@mohasinac/appkit 4.12.2 → 4.12.4

package/dist/_internal/server/features/brands/actions.js

@@ -37,7 +37,12 @@ function brandInputToCategoryFields(input) {
 }
 export async function createBrandAction(input) {
     return wrapAction(async () => {
-        await requireRoleUser("admin");
+        // Sellers create brands inline from the product form's brand picker
+        // (BrandInlineSelect -> BrandQuickCreateForm); there is no /store/brands
+        // page. Mirrors ROLES_STORE_WRITE on the only caller,
+        // src/app/api/admin/brands/route.ts. Kept as a gate rather than dropped:
+        // this is a "use server" export and is independently callable.
+        const actor = await requireRoleUser(["admin", "seller"]);
         const parsed = brandInputSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid brand input");
@@ -73,7 +78,7 @@ export async function createBrandAction(input) {
             },
             seo: { title: parsed.data.name, description: parsed.data.description ?? "", keywords: [parsed.data.name] },
             ancestors: [],
-            createdBy: "admin",
+            createdBy: actor.uid,
             createdAt: new Date(),
             updatedAt: new Date(),
             ...fields,

package/dist/_internal/server/jobs/core/jobRunners.js

@@ -13,6 +13,7 @@ import { runHardBanCascade } from "./hardBanCascade";
 import { runResetOtpVerification } from "./resetOtpVerification";
 import { runWhatsAppNotify } from "./whatsappNotify";
 import { runNewsletterExport } from "./newsletterExport";
+import { runWhatsAppCatalogImport } from "./whatsappCatalogImport";
 async function runPayoutsWeeklyJob(_payload, ctx) {
     const { payoutsCreated, ordersProcessed, payoutIds } = await runWeeklyPayoutEligibility(ctx);
     return {
@@ -45,10 +46,14 @@ async function runWhatsAppNotifyJob(payload, ctx) {
 async function runNewsletterExportJob(_payload, ctx) {
     return runNewsletterExport(ctx);
 }
+async function runWhatsAppCatalogImportJob(payload, ctx) {
+    return runWhatsAppCatalogImport({ storeSlug: String(payload.storeSlug ?? "") }, ctx);
+}
 export const JOB_RUNNERS = {
     payoutsWeekly: runPayoutsWeeklyJob,
     hardBanCascade: runHardBanCascadeJob,
     resetOtpVerification: runResetOtpVerificationJob,
     whatsappNotify: runWhatsAppNotifyJob,
     newsletterExport: runNewsletterExportJob,
+    whatsappCatalogImport: runWhatsAppCatalogImportJob,
 };

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -2,6 +2,7 @@ import { normalizeError } from "../../../../errors/normalize";
 import { storeRepository, userRepository } from "../../../../repositories";
 import { decryptPii } from "../../../../security/index";
 import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server";
+import { resolveKeys } from "../../../../core/integration-keys";
 async function sendAnnouncement(ctx, toPhone, message, phoneNumberId, accessToken, label, orderId) {
     try {
         const sent = await sendWhatsAppBusinessMessage({
@@ -44,10 +45,40 @@ async function notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToke
         ctx.logger.error("Store owner lookup failed (non-fatal)", err, { orderId, storeId });
     }
 }
+/**
+ * Seeded credentials are `*_PLACEHOLDER` strings rather than empty, so an
+ * emptiness test alone would happily send with a fake token. Mirrors the guard
+ * in checkout-value-otp-actions.ts.
+ */
+function usable(value) {
+    const v = value?.trim() ?? "";
+    return v && !v.includes("PLACEHOLDER") ? v : "";
+}
+async function resolveWhatsAppCredentials(ctx, orderId) {
+    let db = {};
+    try {
+        db = await resolveKeys();
+    }
+    catch (err) {
+        void normalizeError(err);
+        // Firestore unreachable from the Functions runtime — env-only is still a
+        // valid configuration, so this is a warning, not a failure.
+        ctx.logger.warn("Credential lookup failed — falling back to env", { orderId });
+    }
+    return {
+        phoneNumberId: usable(db.whatsappPhoneNumberId) || usable(ctx.env("WHATSAPP_PHONE_NUMBER_ID")),
+        accessToken: usable(db.whatsappCloudApiToken) || usable(ctx.env("WHATSAPP_CLOUD_API_TOKEN")),
+        adminNumbersRaw: usable(db.whatsappAdminNotifyNumbers) || usable(ctx.env("WHATSAPP_ADMIN_NOTIFY_NUMBERS")),
+    };
+}
 export async function handleOrderCreate(input, ctx) {
     const { orderId, order } = input;
-    const phoneNumberId = ctx.env("WHATSAPP_PHONE_NUMBER_ID") ?? "";
-    const accessToken = ctx.env("WHATSAPP_CLOUD_API_TOKEN") ?? "";
+    // Credentials resolve DB-first (Admin → Site Settings → WhatsApp) with an env
+    // fallback, matching resolveKeys() and every other WhatsApp send path. This
+    // read ctx.env() ONLY until 2026-08-22, so credentials saved in Site Settings
+    // never reached the order-placed announcement — it silently no-op'd unless the
+    // Functions runtime also carried the env vars.
+    const { phoneNumberId, accessToken, adminNumbersRaw } = await resolveWhatsAppCredentials(ctx, orderId);
     if (!phoneNumberId || !accessToken) {
         ctx.logger.info("WhatsApp Cloud API not configured — skipping announcement", { orderId });
         return;
@@ -64,7 +95,6 @@ export async function handleOrderCreate(input, ctx) {
         totalAmount: order.totalPrice ?? 0,
         orderId,
     });
-    const adminNumbersRaw = ctx.env("WHATSAPP_ADMIN_NOTIFY_NUMBERS") ?? "";
     const adminNumbers = adminNumbersRaw
         .split(",")
         .map((n) => n.trim().replace(/\D/g, ""))

package/dist/_internal/server/jobs/core/whatsappCatalogImport.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Core: async WhatsApp Business Catalog import (`whatsappCatalogImport` job).
+ *
+ * `POST /api/store/whatsapp-settings/catalog-import` used to do this inline:
+ * one Meta fetch capped at `limit=250`, then a sequential per-item loop doing
+ * up to 2 `findBySlug` reads plus 1 `create` write EACH — a real 10s-timeout
+ * risk on Vercel Hobby (CLAUDE.md Rule #6) well before the cap was reached.
+ * It also declared `paging.next` in its response type and never followed it,
+ * so a catalog larger than 250 items silently imported only the first page.
+ *
+ * Running here instead buys the Function's 300s budget, which is what makes
+ * following `paging.next` safe rather than making the timeout worse.
+ *
+ * Two efficiency changes vs. the old route:
+ *  - Existing-slug detection is ONE `findByStore` read into a Set, not 2 reads
+ *    per item. A seller's WA catalog is populated by pushing their own store's
+ *    products, so store-scoped lookup is equivalent to the old global
+ *    `findBySlug` here while costing a single query.
+ *  - That Set is updated as we create, so duplicate rows within one Meta
+ *    response can't produce two products.
+ */
+import type { JobContext } from "../runtime/types";
+import type { JobRunResult } from "./jobRunners";
+export interface WhatsAppCatalogImportPayload {
+    storeSlug: string;
+}
+export declare function runWhatsAppCatalogImport(payload: WhatsAppCatalogImportPayload, ctx: JobContext): Promise<JobRunResult>;

package/dist/_internal/server/jobs/core/whatsappCatalogImport.js

@@ -0,0 +1,172 @@
+/**
+ * Core: async WhatsApp Business Catalog import (`whatsappCatalogImport` job).
+ *
+ * `POST /api/store/whatsapp-settings/catalog-import` used to do this inline:
+ * one Meta fetch capped at `limit=250`, then a sequential per-item loop doing
+ * up to 2 `findBySlug` reads plus 1 `create` write EACH — a real 10s-timeout
+ * risk on Vercel Hobby (CLAUDE.md Rule #6) well before the cap was reached.
+ * It also declared `paging.next` in its response type and never followed it,
+ * so a catalog larger than 250 items silently imported only the first page.
+ *
+ * Running here instead buys the Function's 300s budget, which is what makes
+ * following `paging.next` safe rather than making the timeout worse.
+ *
+ * Two efficiency changes vs. the old route:
+ *  - Existing-slug detection is ONE `findByStore` read into a Set, not 2 reads
+ *    per item. A seller's WA catalog is populated by pushing their own store's
+ *    products, so store-scoped lookup is equivalent to the old global
+ *    `findBySlug` here while costing a single query.
+ *  - That Set is updated as we create, so duplicate rows within one Meta
+ *    response can't produce two products.
+ */
+import { normalizeError } from "../../../../errors/normalize";
+import { storeRepository, productRepository } from "../../../../repositories";
+import { decryptPii } from "../../../../security/index";
+const META_GRAPH_BASE = "https://graph.facebook.com/v20.0";
+const SLUG_PREFIX = "product-";
+const PAGE_SIZE = 250;
+/**
+ * Defensive stop. 40 pages x 250 = 10,000 items, far beyond any realistic
+ * seller catalog — this exists so a malformed/looping `paging.next` from Meta
+ * can't spin until the Function's 300s ceiling kills the job mid-write.
+ */
+const MAX_PAGES = 40;
+/** Meta returns "<amount> <currency>", e.g. "450.00 INR". */
+function parseMetaPrice(raw) {
+    if (!raw)
+        return 0;
+    const digits = raw.replace(/[^0-9.]/g, "");
+    return Math.round((parseFloat(digits) || 0) * 100) / 100;
+}
+/**
+ * The LetItRip slug a Meta item claims to correspond to, if any. Items we
+ * pushed carry it in `description` (see catalog-sync's field mapping) and/or
+ * `retailer_id`; items authored natively in Meta carry neither.
+ */
+function claimedSlug(item) {
+    const description = (item.description ?? "").trim();
+    if (description.startsWith(SLUG_PREFIX))
+        return description;
+    const retailerId = (item.retailer_id ?? "").trim();
+    if (retailerId.startsWith(SLUG_PREFIX))
+        return retailerId;
+    return null;
+}
+export async function runWhatsAppCatalogImport(payload, ctx) {
+    const { storeSlug } = payload;
+    const empty = { total: 0, succeeded: 0, skipped: 0, failed: 0 };
+    const store = await storeRepository.findBySlug(storeSlug);
+    if (!store) {
+        return {
+            summary: empty,
+            succeeded: [],
+            skipped: [],
+            failed: [{ id: storeSlug, reason: "Store not found" }],
+        };
+    }
+    const cfg = store.whatsappConfig;
+    const token = cfg?.accessToken ? decryptPii(cfg.accessToken) : null;
+    // Re-checked here even though the route gates on the same conditions — the
+    // job doc outlives the request, and the seller could disconnect in between.
+    if (!cfg?.connected || !cfg.catalogId || !token) {
+        return {
+            summary: empty,
+            succeeded: [],
+            skipped: [],
+            failed: [{ id: storeSlug, reason: "WhatsApp is not connected for this store" }],
+        };
+    }
+    const existing = await productRepository.findByStore(store.storeSlug);
+    const knownSlugs = new Set(existing.map((p) => p.slug).filter((s) => Boolean(s)));
+    const imported = [];
+    const skipped = [];
+    const failed = [];
+    let url = `${META_GRAPH_BASE}/${cfg.catalogId}/products` +
+        `?fields=name,price,currency,image_url,description,retailer_id&limit=${PAGE_SIZE}`;
+    let page = 0;
+    let truncated = false;
+    while (url) {
+        if (page >= MAX_PAGES) {
+            truncated = true;
+            ctx.logger.warn("whatsappCatalogImport: page cap reached — catalog truncated", {
+                storeSlug,
+                maxPages: MAX_PAGES,
+                importedSoFar: imported.length,
+            });
+            break;
+        }
+        page++;
+        const res = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            const reason = body.error?.message ?? res.statusText;
+            ctx.logger.error("whatsappCatalogImport: Meta fetch failed", null, { storeSlug, page, reason });
+            failed.push({ id: `page-${page}`, reason: `Meta fetch failed: ${reason}` });
+            break;
+        }
+        const body = (await res.json());
+        const items = body.data ?? [];
+        for (const item of items) {
+            const slug = claimedSlug(item);
+            if (slug && knownSlugs.has(slug)) {
+                skipped.push(item.id);
+                continue;
+            }
+            const input = {
+                title: item.name ?? `WhatsApp Import ${item.id}`,
+                description: "",
+                slug: "",
+                listingType: "standard",
+                status: "draft",
+                price: parseMetaPrice(item.price),
+                currency: "INR",
+                mainImage: item.image_url ?? "",
+                images: [],
+                stockQuantity: 1,
+                condition: "new",
+                storeId: store.id,
+                storeName: store.storeName,
+                tags: ["whatsapp-import"],
+                categorySlugs: [],
+                featured: false,
+            };
+            try {
+                const created = await productRepository.create(input);
+                // Guard against the same item appearing twice in one Meta response.
+                if (slug)
+                    knownSlugs.add(slug);
+                if (created.slug)
+                    knownSlugs.add(created.slug);
+                imported.push(created.id);
+            }
+            catch (err) {
+                void normalizeError(err);
+                failed.push({
+                    id: item.id,
+                    reason: err instanceof Error ? err.message : "Product create failed",
+                });
+            }
+        }
+        url = body.paging?.next;
+    }
+    ctx.logger.info("whatsappCatalogImport: complete", {
+        storeSlug,
+        pages: page,
+        imported: imported.length,
+        skipped: skipped.length,
+        failed: failed.length,
+        truncated,
+    });
+    return {
+        summary: {
+            total: imported.length + skipped.length + failed.length,
+            succeeded: imported.length,
+            skipped: skipped.length,
+            failed: failed.length,
+        },
+        succeeded: imported,
+        skipped,
+        failed,
+        data: { imported: imported.length, skipped: skipped.length, pages: page, truncated },
+    };
+}

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -1272,6 +1272,29 @@ const rawTesterChecklistItems = [
                     description: "Fixed 2026-08-21 — the video schema always required a duration the UI never collected, so ANY product with a directly-uploaded video previously failed server validation invisibly. Duration is now captured client-side for file uploads; YouTube/external sources are exempt since their duration can't be read client-side.",
                     href: "/store/products/new",
                 },
+                {
+                    key: "media-upload-multiple-images",
+                    label: "Uploading several gallery images in one go works — each shows its own progress and all of them survive the save",
+                    description: "Select 3-4 images at once. They upload one after another. After saving and reopening the product for editing, every image should still be attached.",
+                    href: "/store/products/new",
+                },
+                {
+                    key: "media-upload-remove-image",
+                    label: "Removing one gallery image removes only that image, and the removal sticks after save + reload",
+                    href: "/store/products/new",
+                },
+                {
+                    key: "media-upload-main-image-crop",
+                    label: "The main product image's crop tool opens, the 1:1 aspect lock works, and the cropped result is what actually gets saved",
+                    description: "Not the uncropped original — check the saved product's main image on the public detail page.",
+                    href: "/store/products/new",
+                },
+                {
+                    key: "media-upload-video-both-sources-render",
+                    label: "A video attached by file upload AND a video attached via the YouTube tab both play on the public product page",
+                    description: "Two separate products, one per source. A raw file renders a native player; a YouTube URL renders an embedded player. Neither should show \"No video with supported format and MIME type found\".",
+                    href: "/store/products/new",
+                },
                 { key: "seller-quick-add-drawer-flips", label: "With Left-hand mode ON, the seller's quick-add-listing side drawer opens from the left instead of the right" },
             ],
         },
@@ -1415,6 +1438,24 @@ const rawTesterChecklistItems = [
                     href: "/store/coupons/new",
                     description: "Create a coupon restricted to one category, then as a buyer put a non-matching item from that store in the cart and try the code — it must be refused. Add a matching item and confirm the discount covers only the matching item's value.",
                 },
+                {
+                    key: "seller-coupon-cannot-be-site-wide",
+                    label: "A seller has no way to create a site-wide/platform coupon — the form offers no scope choice and the created coupon only ever discounts their own store",
+                    href: "/store/coupons/new",
+                    description: "By design: scope is resolved from the logged-in seller, not chosen. Verify as a buyer that a seller coupon leaves a second store's items in the same cart at full price. Only an admin can create a platform-wide coupon.",
+                },
+                {
+                    key: "seller-coupon-second-for-same-store-rejected",
+                    label: "Applying a second seller coupon for the SAME store replaces or refuses — you can never have two coupons from one store active at once",
+                    href: "/cart",
+                    description: "The rule is one seller coupon per store, plus at most one admin coupon overall. Try applying two of store-beyblade-arena's codes back to back.",
+                },
+                {
+                    key: "seller-coupon-stacks-with-admin-coupon",
+                    label: "One seller coupon and one admin (site-wide) coupon apply together, and the order total reflects both",
+                    href: "/cart",
+                    description: "Try ARENA25 (store-beyblade-arena) together with a platform coupon such as FREESHIP499. Both should stay applied and the breakdown should list both.",
+                },
                 { key: "seller-bundles-crud", label: "Seller can create, edit, and list bundles/grouped listings", href: "/store/bundles" },
                 { key: "seller-classified-crud", label: "Seller can create, edit, and list classified listings", href: "/store/classified" },
                 { key: "seller-digitalcodes-crud", label: "Seller can create, edit, and list digital-code listings", href: "/store/digital-codes" },
@@ -1449,6 +1490,58 @@ const rawTesterChecklistItems = [
                     href: "/store/sublisting-categories",
                 },
                 { key: "seller-listing-templates-crud", label: "Seller can create, edit, and reuse listing templates when creating a new product", href: "/store/listing-templates" },
+                {
+                    key: "seller-category-inline-create",
+                    label: "On the product form, the Category picker's \"+ Create new category\" opens a drawer, saves, and auto-selects the new category",
+                    description: "The inline drawer is reachable from the category picker on the product form. Type a name, save, and confirm the drawer closes and the new category is already selected in the picker — you should not have to search for it.",
+                    href: "/store/products/new",
+                },
+                {
+                    key: "seller-category-inline-create-persists",
+                    label: "A category created inline is still there after reload — reopen the picker on a fresh product form and search for it by name",
+                    description: "Proves the category actually persisted to Firestore rather than only existing in the form's local state.",
+                    href: "/store/products/new",
+                },
+                {
+                    key: "seller-category-inline-create-duplicate-rejected",
+                    label: "Creating a category with a name that already exists shows a readable \"already exists\" error, not a generic failure or a silent no-op",
+                    description: "Slug is derived from the name, so a duplicate name collides. Expect a clear message in the drawer.",
+                    href: "/store/products/new",
+                },
+            ],
+        },
+        {
+            pageKey: "seller-custom-brands",
+            pageLabel: "Seller — Custom Brands",
+            // The ONLY way a seller creates a brand is the inline picker on the
+            // product form — there is no /store/brands page.
+            href: "/store/products/new",
+            cases: [
+                {
+                    key: "seller-brand-inline-create",
+                    label: "On the product form, the Brand picker's \"+ Create new brand\" saves successfully and auto-selects the new brand",
+                    description: "Fixed 2026-08-22 — this previously failed with a permissions error for every seller: the API route allowed sellers but the underlying action still demanded an admin role. Confirm a seller (not an admin) can complete this end to end.",
+                },
+                {
+                    key: "seller-brand-inline-create-persists",
+                    label: "A brand created inline is still there after reload — reopen the Brand picker on a fresh product form and search for it by name",
+                    description: "Proves the brand persisted rather than only existing in form state.",
+                },
+                {
+                    key: "seller-brand-appears-on-public-brands-page",
+                    label: "A newly created brand appears on the public /brands page",
+                    description: "Brands are stored as category rows discriminated by categoryType:\"brand\", and the public page filters on exactly that. If the brand saves but never shows here, the discriminator wasn't written.",
+                    href: "/brands",
+                },
+                {
+                    key: "seller-brand-inline-create-duplicate-rejected",
+                    label: "Creating a brand whose name matches an existing brand shows a readable \"already exists\" error rather than creating a second copy",
+                },
+                {
+                    key: "seller-brand-product-saves-with-new-brand",
+                    label: "A product saved with an inline-created brand keeps that brand after save — reopen the product for editing and the Brand field still shows it",
+                    description: "Catches the case where the brand is created but its id never makes it onto the product document.",
+                },
             ],
         },
         {
@@ -1483,6 +1576,24 @@ const rawTesterChecklistItems = [
                     description: "Added 2026-08-21. The store's WhatsApp access token is encrypted before storage by the same mechanism as the admin Integrations keys, and that mechanism was failing in production — so this save path was broken too, in a place nobody would think to check. Enter a throwaway token value, save, reload the page, and confirm you got a success toast and the field shows a masked value rather than an error or a blank field.",
                     href: "/store/whatsapp",
                 },
+                {
+                    key: "seller-whatsapp-import-runs-in-background",
+                    label: "\"Import from WhatsApp\" returns immediately and reports its result when the background job finishes — the page never hangs waiting on it",
+                    description: "Changed 2026-08-22 — the import used to run inline and could time out on a large catalog, silently importing only the first 250 items. It now runs as a background job, so expect an immediate \"import started\" response and a result toast a few moments later.",
+                    href: "/store/whatsapp",
+                },
+                {
+                    key: "seller-whatsapp-import-skips-already-synced",
+                    label: "Re-running \"Import from WhatsApp\" a second time imports nothing new — everything is reported as already synced",
+                    description: "Items pushed from here carry their LetItRip slug, so a repeat import must not create duplicate draft products. Run it twice and compare the counts.",
+                    href: "/store/whatsapp",
+                },
+                {
+                    key: "seller-whatsapp-push-product-link-opens",
+                    label: "A product pushed to the WhatsApp catalog links back to a working, full product URL — not a broken relative link",
+                    description: "Fixed 2026-08-22 — the pushed link was a relative path Meta rejects. Open the item in your WhatsApp catalog and tap through to confirm it lands on the live product page.",
+                    href: "/store/whatsapp",
+                },
                 { key: "seller-reviews-response", label: "Seller can view and respond to product reviews", href: "/store/reviews" },
             ],
         },
@@ -2602,6 +2713,23 @@ const rawTesterChecklistItems = [
             href: "/admin/site",
             cases: [
                 { key: "site-settings-admin", label: "Admin site settings page saves correctly", href: "/admin/site" },
+                {
+                    key: "whatsapp-credentials-persist",
+                    label: "Site Settings → WhatsApp saves the Phone Number ID, Cloud API token, admin notify numbers, template language and all 6 template names — and they survive a reload",
+                    description: "The token field is masked on reload (shows dots, not the raw value) — that is correct. Confirm by changing an unrelated field, saving again, and verifying the token still works rather than being overwritten with the mask.",
+                    href: "/admin/site",
+                },
+                {
+                    key: "whatsapp-channel-toggle-persists",
+                    label: "Site Settings → Notifications: the WhatsApp channel enable toggle, minimum priority, and the checkout OTP switch all persist after save + reload",
+                    href: "/admin/site",
+                },
+                {
+                    key: "whatsapp-order-announcement-fires",
+                    label: "Placing an order sends the WhatsApp announcement to the configured admin numbers using credentials saved in Site Settings — no env var required",
+                    description: "Fixed 2026-08-22 — the order-placed announcement previously read environment variables ONLY, so credentials entered in Site Settings were ignored and it silently did nothing. Needs real Meta credentials configured to verify.",
+                    href: "/admin/site",
+                },
                 {
                     key: "auction-bid-tiers-admin",
                     label: "Admin can add, edit, and remove bid-increment tiers in Site Settings → Auction Config, and the changes persist after saving and reloading the page",

package/dist/features/whatsapp-bot/components/SellerWhatsAppSettingsView.js

@@ -1,7 +1,8 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useApiMutation } from "@mohasinac/appkit/client";
+import { useApiMutation, useBulkEvent, RTDB_PATHS } from "@mohasinac/appkit/client";
 import React from "react";
+import { normalizeError } from "../../../errors/normalize";
 const __P = {
     p3: "p-[var(--appkit-space-3)]",
 };
@@ -136,19 +137,46 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
             showToast(msg, "error");
         },
     });
-    // Catalog import mutation (pull: WhatsApp → site)
-    const importMutation = useApiMutation({
-        mutationFn: async () => apiClient.post(WHATSAPP_SELLER_ENDPOINTS.CATALOG_IMPORT, {}),
-        onSuccess: (res) => {
-            const r = res ?? {};
-            showToast(`Imported ${r.imported ?? 0} product${(r.imported ?? 0) !== 1 ? "s" : ""} from WhatsApp (${r.skipped ?? 0} already synced)`, "success");
+    // Catalog import (pull: WhatsApp → site). Runs as the `whatsappCatalogImport`
+    // async job — the route only enqueues, so the result arrives over the
+    // useBulkEvent RTDB channel rather than in the POST response.
+    const bulkEvent = useBulkEvent({ rtdbPath: RTDB_PATHS.BULK_EVENTS });
+    const [importing, setImporting] = React.useState(false);
+    const startImport = async () => {
+        setImporting(true);
+        try {
+            const res = (await apiClient.post(WHATSAPP_SELLER_ENDPOINTS.CATALOG_IMPORT, {}));
+            const { jobId, customToken } = res.data ?? {};
+            if (jobId && customToken) {
+                bulkEvent.subscribe(jobId, customToken);
+            }
+            else {
+                setImporting(false);
+                showToast("Failed to start catalog import.", "error");
+            }
+        }
+        catch (err) {
+            void normalizeError(err);
+            setImporting(false);
+            showToast(err instanceof Error ? err.message : "Import failed", "error");
+        }
+    };
+    React.useEffect(() => {
+        if (bulkEvent.status === "success") {
+            setImporting(false);
+            const summary = bulkEvent.result?.summary;
+            const imported = summary?.succeeded ?? 0;
+            const skipped = summary?.skipped ?? 0;
+            showToast(`Imported ${imported} product${imported !== 1 ? "s" : ""} from WhatsApp (${skipped} already synced)`, "success");
             void queryClient.invalidateQueries({ queryKey: ["store", "whatsapp-settings"] });
-        },
-        onError: (err) => {
-            const msg = err instanceof Error ? err.message : "Import failed";
-            showToast(msg, "error");
-        },
-    });
+            void queryClient.invalidateQueries({ queryKey: ["store", "products"] });
+        }
+        else if (bulkEvent.status === "failed" || bulkEvent.status === "timeout") {
+            setImporting(false);
+            showToast(bulkEvent.error ?? "Catalog import failed.", "error");
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [bulkEvent.status]);
     if (!hasCapability) {
         return (_jsx(Div, { className: "max-w-xl mx-auto", paddingY: "y-xl", paddingX: "x-md", children: _jsxs(Alert, { variant: "warning", children: [_jsx(Text, { weight: "medium", children: "WhatsApp catalog sync is not enabled for your store." }), _jsx(Text, { className: "mt-1", size: "sm", children: "Contact LetItRip support to request access to the WhatsApp Business integration." })] }) }));
     }
@@ -162,7 +190,7 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
                         }) })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", color: "primary", children: "Connection" }), isLoading ? null : cfg?.connected ? (_jsx(Badge, { variant: "success", children: "Connected" })) : (_jsx(Badge, { variant: "default", children: "Not configured" }))] }), _jsxs(Form, { onSubmit: (e) => {
                             e.preventDefault();
                             saveMutation.mutate();
-                        }, spacing: "md", children: [_jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: setSyncEnabled, disabled: !cfg?.connected })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => importMutation.mutate(), isLoading: importMutation.isPending, disabled: !cfg?.connected || !syncEnabled || importMutation.isPending, variant: "secondary", children: importMutation.isPending ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
+                        }, spacing: "md", children: [_jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: setSyncEnabled, disabled: !cfg?.connected })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
                             buyerName: "Ravi K.",
                             firstItemName: "Charizard PSA 9",
                             additionalItemCount: 2,

package/dist/providers/db-firebase/sieve.js

@@ -136,7 +136,16 @@ export async function applySieveToFirestore(params) {
     const merged = { ...SIEVE_DEFAULTS, ...rest };
     const effective = withAliasesExpanded(model, aliases);
     const processor = new SieveProcessorBase({
-        adapter: createFirebaseAdapter(),
+        // MUST be the enhanced adapter, not the stock one. This is the path
+        // `BaseRepository.sieveQuery` delegates to, so it is what ProductRepository
+        // and most other repositories actually run — only `FirebaseSieveRepository`
+        // used the enhanced adapter, and nothing extends that. With the stock
+        // adapter a same-field OR group (`listingType==art|stickers`, i.e. every
+        // multi-select facet in the app) became a `whereOr` call the Admin SDK does
+        // not implement; `throwExceptions: false` then swallowed it and the clause
+        // vanished, returning the ENTIRE collection instead of the selected subset.
+        // See __tests__/sieve-or-group.test.ts.
+        adapter: createEnhancedFirebaseAdapter(),
         autoLoadConfig: false,
         options: merged,
         fields,

package/dist/seed/site-settings-seed-data.js

@@ -523,9 +523,27 @@ export const siteSettingsSeedData = {
         razorpayWebhookSecret: "webhook_PLACEHOLDER",
         resendApiKey: "",
         whatsappApiKey: "wa_PLACEHOLDER",
+        // Real Meta secrets — deliberately left empty. With these unset the order
+        // announcement logs "not configured" and skips cleanly; a placeholder
+        // string here would instead be treated as a usable token and fail on send.
+        // Enter the real values in Admin → Site Settings → WhatsApp.
         whatsappPhoneNumberId: "",
         whatsappCloudApiToken: "",
-        whatsappAdminNotifyNumbers: "",
+        // The platform's own WhatsApp number, digits-only with country code
+        // (+91 8919665811). Same number as contact.whatsappNumber above.
+        whatsappAdminNotifyNumbers: "918919665811",
+        // Default Meta message-template names. These MUST be created and approved
+        // in Meta Business Manager under exactly these names — business-initiated
+        // sends outside the 24h customer-service window are rejected without an
+        // approved template. Names match the notification types they serve, see
+        // WHATSAPP_TEMPLATE_BY_TYPE in features/admin/actions/notification-actions.ts.
+        whatsappTemplateOrderPlaced: "order_placed",
+        whatsappTemplateOrderConfirmed: "order_confirmed",
+        whatsappTemplateOrderShipped: "order_shipped",
+        whatsappTemplateOrderDelivered: "order_delivered",
+        whatsappTemplateOrderCancelled: "order_cancelled",
+        whatsappTemplateRefundInitiated: "refund_initiated",
+        whatsappTemplateLanguage: "en",
         metaAppId: "meta_app_PLACEHOLDER",
         metaAppSecret: "meta_secret_PLACEHOLDER",
         metaPageAccessToken: "meta_page_token_PLACEHOLDER",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.12.2",
+  "version": "4.12.4",
   "license": "MIT",
   "publishConfig": {
     "access": "public"