@mohasinac/appkit 4.13.0 → 4.14.0

package/dist/_internal/server/features/products/list-public.js

@@ -10,13 +10,21 @@
  *
  * WHAT: `parsePublicProductParams` (URL/searchParams -> typed input) and
  *       `listPublicProducts` (typed input -> page of documents). Firestore-safe
- *       clauses go into the query; `inStock` and unsafe date ranges are applied as
- *       in-memory predicates over one bounded fetch, then re-sorted into the caller's
- *       requested order and re-paginated.
+ *       clauses go into the query; the availability scope and unsafe date
+ *       ranges are applied over bounded fetches, then re-sorted into the
+ *       caller's requested order and re-paginated. See the comment block above
+ *       `listPublicProducts` for why the three scopes execute differently.
+ *
+ *       Since 2026-08-24 this also backs the admin/seller dashboards, via the
+ *       `ANY_STATUS` sentinel — so a dashboard and a public page filtering the
+ *       same listing type issue byte-identical queries instead of two
+ *       hand-rolled filter builders that drift.
  *
  * EXPORTS:
  *   PublicProductListInput, PublicProductListResult, PublicProductExecutor,
- *   PublicProductListOptions, parsePublicProductParams, listPublicProducts
+ *   PublicProductListOptions, parsePublicProductParams, listPublicProducts,
+ *   listStoreProducts, defaultAvailabilityForListingTypes, ANY_STATUS,
+ *   PUBLIC_PRODUCT_MAX_PAGE_SIZE
  *
  * @tag domain:products
  * @tag layer:server-data
@@ -33,11 +41,19 @@ import { TABLE_KEYS } from "../../../../constants/table-keys";
 import { sortBy } from "../../../../constants/sort";
 import { SIEVE_OP, sieveAnd, sieveFilter, expandSieveParam, } from "../../../../utils/sieve-builder";
 import { ALL_LISTING_TYPES } from "../../../shared/listing-types/feature-flags";
-import { hideDefaultsFor } from "../../../shared/listing-types/_registry";
+import { isListingRowAvailable, unavailableClausesFor, } from "../../../shared/listing-types/_registry";
+import { AVAILABILITY_VALUES, isAvailabilityFilter, } from "../../../../constants/field-names";
 /** Vercel Hobby Fluid Compute ceiling (CLAUDE.md Rule #6) — never fetch more at once. */
 export const PUBLIC_PRODUCT_MAX_PAGE_SIZE = 50;
 /**
- * Which "Show X" defaults apply to a set of listing types.
+ * `status` sentinel meaning "every publication state". Only the authenticated
+ * admin/seller dashboards may pass it — a public surface that did would leak
+ * drafts. A sentinel rather than `status: undefined` because undefined already
+ * means "use the safe default", and conflating the two is how a leak ships.
+ */
+export const ANY_STATUS = "__any__";
+/**
+ * The availability scope a listing surface starts in.
  *
  * THE POINT OF THIS FUNCTION is that SSR and the client refetch call the SAME
  * implementation. `staleTime: Infinity` freezes SSR `initialData` forever, so
@@ -46,21 +62,19 @@ export const PUBLIC_PRODUCT_MAX_PAGE_SIZE = 50;
  * them is wrong — permanently (Root Cause #30). Two mirrored literals is
  * exactly how that bug is written; one shared function is how it isn't.
  *
- * `/products` now spans all nine listing types, which makes this load-bearing
- * rather than theoretical: a mixed set includes both sold-out-able types
- * (products, art) and time-boxed ones (auctions, pre-orders, prize draws), so
- * BOTH toggles can apply at once.
+ * It is a constant today rather than a per-type decision — every listing
+ * surface opens on what a shopper can actually buy. It stays a function
+ * because that is the seam a surface would override through, and because
+ * `audit-listing-filter-parity` asserts on this name to prove every SSR view
+ * derives its default rather than hard-coding one (two of them used to).
  */
-export function defaultTogglesForListingTypes(types) {
-    // No explicit set = every type is in play, so both defaults apply.
+export function defaultAvailabilityForListingTypes(_types) {
+    return { availability: AVAILABILITY_VALUES.AVAILABLE };
+}
+/** Narrow arbitrary strings to real listing types, dropping the rest. */
+function asListingTypes(types) {
     const effective = types && types.length > 0 ? types : ALL_LISTING_TYPES;
-    const defaults = hideDefaultsFor(effective.filter((t) => ALL_LISTING_TYPES.includes(t)));
-    return {
-        hideSoldByDefault: defaults.includes("sold"),
-        // "ended" and "closed" are the same query mechanic (a date range against
-        // the type's own end field); they differ only in the toggle's wording.
-        hideEndedByDefault: defaults.includes("ended") || defaults.includes("closed"),
-    };
+    return effective.filter((t) => ALL_LISTING_TYPES.includes(t));
 }
 const DEFAULT_PAGE = 1;
 const DEFAULT_PAGE_SIZE = 24;
@@ -114,6 +128,29 @@ function pipeList(raw) {
     const parts = raw.split("|").map((s) => s.trim()).filter(Boolean);
     return parts.length > 0 ? parts : undefined;
 }
+/**
+ * Read the availability scope, with a back-compat mapping for the three URL
+ * spellings this replaced.
+ *
+ * An unrecognised token falls back to the caller's default rather than being
+ * passed through — a raw query param must never reach a Firestore value.
+ */
+function readAvailability(get, fallback) {
+    const raw = get(TABLE_KEYS.AVAILABILITY);
+    if (raw && isAvailabilityFilter(raw))
+        return raw;
+    if (raw)
+        return fallback;
+    // `showSold` / `showEnded` / `showClosed` each meant "stop filtering", so
+    // they map to `all`, NOT to `unavailable`. Kept only so links shared before
+    // 2026-08-24 still resolve to something sensible; nothing writes them.
+    if (get(TABLE_KEYS.SHOW_SOLD) === "true" ||
+        get(TABLE_KEYS.SHOW_ENDED) === "true" ||
+        get(TABLE_KEYS.SHOW_CLOSED) === "true") {
+        return AVAILABILITY_VALUES.ALL;
+    }
+    return fallback;
+}
 /**
  * Read the shared public-listing query params. SSR views hand in Next's
  * `searchParams` record; the API route hands in `url.searchParams`. Both produce
@@ -160,21 +197,12 @@ export function parsePublicProductParams(params, defaults) {
         typeFacets: readTypeFacets(get),
         preOrderProductionStatus: get(TABLE_KEYS.PREORDER_STATUS) || get("preOrderStatus") || undefined,
         prizeRevealStatus: get(TABLE_KEYS.PRIZE_REVEAL_STATUS) || undefined,
-        // Three spellings of one intent — /products and /art call it "Show sold",
-        // /pre-orders calls it "Show closed", and the client hook sends `inStock`.
-        // Any of them turning the filter OFF wins, so SSR and the client refetch
-        // agree on what the default view means (Root Cause #30).
-        inStock: get(TABLE_KEYS.SHOW_SOLD) === "true" || get(TABLE_KEYS.SHOW_CLOSED) === "true"
-            ? undefined
-            : get(TABLE_KEYS.IN_STOCK)
-                ? get(TABLE_KEYS.IN_STOCK) === "true"
-                : defaults?.hideSoldByDefault
-                    ? true
-                    : undefined,
-        dateFrom: get(TABLE_KEYS.DATE_FROM) ||
-            (defaults?.hideEndedByDefault && get(TABLE_KEYS.SHOW_ENDED) !== "true"
-                ? new Date().toISOString()
-                : undefined),
+        availability: readAvailability(get, defaults?.availability),
+        // Now a plain drawer facet again. It used to double as the hide-ended
+        // mechanism, which is why it only worked when exactly one listing type was
+        // selected — `dateFieldFor` returns null otherwise, so /products silently
+        // showed ended auctions in its default view.
+        dateFrom: get(TABLE_KEYS.DATE_FROM) || undefined,
         dateTo: get(TABLE_KEYS.DATE_TO) || undefined,
         page: num(get(TABLE_KEYS.PAGE)) ?? DEFAULT_PAGE,
         pageSize: num(get(TABLE_KEYS.PAGE_SIZE)) ?? defaults?.pageSize ?? DEFAULT_PAGE_SIZE,
@@ -196,7 +224,10 @@ function buildFirestoreSafeFilters(input) {
     const parts = [];
     // Published-only unless the caller explicitly asks otherwise. Without this
     // default, any refetch that omits `status` leaks drafts (Root Cause #30).
-    parts.push(sieveFilter(PRODUCT_FIELDS.STATUS, SIEVE_OP.EQ, input.status || PRODUCT_FIELDS.STATUS_VALUES.PUBLISHED));
+    // ANY_STATUS is the one opt-out, reserved for the authenticated dashboards.
+    if (input.status !== ANY_STATUS) {
+        parts.push(sieveFilter(PRODUCT_FIELDS.STATUS, SIEVE_OP.EQ, input.status || PRODUCT_FIELDS.STATUS_VALUES.PUBLISHED));
+    }
     const types = input.listingTypes?.filter(Boolean) ?? [];
     if (types.length > 0) {
         parts.push(sieveFilter(PRODUCT_FIELDS.LISTING_TYPE, SIEVE_OP.EQ, types.join("|")));
@@ -308,72 +339,188 @@ async function defaultExecutor(query) {
         cursor: null,
     };
 }
+/** Render one `UnavailableClause` as a Sieve clause against a fixed `now`. */
+function clauseToSieve(clause, now) {
+    const value = clause.value === "NOW" ? now.toISOString() : clause.value;
+    return clause.op === "lt"
+        ? sieveFilter(clause.field, SIEVE_OP.LT, value)
+        : sieveFilter(clause.field, SIEVE_OP.EQ, value);
+}
 // ---------------------------------------------------------------------------
 // The one public listing query
 // ---------------------------------------------------------------------------
+//
+// AVAILABILITY IS ASYMMETRIC, and the asymmetry is what makes this tractable.
+//
+//   "unavailable" is SPARSE and expressible as an OR of EQUALITIES — sold out,
+//   ended, closed, depleted. Firestore cannot OR across different fields, but
+//   it can run each equality as its own bounded query, and merging N small
+//   result sets in memory is cheap. That is Path C.
+//
+//   "available" is DENSE and NEGATION-shaped: NOT(a OR b OR c). There is no
+//   query for that, so it stays what it has always been — one bounded window
+//   in the caller's own sort order, filtered per row. That is fine precisely
+//   because it is dense: nearly every row in the window passes.
+//
+// Path A ("all") applies no predicate at all and is therefore the only scope
+// with true Firestore pagination and an exact total.
 export async function listPublicProducts(input, opts) {
+    const now = opts?.now ?? new Date();
     const page = Math.max(1, input.page ?? DEFAULT_PAGE);
     const pageSize = Math.min(PUBLIC_PRODUCT_MAX_PAGE_SIZE, Math.max(1, input.pageSize ?? DEFAULT_PAGE_SIZE));
     const sorts = input.sorts || DEFAULT_SORTS;
     const requestedSortField = sorts.replace(/^-/, "");
+    const sortDesc = sorts.startsWith("-");
+    const availability = input.availability ?? AVAILABILITY_VALUES.ALL;
+    const wantAvailable = availability === AVAILABILITY_VALUES.AVAILABLE;
+    const wantUnavailable = availability === AVAILABILITY_VALUES.UNAVAILABLE;
     const dateField = dateFieldFor(input.listingTypes);
     const hasDateRange = Boolean((input.dateFrom || input.dateTo) && dateField);
-    // Firestore DOES accept one inequality when the query sorts by that same field —
-    // the auctions "Ending Soon" default is exactly that shape, so push it down.
-    const canPushDate = hasDateRange && !input.inStock && requestedSortField === dateField;
+    // Firestore DOES accept one inequality when the query sorts by that same
+    // field, so a matching date facet can still be pushed down.
+    const canPushDate = hasDateRange && !wantAvailable && requestedSortField === dateField;
     const safeFilters = buildFirestoreSafeFilters(input);
-    const filters = sieveAnd(safeFilters, ...(canPushDate && input.dateFrom
-        ? [sieveFilter(dateField, SIEVE_OP.GTE, input.dateFrom)]
-        : []), ...(canPushDate && input.dateTo
-        ? [sieveFilter(dateField, SIEVE_OP.LTE, input.dateTo)]
-        : []));
-    const hasUnsafeFilter = Boolean(input.inStock) || (hasDateRange && !canPushDate);
+    const dateClauses = [
+        ...(canPushDate && input.dateFrom
+            ? [sieveFilter(dateField, SIEVE_OP.GTE, input.dateFrom)]
+            : []),
+        ...(canPushDate && input.dateTo
+            ? [sieveFilter(dateField, SIEVE_OP.LTE, input.dateTo)]
+            : []),
+    ];
+    const executor = opts?.executor ?? defaultExecutor;
+    const types = asListingTypes(input.listingTypes);
+    // ── Path B: one type whose unavailability IS a pushable inequality, and the
+    //    caller is already sorting by that field. Ended auctions sorted by end
+    //    date is the whole reason this branch exists — it gives the archive real,
+    //    unbounded-depth Firestore pagination instead of a 50-row window.
+    const pushdown = wantUnavailable && types.length === 1 && !hasDateRange
+        ? unavailableClausesFor(types).find((c) => c.op === "lt" && c.sortField === requestedSortField)
+        : undefined;
+    if (pushdown) {
+        const filters = sieveAnd(safeFilters, clauseToSieve(pushdown, now));
+        const result = await runQuery(executor, {
+            filters,
+            sorts,
+            page,
+            pageSize,
+            cursor: input.cursor ?? null,
+        });
+        if (!result)
+            return null;
+        return finish({
+            items: result.items,
+            total: result.total,
+            page: result.page,
+            pageSize,
+            totalPages: result.totalPages,
+            hasMore: result.hasMore,
+            cursor: result.cursor ?? null,
+            truncated: false,
+            filters,
+            sorts,
+            enabled: opts?.enabledListingTypes,
+        });
+    }
+    // ── Path C: unavailable, everything else. One bounded query per distinct
+    //    clause, run in parallel, merged and deduped. Nine listing types collapse
+    //    to five clauses, so this is 5 × 50 = 250 documents in a single round —
+    //    well inside Rule #6, and the same fan-out shape `computeRelatedItems`
+    //    already uses.
+    if (wantUnavailable) {
+        const clauses = unavailableClausesFor(types);
+        const results = await Promise.all(clauses.map((clause) => {
+            // An inequality still has to be ordered by its own field, even here.
+            const clauseSorts = clause.op === "lt" && clause.sortField
+                ? sortBy(clause.sortField, "DESC")
+                : sorts;
+            return runQuery(executor, {
+                filters: sieveAnd(safeFilters, clauseToSieve(clause, now)),
+                sorts: clauseSorts,
+                page: 1,
+                pageSize: PUBLIC_PRODUCT_MAX_PAGE_SIZE,
+                cursor: null,
+            });
+        }));
+        // One failed branch must not blank the whole scope — but it is already
+        // logged loudly by `runQuery`, and it does mean the merge is incomplete,
+        // which `truncated` communicates honestly.
+        if (results.every((r) => r === null))
+            return null;
+        const merged = new Map();
+        let truncated = false;
+        for (const result of results) {
+            if (!result) {
+                truncated = true;
+                continue;
+            }
+            const rows = result.items;
+            if (rows.length >= PUBLIC_PRODUCT_MAX_PAGE_SIZE)
+                truncated = true;
+            for (const row of rows) {
+                const id = typeof row.id === "string" ? row.id : JSON.stringify(row.id);
+                if (!merged.has(id))
+                    merged.set(id, row);
+            }
+        }
+        // Drop false positives — a clause selects a SUPERSET. A pre-order can hold
+        // `availableQuantity: 0` from an over-signed allocation while still open,
+        // and only the per-type predicate knows that.
+        const rows = [...merged.values()].filter((row) => !isListingRowAvailable(row, now));
+        const ordered = sortRows(rows, requestedSortField, sortDesc);
+        const start = (page - 1) * pageSize;
+        return finish({
+            items: ordered.slice(start, start + pageSize),
+            total: ordered.length,
+            page,
+            pageSize,
+            totalPages: truncated
+                ? page + 1
+                : Math.max(1, Math.ceil(ordered.length / pageSize)),
+            hasMore: truncated || start + pageSize < ordered.length,
+            cursor: null,
+            truncated,
+            filters: clauses.map((c) => sieveAnd(safeFilters, clauseToSieve(c, now))).join(" OR "),
+            sorts,
+            enabled: opts?.enabledListingTypes,
+        });
+    }
+    // ── Path A ("all") and the dense "available" case share one query. The only
+    //    difference is whether a per-row predicate runs afterwards.
+    const filters = sieveAnd(safeFilters, ...dateClauses);
+    const inMemory = wantAvailable || (hasDateRange && !canPushDate);
     // When a date range stays in memory, fetch in whichever direction front-loads
     // the rows that will PASS it: `dateFrom` (">=", still live) wants the most
     // future dates first; `dateTo` ("<=", ends by) wants the earliest first.
     // Fetching in the client's own order instead is what made live auctions
     // invisible once ~50 had already ended.
-    const fetchSorts = hasUnsafeFilter && hasDateRange && dateField
+    const fetchSorts = inMemory && hasDateRange && !canPushDate && dateField
         ? input.dateFrom
             ? sortBy(dateField, "DESC")
             : sortBy(dateField, "ASC")
         : sorts;
-    const executor = opts?.executor ?? defaultExecutor;
-    let result;
-    try {
-        result = await executor({
-            filters,
-            sorts: fetchSorts,
-            page: hasUnsafeFilter ? 1 : page,
-            pageSize: hasUnsafeFilter ? PUBLIC_PRODUCT_MAX_PAGE_SIZE : pageSize,
-            cursor: hasUnsafeFilter ? null : (input.cursor ?? null),
-        });
-    }
-    catch (error) {
-        void normalizeError(error);
-        // Loud. A swallowed query failure here is indistinguishable from an empty
-        // catalogue at every call site above, which is exactly how the /art bug hid.
-        serverLogger.error("listPublicProducts query failed", {
-            filters,
-            sorts: fetchSorts,
-            error: error instanceof Error ? error.message : String(error),
-        });
+    const result = await runQuery(executor, {
+        filters,
+        sorts: fetchSorts,
+        page: inMemory ? 1 : page,
+        pageSize: inMemory ? PUBLIC_PRODUCT_MAX_PAGE_SIZE : pageSize,
+        cursor: inMemory ? null : (input.cursor ?? null),
+    });
+    if (!result)
         return null;
-    }
     let items = result.items;
     let total = result.total;
     let totalPages = result.totalPages;
     let resultPage = result.page;
     let hasMore = result.hasMore;
     let cursor = result.cursor ?? null;
-    if (hasUnsafeFilter) {
+    let truncated = false;
+    if (inMemory) {
+        truncated = items.length >= PUBLIC_PRODUCT_MAX_PAGE_SIZE;
         const filtered = items.filter((item) => {
-            if (input.inStock) {
-                const stock = item[PRODUCT_FIELDS.STOCK_QUANTITY];
-                if (!(typeof stock === "number" && stock > 0))
-                    return false;
-            }
-            if (hasDateRange && dateField) {
+            if (wantAvailable && !isListingRowAvailable(item, now))
+                return false;
+            if (hasDateRange && !canPushDate && dateField) {
                 const raw = item[dateField];
                 if (!raw)
                     return false;
@@ -385,28 +532,16 @@ export async function listPublicProducts(input, opts) {
             }
             return true;
         });
-        const ordered = fetchSorts === sorts ? filtered : sortRows(filtered, requestedSortField, sorts.startsWith("-"));
+        const ordered = fetchSorts === sorts ? filtered : sortRows(filtered, requestedSortField, sortDesc);
         total = ordered.length;
-        totalPages = Math.max(1, Math.ceil(total / pageSize));
+        totalPages = truncated ? page + 1 : Math.max(1, Math.ceil(total / pageSize));
         resultPage = page;
         const start = (page - 1) * pageSize;
         items = ordered.slice(start, start + pageSize);
-        hasMore = start + pageSize < total;
+        hasMore = truncated || start + pageSize < total;
         cursor = null;
     }
-    // Feature-flagged-off types never reach a public surface.
-    const enabled = opts?.enabledListingTypes;
-    if (enabled && enabled.size > 0) {
-        const before = items.length;
-        items = items.filter((it) => {
-            const lt = typeof it.listingType === "string" ? it.listingType : "standard";
-            return enabled.has(lt);
-        });
-        const removed = before - items.length;
-        if (removed > 0)
-            total = Math.max(0, total - removed);
-    }
-    return {
+    return finish({
         items,
         total,
         page: resultPage,
@@ -414,8 +549,49 @@ export async function listPublicProducts(input, opts) {
         totalPages,
         hasMore,
         cursor,
+        truncated,
         filters,
         sorts,
+        enabled: opts?.enabledListingTypes,
+    });
+}
+/**
+ * Run one executor call, logging loudly and returning null on failure.
+ *
+ * Loud on purpose: a swallowed query failure is indistinguishable from an
+ * empty catalogue at every call site above, which is exactly how the /art bug
+ * hid for months (Root Cause #59).
+ */
+async function runQuery(executor, query) {
+    try {
+        return await executor(query);
+    }
+    catch (error) {
+        void normalizeError(error);
+        serverLogger.error("listPublicProducts query failed", {
+            filters: query.filters,
+            sorts: query.sorts,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
+}
+/** Apply the feature-flag post-filter and assemble the result. */
+function finish(draft) {
+    const { enabled, ...result } = draft;
+    if (!enabled || enabled.size === 0)
+        return result;
+    // Feature-flagged-off types never reach a public surface.
+    const before = result.items.length;
+    const items = result.items.filter((it) => {
+        const lt = typeof it.listingType === "string" ? it.listingType : "standard";
+        return enabled.has(lt);
+    });
+    const removed = before - items.length;
+    return {
+        ...result,
+        items,
+        total: removed > 0 ? Math.max(0, result.total - removed) : result.total,
     };
 }
 /**
@@ -438,7 +614,7 @@ export async function listStoreProducts(storeId, listingTypes, searchParams = {}
             listingTypes,
             pageSize: defaults?.pageSize ?? DEFAULT_PAGE_SIZE,
             sorts: defaults?.sorts,
-            ...defaultTogglesForListingTypes(listingTypes),
+            ...defaultAvailabilityForListingTypes(listingTypes),
         }),
         // The route owns the store identity — a `?storeId=` in the URL must not be
         // able to make one store's tab render another store's inventory.

package/dist/_internal/server/features/products/listing-tab-counts.d.ts

@@ -0,0 +1,44 @@
+import type { ListingTab } from "../../../../features/products/constants/listing-tabs";
+/**
+ * Which slice of the catalogue a tab bar is counting. Exactly one of the three
+ * scoping fields is set in practice, but the shape is shared so all three
+ * surfaces go through one code path.
+ */
+export interface ListingTabScope {
+    /**
+     * Category ids to match against `categorySlugs`. Products are tagged with
+     * their FULL ancestor chain, so this should be the page's own id alone —
+     * expanding descendants is both unnecessary and, past 30 entries, illegal
+     * (see `ProductRepository.MAX_ARRAY_CONTAINS_ANY`).
+     */
+    categoriesIn?: string[];
+    /**
+     * Brand DISPLAY NAME, not slug. `BrandDetailPageView` matches products on the
+     * free-text `brand` field, so the count must use the same field or it would
+     * disagree with the rows the tab then shows.
+     */
+    brandName?: string;
+    storeId?: string;
+    /** Publication state to count. Defaults to `published`. */
+    status?: string;
+}
+/**
+ * tabSlug -> number of rows, or `undefined` when that count could not be
+ * resolved.
+ *
+ * `undefined` is load-bearing: callers hide a tab at zero, so a failed query
+ * that reported 0 would hide a tab holding real inventory. Callers must treat
+ * `undefined` as "keep the tab visible" (Root Cause #59).
+ */
+export type ListingTabCounts = Record<string, number | undefined>;
+/**
+ * Count every tab in `tabs` within `scope`, in one parallel batch.
+ *
+ * The listing-type buckets come from each tab's own `listingType` field — which
+ * already carries `"art|stickers"` as a pipe OR-group — so this function never
+ * enumerates the `ListingType` union itself and cannot drift from it.
+ *
+ * `stores` is not counted here: only the category page has that tab and it
+ * already resolves its store list eagerly to render the tab body.
+ */
+export declare function listingTabCounts(tabs: readonly ListingTab[], scope: ListingTabScope): Promise<ListingTabCounts>;

package/dist/_internal/server/features/products/listing-tab-counts.js

@@ -0,0 +1,97 @@
+/*
+ * WHY: Category, brand and store detail pages each show a listing-type tab bar
+ *      and hide a tab whose scope holds nothing. Before this module they each
+ *      hand-wrote their own per-type count map, and all three had drifted:
+ *      category and brand counted 6 of 10 tabs (classifieds / digital-codes /
+ *      live / art fell through to `undefined` and could therefore NEVER hide),
+ *      while the store page counted all 9 through eleven copy-pasted queries.
+ *      That is Recurrent Root Cause #61 — an enumeration of `ListingType` kept
+ *      by hand in more than one place always drifts.
+ * WHAT: One function that derives the buckets it counts from the SAME tab array
+ *       the tab bar renders, so a tenth listing type is counted automatically.
+ *
+ * EXPORTS:
+ *   ListingTabScope   — the surface's scope (category / brand / store)
+ *   ListingTabCounts  — tabSlug -> count, `undefined` meaning "query failed"
+ *   listingTabCounts  — resolve every tab's count in one parallel batch
+ *
+ * @tag domain:products,categories,stores
+ * @tag layer:server
+ * @tag pattern:derived-from-registry
+ * @tag access:server-only
+ * @tag consumers:CategoryDetailPageView,BrandDetailPageView,StoreDetailLayoutView
+ * @tag sideEffects:none
+ */
+import { categoriesRepository, productRepository } from "../../../../repositories";
+import { serverLogger } from "../../../../monitoring";
+import { normalizeError } from "../../../../errors/normalize";
+const DEFAULT_STATUS = "published";
+/** Bundles a category owns, resolved by the same rule the bundles tab renders. */
+async function countBundles(scope) {
+    try {
+        const rows = await categoriesRepository.listByType("bundle", {
+            activeOnly: true,
+            limit: 100,
+        });
+        return rows.filter((row) => bundleMatchesScope(row, scope)).length;
+    }
+    catch (error) {
+        void normalizeError(error);
+        serverLogger.warn("listingTabCounts: bundle count failed; tab stays visible");
+        return undefined;
+    }
+}
+/**
+ * Does a bundle belong to the scope being counted?
+ *
+ * A bundle row carries `brandSlug` and `createdByStoreId` but has no category
+ * field of its own, so category membership is derived from the categories its
+ * MEMBER products are filed under — mirrored onto `bundleCategorySlugs` for
+ * index-friendly reads. Per Root Cause #42 the mirror is never trusted alone:
+ * when it is absent the bundle is treated as unscoped rather than as excluded,
+ * because silently dropping a bundle whose mirror one write path forgot is the
+ * exact failure that entry documents.
+ */
+function bundleMatchesScope(bundle, scope) {
+    if (scope.storeId)
+        return bundle.createdByStoreId === scope.storeId;
+    if (scope.brandName)
+        return true; // brand pages filter by slug at the call site
+    if (scope.categoriesIn && scope.categoriesIn.length > 0) {
+        const mirror = bundle.bundleCategorySlugs;
+        if (!mirror || mirror.length === 0)
+            return true;
+        return mirror.some((slug) => scope.categoriesIn.includes(slug));
+    }
+    return true;
+}
+/**
+ * Count every tab in `tabs` within `scope`, in one parallel batch.
+ *
+ * The listing-type buckets come from each tab's own `listingType` field — which
+ * already carries `"art|stickers"` as a pipe OR-group — so this function never
+ * enumerates the `ListingType` union itself and cannot drift from it.
+ *
+ * `stores` is not counted here: only the category page has that tab and it
+ * already resolves its store list eagerly to render the tab body.
+ */
+export async function listingTabCounts(tabs, scope) {
+    const listingTabs = tabs.filter((tab) => Boolean(tab.listingType));
+    const wantsBundles = tabs.some((tab) => tab.collection === "bundles");
+    const [typeCounts, bundleCount] = await Promise.all([
+        productRepository.countByListingTypes(listingTabs.map((tab) => String(tab.listingType)), {
+            status: scope.status ?? DEFAULT_STATUS,
+            storeId: scope.storeId,
+            categoriesIn: scope.categoriesIn,
+            brandName: scope.brandName,
+        }),
+        wantsBundles ? countBundles(scope) : Promise.resolve(undefined),
+    ]);
+    const counts = {};
+    for (const tab of listingTabs) {
+        counts[tab.id] = typeCounts[String(tab.listingType)];
+    }
+    if (wantsBundles)
+        counts.bundles = bundleCount;
+    return counts;
+}

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Site-settings adapter — the allow-list projection for `GET /api/site-settings`.
+ *
+ * Every field of `SiteSettingsDocument` is triaged into exactly one of
+ * `PUBLIC_SITE_SETTINGS_FIELDS` (mapped into the returned literal) or
+ * `PRIVATE_SITE_SETTINGS_FIELDS` (with a stated reason). A field added to the
+ * schema and to neither list fails
+ * `scripts/audit-public-projection-parity.mjs` — new fields are private by
+ * default.
+ *
+ * Why this replaced a deny-list (2026-08-24): the route used to spread the
+ * document and delete three keys (`credentials`, `emailSettings`,
+ * `legalPages`), which meant everything else was public by default and
+ * edge-cached for 300s. That shipped `gst.gstin` + the registered legal name
+ * and address, all 25 `commissions.*` fields, `laborRate.hourlyRate`,
+ * `emi.surchargeSellerSharePercent`, `featureFlags.adminCheckoutBypass`, and —
+ * because they weren't even declared on the interface —
+ * `adSettings.providerCredentials` (which the ADMIN ads endpoint bothers to
+ * mask) plus every draft/paused/scheduled ad in `adSettings.inventory`.
+ *
+ * That last part is the argument for an allow-list over any amount of
+ * deny-list discipline: a deny-list keyed on a TypeScript interface is blind
+ * to fields the interface never declared. This function can only emit what it
+ * names.
+ *
+ * NOTE: fees are deliberately NOT exposed here. Cart and checkout receive them
+ * as SSR props via `toBuyerFacingFees`. If a client ever needs them from this
+ * endpoint, spread `toBuyerFacingFees(doc.commissions)` into the literal below
+ * and move `commissions` across to the public list — do not hand-roll a second
+ * subset.
+ */
+import type { SiteSettingsDocument } from "../../../../features/admin/schemas/firestore";
+import type { MediaVideoWatermark } from "../../../../features/media/MediaVideo";
+import type { PublicSiteSettings } from "../../../shared/features/site-settings/types";
+/**
+ * Document fields with a proven `useSiteSettings()` reader. Every entry below
+ * was traced to a call site; anything without one belongs in the private list,
+ * because an unused public field is pure attack surface.
+ */
+export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "featureFlags", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark"];
+/** Everything else, with the reason it stays server-side. */
+export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "disabledRoutes", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults"];
+export interface ToPublicSiteSettingsOptions {
+    /**
+     * The resolved marker → wordmark → text watermark chain. Injected because
+     * the resolver lives in the consumer app
+     * (`src/lib/watermark/resolve-effective-watermark.ts`), not in appkit.
+     */
+    effectiveWatermark?: MediaVideoWatermark;
+}
+export declare function toPublicSiteSettings(doc: SiteSettingsDocument, opts?: ToPublicSiteSettingsOptions): PublicSiteSettings;