@mohasinac/appkit 4.30.19 → 4.31.0

package/dist/features/products/repository/products.repository.d.ts

@@ -281,7 +281,7 @@ export declare class ProductRepository extends BaseRepository<ProductDocument> {
             canFilter: boolean;
             canSort: boolean;
         };
-        "classified.meetupArea": {
+        "classified.meetupArea.city": {
             canFilter: boolean;
             canSort: boolean;
         };
@@ -317,6 +317,10 @@ export declare class ProductRepository extends BaseRepository<ProductDocument> {
             canFilter: boolean;
             canSort: boolean;
         };
+        "liveItem.transport.method": {
+            canFilter: boolean;
+            canSort: boolean;
+        };
     };
     /**
      * Virtual filter aliases — callers can pass `f=listingType==auction` for

package/dist/features/products/repository/products.repository.js

@@ -594,7 +594,22 @@ ProductRepository.SIEVE_FIELDS = {
     // silently skipped. The toggle did nothing at all until 2026-08-21.
     shippingPaidBy: { canFilter: true, canSort: false },
     searchTxt: { canFilter: true, canSort: false },
-    "classified.meetupArea": { canFilter: true, canSort: false },
+    /*
+     * `classified.meetupArea.city`, NOT `classified.meetupArea`.
+     *
+     * `meetupArea` is an OBJECT (`{city, locality, pincode}`), so an equality
+     * on the parent could never match anything a user typed. The city facet
+     * emits `classified.meetupArea.city` (TYPE_FACET_FIELD), `findField` is an
+     * exact-key lookup, and `throwExceptions:false` drops what it cannot
+     * resolve — so the /classified city filter rendered, counted toward the
+     * badge, and changed nothing. Both halves of Root Cause #62 in one entry:
+     * an orphan key that matches no field, beside a real field with no entry.
+     *
+     * The schema's own docstring already named the right path ("drives the
+     * (listingType, classified.meetupArea.city, createdAt) index"), and the
+     * store-scoped index has always been on `.city`.
+     */
+    "classified.meetupArea.city": { canFilter: true, canSort: false },
     "classified.acceptsShipping": { canFilter: true, canSort: false },
     "classified.negotiable": { canFilter: true, canSort: false },
     "digitalCode.codeDeliveryMethod": { canFilter: true, canSort: false },
@@ -603,6 +618,13 @@ ProductRepository.SIEVE_FIELDS = {
     "liveItem.sex": { canFilter: true, canSort: false },
     "liveItem.jurisdictionAllowed": { canFilter: true, canSort: false },
     "liveItem.cites": { canFilter: true, canSort: false },
+    /*
+     * The live-items transport facet. `StoreLiveItemsListing` has listed
+     * `liveTransportMethod` in its FILTER_KEYS — so ticking it inflated the
+     * active-filter badge — while the key had no TYPE_FACET_FIELD mapping and
+     * this field had no entry, so it never reached Firestore from either end.
+     */
+    "liveItem.transport.method": { canFilter: true, canSort: false },
 };
 /**
  * Virtual filter aliases — callers can pass `f=listingType==auction` for

package/dist/features/products/schemas/firestore.d.ts

@@ -64,11 +64,15 @@ export interface ProductClassifiedMeta {
         locality?: string;
         pincode?: string;
     };
-    /** How the buyer reaches the seller (chat | phone | both). */
-    contactMethod?: "chat" | "phone" | "both";
     /** Seller offers shipping in addition to meetup. */
     acceptsShipping?: boolean;
-    /** Price is negotiable — UI hints "₹X (negotiable)". */
+    /**
+     * Price is negotiable — UI hints "₹X (negotiable)".
+     *
+     * Its sibling `allowOffers` is what actually gates the offer FLOOR on this
+     * type: unset means the buyer may still request to buy, but only at the
+     * asking price.
+     */
     negotiable?: boolean;
 }
 export interface ProductDigitalCodeMeta {

package/dist/features/products/schemas/product-features.validators.js

@@ -110,6 +110,9 @@ export const productFeatureFormSchema = z.object({
     storeId: annotate(productFeatureAdminCreateSchema.shape.storeId, {
         section: "scope", order: 4, row: "pair",
         help: "Only used when scope is \"store\".",
+        // Hidden for a global feature, and paired with visibleValues at the
+        // payload so a store id chosen and then abandoned is not saved.
+        when: (v) => v.scope === "store",
     }),
     isActive: annotate(productFeatureAdminCreateSchema.shape.isActive, {
         section: "visibility", sectionLabel: "Visibility", order: 1, row: "quarter",

package/dist/features/promotions/components/CouponCard.js

@@ -5,7 +5,6 @@ import { useState } from "react";
 import { Pencil, Trash2, ToggleLeft, ToggleRight } from "lucide-react";
 import { Badge, BaseListingCard, Button, ConfirmDeleteModal, Div, IconButton, Row, Span, Stack, Text } from "../../../ui";
 import { useLongPress } from "../../../react/hooks/useLongPress";
-import { useFeatureFlags } from "../../../client/api/useFeatureFlags";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints";
 const CLS_TOGGLE_ON = "h-4 w-4 text-success dark:text-success";
 const CLS_DELETE_BTN = "p-[var(--appkit-space-1-5)] text-[var(--appkit-color-text-muted)] hover:bg-error-surface dark:hover:bg-error-surface hover:text-error dark:hover:text-error transition-colors disabled:opacity-50";
@@ -102,12 +101,14 @@ export function CouponCard({ coupon, labels: labelsProp, onCopy, className = "",
     const discountLabel = formatDiscount(n, labels);
     const hasAdminActions = Boolean(onEdit || onToggleActive || onDelete);
     // Show Claim by default on public surfaces; hide automatically when this
-    // card is being rendered with admin/CRUD actions wired. Also hidden
-    // whenever the COUPONS feature is disabled — the claim endpoint 404s in
-    // that state, and previously that 404 was silently swallowed (see
-    // handleClaim below) instead of the CTA simply not being offered.
-    const { flags: featureFlags } = useFeatureFlags();
-    const showClaim = (hideClaim === undefined ? !hasAdminActions : !hideClaim) && featureFlags.COUPONS === true;
+    // card is being rendered with admin/CRUD actions wired.
+    //
+    // This also consulted the `COUPONS` env feature flag, because the claim
+    // endpoint 404'd when it was off. Both flag systems were deleted 2026-08-29 —
+    // the flag was `true` in every environment, and the endpoint now answers
+    // unconditionally under its own auth — so the fetch that backed this check
+    // is gone too, along with a network request on every coupon card render.
+    const showClaim = hideClaim === undefined ? !hasAdminActions : !hideClaim;
     const handleCopy = () => {
         if (!n.code)
             return;

package/dist/features/scams/schemas/firestore.d.ts

@@ -138,6 +138,20 @@ export interface ScammerDocument extends BaseDocument {
      * Admin records keep the uid; public page shows "Anonymous".
      */
     reportedByAnon: boolean;
+    /**
+     * The reporter ticked "I confirm this report is truthful and accurate".
+     *
+     * 🛑 The form has always REQUIRED this — a `z.literal(true)` in
+     * `scamReportFormSchema` and a hard gate on submit — and never sent it. On a
+     * surface where a false report gets someone listed publicly and has account
+     * consequences for the reporter, the attestation is precisely the record you
+     * want to keep, and it existed only as a client-side gate that any direct
+     * call to the route bypassed entirely.
+     *
+     * Optional on the document so the rows written before 2026-08-29 stay valid;
+     * absent means "not recorded", which is honest, and is NOT the same as false.
+     */
+    reporterAttested?: boolean;
     status: ScammerStatus;
     /** UID of admin/employee who verified or rejected. */
     verifiedBy?: string;
@@ -342,7 +356,7 @@ export declare const SCAMMER_INDEXED_FIELDS: readonly ["status", "scamType", "sc
 export declare const DEFAULT_SCAMMER_DATA: Partial<ScammerDocument>;
 /** Max pending submissions per user — prevents spam flooding. */
 export declare const MAX_PENDING_SCAMMER_REPORTS_PER_USER = 5;
-export type ScammerCreateInput = Pick<ScammerDocument, "displayNames" | "phones" | "upiIds" | "emails" | "socialMedia" | "scamType" | "scamPlatform" | "description" | "amountLost" | "itemInvolved" | "evidence" | "reportedBy" | "reportedByAnon">;
+export type ScammerCreateInput = Pick<ScammerDocument, "displayNames" | "phones" | "upiIds" | "emails" | "socialMedia" | "scamType" | "scamPlatform" | "description" | "amountLost" | "itemInvolved" | "evidence" | "reportedBy" | "reportedByAnon" | "reporterAttested">;
 export type ScammerAdminUpdateInput = Partial<Pick<ScammerDocument, "status" | "verifiedBy" | "verifiedAt" | "verificationNote" | "relatedScammerIds" | "mergedFromIds" | "tags" | "displayNames" | "phones" | "upiIds" | "emails" | "socialMedia" | "isContested">>;
 export declare const SCAMMER_FIELDS: {
     readonly ID: "id";

package/dist/features/scams/schemas/report-form.d.ts

@@ -5,7 +5,7 @@ export declare const scamReportFormSchema: z.ZodEffects<z.ZodObject<{
     upiIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     emails: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     scamType: z.ZodString;
-    scamPlatform: z.ZodOptional<z.ZodString>;
+    scamPlatform: z.ZodString;
     amountLost: z.ZodOptional<z.ZodNumber>;
     itemInvolved: z.ZodOptional<z.ZodString>;
     description: z.ZodString;
@@ -15,9 +15,9 @@ export declare const scamReportFormSchema: z.ZodEffects<z.ZodObject<{
     displayName: string;
     description: string;
     scamType: string;
+    scamPlatform: string;
     agreed: true;
     reportedByAnon?: boolean | undefined;
-    scamPlatform?: string | undefined;
     amountLost?: number | undefined;
     itemInvolved?: string | undefined;
     phones?: string[] | undefined;
@@ -27,9 +27,9 @@ export declare const scamReportFormSchema: z.ZodEffects<z.ZodObject<{
     displayName: string;
     description: string;
     scamType: string;
+    scamPlatform: string;
     agreed: true;
     reportedByAnon?: boolean | undefined;
-    scamPlatform?: string | undefined;
     amountLost?: number | undefined;
     itemInvolved?: string | undefined;
     phones?: string[] | undefined;
@@ -39,9 +39,9 @@ export declare const scamReportFormSchema: z.ZodEffects<z.ZodObject<{
     displayName: string;
     description: string;
     scamType: string;
+    scamPlatform: string;
     agreed: true;
     reportedByAnon?: boolean | undefined;
-    scamPlatform?: string | undefined;
     amountLost?: number | undefined;
     itemInvolved?: string | undefined;
     phones?: string[] | undefined;
@@ -51,9 +51,9 @@ export declare const scamReportFormSchema: z.ZodEffects<z.ZodObject<{
     displayName: string;
     description: string;
     scamType: string;
+    scamPlatform: string;
     agreed: true;
     reportedByAnon?: boolean | undefined;
-    scamPlatform?: string | undefined;
     amountLost?: number | undefined;
     itemInvolved?: string | undefined;
     phones?: string[] | undefined;

package/dist/features/scams/schemas/report-form.js

@@ -45,8 +45,17 @@ export const scamReportFormSchema = z
     scamType: annotate(z.string().trim().min(1, "Choose what kind of scam this was."), {
         section: "what", sectionLabel: "What happened", sectionRequired: true, quick: true, order: 1, row: "pair",
     }),
-    scamPlatform: annotate(z.string().trim().max(120).optional(), {
-        section: "what", order: 2, row: "pair",
+    /*
+     * Required, matching `POST /api/scams/reports` (`z.string().min(1)`).
+     *
+     * It was `.optional()` here, so a report with no platform passed every
+     * client check and came back a 400. The page papered over it with a
+     * hand-written `if (!form.scamType || !form.scamPlatform)` guard — which is
+     * the same drift as the address postal rule: two rules for one field, and
+     * the looser one is the client's.
+     */
+    scamPlatform: annotate(z.string().trim().min(1, "Choose where this happened.").max(120), {
+        section: "what", order: 2, row: "pair", kind: "select",
     }),
     /*
      * Coerced and bounded. It arrives from a text input and is rendered on the
@@ -62,10 +71,16 @@ export const scamReportFormSchema = z
     itemInvolved: annotate(z.string().trim().max(200).optional(), {
         section: "what", order: 4, row: "pair",
     }),
+    /*
+     * 100, matching the route. It was 30 here, so a 31-character description
+     * satisfied every client check and came back a 400 — and the page's own
+     * hand-written guard used 100, which is the number that was actually
+     * enforced. Two rules, three values.
+     */
     description: annotate(z
         .string()
         .trim()
-        .min(30, "Describe what happened in at least 30 characters — this is the evidence.")
+        .min(100, "Describe what happened in at least 100 characters — this is the evidence.")
         .max(5000, "Keep the description under 5000 characters."), { section: "what", order: 5, row: "full", kind: "textarea" }),
     reportedByAnon: annotate(z.boolean().optional(), {
         section: "declare", sectionLabel: "Declaration", order: 1, row: "quarter",

package/dist/features/search/action-index/derive.d.ts

@@ -0,0 +1,49 @@
+import type { NavPortal, SidebarNavGroup } from "../../../_internal/shared/features/layout/types";
+import type { ActionIndexEntry } from "./types";
+/** A nav group set, with the portal it belongs to. */
+export interface PortalNavGroups {
+    portal: NavPortal;
+    /** Human name for the breadcrumb — "Admin", "Seller", "Account". */
+    portalLabel: string;
+    groups: readonly SidebarNavGroup[];
+}
+/**
+ * Every sidebar entry, as an index entry.
+ *
+ * `sectionPath` is the breadcrumb a result row shows — "Admin › System › Site
+ * Settings" — and it is the reason the group title is worth carrying: two
+ * portals both have "Orders", and without the path a result list shows the
+ * same word twice with no way to tell which one you want.
+ */
+export declare function deriveNavEntries(sources: readonly PortalNavGroups[]): ActionIndexEntry[];
+/** One quick action, as the registry stores it. */
+export interface QuickActionSource {
+    id: string;
+    label: string;
+    description?: string;
+    keywords?: string[];
+    href?: string;
+    routeKey?: string;
+    iconKey?: string;
+    requiredPermission?: string;
+    requiredRole?: string;
+    requiresAuth?: boolean;
+}
+/**
+ * Quick actions, as index entries.
+ *
+ * 🛑 An action with no resolvable href is DROPPED, not indexed with a blank
+ * one. `DASHBOARD_QUICK_ACTION_META`'s `routeKey` is dead — every page
+ * re-declares its own `*_QUICK_ACTION_HREFS` map instead — so a registry entry
+ * may genuinely have nowhere to go. Indexing it anyway produces a search
+ * result that does nothing when clicked, which is worse than not finding it.
+ */
+export declare function deriveQuickActionEntries(actions: readonly QuickActionSource[], portal: NavPortal, portalLabel: string, hrefFor: (action: QuickActionSource) => string | undefined): ActionIndexEntry[];
+/**
+ * Assemble the static base.
+ *
+ * Deduplicated by id, first writer winning, so a quick action that shares an
+ * id with a nav entry does not produce two rows for one destination — and the
+ * nav entry, being passed first, is the one that survives.
+ */
+export declare function buildActionIndexBase(...groups: readonly ActionIndexEntry[][]): ActionIndexEntry[];

package/dist/features/search/action-index/derive.js

@@ -0,0 +1,121 @@
+/*
+ * WHY: An index of "everything a user can do" is worth having exactly once and
+ *      worth maintaining never. Hand-writing 260 entries beside the nav arrays
+ *      they duplicate produces the drift this plan has spent every wave
+ *      undoing — ten hand-written enumerations of one union (Root Cause #61),
+ *      three option arrays that had each silently lost a value (W3c), fifteen
+ *      postal rules (W5).
+ * WHAT: Derive the static base FROM the nav groups and the quick-action
+ *       registry, so an entry cannot exist without its nav item and cannot
+ *       go stale when one is renamed.
+ *
+ * W6 is what makes this possible: every nav item now carries a `description`,
+ * `keywords` and a derived `id`. Before that there was nothing to derive
+ * from — which is the actual reason `Search.tsx`'s finished `quickLinks` path
+ * was never wired to anything.
+ *
+ * EXPORTS: deriveNavEntries, deriveQuickActionEntries, buildActionIndexBase
+ *
+ * @tag domain:search
+ * @tag layer:shared
+ * @tag pattern:none
+ * @tag access:isomorphic
+ * @tag consumers:action-index route,CommandPalette
+ * @tag sideEffects:none
+ */
+/**
+ * Every sidebar entry, as an index entry.
+ *
+ * `sectionPath` is the breadcrumb a result row shows — "Admin › System › Site
+ * Settings" — and it is the reason the group title is worth carrying: two
+ * portals both have "Orders", and without the path a result list shows the
+ * same word twice with no way to tell which one you want.
+ */
+export function deriveNavEntries(sources) {
+    const entries = [];
+    for (const { portal, portalLabel, groups } of sources) {
+        for (const group of groups) {
+            for (const item of group.items) {
+                entries.push({
+                    /*
+                     * The nav item's own derived id, reused rather than re-derived. It
+                     * is already `nav-{portal}-{slug}`, so prefixing the kind keeps the
+                     * index's `{portal}:{kind}:{slug}` convention without inventing a
+                     * second identity for the same thing.
+                     */
+                    id: item.id ?? `${portal}:nav:${item.href}`,
+                    kind: "nav",
+                    portal,
+                    label: item.label,
+                    description: item.description,
+                    keywords: item.keywords,
+                    href: item.href,
+                    sectionPath: `${portalLabel} › ${group.title}`,
+                    ...(item.requiredPermission
+                        ? { requiredPermission: item.requiredPermission }
+                        : {}),
+                });
+            }
+        }
+    }
+    return entries;
+}
+/**
+ * Quick actions, as index entries.
+ *
+ * 🛑 An action with no resolvable href is DROPPED, not indexed with a blank
+ * one. `DASHBOARD_QUICK_ACTION_META`'s `routeKey` is dead — every page
+ * re-declares its own `*_QUICK_ACTION_HREFS` map instead — so a registry entry
+ * may genuinely have nowhere to go. Indexing it anyway produces a search
+ * result that does nothing when clicked, which is worse than not finding it.
+ */
+export function deriveQuickActionEntries(actions, portal, portalLabel, hrefFor) {
+    const entries = [];
+    for (const action of actions) {
+        const href = action.href ?? hrefFor(action);
+        if (!href)
+            continue;
+        entries.push({
+            id: `${portal}:action:${action.id}`,
+            kind: "action",
+            portal,
+            label: action.label,
+            description: action.description,
+            keywords: action.keywords,
+            href,
+            sectionPath: `${portalLabel} › Quick actions`,
+            ...(action.iconKey ? { iconName: action.iconKey } : {}),
+            ...(action.requiredPermission
+                ? { requiredPermission: action.requiredPermission }
+                : {}),
+            ...(action.requiredRole ? { requiredRole: action.requiredRole } : {}),
+            /*
+             * A quick action is a shortcut to something already reachable from the
+             * nav, so it ranks BELOW the nav entry for the same screen. Searching
+             * "orders" should land on Orders, not on "Create an order".
+             */
+            weight: -10,
+        });
+    }
+    return entries;
+}
+/**
+ * Assemble the static base.
+ *
+ * Deduplicated by id, first writer winning, so a quick action that shares an
+ * id with a nav entry does not produce two rows for one destination — and the
+ * nav entry, being passed first, is the one that survives.
+ */
+export function buildActionIndexBase(...groups) {
+    const seen = new Set();
+    const out = [];
+    for (const list of groups) {
+        for (const entry of list) {
+            if (seen.has(entry.id))
+                continue;
+            seen.add(entry.id);
+            out.push(entry);
+        }
+    }
+    return out;
+}

package/dist/features/search/action-index/repository.d.ts

@@ -0,0 +1,42 @@
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type ActionIndexControl, type ActionIndexEntry, type ActionIndexOverride } from "./types";
+/** The stored document. `id` is always `ACTION_INDEX_DOC_ID`. */
+export interface ActionIndexDocument extends ActionIndexControl {
+    id: string;
+    updatedAt?: Date;
+    updatedBy?: string;
+}
+export declare class ActionIndexRepository extends BaseRepository<ActionIndexDocument> {
+    constructor();
+    /**
+     * The control document, or an empty one.
+     *
+     * 🛑 Returns EMPTY rather than null, and that is load-bearing:
+     * `mergeActionIndex` treats a missing control as "no overrides", so a site
+     * that has never opened the admin screen still gets the full static base.
+     * A null here would make every caller write the same `?? EMPTY` and one of
+     * them would forget, blanking the search.
+     */
+    getControl(): Promise<ActionIndexControl>;
+    /**
+     * Overwrite one entry's override.
+     *
+     * Merged into the stored map rather than replacing it, because the admin
+     * screen edits one row at a time and a whole-map write would drop every
+     * other override made in a different browser tab — the lost-update shape
+     * that `mergeLotteryConfig` exists to prevent on the lottery side.
+     */
+    setOverride(entryId: string, override: ActionIndexOverride, actorUid: string): Promise<void>;
+    /** Drop an override, returning the entry to whatever the code says. */
+    clearOverride(entryId: string, actorUid: string): Promise<void>;
+    /**
+     * Replace the admin-authored entries.
+     *
+     * Whole-array, unlike `setOverride`: the custom list is edited as a list in
+     * one screen, and its ids are chosen by the admin rather than derived, so
+     * there is no stable key to merge on.
+     */
+    setCustomEntries(custom: ActionIndexEntry[], actorUid: string): Promise<void>;
+    private write;
+}
+export declare const actionIndexRepository: ActionIndexRepository;

package/dist/features/search/action-index/repository.js

@@ -0,0 +1,100 @@
+/*
+ * WHY: D7 — the action index is a Firestore CONTROL PLANE over a static TS
+ *      base, not a second copy of it. An admin can hide, rename, re-describe,
+ *      retag, reorder and author entries; the code keeps `kind`, `href` and
+ *      every permission field for built-ins, because renaming a toggle is
+ *      content and repointing a built-in route is routing.
+ * WHAT: The `actionIndex/global` singleton and its repository.
+ *
+ * ## Deliberately NOT folded into `siteSettings`
+ *
+ * That document is read by an unauthenticated, edge-cached route
+ * (`GET /api/site-settings`, `s-maxage=600`). This one is projected by role and
+ * must never be served from a shared cache — putting them together is one
+ * refactor away from publishing the admin site map, which is exactly the class
+ * of defect Root Cause #70 records.
+ *
+ * ## One document, ~85 KB
+ *
+ * ~380 entries at full size, comfortably inside Firestore's 1 MB ceiling, and
+ * one read rather than a query. The read path caches for 5 minutes and is
+ * fetched **once per session per portal** — a read per keystroke would exhaust
+ * the 50k/day free tier at roughly thirty sessions, and typeahead matching has
+ * to be sub-16ms anyway, which a network hop is not.
+ *
+ * EXPORTS: ActionIndexRepository, actionIndexRepository
+ *
+ * @tag domain:search
+ * @tag layer:repository
+ * @tag pattern:singleton-doc
+ * @tag access:server
+ * @tag consumers:/api/admin/action-index,/api/action-index
+ * @tag sideEffects:firestore
+ */
+import { BaseRepository } from "../../../providers/db-firebase";
+import { ACTION_INDEX_COLLECTION, ACTION_INDEX_DOC_ID, } from "./types";
+/** What an empty control plane looks like — no overrides, no custom entries. */
+const EMPTY_CONTROL = { entries: {}, custom: [] };
+export class ActionIndexRepository extends BaseRepository {
+    constructor() {
+        super(ACTION_INDEX_COLLECTION);
+    }
+    /**
+     * The control document, or an empty one.
+     *
+     * 🛑 Returns EMPTY rather than null, and that is load-bearing:
+     * `mergeActionIndex` treats a missing control as "no overrides", so a site
+     * that has never opened the admin screen still gets the full static base.
+     * A null here would make every caller write the same `?? EMPTY` and one of
+     * them would forget, blanking the search.
+     */
+    async getControl() {
+        const doc = await this.findById(ACTION_INDEX_DOC_ID);
+        if (!doc)
+            return EMPTY_CONTROL;
+        return { entries: doc.entries ?? {}, custom: doc.custom ?? [] };
+    }
+    /**
+     * Overwrite one entry's override.
+     *
+     * Merged into the stored map rather than replacing it, because the admin
+     * screen edits one row at a time and a whole-map write would drop every
+     * other override made in a different browser tab — the lost-update shape
+     * that `mergeLotteryConfig` exists to prevent on the lottery side.
+     */
+    async setOverride(entryId, override, actorUid) {
+        const control = await this.getControl();
+        const next = {
+            ...control,
+            entries: { ...control.entries, [entryId]: override },
+        };
+        await this.write(next, actorUid);
+    }
+    /** Drop an override, returning the entry to whatever the code says. */
+    async clearOverride(entryId, actorUid) {
+        const control = await this.getControl();
+        const entries = { ...control.entries };
+        delete entries[entryId];
+        await this.write({ ...control, entries }, actorUid);
+    }
+    /**
+     * Replace the admin-authored entries.
+     *
+     * Whole-array, unlike `setOverride`: the custom list is edited as a list in
+     * one screen, and its ids are chosen by the admin rather than derived, so
+     * there is no stable key to merge on.
+     */
+    async setCustomEntries(custom, actorUid) {
+        const control = await this.getControl();
+        await this.write({ ...control, custom }, actorUid);
+    }
+    async write(control, actorUid) {
+        const payload = { ...control, updatedAt: new Date(), updatedBy: actorUid };
+        const existing = await this.findById(ACTION_INDEX_DOC_ID);
+        if (existing)
+            await this.update(ACTION_INDEX_DOC_ID, payload);
+        else
+            await this.createWithId(ACTION_INDEX_DOC_ID, payload);
+    }
+}
+export const actionIndexRepository = new ActionIndexRepository();

package/dist/features/search/action-index/settings-entries.d.ts

@@ -0,0 +1,41 @@
+import type { SiteSettingsTabId } from "../../admin/constants/site-settings-tabs";
+import type { ActionIndexEntry } from "./types";
+/** One control on the site-settings screen. */
+export interface SettingsIndexSource {
+    /** Slug — becomes both the entry id and the `#anchor`. */
+    slug: string;
+    label: string;
+    description: string;
+    keywords: string[];
+    tab: SiteSettingsTabId;
+    /** `toggle` for an on/off switch, `setting` for a value. */
+    kind: "toggle" | "setting";
+    /**
+     * Whether the view renders `id="setting-{slug}"` for this control.
+     *
+     * 🛑 Opt-in, and audited. An anchor that matches no `id=` in the DOM scrolls
+     * nowhere and reads as the search having missed — so claiming one you have
+     * not added is worse than not claiming it. An entry without one deep-links
+     * to its TAB, which is truthful: "this lives on the Fees tab" is a smaller
+     * promise than "here is the control", and it is one the page can keep.
+     */
+    anchored?: boolean;
+}
+/**
+ * The controls worth finding.
+ *
+ * Deliberately not all ~160: a search result list is only useful while it is
+ * short, and "Hero title" is not something anyone hunts for — they open the
+ * About tab and see it. What is here is what someone arrives ALREADY looking
+ * for, usually in a hurry, and usually not knowing which tab it is filed under.
+ */
+export declare const SITE_SETTINGS_ENTRIES: readonly SettingsIndexSource[];
+/**
+ * The settings entries, as index entries.
+ *
+ * `deepLink` carries the whole query-and-hash — `?tab=fees#setting-cod-enabled`
+ * — rather than just the tab, because landing on the right tab and leaving the
+ * reader to find the control among forty others is most of the way to not
+ * having searched at all.
+ */
+export declare function deriveSettingsEntries(settingsHref: string, requiredPermission?: string): ActionIndexEntry[];