fix production issues

apps/homepage/package.json

@@ -3,10 +3,14 @@
   "version": "1.0.1",
   "private": true,
   "scripts": {
+    "predev": "npm run build --workspace @rentaldrivego/types",
     "dev": "next dev -H 0.0.0.0 -p 3000",
+    "prebuild": "npm run build --workspace @rentaldrivego/types",
     "build": "next build",
     "start": "next start -H 0.0.0.0 -p 3000",
+    "pretype-check": "npm run build --workspace @rentaldrivego/types",
     "type-check": "tsc --noEmit",
+    "pretest": "npm run build --workspace @rentaldrivego/types",
     "test": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "test:watch": "vitest",
@@ -17,6 +21,7 @@
   "dependencies": {
     "@fontsource-variable/inter": "^5.2.8",
     "@fontsource-variable/noto-sans-arabic": "^5.2.10",
+    "@rentaldrivego/types": "*",
     "firebase-admin": "^10.3.0",
     "next": "^16.2.9",
     "node-cron": "4.5.0",

apps/homepage/src/components/auth/SignInForm.tsx

@@ -11,6 +11,16 @@ import { usePathname, useSearchParams } from 'next/navigation';
 import { useState } from 'react';
 import styles from './AuthForms.module.css';
 
+function resolveSafeAppRedirect(candidate: string | null | undefined, fallback: string): string {
+  const value = (candidate ?? '').trim();
+  if (!value) return fallback;
+  if (!value.startsWith('/')) return fallback;
+  if (value.startsWith('//') || value.startsWith('/\\')) return fallback;
+  if (value.includes('://')) return fallback;
+  if (/[\r\n\\]/.test(value)) return fallback;
+  return value;
+}
+
 interface Dict {
   title: string;
   subtitle: string;
@@ -120,7 +130,7 @@ export function SignInForm({
   const [step, setStep] = useState<'credentials' | 'totp'>('credentials');
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const employeeRedirect = searchParams.get('redirect') || '/dashboard';
+  const employeeRedirect = resolveSafeAppRedirect(searchParams.get('redirect'), '/dashboard');
 
   function completeLogin(data: any) {
     if (data?.admin) {

apps/homepage/src/content/pricing-config.ts

@@ -1,3 +1,9 @@
+import {
+  ANNUAL_DISCOUNT_PERCENT,
+  getPublicMonthlyMajorUnits,
+  type PublicPricingPlanId,
+} from '@rentaldrivego/types';
+
 export const fleetBandIds = ['small', 'growing', 'scale', 'enterprise'] as const;
 export type FleetBandId = (typeof fleetBandIds)[number];
 
@@ -14,33 +20,28 @@ export interface PricingCommercialConfig {
   recommendedPlanByFleetBand: Record<FleetBandId, PricingPlanId>;
 }
 
+function bandPrices(planId: PublicPricingPlanId): Record<FleetBandId, number | null> {
+  const major = getPublicMonthlyMajorUnits(planId);
+  return {
+    small: major,
+    growing: major,
+    scale: major,
+    enterprise: major,
+  };
+}
+
 /**
- * This is the only file that should contain commercial pricing numbers.
- * Public prices apply only to non-custom plans. Enterprise remains custom.
+ * Public marketing prices derived from `@rentaldrivego/types` planCatalog.
+ * Do not hard-code MAD amounts here — change PLAN_PRICES in packages/types.
  */
 export const pricingCommercialConfig: PricingCommercialConfig = {
   currency: 'MAD',
-  annualDiscountPercent: 20,
+  annualDiscountPercent: ANNUAL_DISCOUNT_PERCENT,
   publicPricesApproved: true,
   monthlyPrices: {
-    launch: {
-      small: 149,
-      growing: 149,
-      scale: 149,
-      enterprise: 149,
-    },
-    growth: {
-      small: 299,
-      growing: 299,
-      scale: 299,
-      enterprise: 299,
-    },
-    enterprise: {
-      small: null,
-      growing: null,
-      scale: null,
-      enterprise: null,
-    },
+    launch: bandPrices('launch'),
+    growth: bandPrices('growth'),
+    enterprise: bandPrices('enterprise'),
   },
   recommendedPlanByFleetBand: {
     small: 'launch',