prevents accidental nulling on PATCH. Matches prior feedback.

apps/web/app/(ee)/api/bounties/[bountyId]/route.ts (1)

173-181: Double-check re-notification behavior when startsAt moves.

If a previous notify job exists, publishing another without cancel/dedupe may double-notify. Confirm QStash dedupe strategy or include an idempotency key.

apps/web/lib/api/links/create-link.ts (1)

70-73: Switch to DbNull on create is fine; align bulk-create/read paths.

Ensure all writers use the same defaulting (DbNull) for geo/testVariants, and that readers don’t rely on JSON-null semantics.

apps/web/lib/api/links/bulk-create-links.ts (1)

74-76: Use DbNull for geo to match create-link semantics.

Make createMany explicit instead of relying on omitted fields/defaults.

Apply:

-        expiresAt: link.expiresAt ? new Date(link.expiresAt) : null,
-        geo: link.geo || undefined,
-        testVariants: link.testVariants || Prisma.DbNull,
+        expiresAt: link.expiresAt ? new Date(link.expiresAt) : null,
+        geo: link.geo || Prisma.DbNull,
+        testVariants: link.testVariants || Prisma.DbNull,

apps/web/lib/actions/partners/update-program.ts (1)

87-89: Clear publishedAt and revalidate when landerData is cleared.

When landerData is explicitly null, also clear landerPublishedAt. Revalidation should run on both set and clear.

Apply:

-        landerData: landerData === null ? Prisma.DbNull : landerData,
-        landerPublishedAt: landerData ? new Date() : undefined,
+        landerData: landerData === null ? Prisma.DbNull : landerData,
+        landerPublishedAt:
+          landerData === null ? null : landerData ? new Date() : undefined,

And below:

-        ...(name !== program.name ||
-        logoUrl ||
-        wordmarkUrl ||
-        brandColor !== program.brandColor ||
-        landerData
+        ...(name !== program.name ||
+        logoUrl ||
+        wordmarkUrl ||
+        brandColor !== program.brandColor ||
+        landerData !== undefined
           ? [

apps/web/lib/actions/partners/create-reward.ts (2)

55-56: Use nullish coalescing to avoid accidental DbNull.

|| treats some valid (albeit unlikely) falsy JSON values as empty. Prefer ?? so only null/undefined fall back.

-          modifiers: modifiers || Prisma.DbNull,
+          modifiers: modifiers ?? Prisma.DbNull,

---

27-31: Gate advanced logic on presence, not generic truthiness.

If the client sends an empty object/array, if (modifiers && …) may block unnecessarily. Consider an explicit “has rules” check or at least modifiers != null.

-    if (modifiers && !canUseAdvancedRewardLogic) {
+    if (modifiers != null && !canUseAdvancedRewardLogic) {

apps/web/app/api/domains/[domain]/route.ts (1)

21-24: Validate deepviewData at the schema boundary (optional).

Consider parsing/validating deepviewData as JSON in the Zod extension so bad inputs fail fast with a 400 instead of surfacing later during update.

Example:

-const updateDomainBodySchemaExtended = updateDomainBodySchema.extend({
-  deepviewData: z.string().nullish(),
-  autoRenew: z.boolean().nullish(),
-});
+const updateDomainBodySchemaExtended = updateDomainBodySchema.extend({
+  deepviewData: z
+    .string()
+    .nullish()
+    .refine((v) => v == null || isValidJson(v), "deepviewData must be valid JSON"),
+  autoRenew: z.boolean().nullish(),
+});
+
+function isValidJson(s?: string | null) {
+  if (!s) return true;
+  try {
+    JSON.parse(s);
+    return true;
+  } catch {
+    return false;
+  }
+}

apps/web/ui/domains/add-edit-domain-form.tsx (2)

123-131: Expose setError from useForm for client-side JSON validation.

You’ll need setError to surface field errors before submit.

Apply:

-  const {
+  const {
     register,
     control,
     handleSubmit,
     watch,
     setValue,
+    setError,
     formState: { isSubmitting, isDirty },
   } = useForm<FormData>({

---

657-662: Consistency: “Asset Links” (plural) to match API messaging.

UI shows “Asset Link” but server toasts/gating say “Asset Links”. Consider plural for consistency.

Apply:

-    title: "Asset Link",
+    title: "Asset Links",

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: TWilson023
PR: dubinc/dub#2673
File: apps/web/ui/partners/rewards/rewards-logic.tsx:268-275
Timestamp: 2025-07-30T15:29:54.131Z
Learning: In apps/web/ui/partners/rewards/rewards-logic.tsx, when setting the entity field in a reward condition, dependent fields (attribute, operator, value) should be reset rather than preserved because different entities (customer vs sale) have different available attributes. Maintaining existing fields when the entity changes would create invalid state combinations and confusing UX.

Learnt from: devkiran
PR: dubinc/dub#2177
File: apps/web/lib/api/links/bulk-create-links.ts:66-84
Timestamp: 2025-06-06T07:59:03.120Z
Learning: In apps/web/lib/api/links/bulk-create-links.ts, the team accepts the risk of potential undefined results from links.find() operations when building invalidLinks arrays, because existing links are fetched from the database based on the input links, so matches are expected to always exist.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/lib/actions/partners/create-bounty-submission.ts:105-112
Timestamp: 2025-08-26T14:32:33.851Z
Learning: Non-performance bounties are required to have submissionRequirements. In create-bounty-submission.ts, it's appropriate to let the parsing fail if submissionRequirements is null for non-performance bounties, as this indicates a data integrity issue that should be caught.

Learnt from: TWilson023
PR: dubinc/dub#2736
File: apps/web/app/api/workspaces/[idOrSlug]/notification-preferences/route.ts:13-14
Timestamp: 2025-08-26T14:20:23.943Z
Learning: The updateNotificationPreference action in apps/web/lib/actions/update-notification-preference.ts already handles all notification preference types dynamically, including newBountySubmitted, through its schema validation using the notificationTypes enum and Prisma's dynamic field update pattern.

Learnt from: devkiran
PR: dubinc/dub#2735
File: apps/web/lib/actions/partners/delete-reward.ts:33-41
Timestamp: 2025-08-14T05:17:51.825Z
Learning: In the partner groups system, a rewardId can only belong to one group, establishing a one-to-one relationship between rewards and groups. This means using Prisma's `update` method (rather than `updateMany`) is appropriate when updating groups by rewardId.