@mohasinac/appkit 4.37.1 → 4.39.0

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -390,9 +390,9 @@ const rawTesterChecklistItems = [
                     href: "/products",
                 },
                 {
-                    key: "pre-orders-reachable-from-products",
-                    label: "Pre-orders are reachable from /products — Filters → Listing type → tick Pre-Orders → Apply, and confirm real pre-order items appear with a \"Pre-Order\" badge",
-                    description: "This was the original report: pre-orders (and auctions, prize draws, art, stickers) had no entry in the type filter at all, so they could only be found via their own dedicated pages.",
+                    key: "every-listing-type-reachable-from-nav-or-products",
+                    label: "Every listing type is reachable — the five with a main-nav entry from the nav, and the four without one from the /products Listing type filter",
+                    description: "Reachability is the invariant, not the route to it. Auctions, pre-orders, prize draws and art/stickers used to have no entry in the /products type filter and were unreachable from the main catalogue; they were added there, and have now been moved back out because each owns a nav-linked page of its own. Classifieds, digital codes and live items have NO nav entry, so /products is still their only discovery path — dropping them from it is the same bug in a new place.",
                     href: "/products",
                 },
                 {
@@ -456,7 +456,19 @@ const rawTesterChecklistItems = [
             pageLabel: "Product / Auction / Pre-order Detail",
             href: "/products",
             cases: [
-                { key: "standard-detail", label: "Standard product detail page loads correctly", href: "/products/product-tester-standard-1" },
+                { key: "standard-detail", label: "Standard product detail page loads correctly, and a SIGNED-OUT visitor sees \"Sign in to see price\" where the price was", href: "/products/product-tester-standard-1" },
+                {
+                    key: "standard-detail-price-signed-in",
+                    label: "SIGNED IN, the same product detail page shows the real price (₹199.00) and no sign-in prompt",
+                    description: "The twin of the guest case above, and the half that is easy to forget: gating a price must not cost the coverage of the price itself. A gate that hides the amount from everyone passes the guest case perfectly and is a total regression.",
+                    href: "/products/product-tester-standard-1",
+                },
+                {
+                    key: "price-does-not-flash-sign-in-prompt-on-hard-reload",
+                    label: "SIGNED IN, hard-reloading a product page never flashes \"Sign in to see price\" before the real price appears",
+                    description: "The session provider is mounted with no user and resolves asynchronously, so `loading` starts true on every hard load — for signed-in visitors too. A gate written as \"no user means show the prompt\" therefore accuses an already-signed-in buyer of being signed out for several hundred milliseconds on every page load. The gate has THREE states for this reason: while the session is resolving it renders a neutral placeholder, never the prompt. This is the single most likely regression in the price-gating work and it is invisible to every static check.",
+                    href: "/products/product-tester-standard-1",
+                },
                 {
                     key: "tester-fixtures-hidden-from-the-public",
                     label: "SIGNED OUT, no product on /products has an id containing \"tester\" — the sandbox is invisible to the public",
@@ -477,8 +489,14 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "auction-detail",
-                    label: "Auction detail page shows current bid + a live, ticking countdown correctly",
-                    description: "The countdown (\"Ends in 2d 5h 30m\", ticking every second — not a static date) must appear directly above every \"Place a bid\" button: the info panel, the desktop and mobile compact bid-summary cards, inside the \"Place your bid\" modal above the submit button, and in the mobile sticky bottom bar (as a row above the current-bid/bid-count line). It should switch to \"Ended\" once the end time passes.",
+                    label: "SIGNED OUT, the auction detail page hides every bid figure and still shows a live, ticking countdown",
+                    description: "The countdown (\"Ends in 2d 5h 30m\", ticking every second — not a static date) must appear directly above every \"Place a bid\" button: the info panel, the desktop and mobile compact bid-summary cards, and the mobile sticky bottom bar. It should switch to \"Ended\" once the end time passes. A signed-out visitor additionally sees NO bid amounts: the current bid reads \"Sign in to see the current bid\" and the bid form is replaced by \"Bidding is for members\" — the form was never usable signed out, so showing it with live figures was both a disclosure and a dead end.",
+                    href: "/auctions/auction-tester-sandbox-cycle-1",
+                },
+                {
+                    key: "auction-detail-bid-signed-in",
+                    label: "SIGNED IN, the same auction shows the real current bid (₹15,000.00), the minimum increment and a working bid form",
+                    description: "The twin of the guest case above. A gate that hides the bid from signed-in buyers too would pass the guest case and break bidding entirely.",
                     href: "/auctions/auction-tester-sandbox-cycle-1",
                 },
                 { key: "preorder-detail", label: "Pre-order detail page shows expected ship date correctly", href: "/pre-orders/preorder-tester-sandbox-1" },
@@ -4232,6 +4250,12 @@ const rawTesterChecklistItems = [
                     label: "The apex host redirects to the www host, and does so permanently rather than temporarily",
                     description: "BEFORE: the apex 307'd to www. A 307 is TEMPORARY and explicitly tells a search engine NOT to move the index entry, so every page kept two competing addresses. AFTER: the redirect is permanent and the destination is the host the sitemap advertises.",
                 },
+                {
+                    key: "gated-price-is-declared-in-structured-data",
+                    label: "A product and an auction page still publish offers.price to search engines, AND declare the sign-in gate with isAccessibleForFree:false plus a cssSelector that matches a real element",
+                    description: "Prices are hidden from signed-out visitors, and Googlebot crawls signed out — so the crawler renders 'Sign in to see price' while the JSON-LD beside it declares a real amount. Google requires marked-up content to be visible to the user, so that gap has to be DECLARED (paywalled-content markup) rather than left implicit, which risks the rich result. Serving prices to crawler user-agents but not to people would be cloaking and is deliberately not done. The selector half matters as much as the flag: a cssSelector matching nothing is indistinguishable from having made no declaration at all.",
+                    href: "/products/product-beyblade-burst-valkyrie",
+                },
                 {
                     key: "locale-prefix-redirects-to-bare",
                     label: "A locale-prefixed path redirects to the unprefixed one",
@@ -4362,6 +4386,12 @@ const rawTesterChecklistItems = [
                     label: "A product's social preview image shows that product's own title and image",
                     href: "/products/product-beyblade-burst-valkyrie",
                 },
+                {
+                    key: "og-image-carries-no-price",
+                    label: "No social preview image renders a ₹ amount — product, bundle, classified, digital code, live item, catalogue item, prize draw or item request",
+                    description: "An OG image is a public image URL with the amount burned into the pixels. No sign-in gate reaches it and no structured-data declaration describes it, so it is the one surface where hiding a price on the page buys nothing. Eight og.tsx renderers carried a ₹ figure before 2026-09-14; the auction and pre-order cards already used a non-money accent (end date / release date) and are the pattern the rest now follow.",
+                    href: "/products/product-beyblade-burst-valkyrie",
+                },
                 {
                     key: "og-image-brand-logo-present",
                     label: "A brand's social preview card shows the brand's cover image rather than an empty slot",

package/dist/features/tester/utils/phases.js

@@ -25,22 +25,88 @@ export const DEFAULT_TESTER_PHASE_SIZE = 25;
  * already be in catalog order (e.g. sorted by the `order` field).
  */
 export function assignDefaultPhases(itemsInCatalogOrder, targetPhaseSize = DEFAULT_TESTER_PHASE_SIZE) {
-    const phaseNumbers = new Array(itemsInCatalogOrder.length);
+    /*
+     * 🛑 PAGES ARE INTERLEAVED ACROSS GROUPS, NOT PACKED IN CATALOGUE ORDER.
+     *
+     * This used to walk the catalogue straight through, so a group's phase number
+     * was an accident of where its `...group(...)` spread sat in a 6,200-line
+     * literal. `admin` is the 9th spread, so its 231 cases landed at phases
+     * **25–32** — and any run that stops early is therefore GUARANTEED to lose
+     * the largest, most privileged group in its entirety. The same held for every
+     * infrastructure group in the tail: page-wiring (32–33), cta-layout (33),
+     * addresses and search-and-nav (34).
+     *
+     * That is not hypothetical. Run run-1789300124915 stopped at phase 17 of 34
+     * and ten of fourteen groups had ZERO coverage — 527 cases, including all 233
+     * admin ones — while the run looked about half done.
+     *
+     * Round-robin over groups fixes the shape rather than the symptom: an early
+     * stop now costs a proportional slice of every group instead of the whole
+     * tail. Groups are visited largest-first within each round so the big ones do
+     * not bunch up at the end as the small ones run out.
+     *
+     * A phase may now span several groups. That is fine for a tester session —
+     * it is ~25 cases either way — and every read path already groups by the
+     * STORED `item.phase`, never by position.
+     *
+     * 🛑 The RETURN IS STILL POSITIONAL. Items keep their catalogue order and
+     * their `order` field; only the phase LABEL changes. Nothing downstream
+     * reorders, and `fetch-cases` still sorts by (phase, order) to build batches.
+     */
+    const pageOrder = [];
+    const pageSize = new Map();
+    const pageGroup = new Map();
+    for (const item of itemsInCatalogOrder) {
+        const pageId = `${item.groupKey}␟${item.pageKey}`;
+        if (!pageSize.has(pageId)) {
+            pageOrder.push(pageId);
+            pageSize.set(pageId, 0);
+            pageGroup.set(pageId, item.groupKey);
+        }
+        pageSize.set(pageId, pageSize.get(pageId) + 1);
+    }
+    // Queues of pages per group, each still in catalogue order within its group.
+    const byGroup = new Map();
+    for (const pageId of pageOrder) {
+        const g = pageGroup.get(pageId);
+        if (!byGroup.has(g))
+            byGroup.set(g, []);
+        byGroup.get(g).push(pageId);
+    }
+    const groupsLargestFirst = [...byGroup.entries()]
+        .map(([g, pages]) => ({
+        g,
+        pages,
+        cases: pages.reduce((n, p) => n + pageSize.get(p), 0),
+    }))
+        .sort((a, b) => b.cases - a.cases || a.g.localeCompare(b.g))
+        .map((e) => e.g);
+    const cursor = new Map(groupsLargestFirst.map((g) => [g, 0]));
+    const interleaved = [];
+    let remaining = pageOrder.length;
+    while (remaining > 0) {
+        for (const g of groupsLargestFirst) {
+            const i = cursor.get(g);
+            const pages = byGroup.get(g);
+            if (i >= pages.length)
+                continue;
+            interleaved.push(pages[i]);
+            cursor.set(g, i + 1);
+            remaining--;
+        }
+    }
+    // Pack the interleaved page sequence into phases, never splitting a page.
+    const phaseOfPage = new Map();
     let currentPhase = 1;
     let currentPhaseCount = 0;
-    let lastPageKey = null;
-    for (let i = 0; i < itemsInCatalogOrder.length; i++) {
-        const item = itemsInCatalogOrder[i];
-        const pageId = `${item.groupKey}␟${item.pageKey}`;
-        const isNewPage = pageId !== lastPageKey;
-        // Only allow a phase boundary between pages, never mid-page.
-        if (isNewPage && currentPhaseCount >= targetPhaseSize) {
+    for (const pageId of interleaved) {
+        const size = pageSize.get(pageId);
+        if (currentPhaseCount > 0 && currentPhaseCount >= targetPhaseSize) {
             currentPhase += 1;
             currentPhaseCount = 0;
         }
-        phaseNumbers[i] = currentPhase;
-        currentPhaseCount += 1;
-        lastPageKey = pageId;
+        phaseOfPage.set(pageId, currentPhase);
+        currentPhaseCount += size;
     }
-    return phaseNumbers;
+    return itemsInCatalogOrder.map((item) => phaseOfPage.get(`${item.groupKey}␟${item.pageKey}`));
 }

package/dist/features/wishlist/components/WishlistPage.js

@@ -1,12 +1,12 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Button, Div, Stack, Text } from "../../../ui";
+import { Button, Div, GatedPrice, Stack, Text } from "../../../ui";
 import { MediaImage } from "../../media/MediaImage";
 import { formatCurrency } from "../../../utils/number.formatter";
 const CLS_REMOVE_BTN = "self-start text-[var(--appkit-color-text-faint)] transition hover:text-error";
 export function WishlistCard({ item, onRemove, onProductClick, }) {
     return (_jsxs(Div, { layout: "flex", gap: "4", surface: "card", padding: "sm", children: [_jsx(Div, { role: onProductClick ? "button" : undefined, tabIndex: onProductClick ? 0 : undefined, onClick: onProductClick ? () => onProductClick(item) : undefined, onKeyDown: onProductClick
                     ? (e) => e.key === "Enter" && onProductClick(item)
-                    : undefined, className: `relative h-20 w-20 flex-shrink-0 overflow-hidden bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)] ${onProductClick ? "cursor-pointer" : ""}`, rounded: "lg", children: item.productImage && (_jsx(MediaImage, { src: item.productImage, alt: item.productTitle ?? "", size: "thumbnail" })) }), _jsxs(Stack, { justify: "between", className: "flex-1", children: [_jsx(Text, { truncate: 2, weight: "medium", color: "primary", children: item.productTitle }), item.productPrice !== undefined && (_jsx(Text, { className: "text-[var(--appkit-color-text)]", size: "sm", weight: "semibold", children: formatCurrency(item.productPrice, item.productCurrency) }))] }), onRemove && (_jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: () => onRemove(item.id), "aria-label": "Remove from wishlist", className: CLS_REMOVE_BTN, children: "\u2715" }))] }));
+                    : undefined, className: `relative h-20 w-20 flex-shrink-0 overflow-hidden bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)] ${onProductClick ? "cursor-pointer" : ""}`, rounded: "lg", children: item.productImage && (_jsx(MediaImage, { src: item.productImage, alt: item.productTitle ?? "", size: "thumbnail" })) }), _jsxs(Stack, { justify: "between", className: "flex-1", children: [_jsx(Text, { truncate: 2, weight: "medium", color: "primary", children: item.productTitle }), item.productPrice !== undefined && (_jsx(Text, { className: "text-[var(--appkit-color-text)]", size: "sm", weight: "semibold", children: _jsx(GatedPrice, { children: formatCurrency(item.productPrice, item.productCurrency) }) }))] }), onRemove && (_jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: () => onRemove(item.id), "aria-label": "Remove from wishlist", className: CLS_REMOVE_BTN, children: "\u2715" }))] }));
 }
 export function WishlistPage({ items, isLoading, onRemove, onProductClick, emptyLabel = "Your wishlist is empty", }) {
     if (isLoading) {

package/dist/index.d.ts

@@ -341,6 +341,7 @@ export { blogPostJsonLd } from "./seo/index";
 export { breadcrumbJsonLd } from "./seo/index";
 export { createSeoConfig } from "./seo/index";
 export { faqJsonLd } from "./seo/index";
+export { gatedPriceWebPageJsonLd } from "./seo/index";
 export { generateAuctionMetadata } from "./seo/index";
 export { generateBlogMetadata } from "./seo/index";
 export { generateCategoryMetadata } from "./seo/index";
@@ -3001,7 +3002,7 @@ export { Heading, Spinner, IconButton, Progress, IndeterminateProgress, Paginati
 export { ModalFooter, UnsavedChangesModal, ResponsiveView, Textarea, Checkbox } from "./ui/index";
 export { ActionRow } from "./ui/index";
 export type { ActionRowProps, ActionRowAlign } from "./ui/index";
-export { ToastProvider, StarRating, StepperNav, ViewToggle, PriceDisplay, SummaryCard } from "./ui/index";
+export { ToastProvider, StarRating, StepperNav, ViewToggle, PriceDisplay, GatedPrice, PricesOnly, SummaryCard } from "./ui/index";
 export { CountdownDisplay, ItemRow, HorizontalScroller } from "./ui/index";
 export { CardBody, MenuTrigger, MenuContent, MenuSeparator, RoleBadge, SkipToMain } from "./ui/index";
 export { Tabs, TabsList, TabsTrigger, TabsContent, PasswordStrengthIndicator, TablePagination } from "./ui/index";

package/dist/index.js

@@ -598,6 +598,9 @@ export { createSeoConfig } from "./seo/index";
 // faqJsonLd - Shared export for faq json ld.
 export { faqJsonLd } from "./seo/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
+// gatedPriceWebPageJsonLd - Shared export for gated price web page json ld.
+export { gatedPriceWebPageJsonLd } from "./seo/index";
+// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // generateAuctionMetadata - Helper for generate auction metadata.
 export { generateAuctionMetadata } from "./seo/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
@@ -5364,7 +5367,7 @@ export { Button } from "./ui/index";
 export { Heading, Spinner, IconButton, Progress, IndeterminateProgress, Pagination, PageLoader } from "./ui/index";
 export { ModalFooter, UnsavedChangesModal, ResponsiveView, Textarea, Checkbox } from "./ui/index";
 export { ActionRow } from "./ui/index";
-export { ToastProvider, StarRating, StepperNav, ViewToggle, PriceDisplay, SummaryCard } from "./ui/index";
+export { ToastProvider, StarRating, StepperNav, ViewToggle, PriceDisplay, GatedPrice, PricesOnly, SummaryCard } from "./ui/index";
 export { CountdownDisplay, ItemRow, HorizontalScroller } from "./ui/index";
 export { CardBody, MenuTrigger, MenuContent, MenuSeparator, RoleBadge, SkipToMain } from "./ui/index";
 export { Tabs, TabsList, TabsTrigger, TabsContent, PasswordStrengthIndicator, TablePagination } from "./ui/index";

package/dist/providers/db-firebase/rtdb-paths.d.ts

@@ -19,4 +19,11 @@ export declare const RTDB_PATHS: {
     readonly AUTH_EVENTS: "auth_events";
     readonly PAYMENT_EVENTS: "payment_events";
     readonly BULK_EVENTS: "bulk_events";
+    /**
+     * Tester-only. A one-line ping per email decision so the harness can poll
+     * instead of reading a real mailbox — see `send-recorder.ts` for why, and for
+     * the gate that keeps real users' mail out of it. Pruned by
+     * `cleanupRtdbEvents` alongside the other three.
+     */
+    readonly EMAIL_EVENTS: "email_events";
 };

package/dist/providers/db-firebase/rtdb-paths.js

@@ -19,4 +19,11 @@ export const RTDB_PATHS = {
     AUTH_EVENTS: "auth_events",
     PAYMENT_EVENTS: "payment_events",
     BULK_EVENTS: "bulk_events",
+    /**
+     * Tester-only. A one-line ping per email decision so the harness can poll
+     * instead of reading a real mailbox — see `send-recorder.ts` for why, and for
+     * the gate that keeps real users' mail out of it. Pruned by
+     * `cleanupRtdbEvents` alongside the other three.
+     */
+    EMAIL_EVENTS: "email_events",
 };

package/dist/react/contexts/SessionContext.js

@@ -19,7 +19,22 @@ const DEFAULT_ENDPOINTS = {
 // ---------------------------------------------------------------------------
 const SESSION_COOKIE = "__session";
 const SESSION_ID_COOKIE = "__session_id";
-const ACTIVITY_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * How often a VISIBLE tab pings session activity and re-reads RBAC flags.
+ *
+ * Each tick costs two function invocations (`sessionActivity`, then the
+ * piggybacked profile re-fetch below), per open tab, wall-clock rather than
+ * activity-gated. At the original 5 minutes that was 24 invocations/hour for
+ * every tab any signed-in user had left open, and it contributed to the Vercel
+ * overage that paused the account (2026-09-14).
+ *
+ * 15 minutes is safe because it is a BACKSTOP, not the primary freshness
+ * mechanism: `RoleGuard` calls `refreshUser()` on every mount of a role-gated
+ * layout, so navigating into /admin, /store or /user re-reads the flags
+ * immediately, and the visibility handler below re-reads them the moment a
+ * backgrounded tab is looked at again.
+ */
+const ACTIVITY_INTERVAL_MS = 15 * 60 * 1000; // 15 minutes
 // ---------------------------------------------------------------------------
 // Context
 // ---------------------------------------------------------------------------
@@ -166,6 +181,14 @@ export function SessionProvider({ children, initialUser, endpoints: endpointOver
         const currentSessionId = getSessionIdFromCookie();
         if (!currentSessionId || !user)
             return;
+        // A hidden tab is not "activity", so reporting it as such is both wasteful
+        // and wrong — an abandoned background tab used to keep both requests below
+        // firing indefinitely. The visibility handler re-runs this immediately when
+        // the tab is looked at again, so nothing is merely deferred into staleness.
+        if (typeof document !== "undefined" &&
+            document.visibilityState === "hidden") {
+            return;
+        }
         try {
             await apiClient.post(ep.sessionActivity, {
                 sessionId: currentSessionId,
@@ -203,6 +226,22 @@ export function SessionProvider({ children, initialUser, endpoints: endpointOver
     useEffect(() => {
         updateSessionActivityRef.current = updateSessionActivity;
     }, [updateSessionActivity]);
+    // Re-read session activity and RBAC flags the moment a backgrounded tab is
+    // looked at again. This is what lets the interval above be 15 minutes and the
+    // hidden-tab skip be safe: the user-visible freshness guarantee is now "fresh
+    // whenever you are actually looking at it", which is strictly better than the
+    // old fixed 5-minute tick that fired whether anyone was there or not.
+    useEffect(() => {
+        if (typeof document === "undefined")
+            return;
+        const onVisible = () => {
+            if (document.visibilityState === "visible") {
+                void updateSessionActivityRef.current?.();
+            }
+        };
+        document.addEventListener("visibilitychange", onVisible);
+        return () => document.removeEventListener("visibilitychange", onVisible);
+    }, []);
     // -----------------------------------------------------------------------
     // Refresh helpers
     // -----------------------------------------------------------------------

package/dist/react/hooks/useCanSeePrices.d.ts

@@ -0,0 +1,37 @@
+export interface CanSeePricesState {
+    /** The viewer is signed in and may be shown money amounts. */
+    canSeePrices: boolean;
+    /**
+     * The session has not resolved yet. Render a neutral placeholder while this
+     * is true — NEVER the sign-in prompt. See the note below.
+     */
+    isAuthResolving: boolean;
+}
+/**
+ * May the current viewer be shown money amounts on a public listing surface?
+ *
+ * Prices, current bids, deposits and per-entry amounts are hidden from
+ * signed-out visitors so the catalogue cannot be read at scale without an
+ * account. Signed-in users see everything exactly as before.
+ *
+ * ## Why there are THREE states, not two
+ *
+ * `SessionProvider` is mounted `initialUser={null}` because the root locale
+ * layout must stay static (Root Cause #82), so `loading` starts `true` on every
+ * hard load — for signed-in users too, until Firebase persistence resolves and
+ * `/api/user/profile` returns. A naive `!user` test therefore renders
+ * "Sign in to see price" at an already-signed-in user for several hundred
+ * milliseconds on every page load.
+ *
+ * So: `isAuthResolving` means "don't know yet" and must render a neutral
+ * placeholder. Only `canSeePrices === false && isAuthResolving === false` is a
+ * confirmed guest.
+ *
+ * ## Why `useOptionalSession`
+ *
+ * This is library code that ADJUSTS for the viewer rather than requiring one.
+ * `useSession()` throws without a provider, which would turn an optional
+ * refinement into a breaking contract for every consumer (Root Cause #20). With
+ * no provider we fail CLOSED — no session means no prices.
+ */
+export declare function useCanSeePrices(): CanSeePricesState;

package/dist/react/hooks/useCanSeePrices.js

@@ -0,0 +1,40 @@
+"use client";
+import { useOptionalSession } from "../contexts/SessionContext";
+/**
+ * May the current viewer be shown money amounts on a public listing surface?
+ *
+ * Prices, current bids, deposits and per-entry amounts are hidden from
+ * signed-out visitors so the catalogue cannot be read at scale without an
+ * account. Signed-in users see everything exactly as before.
+ *
+ * ## Why there are THREE states, not two
+ *
+ * `SessionProvider` is mounted `initialUser={null}` because the root locale
+ * layout must stay static (Root Cause #82), so `loading` starts `true` on every
+ * hard load — for signed-in users too, until Firebase persistence resolves and
+ * `/api/user/profile` returns. A naive `!user` test therefore renders
+ * "Sign in to see price" at an already-signed-in user for several hundred
+ * milliseconds on every page load.
+ *
+ * So: `isAuthResolving` means "don't know yet" and must render a neutral
+ * placeholder. Only `canSeePrices === false && isAuthResolving === false` is a
+ * confirmed guest.
+ *
+ * ## Why `useOptionalSession`
+ *
+ * This is library code that ADJUSTS for the viewer rather than requiring one.
+ * `useSession()` throws without a provider, which would turn an optional
+ * refinement into a breaking contract for every consumer (Root Cause #20). With
+ * no provider we fail CLOSED — no session means no prices.
+ */
+export function useCanSeePrices() {
+    const session = useOptionalSession();
+    // No provider: fail closed, and don't claim to be mid-resolution — there is
+    // nothing in flight that will ever change the answer.
+    if (!session)
+        return { canSeePrices: false, isAuthResolving: false };
+    return {
+        canSeePrices: Boolean(session.user?.uid),
+        isAuthResolving: session.loading,
+    };
+}

package/dist/seed/addresses-seed-data.js

@@ -3,12 +3,12 @@
  *      addresses live entirely in store-addresses-seed-data.ts (merged in at the API route
  *      level) — this file only carries ownerType:"user" entries now, to avoid seeding two
  *      overlapping sources of store address data.
- * WHAT: Exports 3 user addresses. Top-level collection (SB-UNI-A) with ownerType discriminator.
+ * WHAT: Exports 4 user addresses. Top-level collection (SB-UNI-A) with ownerType discriminator.
  *       PII encrypted via HMAC blind indices (emailIndex, phoneIndex). Composite indexes
  *       (ownerType, ownerId, createdAt desc) + (ownerType, ownerId, isDefault).
  *
  * EXPORTS:
- *   addressesSeedData — Array of 3 user address documents
+ *   addressesSeedData — Array of 4 user address documents
  *
  * @tag domain:addresses,shipping
  * @tag layer:seed
@@ -74,5 +74,39 @@ const _rawAddressesSeedData = [
         createdAt: daysAgo(365),
         updatedAt: daysAgo(5),
     },
+    /*
+     * Automated checklist runner — delivery address.
+     *
+     * 🛑 THIS ROW IS WHY CHECKOUT CAN BE TESTED AT ALL.
+     *
+     * `user-claude-tester` had no address, so /checkout stopped dead at "Step 1 of 3:
+     * Shipping Address — No saved addresses yet." Every order, payment, coupon-at-placement,
+     * offer-checkout and forfeited-bid case died there: 117 blocked cases, 27% of everything
+     * the run could not test, and the single largest blocker by a wide margin (measured,
+     * run 1789300124915).
+     *
+     * It has to be SEEDED rather than created by the runner mid-run. `addresses` is PRESERVE
+     * tier in tester/scripts/lib/collections.mjs — teardown deliberately never touches it,
+     * because real people's saved addresses live there — so a row the runner created at
+     * runtime would survive every future run with nothing owning its cleanup. Seeded, it is
+     * idempotent: `appkit-seed load` upserts this exact id, and re-running changes nothing.
+     */
+    {
+        id: "addr-claude-tester-home",
+        ownerType: "user",
+        ownerId: "user-claude-tester",
+        label: "Home",
+        fullName: "Claude (automated)",
+        phone: "+91-99999-00019",
+        addressLine1: "1 Automation Street",
+        addressLine2: "Koramangala",
+        city: "Bengaluru",
+        state: "Karnataka",
+        postalCode: "560034",
+        country: "India",
+        isDefault: true,
+        createdAt: daysAgo(1),
+        updatedAt: daysAgo(1),
+    },
 ];
 export const addressesSeedData = _rawAddressesSeedData;

package/dist/seed/users-seed-data.js

@@ -546,8 +546,16 @@ export const usersSeedData = [
         isBot: true,
         emailVerified: true,
         disabled: false,
-        storeId: "store-tester-qa-seller",
-        storeSlug: "store-tester-qa-seller",
+        // 🛑 This MUST name a store whose own `ownerId` is this uid. It used to say
+        // "store-tester-qa-seller", which is owned by `user-tester-qa` — so the app, which
+        // resolves sellers by `ownerId`, answered every /api/store/* call with 403
+        // "No store found for this account" while the client, reading `role` and `storeId`
+        // off this document, rendered the entire Store Panel over it. 36 checklist cases were
+        // blocked by that one-way pointer (measured, run 1789300124915).
+        // See stores-tester-seed-data.ts for why the shared sandbox could not simply be
+        // repointed at this account instead.
+        storeId: "store-claude-tester",
+        storeSlug: "store-claude-tester",
         storeStatus: "approved",
         publicProfile: {
             isPublic: false,

package/dist/seo/json-ld.d.ts

@@ -84,6 +84,27 @@ export interface BlogPostJsonLdInput {
     metaTitle?: string;
     metaDescription?: string;
 }
+/**
+ * Declares that this page's price is behind a sign-in gate.
+ *
+ * Prices are hidden from signed-out visitors, and Googlebot crawls signed out —
+ * so the crawler sees "Sign in to see price" while the Product JSON-LD beside it
+ * declares a real `offers.price`. Left undeclared, that is a structured-data
+ * mismatch: Google requires marked-up content to be visible to the user, and an
+ * unexplained gap can cost the rich result.
+ *
+ * `isAccessibleForFree: false` + `hasPart`/`cssSelector` is the supported way to
+ * say "the markup is richer than what an anonymous visitor sees". It lives on a
+ * `WebPage` node rather than on the Product, because `isAccessibleForFree` is a
+ * `CreativeWork` property and `Product` is not a `CreativeWork`.
+ *
+ * Serving the price to crawler user-agents but not to people would be cloaking,
+ * which is a harder violation; this declares the gate instead of hiding it.
+ *
+ * 🛑 Emit this on EVERY page that emits `offers.price`. The audit enforces the
+ * pairing precisely so nobody removes one half later.
+ */
+export declare function gatedPriceWebPageJsonLd(path: string): Record<string, JsonLdValue>;
 export declare function productJsonLd(product: ProductJsonLdInput): Record<string, JsonLdValue>;
 export declare function reviewJsonLd(review: ReviewJsonLdInput): Record<string, JsonLdValue>;
 export declare function aggregateRatingJsonLd(product: Pick<ProductJsonLdInput, "title" | "slug">, stats: {

package/dist/seo/json-ld.js

@@ -39,6 +39,51 @@ function absoluteUrl(value, base = SITE_URL) {
 import { ProductStatusValues } from "../features/products/schemas";
 import { getDefaultCurrency } from "../core/baseline-resolver";
 // --- Helpers -----------------------------------------------------------------
+/**
+ * The CSS selector the price gate renders in every state.
+ *
+ * 🛑 Must equal `GATED_PRICE_CLASS` in `ui/components/GatedPrice.tsx`. It is
+ * duplicated as a literal here rather than imported because `seo/` is reached
+ * from server-only metadata paths and must not pull in a `"use client"` module
+ * (Root Cause #76). `audit-guest-price-leak` cross-checks the two.
+ */
+const GATED_PRICE_SELECTOR = ".appkit-gated-price";
+/**
+ * Declares that this page's price is behind a sign-in gate.
+ *
+ * Prices are hidden from signed-out visitors, and Googlebot crawls signed out —
+ * so the crawler sees "Sign in to see price" while the Product JSON-LD beside it
+ * declares a real `offers.price`. Left undeclared, that is a structured-data
+ * mismatch: Google requires marked-up content to be visible to the user, and an
+ * unexplained gap can cost the rich result.
+ *
+ * `isAccessibleForFree: false` + `hasPart`/`cssSelector` is the supported way to
+ * say "the markup is richer than what an anonymous visitor sees". It lives on a
+ * `WebPage` node rather than on the Product, because `isAccessibleForFree` is a
+ * `CreativeWork` property and `Product` is not a `CreativeWork`.
+ *
+ * Serving the price to crawler user-agents but not to people would be cloaking,
+ * which is a harder violation; this declares the gate instead of hiding it.
+ *
+ * 🛑 Emit this on EVERY page that emits `offers.price`. The audit enforces the
+ * pairing precisely so nobody removes one half later.
+ */
+export function gatedPriceWebPageJsonLd(path) {
+    return {
+        "@context": "https://schema.org",
+        "@type": "WebPage",
+        // Absolutised against the ONE canonical host, never a second definition of
+        // it (Root Cause #81) — a WebPage node naming a host the sitemap does not
+        // advertise is the same split-identity bug in miniature.
+        url: absoluteUrl(path),
+        isAccessibleForFree: false,
+        hasPart: {
+            "@type": "WebPageElement",
+            isAccessibleForFree: false,
+            cssSelector: GATED_PRICE_SELECTOR,
+        },
+    };
+}
 export function productJsonLd(product) {
     const url = `${SITE_URL}/products/${product.slug}`;
     // Absolutise, then de-duplicate: `mainImage` is very often also `images[0]`,

package/dist/server.d.ts

@@ -556,6 +556,9 @@ export { getDigitalCodeForDetail } from "./_internal/server/features/digital-cod
 export { toClientDigitalCode, type DigitalCodeClientShape } from "./_internal/server/features/digital-code/adapters";
 export { buildDigitalCodeMetadata, type DigitalCodeMetadataOptions } from "./_internal/server/features/digital-code/metadata";
 export { renderDigitalCodeOg, renderDigitalCodeOgImage, renderDigitalCodeOgFromDoc, type DigitalCodeOgData } from "./_internal/server/features/digital-code/og";
+export { addPoolEntries, listPoolEntries, deletePoolEntry, recountPool, assertCanUploadContentKind, DIGITAL_CONTENT_PREFIX, type AddPoolEntryInput, } from "./_internal/server/features/digital-code/pool";
+export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForMime, type SignedDigitalContent, type FinalizedDigitalContent, } from "./_internal/server/features/digital-code/upload";
+export { resolveCodeAssetForOrder, codeAssetHeaders, CODE_DOWNLOAD_STATUSES, type CodeAssetResolution, } from "./_internal/server/features/digital-code/download";
 export { getLiveItemForDetail } from "./_internal/server/features/live/data";
 export { toClientLiveItem, type LiveItemClientShape } from "./_internal/server/features/live/adapters";
 export { buildLiveItemMetadata, type LiveItemMetadataOptions } from "./_internal/server/features/live/metadata";

package/dist/server.js

@@ -1444,6 +1444,18 @@ export { getDigitalCodeForDetail } from "./_internal/server/features/digital-cod
 export { toClientDigitalCode } from "./_internal/server/features/digital-code/adapters";
 export { buildDigitalCodeMetadata } from "./_internal/server/features/digital-code/metadata";
 export { renderDigitalCodeOg, renderDigitalCodeOgImage, renderDigitalCodeOgFromDoc } from "./_internal/server/features/digital-code/og";
+/*
+ * The digital-CONTENT pool: the half of this feature that had no writer at all
+ * until 2026-09-14, so every digital-code purchase delivered nothing.
+ *
+ * Server-only, and that is structural rather than tidy — `pool` and `download`
+ * both reach `getAdminDb`/`getAdminStorage`, and `upload` mints signed URLs.
+ * None of it may appear in `index.ts` or `client.ts` (the Turbopack
+ * client-bundle trap, Root Cause #6/#24).
+ */
+export { addPoolEntries, listPoolEntries, deletePoolEntry, recountPool, assertCanUploadContentKind, DIGITAL_CONTENT_PREFIX, } from "./_internal/server/features/digital-code/pool";
+export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForMime, } from "./_internal/server/features/digital-code/upload";
+export { resolveCodeAssetForOrder, codeAssetHeaders, CODE_DOWNLOAD_STATUSES, } from "./_internal/server/features/digital-code/download";
 // ── Live-item listing — data + adapters + metadata + OG ──────────────────────
 export { getLiveItemForDetail } from "./_internal/server/features/live/data";
 export { toClientLiveItem } from "./_internal/server/features/live/adapters";