@mohasinac/appkit 4.14.0 → 4.15.0

package/dist/features/store-extensions/schemas/custom-role-form.d.ts

@@ -0,0 +1,85 @@
+import { z } from "zod";
+/** Whether a string is a permission this system can actually grant. */
+export declare function isKnownPermission(value: string): boolean;
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export declare const customRoleFormSchema: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    scope: z.ZodEnum<["global", "store"]>;
+    permissions: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+    inheritsFrom: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    scope: "store" | "global";
+    name: string;
+    slug: string;
+    isActive: boolean;
+    permissions: string[];
+    description?: string | undefined;
+    inheritsFrom?: string | undefined;
+}, {
+    scope: "store" | "global";
+    name: string;
+    slug: string;
+    isActive: boolean;
+    permissions: string[];
+    description?: string | undefined;
+    inheritsFrom?: string | undefined;
+}>;
+export type CustomRoleFormValues = z.infer<typeof customRoleFormSchema>;
+/** Create contract. `createdBy` is absent — the route sets it from the session. */
+export declare const customRoleCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    scope: z.ZodEnum<["global", "store"]>;
+    permissions: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+    inheritsFrom: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    scope: "store" | "global";
+    name: string;
+    slug: string;
+    isActive: boolean;
+    permissions: string[];
+    description?: string | undefined;
+    inheritsFrom?: string | undefined;
+}, {
+    scope: "store" | "global";
+    name: string;
+    slug: string;
+    isActive: boolean;
+    permissions: string[];
+    description?: string | undefined;
+    inheritsFrom?: string | undefined;
+}>;
+/**
+ * Update contract — partial and `.strict()`, so an unknown key is a 400 rather
+ * than a silent write into a document the permission system reads.
+ */
+export declare const customRoleUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodEnum<["global", "store"]>>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    inheritsFrom: z.ZodOptional<z.ZodString>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    scope?: "store" | "global" | undefined;
+    name?: string | undefined;
+    description?: string | undefined;
+    isActive?: boolean | undefined;
+    permissions?: string[] | undefined;
+    inheritsFrom?: string | undefined;
+}, {
+    scope?: "store" | "global" | undefined;
+    name?: string | undefined;
+    description?: string | undefined;
+    isActive?: boolean | undefined;
+    permissions?: string[] | undefined;
+    inheritsFrom?: string | undefined;
+}>;

package/dist/features/store-extensions/schemas/custom-role-form.js

@@ -0,0 +1,118 @@
+/*
+ * WHY: Custom roles GRANT PERMISSIONS, and neither creating nor updating one
+ *      validated anything. Measured 2026-08-24:
+ *        · `POST /api/admin/roles` — `parseJsonBody` then `...body` spread
+ *          into `.create()`.
+ *        · `PATCH /api/admin/roles/[id]` — the raw body handed straight to
+ *          `.update()`.
+ *        · Both pages (`admin/roles/new`, `.../[id]/edit`) are raw controls
+ *          with no Zod anywhere.
+ *      So a role could be written with no name, a `permissions` array holding
+ *      arbitrary strings, a `scope` outside its union, or any invented key —
+ *      all persisted verbatim into the document the permission system reads.
+ * WHAT: One schema for both pages AND both routes.
+ *
+ * ## Permissions are checked against the real catalogue
+ *
+ * `Permission` is a closed union of ~85 `admin:resource:action` strings, and
+ * `PERMISSION_GROUPS` is its runtime form. A permission string that is not in
+ * it grants nothing — it silently never matches — so a role built from typos
+ * looks configured and does nothing, which is worse than being rejected.
+ *
+ * `"*"` is accepted deliberately: `security/rbac/types.ts` defines it as the
+ * wildcard, and rejecting it here would break a legitimate super-role.
+ *
+ * ## What is NOT accepted from the body
+ *
+ * `createdBy` is set from the session by the route. `id`/`createdAt`/
+ * `updatedAt` are the repository's. A caller able to set `createdBy` could
+ * attribute a privilege grant to somebody else, which is precisely the field
+ * an audit trail depends on.
+ *
+ * EXPORTS:
+ *   customRoleFormSchema, customRoleCreateSchema, customRoleUpdateSchema,
+ *   isKnownPermission, type CustomRoleFormValues
+ *
+ * @tag domain:store-extensions,rbac
+ * @tag layer:schema
+ * @tag pattern:none
+ * @tag access:isomorphic
+ * @tag consumers:admin/roles pages,/api/admin/roles
+ * @tag sideEffects:none
+ */
+import { z } from "zod";
+import { annotate } from "../../shell/field-ui-meta";
+import { PERMISSION_GROUPS } from "../../auth/permissions/constants";
+/**
+ * Every permission the catalogue actually defines, plus the wildcard.
+ *
+ * Derived from `PERMISSION_GROUPS` rather than restated — a hand-written copy
+ * would be the second list of ~85 strings to keep in sync, and the first one
+ * to drift (Root Cause #61).
+ */
+const KNOWN_PERMISSIONS = new Set([
+    "*",
+    ...Object.values(PERMISSION_GROUPS).flat(),
+]);
+/** Whether a string is a permission this system can actually grant. */
+export function isKnownPermission(value) {
+    return KNOWN_PERMISSIONS.has(value);
+}
+const permissionSchema = z.string().refine(isKnownPermission, {
+    message: "Not a permission this system defines — it would grant nothing.",
+});
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export const customRoleFormSchema = z.object({
+    name: annotate(z.string().min(1, "A role needs a name.").max(80, "Keep the name under 80 characters."), {
+        section: "basics", sectionLabel: "Role", sectionRequired: true,
+        quick: true, order: 1, row: "pair",
+    }),
+    slug: annotate(z
+        .string()
+        .min(1, "A slug is required.")
+        .max(80)
+        .regex(/^[a-z0-9-]+$/, "Use lowercase letters, numbers and hyphens only."), {
+        section: "basics", quick: true, order: 2, row: "pair",
+        tier: "t1-derive",
+        help: "Generated from the name when left blank.",
+    }),
+    description: annotate(z.string().max(300, "Keep the description under 300 characters.").optional(), {
+        section: "basics", order: 3, row: "full",
+    }),
+    scope: annotate(z.enum(["global", "store"]), {
+        section: "basics", quick: true, order: 4, row: "pair",
+    }),
+    permissions: annotate(z.array(permissionSchema), {
+        section: "permissions", sectionLabel: "Permissions",
+        order: 1, row: "full", kind: "list",
+    }),
+    inheritsFrom: annotate(z.string().max(80).optional(), {
+        section: "permissions", order: 2, row: "pair",
+        help: "Another role whose permissions this one starts from.",
+    }),
+    isActive: annotate(z.boolean(), {
+        section: "visibility", sectionLabel: "Visibility", order: 1, row: "quarter",
+    }),
+});
+/** Create contract. `createdBy` is absent — the route sets it from the session. */
+export const customRoleCreateSchema = customRoleFormSchema;
+/**
+ * Update contract — partial and `.strict()`, so an unknown key is a 400 rather
+ * than a silent write into a document the permission system reads.
+ */
+export const customRoleUpdateSchema = z
+    .object({
+    name: z.string().min(1).max(80).optional(),
+    description: z.string().max(300).optional(),
+    scope: z.enum(["global", "store"]).optional(),
+    permissions: z.array(permissionSchema).optional(),
+    inheritsFrom: z.string().max(80).optional(),
+    isActive: z.boolean().optional(),
+    // `slug` is deliberately absent: it is the role's stable identifier and
+    // renaming it would orphan every user already assigned the role. Same
+    // create-only rule every other slug in this codebase follows.
+})
+    .strict();

package/dist/features/store-extensions/schemas/firestore.d.ts

@@ -100,7 +100,25 @@ export interface StoreCategoryDocument extends BaseDocument {
 export declare const STORE_CATEGORIES_COLLECTION: "storeCategories";
 export declare const STORE_CATEGORY_INDEXED_FIELDS: readonly ["storeId", "slug", "isActive", "displayOrder", "createdAt"];
 export declare const DEFAULT_STORE_CATEGORY_DATA: Partial<StoreCategoryDocument>;
-export type ListingTemplateType = "standard" | "auction" | "pre-order" | "prize-draw" | "bundle" | "classified" | "digital-code" | "live";
+/**
+ * The listing kinds a seller can save a template for.
+ *
+ * A runtime array, with the type DERIVED from it — so the Zod enum in
+ * `listing-template-form.ts` reads this rather than restating it. That was the
+ * eleventh hand-written copy of the listing-type union in this codebase, and
+ * the tenth had already drifted (Root Cause #61).
+ *
+ * Two deliberate differences from `ListingType`:
+ *  - `bundle` is KEPT even though SB-UNI-D stopped it being a listingType. A
+ *    seeded template stores it (`store-extensions-seed-data.ts:202`), so
+ *    dropping it here would make that template fail validation and become
+ *    unsaveable — the same defect as the blog `slug` regex no stored row
+ *    satisfied.
+ *  - `art` and `stickers` are ADDED. They are real listing types a seller can
+ *    create, and their absence meant a template could never be saved for them.
+ */
+export declare const LISTING_TEMPLATE_TYPES: readonly ["standard", "auction", "pre-order", "prize-draw", "bundle", "classified", "digital-code", "live", "art", "stickers"];
+export type ListingTemplateType = (typeof LISTING_TEMPLATE_TYPES)[number];
 export interface ListingTemplateDocument extends BaseDocument {
     storeId: string;
     ownerId: string;
@@ -151,6 +169,8 @@ export interface ReportDocument extends BaseDocument {
     resolution?: string;
     resolvedAt?: Date;
 }
+export declare const REPORT_ENTITY_TYPES: [ReportEntityType, ...ReportEntityType[]];
+export declare const REPORT_REASONS: [ReportReason, ...ReportReason[]];
 export declare const REPORTS_COLLECTION: "reports";
 export declare const REPORT_INDEXED_FIELDS: readonly ["entityType", "entityId", "reporterId", "reason", "status", "createdAt"];
 export declare const DEFAULT_REPORT_DATA: Partial<ReportDocument>;

package/dist/features/store-extensions/schemas/firestore.js

@@ -63,6 +63,36 @@ export const DEFAULT_STORE_CATEGORY_DATA = {
     displayOrder: 0,
     productIds: [],
 };
+// 6. ───── listingTemplates ───────────────────────────────────────────────
+/**
+ * The listing kinds a seller can save a template for.
+ *
+ * A runtime array, with the type DERIVED from it — so the Zod enum in
+ * `listing-template-form.ts` reads this rather than restating it. That was the
+ * eleventh hand-written copy of the listing-type union in this codebase, and
+ * the tenth had already drifted (Root Cause #61).
+ *
+ * Two deliberate differences from `ListingType`:
+ *  - `bundle` is KEPT even though SB-UNI-D stopped it being a listingType. A
+ *    seeded template stores it (`store-extensions-seed-data.ts:202`), so
+ *    dropping it here would make that template fail validation and become
+ *    unsaveable — the same defect as the blog `slug` regex no stored row
+ *    satisfied.
+ *  - `art` and `stickers` are ADDED. They are real listing types a seller can
+ *    create, and their absence meant a template could never be saved for them.
+ */
+export const LISTING_TEMPLATE_TYPES = [
+    "standard",
+    "auction",
+    "pre-order",
+    "prize-draw",
+    "bundle",
+    "classified",
+    "digital-code",
+    "live",
+    "art",
+    "stickers",
+];
 export const LISTING_TEMPLATES_COLLECTION = "listingTemplates";
 export const LISTING_TEMPLATE_INDEXED_FIELDS = [
     "storeId",
@@ -92,6 +122,36 @@ export const MODERATION_QUEUE_INDEXED_FIELDS = [
 export const DEFAULT_MODERATION_QUEUE_DATA = {
     status: "pending",
 };
+/*
+ * Runtime companions for the three report unions above.
+ *
+ * Keyed `Record<Union, true>` rather than written as arrays, because that is
+ * the only shape where BOTH mistakes are compile errors: a member added to the
+ * union and forgotten here, AND a value here that is not a real member. An
+ * array literal catches neither, which is how ten independent enumerations of
+ * `ListingType` came to disagree (Recurrent Root Cause #61).
+ */
+const REPORT_ENTITY_TYPE_MAP = {
+    product: true,
+    store: true,
+    review: true,
+    event: true,
+    user: true,
+    blog: true,
+    comment: true,
+};
+export const REPORT_ENTITY_TYPES = Object.keys(REPORT_ENTITY_TYPE_MAP);
+const REPORT_REASON_MAP = {
+    scam: true,
+    counterfeit: true,
+    prohibited: true,
+    inappropriate: true,
+    harassment: true,
+    spam: true,
+    "ip-violation": true,
+    other: true,
+};
+export const REPORT_REASONS = Object.keys(REPORT_REASON_MAP);
 export const REPORTS_COLLECTION = "reports";
 export const REPORT_INDEXED_FIELDS = [
     "entityType",

package/dist/features/store-extensions/schemas/google-config-form.d.ts

@@ -0,0 +1,53 @@
+import { z } from "zod";
+import type { StoreGoogleConfigDocument } from "./firestore";
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export declare const storeGoogleConfigUpdateSchema: z.ZodObject<{
+    isConnected: z.ZodOptional<z.ZodBoolean>;
+    placeId: z.ZodOptional<z.ZodString>;
+    businessName: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    placeId?: string | undefined;
+    isConnected?: boolean | undefined;
+    businessName?: string | undefined;
+}, {
+    placeId?: string | undefined;
+    isConnected?: boolean | undefined;
+    businessName?: string | undefined;
+}>;
+export type StoreGoogleConfigFormValues = z.infer<typeof storeGoogleConfigUpdateSchema>;
+/**
+ * What the seller's own settings page may see.
+ *
+ * An ALLOW-list, built as a new object — never the document with keys deleted.
+ * A deny-list publishes every field nobody thought to remove, including ones
+ * the interface does not declare, which is exactly how a decrypted API token
+ * and an unmasked ad-credentials blob reached anonymous callers before
+ * (Recurrent Root Cause #70).
+ *
+ * PUBLIC (to the store owner):
+ *   storeId, isConnected — what the page renders
+ *   placeId, businessName — what the page lets them edit
+ *   averageRating, totalReviews, lastSyncedAt — sync output they need to see
+ *   id, createdAt, updatedAt — ordinary record metadata
+ *
+ * PRIVATE:
+ *   oauthRefreshToken — a long-lived Google credential with no reader and no
+ *     writer anywhere in either tree. It was being sent to the browser on every
+ *     load simply because the route returned the document whole.
+ */
+export declare function toSellerGoogleConfig(doc: StoreGoogleConfigDocument): {
+    id: string;
+    storeId: string;
+    isConnected: boolean;
+    placeId: string | undefined;
+    businessName: string | undefined;
+    averageRating: number | undefined;
+    totalReviews: number | undefined;
+    lastSyncedAt: Date | undefined;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type SellerGoogleConfig = ReturnType<typeof toSellerGoogleConfig>;

package/dist/features/store-extensions/schemas/google-config-form.js

@@ -0,0 +1,105 @@
+/*
+ * WHY: `PUT /api/store/google-reviews` spread the raw request body into
+ *      Firestore on both the create and the update branch, with `storeId`
+ *      pinned and nothing else checked.
+ *
+ * ## 🛑 The field that makes this worth doing carefully
+ *
+ * `StoreGoogleConfigDocument` declares `oauthRefreshToken` — a long-lived
+ * Google credential. The raw spread meant a request body could set it, and the
+ * sibling `GET` returns the document WHOLE, so it was also being sent to the
+ * browser on every load of the seller's Google Reviews settings page.
+ *
+ * It is scoped to the caller's own store, so this is not a cross-tenant leak.
+ * It is still a secret in a page payload for no reason: a repo-wide grep finds
+ * **no reader and no writer** for that field anywhere — nothing sets it and
+ * nothing consumes it. Per the public-projection rule, a field nobody can name
+ * a reader for is private by default.
+ *
+ * So this schema deliberately does NOT declare it, and the route projects it
+ * out of the response. The field itself is left on the document rather than
+ * deleted — removing a schema field is a data-model change and deserves its
+ * own decision, not a drive-by inside a validation fix.
+ *
+ * ## `averageRating` / `totalReviews` / `lastSyncedAt` are absent too
+ *
+ * Those are SYNC OUTPUT — what Google last told us. A seller typing their own
+ * review count in is not configuration, it is fabricating the number the
+ * storefront displays.
+ *
+ * EXPORTS:
+ *   storeGoogleConfigUpdateSchema, toSellerGoogleConfig,
+ *   type StoreGoogleConfigFormValues, type SellerGoogleConfig
+ *
+ * @tag domain:store-extensions,google-reviews
+ * @tag layer:schema
+ * @tag pattern:none
+ * @tag access:isomorphic
+ * @tag consumers:/api/store/google-reviews
+ * @tag sideEffects:none
+ */
+import { z } from "zod";
+import { annotate } from "../../shell/field-ui-meta";
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export const storeGoogleConfigUpdateSchema = z
+    .object({
+    isConnected: annotate(z.boolean().optional(), {
+        section: "google",
+        sectionLabel: "Google Reviews",
+        sectionRequired: true,
+        quick: true,
+        order: 1,
+        row: "quarter",
+    }),
+    placeId: annotate(z.string().max(256).optional(), {
+        section: "google",
+        quick: true,
+        order: 2,
+        row: "pair",
+        help: "The Google Place ID for this store's listing.",
+    }),
+    businessName: annotate(z.string().max(200).optional(), {
+        section: "google",
+        quick: true,
+        order: 3,
+        row: "pair",
+    }),
+})
+    .strict();
+/**
+ * What the seller's own settings page may see.
+ *
+ * An ALLOW-list, built as a new object — never the document with keys deleted.
+ * A deny-list publishes every field nobody thought to remove, including ones
+ * the interface does not declare, which is exactly how a decrypted API token
+ * and an unmasked ad-credentials blob reached anonymous callers before
+ * (Recurrent Root Cause #70).
+ *
+ * PUBLIC (to the store owner):
+ *   storeId, isConnected — what the page renders
+ *   placeId, businessName — what the page lets them edit
+ *   averageRating, totalReviews, lastSyncedAt — sync output they need to see
+ *   id, createdAt, updatedAt — ordinary record metadata
+ *
+ * PRIVATE:
+ *   oauthRefreshToken — a long-lived Google credential with no reader and no
+ *     writer anywhere in either tree. It was being sent to the browser on every
+ *     load simply because the route returned the document whole.
+ */
+export function toSellerGoogleConfig(doc) {
+    return {
+        id: doc.id,
+        storeId: doc.storeId,
+        isConnected: doc.isConnected,
+        placeId: doc.placeId,
+        businessName: doc.businessName,
+        averageRating: doc.averageRating,
+        totalReviews: doc.totalReviews,
+        lastSyncedAt: doc.lastSyncedAt,
+        createdAt: doc.createdAt,
+        updatedAt: doc.updatedAt,
+    };
+}

package/dist/features/store-extensions/schemas/item-request-create-form.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export declare const itemRequestCreateSchema: z.ZodObject<{
+    title: z.ZodString;
+    description: z.ZodString;
+    category: z.ZodOptional<z.ZodString>;
+    brand: z.ZodOptional<z.ZodString>;
+    maxBudget: z.ZodOptional<z.ZodNumber>;
+    imageUrls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    title: string;
+    description: string;
+    brand?: string | undefined;
+    category?: string | undefined;
+    imageUrls?: string[] | undefined;
+    maxBudget?: number | undefined;
+}, {
+    title: string;
+    description: string;
+    brand?: string | undefined;
+    category?: string | undefined;
+    imageUrls?: string[] | undefined;
+    maxBudget?: number | undefined;
+}>;
+export type ItemRequestCreateValues = z.infer<typeof itemRequestCreateSchema>;

package/dist/features/store-extensions/schemas/item-request-create-form.js

@@ -0,0 +1,80 @@
+/*
+ * WHY: `POST /api/item-requests` spread the raw body into Firestore, and this
+ *      one is READ BY THE PUBLIC — `GET /api/item-requests` is `auth: false`
+ *      and returns the open list to anyone.
+ *
+ *          const body = await parseJsonBody<FirestoreDocument>(request);
+ *          await itemRequestsRepository.create({ ...body, opUserId, ..., replies: [], replyCount: 0 });
+ *
+ *      So an unvalidated write here is an unvalidated PUBLISH. A request could
+ *      be created with no title and no description, and a caller could set
+ *      `approvedAt` / `approvedBy` — the fields that record a moderator having
+ *      cleared it.
+ *
+ *      `status`, `replies` and `replyCount` were pinned server-side, so the
+ *      approval GATE itself held; what a caller could forge was the RECORD of
+ *      approval, which is the part a human reads when deciding whether it has
+ *      already been looked at.
+ *
+ * WHAT: The create contract — title and description required, budget bounded,
+ *       and nothing a moderator owns.
+ *
+ * ## `maxBudget` is coerced and bounded
+ *
+ * It arrives from a number input as a string. Uncoerced it was written to
+ * Firestore as a string, and a later numeric comparison against it would sort
+ * lexically — the quiet half of the same class as the `resolvedAt` string that
+ * was being written into a Date field on the reports route.
+ *
+ * EXPORTS: itemRequestCreateSchema, type ItemRequestCreateValues
+ *
+ * @tag domain:store-extensions,item-requests
+ * @tag layer:schema
+ * @tag pattern:none
+ * @tag access:isomorphic
+ * @tag consumers:/api/item-requests
+ * @tag sideEffects:none
+ */
+import { z } from "zod";
+import { annotate } from "../../shell/field-ui-meta";
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export const itemRequestCreateSchema = z
+    .object({
+    title: annotate(z
+        .string()
+        .min(3, "Give the request a title of at least 3 characters.")
+        .max(200, "Keep the title under 200 characters."), {
+        section: "basics",
+        sectionLabel: "What are you looking for?",
+        sectionRequired: true,
+        quick: true,
+        order: 1,
+        row: "full",
+    }),
+    description: annotate(z
+        .string()
+        .min(10, "Describe what you're after in at least 10 characters.")
+        .max(5000, "Keep the description under 5000 characters."), { section: "basics", quick: true, order: 2, row: "full", kind: "textarea" }),
+    category: annotate(z.string().max(120).optional(), {
+        section: "basics",
+        order: 3,
+        row: "pair",
+    }),
+    brand: annotate(z.string().max(120).optional(), {
+        section: "basics",
+        order: 4,
+        row: "pair",
+    }),
+    // Coerced — see the header. Bounded so a typo cannot record a budget that
+    // reads as real money.
+    maxBudget: annotate(z.coerce
+        .number()
+        .min(0, "A budget cannot be negative.")
+        .max(10000000, "That budget looks like a typo.")
+        .optional(), { section: "basics", order: 5, row: "pair", kind: "number" }),
+    imageUrls: annotate(z.array(z.string().url("Each image must be a URL.")).max(10).optional(), { section: "media", sectionLabel: "Photos", order: 1, row: "full", kind: "media" }),
+})
+    .strict();

package/dist/features/store-extensions/schemas/listing-template-form.d.ts

@@ -0,0 +1,78 @@
+import { z } from "zod";
+/**
+ * 🛑 `annotate()` must be the OUTERMOST call on each field — it keys a WeakMap
+ * by schema instance and every zod wrapper returns a new one.
+ */
+export declare const listingTemplateFormSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    listingType: z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "bundle", "classified", "digital-code", "live", "art", "stickers"]>;
+    defaults: z.ZodRecord<z.ZodString, z.ZodType<import("../../..").FirestoreValue, z.ZodTypeDef, import("../../..").FirestoreValue>>;
+    isShared: z.ZodBoolean;
+    isActive: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live" | "bundle";
+    isActive: boolean;
+    isShared: boolean;
+    defaults: Record<string, import("../../..").FirestoreValue>;
+    description?: string | undefined;
+}, {
+    name: string;
+    listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live" | "bundle";
+    isActive: boolean;
+    isShared: boolean;
+    defaults: Record<string, import("../../..").FirestoreValue>;
+    description?: string | undefined;
+}>;
+export type ListingTemplateFormValues = z.infer<typeof listingTemplateFormSchema>;
+/**
+ * Create contract. `storeId`/`ownerId` are deliberately absent: the route sets
+ * both from the session, so a caller cannot create a template inside someone
+ * else's store by adding a field to the body.
+ */
+export declare const listingTemplateCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    listingType: z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "bundle", "classified", "digital-code", "live", "art", "stickers"]>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+    isShared: z.ZodOptional<z.ZodBoolean>;
+    defaults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("../../..").FirestoreValue, z.ZodTypeDef, import("../../..").FirestoreValue>>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live" | "bundle";
+    description?: string | undefined;
+    isActive?: boolean | undefined;
+    isShared?: boolean | undefined;
+    defaults?: Record<string, import("../../..").FirestoreValue> | undefined;
+}, {
+    name: string;
+    listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live" | "bundle";
+    description?: string | undefined;
+    isActive?: boolean | undefined;
+    isShared?: boolean | undefined;
+    defaults?: Record<string, import("../../..").FirestoreValue> | undefined;
+}>;
+/** Update contract — every field optional, and the same ownership fields absent. */
+export declare const listingTemplateUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    listingType: z.ZodOptional<z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "bundle", "classified", "digital-code", "live", "art", "stickers"]>>;
+    defaults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("../../..").FirestoreValue, z.ZodTypeDef, import("../../..").FirestoreValue>>>;
+    isShared: z.ZodOptional<z.ZodBoolean>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    name?: string | undefined;
+    description?: string | undefined;
+    listingType?: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live" | "bundle" | undefined;
+    isActive?: boolean | undefined;
+    isShared?: boolean | undefined;
+    defaults?: Record<string, import("../../..").FirestoreValue> | undefined;
+}, {
+    name?: string | undefined;
+    description?: string | undefined;
+    listingType?: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live" | "bundle" | undefined;
+    isActive?: boolean | undefined;
+    isShared?: boolean | undefined;
+    defaults?: Record<string, import("../../..").FirestoreValue> | undefined;
+}>;