@mohasinac/appkit 4.37.1 → 4.39.0

package/dist/_internal/server/features/digital-code/pool.js

@@ -0,0 +1,208 @@
+/**
+ * The digital-content pool for a `digital-code` listing.
+ *
+ * 🛑 THIS IS THE MISSING HALF OF THE FEATURE. Everything downstream already
+ * existed — `claimDigitalCodeForOrder` claims one at checkout, the buyer reveals
+ * it through `GET /api/orders/{id}/code`, a refund revokes unclaimed ones — but
+ * **nothing in the codebase had ever WRITTEN a row into the pool.** The one
+ * seller-facing route returned `501 "Digital code management is not implemented
+ * yet."` So every purchase of a digital-code listing hit
+ * `serverLogger.warn("claimDigitalCode: code pool exhausted")` and returned
+ * silently, the order completed normally, and the buyer's reveal panel answered
+ * 404. The seller form even has a "Code Pool Size" field, which made the pool
+ * look populated on the listing page while it was always empty.
+ *
+ * A "digital code" delivers digital CONTENT: a redemption string, a QR image, or
+ * a file. `contentKind` says which, defaulting to `"code"` so every pre-existing
+ * document keeps its meaning with no migration.
+ */
+import { getAdminDb } from "../../../../providers/db-firebase/admin";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring";
+import { ValidationError } from "../../../../errors";
+import { ORDER_FIELDS } from "../../../../constants/field-names";
+import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION, } from "../../../../features/products/schemas/firestore";
+/**
+ * Where a delivered asset's bytes live.
+ *
+ * Deliberately OUTSIDE every prefix the public media proxy knows how to resolve,
+ * and no `mediaAssets` row is ever created for it — a `mediaAssets` row is what
+ * mints a `/media/{shortId}` slug, and that slug is served without
+ * authentication. No row, no slug, no public URL.
+ */
+export const DIGITAL_CONTENT_PREFIX = "private/digital-content";
+/**
+ * 🛑 THE PERMISSION SPLIT, and the reason it is not simply "admins only".
+ *
+ * An image is the QR/voucher case and is the whole point of widening this from
+ * strings, so a seller must be able to add one — they are the person who has it.
+ * Any OTHER file type is admin-only to upload: the upload surface accepts bytes
+ * that will later be streamed to a buyer, and a `.html` renamed `.pdf` is stored
+ * XSS the moment anything renders it inline. Narrowing who can put a non-image
+ * file into that path is the cheap half of the defence; the magic-byte check and
+ * the forced `Content-Disposition: attachment` are the other half.
+ *
+ * READ is a third thing again and is not on this axis at all: whoever may
+ * upload, only the buyer who paid for that order (or staff) may download. See
+ * `assertCanDownloadCodeAsset`.
+ */
+export function assertCanUploadContentKind(kind, role) {
+    const isStaff = role === "admin" || role === "moderator" || role === "employee";
+    if (kind === "file" && !isStaff) {
+        throw new ValidationError("Only an administrator can attach a downloadable file to a listing. Sellers can attach a code or a QR image.");
+    }
+}
+function assertPoolEntryShape(input) {
+    if (input.contentKind === "code") {
+        if (!input.code || !input.code.trim()) {
+            throw new ValidationError("A code entry needs a code.");
+        }
+        return;
+    }
+    if (!input.assetPath) {
+        throw new ValidationError(`A ${input.contentKind} entry needs an uploaded asset.`);
+    }
+    /*
+     * Refuse anything outside the private prefix rather than "fixing it up".
+     * A caller that hands us `tmp/uploads/<uid>/x.png` is handing us a path the
+     * public proxy can already serve, and silently rewriting it would hide the
+     * mistake instead of surfacing it.
+     */
+    if (!input.assetPath.startsWith(`${DIGITAL_CONTENT_PREFIX}/`)) {
+        throw new ValidationError("Asset is not in the private digital-content store.");
+    }
+}
+/**
+ * Append entries to a product's pool and re-sync the two counters.
+ *
+ * `codePoolSize` and `codesAvailable` are recomputed from the subcollection, not
+ * incremented from the input — the seller form lets a human type `codePoolSize`
+ * by hand, so treating that number as authoritative would let the listing page
+ * advertise stock that does not exist. Counting is the only thing that cannot
+ * drift (Root Cause #42: a mirror is only as good as every writer of it).
+ */
+export async function addPoolEntries(entries) {
+    if (entries.length === 0)
+        throw new ValidationError("Nothing to add.");
+    const productId = entries[0].productId;
+    for (const e of entries) {
+        if (e.productId !== productId) {
+            throw new ValidationError("All entries must belong to the same listing.");
+        }
+        assertPoolEntryShape(e);
+    }
+    const db = getAdminDb();
+    const codesRef = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION);
+    const now = new Date();
+    const batch = db.batch();
+    for (const e of entries) {
+        const doc = {
+            productId,
+            code: e.contentKind === "code" ? e.code.trim() : "",
+            contentKind: e.contentKind,
+            status: "available",
+            createdAt: now,
+            updatedAt: now,
+            ...(e.assetPath ? { assetPath: e.assetPath } : {}),
+            ...(e.fileName ? { fileName: e.fileName } : {}),
+            ...(e.contentType ? { contentType: e.contentType } : {}),
+            ...(e.expiresAt ? { expiresAt: e.expiresAt } : {}),
+        };
+        batch.set(codesRef.doc(), doc);
+    }
+    await batch.commit();
+    const counts = await recountPool(productId);
+    return { added: entries.length, ...counts };
+}
+/**
+ * Recount the pool and write both counters onto the product.
+ *
+ * 🛑 `codesAvailable` HAD NO WRITER EITHER. `claimDigitalCodeForOrder` flips a
+ * code to `claimed` and never decrements it, so the counter only ever held
+ * whatever the seed or the seller typed. Since `hasCodesAvailable()` is what the
+ * availability predicate reads, a sold-out listing stayed "available" forever and
+ * a listing that never had codes still advertised stock. Both counters are
+ * derived here, so neither can drift from the subcollection.
+ */
+export async function recountPool(productId) {
+    const db = getAdminDb();
+    const codesRef = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION);
+    // Aggregation counts, not document reads — a pool can be large and this runs
+    // on every claim (Rule #6).
+    const [availableAgg, totalAgg] = await Promise.all([
+        codesRef.where(ORDER_FIELDS.STATUS, "==", "available").count().get(),
+        codesRef.count().get(),
+    ]);
+    const available = availableAgg.data().count;
+    const total = totalAgg.data().count;
+    try {
+        await db.collection(PRODUCT_COLLECTION).doc(productId).update({
+            "digitalCode.codesAvailable": available,
+            "digitalCode.codePoolSize": total,
+            updatedAt: new Date(),
+        });
+    }
+    catch (err) {
+        void normalizeError(err);
+        // Non-fatal: the pool itself is the source of truth and a stale counter only
+        // affects a badge. Failing the claim over it would be worse.
+        serverLogger.error("recountPool: counter write failed", { error: normalizeError(err).message, productId });
+    }
+    return { available, total };
+}
+/** The seller/admin view of a pool. Never returns `code` or `assetPath`. */
+export async function listPoolEntries(productId) {
+    const db = getAdminDb();
+    const snap = await db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION)
+        .orderBy(ORDER_FIELDS.CREATED_AT, "desc")
+        .limit(200)
+        .get();
+    /*
+     * 🛑 An ALLOW-LIST, not a spread-and-delete. The whole value of this
+     * subcollection is that the seller can see how many codes are left without
+     * seeing the codes, and a buyer's claimed code is not the seller's to read
+     * back either. Root Cause #70: a projection built by deleting keys publishes
+     * every field nobody thought to delete.
+     */
+    return snap.docs.map((d) => {
+        const c = d.data();
+        return {
+            id: d.id,
+            contentKind: c.contentKind ?? "code",
+            status: c.status,
+            ...(c.fileName ? { fileName: c.fileName } : {}),
+            ...(c.orderId ? { orderId: c.orderId } : {}),
+            ...(c.claimedAt ? { claimedAt: new Date(c.claimedAt).toISOString() } : {}),
+            ...(c.createdAt ? { createdAt: new Date(c.createdAt).toISOString() } : {}),
+        };
+    });
+}
+/**
+ * Remove an UNCLAIMED entry. A claimed one is somebody's purchase and deleting
+ * it would make their reveal 404 with no trace of what they bought.
+ */
+export async function deletePoolEntry(productId, codeId) {
+    const db = getAdminDb();
+    const ref = db
+        .collection(PRODUCT_COLLECTION)
+        .doc(productId)
+        .collection(PRODUCT_CODES_SUBCOLLECTION)
+        .doc(codeId);
+    const snap = await ref.get();
+    if (!snap.exists)
+        throw new ValidationError("Entry not found.");
+    if (snap.data().status === "claimed") {
+        throw new ValidationError("That entry has already been delivered to a buyer and cannot be removed.");
+    }
+    await ref.delete();
+    return recountPool(productId);
+}

package/dist/_internal/server/features/digital-code/upload.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Upload for delivered digital content.
+ *
+ * 🛑 A SEPARATE PIPELINE FROM `/api/media/*`, ON PURPOSE.
+ *
+ * The public media pipeline ends by creating a `mediaAssets` row, and that row
+ * IS the `/media/{shortId}` slug — which `GET /api/media/[...slug]` serves with
+ * no authentication at all. Reusing it for paid content and then "remembering
+ * not to publish the URL" is not a boundary; the slug exists the moment the row
+ * does. So this writes to `private/digital-content/...`, mints no row, and the
+ * bytes are only ever readable through `resolveCodeAssetForOrder`, which checks
+ * that the caller owns the order.
+ *
+ * Everything else about the flow is deliberately identical to the public one —
+ * a short-lived signed PUT so bytes never traverse the Next.js function (Rule
+ * #6 caps a request body at 4.5 MB), then a server-side finalize that verifies
+ * the file by its MAGIC BYTES rather than by what the client declared.
+ */
+import type { ProductCodeContentKind } from "../../../../features/products/schemas/firestore";
+/** The content kind a declared MIME maps to. */
+export declare function contentKindForMime(mime: string): ProductCodeContentKind;
+export interface SignDigitalContentInput {
+    productId: string;
+    fileName: string;
+    contentType: string;
+    size: number;
+}
+export interface SignedDigitalContent {
+    uploadUrl: string;
+    storagePath: string;
+    contentKind: ProductCodeContentKind;
+    expiresAt: string;
+}
+export declare function signDigitalContentUpload(input: SignDigitalContentInput): Promise<SignedDigitalContent>;
+export interface FinalizedDigitalContent {
+    storagePath: string;
+    contentType: string;
+    fileName: string;
+    contentKind: ProductCodeContentKind;
+    size: number;
+}
+/**
+ * Verify an uploaded object and return the facts a pool entry needs.
+ *
+ * 🛑 THE DECLARED MIME IS NOT EVIDENCE. `finalize` on the public pipeline exists
+ * for exactly this reason and returns a structured 422 `MIME_MISMATCH`; the same
+ * rule has to hold here, and matters more, because the output is handed to a
+ * paying buyer. A mismatch DELETES the object rather than leaving it in the
+ * bucket for a later caller to reference.
+ */
+export declare function finalizeDigitalContentUpload(storagePath: string, declaredContentType: string): Promise<FinalizedDigitalContent>;

package/dist/_internal/server/features/digital-code/upload.js

@@ -0,0 +1,144 @@
+/**
+ * Upload for delivered digital content.
+ *
+ * 🛑 A SEPARATE PIPELINE FROM `/api/media/*`, ON PURPOSE.
+ *
+ * The public media pipeline ends by creating a `mediaAssets` row, and that row
+ * IS the `/media/{shortId}` slug — which `GET /api/media/[...slug]` serves with
+ * no authentication at all. Reusing it for paid content and then "remembering
+ * not to publish the URL" is not a boundary; the slug exists the moment the row
+ * does. So this writes to `private/digital-content/...`, mints no row, and the
+ * bytes are only ever readable through `resolveCodeAssetForOrder`, which checks
+ * that the caller owns the order.
+ *
+ * Everything else about the flow is deliberately identical to the public one —
+ * a short-lived signed PUT so bytes never traverse the Next.js function (Rule
+ * #6 caps a request body at 4.5 MB), then a server-side finalize that verifies
+ * the file by its MAGIC BYTES rather than by what the client declared.
+ */
+import { randomUUID } from "node:crypto";
+import { getAdminStorage } from "../../../../providers/db-firebase";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring";
+import { ValidationError } from "../../../../errors";
+import { classifyMime, isAllowedMime, maxBytesFor, PDF_MAGIC, } from "../../../shared/media/limits";
+import { DIGITAL_CONTENT_PREFIX } from "./pool";
+/** Signed-PUT lifetime. Long enough for a slow upload, short enough to matter. */
+const SIGNED_URL_TTL_MS = 15 * 60 * 1000;
+/** Magic bytes are read from the head of the object; 4 KB is ample for every type. */
+const MAGIC_BYTE_WINDOW = 4096;
+/** The content kind a declared MIME maps to. */
+export function contentKindForMime(mime) {
+    return classifyMime(mime) === "image" ? "image" : "file";
+}
+export async function signDigitalContentUpload(input) {
+    if (!isAllowedMime(input.contentType)) {
+        throw new ValidationError(`Unsupported file type: ${input.contentType}`);
+    }
+    const kind = classifyMime(input.contentType);
+    if (kind === "video") {
+        // Video as a delivered good is a different product with different economics
+        // (egress on a 50 MB file, per download, on the Hobby tier). Refuse loudly
+        // rather than accept it and discover the bill.
+        throw new ValidationError("Video cannot be delivered as digital content.");
+    }
+    const max = maxBytesFor(input.contentType);
+    if (!(input.size > 0))
+        throw new ValidationError("Empty file.");
+    if (max !== null && input.size > max) {
+        throw new ValidationError("File is too large.");
+    }
+    /*
+     * A RANDOM object name, which is the opposite of the convention everywhere
+     * else in this codebase. Public media filenames are content-derived for SEO —
+     * and therefore guessable, which is precisely the property that must not hold
+     * for a paid good. The private prefix already means Storage's world-read rule
+     * cannot be reached through any app route, and an unguessable name means a
+     * leaked path is not a leaked catalogue.
+     */
+    const safeName = input.fileName.replace(/[^\w.\-]+/g, "_").slice(-80) || "asset";
+    const storagePath = `${DIGITAL_CONTENT_PREFIX}/${input.productId}/${randomUUID()}-${safeName}`;
+    const expires = Date.now() + SIGNED_URL_TTL_MS;
+    const [uploadUrl] = await getAdminStorage()
+        .bucket()
+        .file(storagePath)
+        .getSignedUrl({
+        version: "v4",
+        action: "write",
+        expires,
+        contentType: input.contentType,
+    });
+    return {
+        uploadUrl,
+        storagePath,
+        contentKind: contentKindForMime(input.contentType),
+        expiresAt: new Date(expires).toISOString(),
+    };
+}
+/**
+ * Verify an uploaded object and return the facts a pool entry needs.
+ *
+ * 🛑 THE DECLARED MIME IS NOT EVIDENCE. `finalize` on the public pipeline exists
+ * for exactly this reason and returns a structured 422 `MIME_MISMATCH`; the same
+ * rule has to hold here, and matters more, because the output is handed to a
+ * paying buyer. A mismatch DELETES the object rather than leaving it in the
+ * bucket for a later caller to reference.
+ */
+export async function finalizeDigitalContentUpload(storagePath, declaredContentType) {
+    if (!storagePath.startsWith(`${DIGITAL_CONTENT_PREFIX}/`)) {
+        throw new ValidationError("Not a digital-content upload path.");
+    }
+    const file = getAdminStorage().bucket().file(storagePath);
+    const [exists] = await file.exists();
+    if (!exists)
+        throw new ValidationError("Upload not found.");
+    const [meta] = await file.getMetadata();
+    const size = Number(meta.size ?? 0);
+    const declaredKind = classifyMime(declaredContentType);
+    if (!declaredKind) {
+        await file.delete({ ignoreNotFound: true });
+        throw new ValidationError("Unsupported file type.");
+    }
+    const max = maxBytesFor(declaredContentType);
+    if (size <= 0 || (max !== null && size > max)) {
+        await file.delete({ ignoreNotFound: true });
+        throw new ValidationError("File is empty or too large.");
+    }
+    const [head] = await file.download({ start: 0, end: MAGIC_BYTE_WINDOW - 1 });
+    let detectedKind = null;
+    try {
+        const { fileTypeFromBuffer } = await import("file-type");
+        const detected = await fileTypeFromBuffer(head);
+        detectedKind = detected ? classifyMime(detected.mime) : null;
+        if (!detectedKind && head.subarray(0, PDF_MAGIC.length).toString("latin1") === PDF_MAGIC) {
+            detectedKind = "pdf";
+        }
+    }
+    catch (err) {
+        const normalized = normalizeError(err);
+        /*
+         * Detection FAILING is treated exactly like detection DISAGREEING — the
+         * check below sees `detectedKind === null` and deletes the object. So this
+         * catch cannot hide a bad upload; it only records why the prover gave up
+         * (a corrupt head, or file-type failing to load). Logging it matters
+         * because a systematic failure here would look like "every upload is
+         * malformed" to the person uploading.
+         */
+        serverLogger.warn("digital-content: magic-byte detection failed", {
+            error: normalized.message,
+            storagePath,
+        });
+    }
+    if (!detectedKind || detectedKind !== declaredKind) {
+        await file.delete({ ignoreNotFound: true });
+        throw new ValidationError("The uploaded file is not the type it claims to be, so it was discarded.");
+    }
+    const fileName = storagePath.split("/").pop().replace(/^[0-9a-f-]{36}-/, "");
+    return {
+        storagePath,
+        contentType: declaredContentType,
+        fileName,
+        contentKind: contentKindForMime(declaredContentType),
+        size,
+    };
+}

package/dist/_internal/server/features/grouped/og.d.ts

@@ -3,10 +3,13 @@
  *
  * Deliberately delegates to `renderBundleOgImage` rather than re-implementing
  * the layout: the card is the same shape (title, description, cover, item
- * count) minus the price, and `BundleOgData.priceLabel` / `.stockStatus` are
- * already nullable for exactly that case. Forking it would give two ~150-line
- * OG layouts to keep visually in step — the Duplication Framework's
- * "same prop surface, same output" consolidate rule.
+ * count), and `BundleOgData.stockStatus` is already nullable for the fields a
+ * group has no value for. Forking it would give two ~150-line OG layouts to
+ * keep visually in step — the Duplication Framework's "same prop surface, same
+ * output" consolidate rule.
+ *
+ * Neither card carries a price any more: an OG image is a public URL with the
+ * amount burned into the pixels, which no sign-in gate reaches.
  */
 import type { ReactElement } from "react";
 import type { GroupedListingDocument } from "../../../../features/grouped/schemas/firestore";

package/dist/_internal/server/features/grouped/og.js

@@ -3,10 +3,13 @@
  *
  * Deliberately delegates to `renderBundleOgImage` rather than re-implementing
  * the layout: the card is the same shape (title, description, cover, item
- * count) minus the price, and `BundleOgData.priceLabel` / `.stockStatus` are
- * already nullable for exactly that case. Forking it would give two ~150-line
- * OG layouts to keep visually in step — the Duplication Framework's
- * "same prop surface, same output" consolidate rule.
+ * count), and `BundleOgData.stockStatus` is already nullable for the fields a
+ * group has no value for. Forking it would give two ~150-line OG layouts to
+ * keep visually in step — the Duplication Framework's "same prop surface, same
+ * output" consolidate rule.
+ *
+ * Neither card carries a price any more: an OG image is a public URL with the
+ * amount burned into the pixels, which no sign-in gate reaches.
  */
 import { renderBundleOgImage } from "../bundles/og";
 import { resolveOgImageUrl } from "../seo/og";
@@ -16,8 +19,6 @@ export function renderGroupedListingOg(doc, opts) {
         description: doc?.description?.slice(0, 140) ??
             `A curated group of related listings on ${opts.siteName}.`,
         coverImageUrl: resolveOgImageUrl(doc?.coverImage ?? null, opts.baseUrl),
-        // A group has no price of its own — the buyer's selection is the price.
-        priceLabel: null,
         itemCount: doc?.productIds?.length ?? null,
         stockStatus: null,
     }, opts.siteName);

package/dist/_internal/server/features/item-requests/og.d.ts

@@ -17,7 +17,6 @@ import type { ReactElement } from "react";
 export interface ItemRequestOgData {
     title: string;
     opDisplayName?: string | null;
-    budgetLabel?: string | null;
     imageUrl?: string | null;
     status?: "open" | "closed" | "removed" | "approved" | null;
     replyCount?: number | null;

package/dist/_internal/server/features/item-requests/og.js

@@ -1,21 +1,14 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { resolveOgImageUrl } from "../seo/og";
-function formatPriceInr(amount) {
-    return `≤ ₹${amount.toLocaleString("en-IN")}`;
-}
 function normalizeStatus(s) {
     if (s === "open" || s === "closed" || s === "removed" || s === "approved")
         return s;
     return null;
 }
 export function renderItemRequestOg(doc, opts) {
-    const budgetLabel = typeof doc?.maxBudget === "number" && doc.maxBudget > 0
-        ? formatPriceInr(doc.maxBudget)
-        : null;
     return renderItemRequestOgImage({
         title: doc?.title ?? "Item Request",
         opDisplayName: doc?.opDisplayName ?? null,
-        budgetLabel,
         imageUrl: resolveOgImageUrl(doc?.imageUrls?.[0] ?? null, opts.baseUrl),
         status: normalizeStatus(doc?.status),
         replyCount: doc?.replyCount ?? null,
@@ -49,7 +42,7 @@ const STATUS_BADGE = {
     },
 };
 export function renderItemRequestOgImage(data, siteName) {
-    const { title, opDisplayName, budgetLabel, imageUrl, status, replyCount, category } = data;
+    const { title, opDisplayName, imageUrl, status, replyCount, category } = data;
     const statusBadge = status ? STATUS_BADGE[status] : null;
     const replyLabel = typeof replyCount === "number" && replyCount >= 0
         ? `${replyCount} repl${replyCount === 1 ? "y" : "ies"}`
@@ -113,16 +106,7 @@ export function renderItemRequestOgImage(data, siteName) {
                                     fontSize: 22,
                                     fontWeight: 700,
                                     border: `1px solid ${statusBadge.border}`,
-                                }, children: statusBadge.text })), budgetLabel && (_jsx("div", { style: {
-                                    display: "inline-flex",
-                                    padding: "10px 22px",
-                                    borderRadius: 999,
-                                    background: "rgba(34, 211, 238, 0.18)",
-                                    color: "#cffafe",
-                                    fontSize: 22,
-                                    fontWeight: 700,
-                                    border: "1px solid rgba(34, 211, 238, 0.4)",
-                                }, children: budgetLabel })), replyLabel && (_jsx("div", { style: {
+                                }, children: statusBadge.text })), replyLabel && (_jsx("div", { style: {
                                     display: "inline-flex",
                                     padding: "10px 22px",
                                     borderRadius: 999,

package/dist/_internal/server/features/live/og.d.ts

@@ -3,7 +3,6 @@ import type { ProductDocument } from "../../../../features/products/schemas/fire
 export interface LiveItemOgData {
     title: string;
     species?: string | null;
-    priceLabel?: string | null;
     imageUrl?: string | null;
 }
 interface LiveItemDocLike {

package/dist/_internal/server/features/live/og.js

@@ -1,17 +1,9 @@
 import { renderOgLayout } from "../seo/og-layout";
 import { resolveOgImageUrl } from "../seo/og";
 export function renderLiveItemOg(doc, opts) {
-    const priceLabel = doc?.price != null
-        ? new Intl.NumberFormat("en-IN", {
-            style: "currency",
-            currency: doc.currency ?? "INR",
-            maximumFractionDigits: 0,
-        }).format(doc.price)
-        : null;
     return renderLiveItemOgImage({
         title: doc?.title ?? "Live Listing",
         species: doc?.liveItem?.species ?? null,
-        priceLabel,
         imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
     }, opts.siteName);
 }
@@ -21,7 +13,7 @@ export function renderLiveItemOgImage(data, siteName) {
         subtitle: data.species ?? undefined,
         imageUrl: data.imageUrl,
         siteName: `${siteName} · Live Listing`,
-        accentSlot: data.priceLabel,
+        accentSlot: null,
         theme: { background: "#052e16", accentColor: "#86efac" },
     });
 }

package/dist/_internal/server/features/prize-draws/og.js

@@ -4,18 +4,13 @@
  */
 import { renderOgLayout } from "../seo/og-layout";
 import { resolveOgImageUrl } from "../seo/og";
-function formatPriceInr(amount, currency) {
-    return new Intl.NumberFormat("en-IN", {
-        style: "currency",
-        currency,
-        maximumFractionDigits: 0,
-    }).format(amount);
-}
 export function renderPrizeDrawOg(doc, opts) {
     const entryPrice = doc?.pricePerEntry ?? doc?.price ?? null;
-    const pricePerEntryLabel = typeof entryPrice === "number" && entryPrice > 0
-        ? `${formatPriceInr(entryPrice, doc?.currency ?? "INR")} / entry`
-        : "Free entry";
+    // "Free entry" is kept — it is a fact about the draw, not a disclosed amount,
+    // and it is the half of this chip that actually earns a click. The priced case
+    // renders nothing: an OG image is a public URL with the value burned into the
+    // pixels, which no sign-in gate or paywall markup can reach.
+    const pricePerEntryLabel = typeof entryPrice === "number" && entryPrice > 0 ? null : "Free entry";
     const max = doc?.prizeMaxEntries ?? null;
     const current = doc?.prizeCurrentEntries ?? 0;
     const entriesLabel = typeof max === "number" && max > 0

package/dist/_internal/server/features/products/og.js

@@ -9,11 +9,14 @@ export function renderProductOg(doc, opts) {
     }, opts.siteName);
 }
 export function renderProductOgImage(data, siteName) {
-    const priceLabel = data.price ? `₹${data.price.toLocaleString("en-IN")}` : null;
+    // 🛑 No money in the accent slot. An OG image is a PUBLIC image URL anyone can
+    // fetch directly, with the amount burned into the pixels — no gate reaches it,
+    // and no paywall markup describes it. The auction and pre-order OGs already
+    // use a non-money accent (end date / release date); this matches them.
     return renderOgLayout({
         title: data.title,
         imageUrl: data.imageUrl,
         siteName,
-        accentSlot: priceLabel,
+        accentSlot: null,
     });
 }

package/dist/_internal/server/features/seo/sitemap.js

@@ -62,8 +62,16 @@ function staticPages(baseUrl) {
     const page = (path, changeFreq, priority) => ({ url: `${baseUrl}${path}`, lastModified: new Date(), changeFrequency: changeFreq, priority });
     return [
         page(String(ROUTES.HOME), "daily", 1.0),
-        page(String(ROUTES.PUBLIC.PRODUCTS), "hourly", 0.9),
-        page(String(ROUTES.PUBLIC.AUCTIONS), "hourly", 0.9),
+        // "daily", not "hourly". These two are the highest-priority URLs in the
+        // sitemap AND the entry points into the deepest faceted URL space
+        // (tab x sortKey x page), so an hourly hint invites recrawl of that whole
+        // surface at a rate a catalogue this size cannot justify — new listings
+        // arrive daily, not hourly. `changeFrequency` is only a hint and Google has
+        // said it largely disregards it, so treat this as removing a bad signal
+        // rather than as a lever: priority is unchanged and neither page loses
+        // indexability. 2026-09-14, Vercel usage reduction.
+        page(String(ROUTES.PUBLIC.PRODUCTS), "daily", 0.9),
+        page(String(ROUTES.PUBLIC.AUCTIONS), "daily", 0.9),
         page(String(ROUTES.PUBLIC.CATEGORIES), "weekly", 0.8),
         page(String(ROUTES.PUBLIC.BRANDS), "weekly", 0.7),
         page(String(ROUTES.PUBLIC.BLOG), "daily", 0.7),

package/dist/_internal/server/features/shared/listing-adapters.d.ts

@@ -4,7 +4,6 @@ export interface BaseListingClientShape {
     title: string;
     description: string;
     price: number;
-    priceLabel: string;
     currency: string;
     mainImage: string | null;
     images: string[];
@@ -15,5 +14,5 @@ export interface BaseListingClientShape {
     status: ProductDocument["status"];
     createdAt: string;
 }
-/** Maps the 11 shared fields from a raw Firestore ProductDocument. */
+/** Maps the shared fields from a raw Firestore ProductDocument. */
 export declare function mapBaseListingFields(doc: ProductDocument): BaseListingClientShape;

package/dist/_internal/server/features/shared/listing-adapters.js

@@ -1,12 +1,14 @@
-import { formatCurrency } from "../../../../utils/number.formatter";
-/** Maps the 11 shared fields from a raw Firestore ProductDocument. */
+/** Maps the shared fields from a raw Firestore ProductDocument. */
 export function mapBaseListingFields(doc) {
     return {
         id: doc.id,
         title: doc.title,
         description: doc.description,
         price: doc.price,
-        priceLabel: formatCurrency(doc.price, doc.currency ?? "INR"),
+        // 🛑 No pre-formatted money string here. A `priceLabel` baked server-side
+        // is a ready-to-print amount that any component can render directly,
+        // bypassing <GatedPrice> entirely — and it had zero readers, so it was
+        // pure exposure. Clients format from `price` through the gate.
         currency: doc.currency ?? "INR",
         mainImage: doc.mainImage || doc.images?.[0] || null,
         images: doc.images ?? [],