@mohasinac/appkit 4.30.19 → 4.31.0

package/dist/_internal/server/features/products/data.js

@@ -24,11 +24,21 @@ import { REVIEWS_DETAIL_PAGE_SIZE } from "../../../shared/features/reviews/confi
 // ---------------------------------------------------------------------------
 /** Fetch a single product by slug or id, deduped per request. */
 export const getProductForDetail = cache(async (slugOrId) => {
-    const product = (await productRepository.findByIdOrSlug(slugOrId)) ?? null;
-    // Fire-and-forget viewCount increment — must not affect response time
-    if (product)
-        void productRepository.incrementViewCount(product.id);
-    return product;
+    /*
+     * 🛑 No view-count write here — deleted 2026-08-31.
+     *
+     * This fired `incrementViewCount` on every render, which was two defects at
+     * once. It is a Firestore WRITE on the render path (Rule #6), and product
+     * and category detail were being counted TWICE by two systems that key
+     * differently: this one on the document by id, and the client
+     * `PageViewTracker` into `pageViews` by slug. They can never reconcile —
+     * they disagree on bots, on prefetch, and on JS-disabled clients — so the
+     * two numbers were guaranteed to drift and neither could be trusted.
+     *
+     * `pageViews` is the single counter now. `viewCount` on the document stays
+     * for historical rows; nothing increments it.
+     */
+    return (await productRepository.findByIdOrSlug(slugOrId)) ?? null;
 });
 /** Fetch the first page of approved reviews for a product, deduped per request. */
 export const getReviewsForProduct = cache(async (productId, limit = REVIEWS_DETAIL_PAGE_SIZE) => {

package/dist/_internal/server/features/products/list-public.d.ts

@@ -157,6 +157,15 @@ export interface PublicProductListOptions {
      */
     now?: Date;
 }
+/** Every field path a per-type facet can filter on. Read by the wiring audit. */
+export declare const TYPE_FACET_FIELD_PATHS: string[];
+/**
+ * The ONE sort a per-type facet query is fetched at, so each facet needs one
+ * composite index instead of one per offered sort. The user's chosen sort is
+ * applied in memory afterwards. Changing this string invalidates all 8 indexes
+ * — the audit derives its expected shapes from it, so it will say so.
+ */
+export declare const FACET_FETCH_SORT: string;
 /**
  * Read the shared public-listing query params. SSR views hand in Next's
  * `searchParams` record; the API route hands in `url.searchParams`. Both produce

package/dist/_internal/server/features/products/list-public.js

@@ -104,6 +104,16 @@ function num(raw) {
  * declared these keys in their FILTER_KEYS (so they counted toward the
  * filter badge) and rendered the controls, but never put them on the wire.
  */
+/*
+ * Facet key → the Firestore field path it filters.
+ *
+ * 🛑 Every value here MUST have an entry in the products `SIEVE_FIELDS`, and
+ * a `(status, listingType, <field>, createdAt DESC)` composite index. Miss the
+ * first and sievejs drops the clause silently; miss the second and the query
+ * throws FAILED_PRECONDITION, which `runQuery` logs and turns into an empty
+ * grid. Both read to the user as "this filter matches nothing".
+ * `scripts/audit-type-facet-wiring.mjs` checks all three ends.
+ */
 const TYPE_FACET_FIELD = {
     [TABLE_KEYS.CITY]: "classified.meetupArea.city",
     [TABLE_KEYS.NEGOTIABLE]: "classified.negotiable",
@@ -112,7 +122,17 @@ const TYPE_FACET_FIELD = {
     [TABLE_KEYS.SPECIES]: "liveItem.species",
     [TABLE_KEYS.LIVE_SEX]: "liveItem.sex",
     [TABLE_KEYS.JURISDICTION]: "liveItem.jurisdictionAllowed",
+    [TABLE_KEYS.LIVE_TRANSPORT_METHOD]: "liveItem.transport.method",
 };
+/** Every field path a per-type facet can filter on. Read by the wiring audit. */
+export const TYPE_FACET_FIELD_PATHS = Object.values(TYPE_FACET_FIELD);
+/**
+ * The ONE sort a per-type facet query is fetched at, so each facet needs one
+ * composite index instead of one per offered sort. The user's chosen sort is
+ * applied in memory afterwards. Changing this string invalidates all 8 indexes
+ * — the audit derives its expected shapes from it, so it will say so.
+ */
+export const FACET_FETCH_SORT = sortBy(PRODUCT_FIELDS.CREATED_AT);
 /** Read every known per-type facet present in the params. */
 function readTypeFacets(get) {
     const out = {};
@@ -287,12 +307,21 @@ function buildFirestoreSafeFilters(input) {
     // Search now travels as `query.search` (see PublicProductQuery) and becomes an
     // `array-contains` on `searchTxt` inside the repository, which is the only
     // shape Firestore can serve for token matching.
-    // `array-contains-any` isn't supported by the Sieve Firebase adapter, so only a
-    // single feature can be pushed down; multi-select falls through to the caller.
+    /*
+     * `array-contains-any` isn't supported by the Sieve Firebase adapter, so one
+     * value pushes down as `array-contains` and several cannot.
+     *
+     * "Falls through to the caller" was the old comment here, and no caller ever
+     * caught it — a two-tag selection filtered NOTHING while the chips stayed lit
+     * and the badge counted them. The multi-value case now runs as a per-row
+     * predicate over the bounded window (see `hasArrayMultiSelect` below), which
+     * is the same trade the per-type facets make. A partial pushdown is not an
+     * option: `array-contains` on the first value would return a strict SUBSET
+     * for OR semantics, quietly hiding rows that match only the second.
+     */
     if (input.features?.length === 1) {
         parts.push(sieveFilter(PRODUCT_FIELDS.FEATURES, SIEVE_OP.CONTAINS, input.features[0]));
     }
-    // `tags` is an array field, so the same one-value limit applies.
     if (input.tags?.length === 1) {
         parts.push(sieveFilter(PRODUCT_FIELDS.TAGS, SIEVE_OP.CONTAINS, input.tags[0]));
     }
@@ -504,7 +533,29 @@ export async function listPublicProducts(input, opts) {
     // ── Path A ("all") and the dense "available" case share one query. The only
     //    difference is whether a per-row predicate runs afterwards.
     const filters = sieveAnd(safeFilters, ...dateClauses);
-    const inMemory = wantAvailable || (hasDateRange && !canPushDate);
+    /*
+     * A per-type facet IS pushed down — it is a sparse equality, which is the
+     * side of the availability asymmetry that belongs in the query. What is not
+     * tractable is the SORT cross-product: `(status, listingType, <facet>,
+     * <sort>)` over 8 facets and the 7 publicly-offered sorts is 56 composite
+     * indexes, and every sort added later costs 8 more.
+     *
+     * So the facet goes down and the SORT comes back up: fetch a bounded window
+     * ordered by the one sort we index for every facet, then re-order in memory.
+     * 56 indexes become 8, a new sort costs none, and `truncated` keeps the
+     * pager honest — the same trade `fetchSorts` already makes for a date range
+     * that cannot ride its own sort.
+     *
+     * Before this, none of the 8 had a public index at all: every facet on
+     * /classified, /live and /digital-codes threw FAILED_PRECONDITION, which
+     * `runQuery` logs and returns as null, i.e. an empty grid. The store-scoped
+     * copies were indexed for 3 of the 7 sorts, so those pages worked until
+     * someone chose "Name: A–Z".
+     */
+    const hasTypeFacet = Object.keys(input.typeFacets ?? {}).length > 0;
+    /** Multi-value `tags`/`features` — no `array-contains-any`, so per-row. */
+    const hasArrayMultiSelect = (input.tags?.length ?? 0) > 1 || (input.features?.length ?? 0) > 1;
+    const inMemory = wantAvailable || hasTypeFacet || hasArrayMultiSelect || (hasDateRange && !canPushDate);
     // When a date range stays in memory, fetch in whichever direction front-loads
     // the rows that will PASS it: `dateFrom` (">=", still live) wants the most
     // future dates first; `dateTo` ("<=", ends by) wants the earliest first.
@@ -514,7 +565,9 @@ export async function listPublicProducts(input, opts) {
         ? input.dateFrom
             ? sortBy(dateField, "DESC")
             : sortBy(dateField, "ASC")
-        : sorts;
+        : hasTypeFacet
+            ? FACET_FETCH_SORT
+            : sorts;
     const result = await runQuery(executor, {
         filters,
         sorts: fetchSorts,
@@ -534,9 +587,24 @@ export async function listPublicProducts(input, opts) {
     let truncated = false;
     if (inMemory) {
         truncated = items.length >= PUBLIC_PRODUCT_MAX_PAGE_SIZE;
+        /** OR semantics, matching the single-value `array-contains` pushdown. */
+        const matchesAny = (raw, wanted) => {
+            if (!Array.isArray(raw))
+                return false;
+            return wanted.some((w) => raw.includes(w));
+        };
         const filtered = items.filter((item) => {
             if (wantAvailable && !isListingRowAvailable(item, now))
                 return false;
+            if (hasArrayMultiSelect) {
+                if ((input.tags?.length ?? 0) > 1 && !matchesAny(item[PRODUCT_FIELDS.TAGS], input.tags)) {
+                    return false;
+                }
+                if ((input.features?.length ?? 0) > 1 &&
+                    !matchesAny(item[PRODUCT_FIELDS.FEATURES], input.features)) {
+                    return false;
+                }
+            }
             if (hasDateRange && !canPushDate && dateField) {
                 const raw = item[dateField];
                 if (!raw)
@@ -638,10 +706,30 @@ export async function listStoreProducts(storeId, listingTypes, searchParams = {}
         storeId,
     });
 }
+/**
+ * Comparable primitive for one row value.
+ *
+ * 🛑 The `Date` branch is load-bearing. Without it a Date falls through to
+ * `String(value)` — `"Wed Aug 30 2026 …"` — and a lexical compare of those
+ * orders by WEEKDAY NAME. Every in-memory date sort was wrong: the "Sold &
+ * Ended" tab ordered by `createdAt`/`auctionEndDate`, and now every per-type
+ * facet under "Oldest First". A Firestore Timestamp arrives here as a Date via
+ * `mapDoc`, so the ISO-string case is only for a row that has already been
+ * serialised; both are handled.
+ */
+function sortKey(value) {
+    if (value == null)
+        return null;
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === "number" || typeof value === "string")
+        return value;
+    return String(value);
+}
 function sortRows(rows, field, desc) {
     return [...rows].sort((a, b) => {
-        const av = a[field];
-        const bv = b[field];
+        const av = sortKey(a[field]);
+        const bv = sortKey(b[field]);
         if (av == null && bv == null)
             return 0;
         if (av == null)

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -13,7 +13,7 @@
  * `legalPages`), which meant everything else was public by default and
  * edge-cached for 300s. That shipped `gst.gstin` + the registered legal name
  * and address, all 25 `commissions.*` fields, `laborRate.hourlyRate`,
- * `emi.surchargeSellerSharePercent`, `featureFlags.adminCheckoutBypass`, and —
+ * `emi.surchargeSellerSharePercent`, `payment.adminCheckoutBypass`, and —
  * because they weren't even declared on the interface —
  * `adSettings.providerCredentials` (which the ADMIN ads endpoint bothers to
  * mask) plus every draft/paused/scheduled ad in `adSettings.inventory`.
@@ -37,7 +37,7 @@ import type { PublicSiteSettings } from "../../../shared/features/site-settings/
  * was traced to a call site; anything without one belongs in the private list,
  * because an unused public field is pure attack surface.
  */
-export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "featureFlags", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark"];
+export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark"];
 /** Everything else, with the reason it stays server-side. */
 export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "disabledRoutes", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults"];
 export interface ToPublicSiteSettingsOptions {

package/dist/_internal/server/features/site-settings/adapters.js

@@ -6,7 +6,7 @@
 export const PUBLIC_SITE_SETTINGS_FIELDS = [
     "contact", // user/orders/[id]/payment — contact.whatsappNumber (narrowed: no address/upiVpa)
     "payment", // CheckoutRouteClient — payment.otpCheckoutThreshold (narrowed)
-    "featureFlags", // useListingTypeFlags — featureFlags.listingTypes (narrowed: no adminCheckoutBypass)
+    "listings", // useListingTypeFlags — narrowed to listings.listingTypes; categoryTypes has no client reader
     "notificationChannels", // NotificationPreferencesPanel + CheckoutRouteClient (whatsapp.otpEnabled)
     "announcementBar", // AdminSiteView; also the homepage banner
     "navConfig", // NavbarWithSettings, DashboardLayoutClient
@@ -51,8 +51,11 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
 export function toPublicSiteSettings(doc, opts) {
     return {
         // Explicit sub-literals, never spreads. These two are the ones that carry
-        // real weight: `contact` drops `address` + `upiVpa`, and `featureFlags`
-        // drops `adminCheckoutBypass` — the flag that turns off payment and OTP.
+        // real weight: `contact` drops `address` + `upiVpa`, and `payment` emits
+        // ONLY `otpCheckoutThreshold` — it also holds `adminCheckoutBypass` (the
+        // setting that skips OTP and payment capture) and `smsVerification`, both
+        // of which must never reach a client. `listings` is narrowed too:
+        // `categoryTypes` has no client reader.
         contact: {
             email: doc.contact?.email ?? "",
             phone: doc.contact?.phone ?? "",
@@ -61,8 +64,8 @@ export function toPublicSiteSettings(doc, opts) {
         payment: {
             otpCheckoutThreshold: doc.payment?.otpCheckoutThreshold,
         },
-        featureFlags: {
-            listingTypes: doc.featureFlags?.listingTypes,
+        listings: {
+            listingTypes: doc.listings?.listingTypes,
         },
         notificationChannels: doc.notificationChannels,
         announcementBar: doc.announcementBar,

package/dist/_internal/server/features/tester/visibility.d.ts

@@ -2,8 +2,9 @@ export interface TestDataFlagged {
     isTestData?: boolean;
 }
 export interface ViewerLike {
-    isTester?: boolean;
     role?: string | null;
+    /** @deprecated Legacy flag; read via isTesterUser during the migration window. */
+    isTester?: boolean;
 }
 /** True when the viewer is allowed to see isTestData:true documents. */
 export declare function canViewTestData(viewer: ViewerLike | null | undefined): boolean;

package/dist/_internal/server/features/tester/visibility.js

@@ -7,10 +7,10 @@
  * (a `!=` clause) would silently exclude every pre-existing document that doesn't have
  * the field set at all, which is worse than the problem it solves.
  */
-import { isAdminUser } from "../../../../features/auth/role-predicates";
+import { isAdminUser, isTesterUser } from "../../../../features/auth/role-predicates";
 /** True when the viewer is allowed to see isTestData:true documents. */
 export function canViewTestData(viewer) {
-    return Boolean(viewer?.isTester) || isAdminUser(viewer);
+    return isTesterUser(viewer) || isAdminUser(viewer);
 }
 /** Strips isTestData:true items from a list unless the viewer is a tester or admin. */
 export function filterTestDataForViewer(items, viewer) {

package/dist/_internal/server/functions/scheduled.d.ts

@@ -7,6 +7,8 @@ export declare const couponExpiry: import("./types").ScheduledFunctionDefinition
 export declare const offerExpiry: import("./types").ScheduledFunctionDefinition;
 export declare const productStatsSync: import("./types").ScheduledFunctionDefinition;
 export declare const revenueRollup: import("./types").ScheduledFunctionDefinition;
+export declare const pageViewRollup: import("./types").ScheduledFunctionDefinition;
+export declare const pageViewPrune: import("./types").ScheduledFunctionDefinition;
 export declare const dailyStatusDigest: import("./types").ScheduledFunctionDefinition;
 export declare const dailyDataCleanup: import("./types").ScheduledFunctionDefinition;
 export declare const countersReconcile: import("./types").ScheduledFunctionDefinition;
@@ -25,4 +27,4 @@ export declare const prizeDrawExpiryReveal: import("./types").ScheduledFunctionD
 export declare const bundleStockSync: import("./types").ScheduledFunctionDefinition;
 export declare const emiInstallmentReminder: import("./types").ScheduledFunctionDefinition;
 export declare const catalogueImageStalenessReminder: import("./types").ScheduledFunctionDefinition;
-export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];
+export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];

package/dist/_internal/server/functions/scheduled.js

@@ -1,6 +1,6 @@
 // Scheduled function definitions (Cloud Scheduler triggers).
 // Cron syntax accepts both Firebase shorthand and standard cron expressions.
-import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, payoutBatchHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testerSandboxCleanupHandler, testerSandboxRefreshHandler, } from "../jobs/handlers";
+import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, payoutBatchHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testerSandboxCleanupHandler, testerSandboxRefreshHandler, } from "../jobs/handlers";
 import { defineFunction } from "./define";
 const REGION = "asia-south1";
 const EVERY_5_MIN = "every 5 minutes";
@@ -67,6 +67,30 @@ export const revenueRollup = defineFunction({
     handler: revenueRollupHandler,
     options: { region: REGION, timeoutSeconds: 300, memory: "256MiB", maxInstances: 1 },
 });
+/*
+ * The rollup runs BEFORE the prune, and both before the retention boundary
+ * moves. `pageViews` had neither until 2026-08-31: it wrote one document per
+ * entity per day, forever, and was the only unbounded writer among 27 scheduled
+ * functions.
+ *
+ * Order matters — the prune deletes the day-buckets the rollup reads, so a
+ * prune that ran first would delete views nobody had counted yet. 01:45 then
+ * 02:15, either side of nothing else.
+ */
+export const pageViewRollup = defineFunction({
+    name: "pageViewRollup",
+    description: "Fold new page-view day-buckets into analytics/pageViewRollup so the prune below cannot delete uncounted views (daily 01:45 UTC).",
+    trigger: { kind: "schedule", cron: "45 1 * * *", timeZone: "UTC" },
+    handler: pageViewRollupHandler,
+    options: { region: REGION, timeoutSeconds: 300, memory: "256MiB", maxInstances: 1 },
+});
+export const pageViewPrune = defineFunction({
+    name: "pageViewPrune",
+    description: "Delete page-view day-buckets past the 90-day retention window; lifetime totals survive in the rollup (daily 02:15 UTC).",
+    trigger: { kind: "schedule", cron: "15 2 * * *", timeZone: "UTC" },
+    handler: pageViewPruneHandler,
+    options: { region: REGION, timeoutSeconds: 300, memory: "256MiB", maxInstances: 1 },
+});
 export const dailyStatusDigest = defineFunction({
     name: "dailyStatusDigest",
     description: "Email the previous 24h order summary + platform status to the team every morning at 10:00 IST.",
@@ -203,6 +227,8 @@ export const SCHEDULED_FUNCTIONS = [
     offerExpiry,
     productStatsSync,
     revenueRollup,
+    pageViewRollup,
+    pageViewPrune,
     dailyStatusDigest,
     dailyDataCleanup,
     countersReconcile,

package/dist/_internal/server/jobs/core/hardBanCascade.js

@@ -79,6 +79,10 @@ export async function runHardBanCascade(input, ctx) {
     // ban to take effect. Left unguarded so a failure here marks the whole job
     // failed (matches the original route's behavior of surfacing a 500).
     await userRepository.update(uid, {
+        // BOTH fields: every server-side guard reads `disabled`, and until
+        // 2026-08-29 no ban path wrote it — so a hard ban blocked a fresh login and
+        // left every existing session fully authenticated.
+        disabled: true,
         isDisabled: true,
         hardBanReason: reason,
         hardBannedAt: new Date(),

package/dist/_internal/server/jobs/core/index.d.ts

@@ -12,6 +12,8 @@ export { runCouponExpiry } from "./couponExpiry";
 export { runOfferExpiry } from "./offerExpiry";
 export { runCartPrune } from "./cartPrune";
 export { runNotificationPrune } from "./notificationPrune";
+export { runPageViewRollup } from "./pageViewRollup";
+export { runPageViewPrune, PAGE_VIEW_TTL_DAYS } from "./pageViewPrune";
 export { runDailyDataCleanup } from "./dailyDataCleanup";
 export { runCleanupRtdbEvents } from "./cleanupRtdbEvents";
 export { runMediaTmpCleanup } from "./mediaTmpCleanup";

package/dist/_internal/server/jobs/core/index.js

@@ -13,6 +13,8 @@ export { runCouponExpiry } from "./couponExpiry";
 export { runOfferExpiry } from "./offerExpiry";
 export { runCartPrune } from "./cartPrune";
 export { runNotificationPrune } from "./notificationPrune";
+export { runPageViewRollup } from "./pageViewRollup";
+export { runPageViewPrune, PAGE_VIEW_TTL_DAYS } from "./pageViewPrune";
 export { runDailyDataCleanup } from "./dailyDataCleanup";
 export { runCleanupRtdbEvents } from "./cleanupRtdbEvents";
 export { runMediaTmpCleanup } from "./mediaTmpCleanup";

package/dist/_internal/server/jobs/core/pageViewPrune.d.ts

@@ -0,0 +1,10 @@
+import type { JobContext } from "../runtime/types";
+/**
+ * 90 days.
+ *
+ * Long enough for a quarter-over-quarter comparison in the admin report, which
+ * is the longest range that screen offers, and short enough that the collection
+ * reaches a steady state instead of growing forever.
+ */
+export declare const PAGE_VIEW_TTL_DAYS = 90;
+export declare function runPageViewPrune(ctx: JobContext): Promise<void>;

package/dist/_internal/server/jobs/core/pageViewPrune.js

@@ -0,0 +1,44 @@
+/*
+ * WHY: `pageViews` writes one document per entity per day and had NO prune.
+ *      Twenty-seven scheduled functions existed — `cartPrune`,
+ *      `notificationPrune`, `draftPrune`, `dailyDataCleanup` — and not one of
+ *      them touched this collection, so it was the only unbounded writer in the
+ *      system. Its size was capped by nothing except how many distinct pages
+ *      the catalogue had, multiplied by how long the site had been running.
+ *
+ * WHAT: Delete day-buckets older than the retention window. Shaped after
+ *       `notificationPrune`, which is the smallest correct prune in the repo.
+ *
+ * The daily rows are the raw material; `pageViewRollup` keeps the long-run
+ * totals, so deleting the buckets loses granularity past the window and not the
+ * history itself.
+ *
+ * EXPORTS: PAGE_VIEW_TTL_DAYS, runPageViewPrune
+ *
+ * @tag domain:analytics
+ * @tag layer:job
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:pageViewPrune scheduled function
+ * @tag sideEffects:deletes pageViews documents
+ */
+import { pageViewsRepository } from "../../../../features/analytics/repository/page-views.repository";
+import { batchDelete } from "../handlers/_helpers";
+/**
+ * 90 days.
+ *
+ * Long enough for a quarter-over-quarter comparison in the admin report, which
+ * is the longest range that screen offers, and short enough that the collection
+ * reaches a steady state instead of growing forever.
+ */
+export const PAGE_VIEW_TTL_DAYS = 90;
+export async function runPageViewPrune(ctx) {
+    ctx.logger.info(`Pruning page-view buckets older than ${PAGE_VIEW_TTL_DAYS} days`);
+    const refs = await pageViewsRepository.getOlderThanRefs(PAGE_VIEW_TTL_DAYS);
+    if (refs.length === 0) {
+        ctx.logger.info("No stale page-view buckets found");
+        return;
+    }
+    const deleted = await batchDelete(ctx, refs);
+    ctx.logger.info("Page-view prune complete", { deleted });
+}

package/dist/_internal/server/jobs/core/pageViewRollup.d.ts

@@ -0,0 +1,2 @@
+import type { JobContext } from "../runtime/types";
+export declare function runPageViewRollup(ctx: JobContext): Promise<void>;

package/dist/_internal/server/jobs/core/pageViewRollup.js

@@ -0,0 +1,87 @@
+/*
+ * WHY: `pageViewPrune` deletes day-buckets past the retention window. Without a
+ *      rollup that would also delete the only record that those views ever
+ *      happened — the admin's lifetime total would silently walk backwards as
+ *      the prune caught up with it.
+ *
+ * WHAT: Fold each new day-bucket into a singleton total before the prune can
+ *       reach it. Modelled on `revenueRollup`: scan → one small doc → the API
+ *       route reads a single document instead of the collection.
+ *
+ * EXPORTS: runPageViewRollup
+ *
+ * @tag domain:analytics
+ * @tag layer:job
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:pageViewRollup scheduled function
+ * @tag sideEffects:writes analytics/pageViewRollup
+ */
+import { pageViewsRepository } from "../../../../features/analytics/repository/page-views.repository";
+import { pageViewRollupRepository } from "../../../../features/admin/repository/analytics-rollup.repository";
+/** The earliest date this rollup will fold in on a cold start. */
+const EPOCH_DATE = "2020-01-01";
+function dayKey(offsetDays) {
+    const d = new Date();
+    d.setUTCDate(d.getUTCDate() + offsetDays);
+    return d.toISOString().slice(0, 10);
+}
+export async function runPageViewRollup(ctx) {
+    const existing = await pageViewRollupRepository.get();
+    /*
+     * 🛑 `throughDate` is what makes this job re-runnable.
+     *
+     * The rollup ACCUMULATES rather than recomputing — the day-buckets it has
+     * already folded in get deleted by `pageViewPrune`, so a recompute-from-
+     * scratch would produce a total that shrinks every time the prune runs. So it
+     * must only ever read buckets it has not seen, and `throughDate` is the
+     * boundary. Running this twice in one day is a no-op; running it after a
+     * missed day still catches up.
+     */
+    const from = existing?.throughDate
+        ? dayKey(0) === existing.throughDate
+            ? null // already folded in today — nothing new to read
+            : nextDay(existing.throughDate)
+        : EPOCH_DATE;
+    if (from === null) {
+        ctx.logger.info("pageViewRollup: already current", {
+            throughDate: existing?.throughDate ?? "",
+        });
+        return;
+    }
+    // Yesterday, not today: today's buckets are still being written to, and
+    // folding a partial day in would make it uncountable tomorrow.
+    const through = dayKey(-1);
+    if (from > through) {
+        ctx.logger.info("pageViewRollup: nothing to fold", { from, through });
+        return;
+    }
+    /*
+     * No `.catch(() => [])`. An empty range is a legitimate zero, so a swallowed
+     * query failure would write a confident "no views" the dashboard cannot tell
+     * from the real thing — and unlike `revenueRollup`, this one ACCUMULATES, so
+     * a bad read would also advance `throughDate` past days it never counted and
+     * lose them permanently. Let it throw; the runner records the failure and the
+     * stale-but-correct singleton stays.
+     */
+    const buckets = await pageViewsRepository.listInRange(from, through);
+    const byEntityType = { ...(existing?.byEntityType ?? {}) };
+    let totalViews = existing?.totalViews ?? 0;
+    for (const b of buckets) {
+        const n = Number(b.count) || 0;
+        totalViews += n;
+        byEntityType[b.entityType] = (byEntityType[b.entityType] ?? 0) + n;
+    }
+    await pageViewRollupRepository.set({ totalViews, byEntityType, throughDate: through });
+    ctx.logger.info("pageViewRollup: complete", {
+        from,
+        through,
+        bucketsFolded: buckets.length,
+        totalViews,
+    });
+}
+function nextDay(dateKey) {
+    const d = new Date(`${dateKey}T00:00:00.000Z`);
+    d.setUTCDate(d.getUTCDate() + 1);
+    return d.toISOString().slice(0, 10);
+}

package/dist/_internal/server/jobs/handlers/index.d.ts

@@ -28,6 +28,8 @@ export { hardBanReinstatementHandler } from "./hardBanReinstatement";
 export { paymentReviewAutoApproveHandler } from "./paymentReviewAutoApprove";
 export { productStatsSyncHandler } from "./productStatsSync";
 export { revenueRollupHandler } from "./revenueRollup";
+export { pageViewRollupHandler } from "./pageViewRollup";
+export { pageViewPruneHandler } from "./pageViewPrune";
 export { dailyStatusDigestHandler } from "./dailyStatusDigest";
 export { positionsReconcileHandler } from "./positionsReconcile";
 export { payoutBatchHandler } from "./payoutBatch";

package/dist/_internal/server/jobs/handlers/index.js

@@ -28,6 +28,8 @@ export { hardBanReinstatementHandler } from "./hardBanReinstatement";
 export { paymentReviewAutoApproveHandler } from "./paymentReviewAutoApprove";
 export { productStatsSyncHandler } from "./productStatsSync";
 export { revenueRollupHandler } from "./revenueRollup";
+export { pageViewRollupHandler } from "./pageViewRollup";
+export { pageViewPruneHandler } from "./pageViewPrune";
 export { dailyStatusDigestHandler } from "./dailyStatusDigest";
 export { positionsReconcileHandler } from "./positionsReconcile";
 export { payoutBatchHandler } from "./payoutBatch";

package/dist/_internal/server/jobs/handlers/pageViewPrune.d.ts

@@ -0,0 +1,2 @@
+import type { ScheduleHandler } from "../runtime/types";
+export declare const pageViewPruneHandler: ScheduleHandler;

package/dist/_internal/server/jobs/handlers/pageViewPrune.js

@@ -0,0 +1,2 @@
+import { runPageViewPrune } from "../core/pageViewPrune";
+export const pageViewPruneHandler = runPageViewPrune;

package/dist/_internal/server/jobs/handlers/pageViewRollup.d.ts

@@ -0,0 +1,2 @@
+import type { ScheduleHandler } from "../runtime/types";
+export declare const pageViewRollupHandler: ScheduleHandler;

package/dist/_internal/server/jobs/handlers/pageViewRollup.js

@@ -0,0 +1,2 @@
+import { runPageViewRollup } from "../core/pageViewRollup";
+export const pageViewRollupHandler = runPageViewRollup;

package/dist/_internal/shared/actions/action-registry.d.ts

@@ -29,7 +29,7 @@ import type { IconKey } from "../../../ui/icons/icon-registry";
 /** What KIND of action — drives default UI affordance (link vs button vs danger). */
 export type ActionKind = "primary" | "secondary" | "danger" | "ghost" | "link" | "chip";
 /** Resource bucket — keyed top-level in the ACTIONS tree. */
-export type ActionResource = "PRODUCT" | "AUCTION" | "PRE_ORDER" | "PRIZE_DRAW" | "CLASSIFIED" | "DIGITAL_CODE" | "LIVE" | "BUNDLE" | "GROUP" | "CATEGORY" | "BRAND" | "SUBLISTING" | "STORE" | "BLOG" | "EVENT" | "SHIPMENT" | "CATALOGUE" | "USER" | "SELLER" | "ADMIN" | "CART" | "CHECKOUT" | "NAV" | "MEDIA" | "SUPPORT" | "LOTTERY" | "TESTER";
+export type ActionResource = "PRODUCT" | "AUCTION" | "PRE_ORDER" | "PRIZE_DRAW" | "DIGITAL_CODE" | "BUNDLE" | "GROUP" | "CATEGORY" | "BRAND" | "SUBLISTING" | "STORE" | "BLOG" | "EVENT" | "SHIPMENT" | "CATALOGUE" | "USER" | "SELLER" | "ADMIN" | "CART" | "CHECKOUT" | "NAV" | "MEDIA" | "SUPPORT" | "LOTTERY" | "TESTER";
 /** Confirmation modal config — when set, <Button action={...}> opens
  *  a confirm dialog before firing the actual handler. */
 export interface ActionConfirmation {