@mohasinac/appkit 4.43.0 → 4.45.0

package/dist/_internal/server/features/blog/data.js

@@ -1,5 +1,5 @@
 import { cache } from "react";
-import { blogRepository } from "../../../../repositories";
+import { blogRepository } from "../../../../repositories/index.js";
 export const getBlogPostForDetail = cache(async (slug) => {
     return (await blogRepository.findBySlug(slug)) ?? null;
 });

package/dist/_internal/server/features/blog/index.js

@@ -1,5 +1,5 @@
-export { getBlogPostForDetail, getBlogPostById } from "./data";
-export { assertBlogPostExists, computeReadTime } from "./service";
-export { createBlogPostAction, updateBlogPostAction, deleteBlogPostAction, publishBlogPostAction, unpublishBlogPostAction, } from "./actions";
-export { BLOG_PAGE_SIZE, BLOG_FEATURED_LIMIT, BLOG_RELATED_LIMIT, BLOG_SITEMAP_LIMIT, } from "../../../shared/features/blog/config";
-export { renderBlogOgImage, renderBlogOg } from "./og";
+export { getBlogPostForDetail, getBlogPostById } from "./data.js";
+export { assertBlogPostExists, computeReadTime } from "./service.js";
+export { createBlogPostAction, updateBlogPostAction, deleteBlogPostAction, publishBlogPostAction, unpublishBlogPostAction, } from "./actions.js";
+export { BLOG_PAGE_SIZE, BLOG_FEATURED_LIMIT, BLOG_RELATED_LIMIT, BLOG_SITEMAP_LIMIT, } from "../../../shared/features/blog/config.js";
+export { renderBlogOgImage, renderBlogOg } from "./og.js";

package/dist/_internal/server/features/blog/og.js

@@ -1,5 +1,5 @@
-import { renderOgLayout } from "../seo/og-layout";
-import { resolveOgImageUrl } from "../seo/og";
+import { renderOgLayout } from "../seo/og-layout.js";
+import { resolveOgImageUrl } from "../seo/og.js";
 /** High-level OG renderer — accepts the raw blog post document from `getBlogPostForDetail`. */
 export function renderBlogOg(doc, opts) {
     const rawCoverImage = typeof doc?.coverImage === "string"

package/dist/_internal/server/features/blog/service.js

@@ -1,5 +1,5 @@
-import { blogRepository } from "../../../../repositories";
-import { BlogPostNotFoundError, BlogSlugConflictError } from "../../../shared/features/blog/errors";
+import { blogRepository } from "../../../../repositories/index.js";
+import { BlogPostNotFoundError, BlogSlugConflictError } from "../../../shared/features/blog/errors.js";
 export async function assertBlogPostExists(slugOrId) {
     const post = await blogRepository.findBySlug(slugOrId)
         ?? await blogRepository.findById(slugOrId);

package/dist/_internal/server/features/brands/actions.js

@@ -1,10 +1,10 @@
 "use server";
 import { wrapAction } from "@mohasinac/appkit/server";
-import { categoriesRepository } from "../../../../repositories";
-import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
-import { brandInputSchema, brandUpdateSchema } from "../../../shared/features/brands/schema";
-import { assertBrandExists, assertBrandSlugUnique } from "./service";
-import { ValidationError } from "../../../shared/errors/index";
+import { categoriesRepository } from "../../../../repositories/index.js";
+import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
+import { brandInputSchema, brandUpdateSchema } from "../../../shared/features/brands/schema.js";
+import { assertBrandExists, assertBrandSlugUnique } from "./service.js";
+import { ValidationError } from "../../../shared/errors/index.js";
 /**
  * Translate the brand-input wire format (logoURL / bannerURL / website /
  * country / founded) to the CategoryDocument storage shape after

package/dist/_internal/server/features/brands/data.js

@@ -1,5 +1,5 @@
 import { cache } from "react";
-import { categoriesRepository } from "../../../../repositories";
+import { categoriesRepository } from "../../../../repositories/index.js";
 /**
  * Brand detail loader — SB-UNI-C moved brands into the `categories`
  * collection with `categoryType: "brand"`. Both `generateMetadata` and

package/dist/_internal/server/features/brands/index.js

@@ -1,5 +1,5 @@
-export { getBrandForDetail, getBrandCategoryForDetail } from "./data";
-export { assertBrandExists, assertBrandSlugUnique } from "./service";
-export { createBrandAction, updateBrandAction, deleteBrandAction, toggleBrandActiveAction } from "./actions";
-export { BRANDS_PAGE_SIZE, BRANDS_FEATURED_LIMIT, BRAND_NAME_MAX_LENGTH, } from "../../../shared/features/brands/config";
-export { renderBrandOgImage, renderBrandOg } from "./og";
+export { getBrandForDetail, getBrandCategoryForDetail } from "./data.js";
+export { assertBrandExists, assertBrandSlugUnique } from "./service.js";
+export { createBrandAction, updateBrandAction, deleteBrandAction, toggleBrandActiveAction } from "./actions.js";
+export { BRANDS_PAGE_SIZE, BRANDS_FEATURED_LIMIT, BRAND_NAME_MAX_LENGTH, } from "../../../shared/features/brands/config.js";
+export { renderBrandOgImage, renderBrandOg } from "./og.js";

package/dist/_internal/server/features/brands/og.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { resolveOgImageUrl } from "../seo/og";
+import { resolveOgImageUrl } from "../seo/og.js";
 /** High-level OG renderer — accepts the raw brand document from `getBrandForDetail`. */
 export function renderBrandOg(doc, opts) {
     const name = doc?.name ?? "Brand";

package/dist/_internal/server/features/brands/service.js

@@ -1,5 +1,5 @@
-import { categoriesRepository } from "../../../../repositories";
-import { BrandNotFoundError, BrandSlugConflictError } from "../../../shared/features/brands/errors";
+import { categoriesRepository } from "../../../../repositories/index.js";
+import { BrandNotFoundError, BrandSlugConflictError } from "../../../shared/features/brands/errors.js";
 export async function assertBrandExists(slugOrId) {
     const brand = (await categoriesRepository.findBySlugAndType(slugOrId, "brand")) ??
         (await categoriesRepository.findById(slugOrId));

package/dist/_internal/server/features/bundles/actions.js

@@ -12,14 +12,14 @@
  * bundleCategorySlug + bundleProductIds so checkout's bundle-expansion
  * helpers can fan out stock decrements to member products.
  */
-import { NotFoundError, ValidationError } from "../../../../errors";
-import { safeRead } from "../../../../errors/safe-read";
-import { categoriesRepository } from "../../../../repositories";
-import { cartRepository } from "../../../../features/cart/repository/cart.repository";
-import { assertCanAddNewItems } from "../../../../features/cart/actions/cart-actions";
-import { productRepository } from "../../../../features/products/repository/products.repository";
-import { normalizeListingType } from "../../../../features/products/utils/listing-type";
-import { getDefaultCurrency } from "../../../../core/baseline-resolver";
+import { NotFoundError, ValidationError } from "../../../../errors/index.js";
+import { safeRead } from "../../../../errors/safe-read.js";
+import { categoriesRepository } from "../../../../repositories/index.js";
+import { cartRepository } from "../../../../features/cart/repository/cart.repository.js";
+import { assertCanAddNewItems } from "../../../../features/cart/actions/cart-actions.js";
+import { productRepository } from "../../../../features/products/repository/products.repository.js";
+import { normalizeListingType } from "../../../../features/products/utils/listing-type.js";
+import { getDefaultCurrency } from "../../../../core/baseline-resolver.js";
 export async function addBundleToCartAction(userId, bundleSlug, 
 /** Number of COPIES of the whole bundle. Bundles are all-or-nothing, so this
  *  is the only quantity a buyer can change — member quantities are fixed. */

package/dist/_internal/server/features/bundles/data.js

@@ -6,10 +6,10 @@
  * and its `generateMetadata` share one Firestore read per request.
  */
 import { cache } from "react";
-import { categoriesRepository } from "../../../../repositories";
-import { productRepository } from "../../../../repositories";
-import { safeRead } from "../../../../errors/safe-read";
-import { hidePublicTestData } from "../tester/visibility";
+import { categoriesRepository } from "../../../../repositories/index.js";
+import { productRepository } from "../../../../repositories/index.js";
+import { safeRead } from "../../../../errors/safe-read.js";
+import { hidePublicTestData } from "../tester/visibility.js";
 /**
  * Fetch a single bundle by slug for the public detail page. Returns null
  * when the slug is empty or no matching `categoryType:"bundle"` row exists.

package/dist/_internal/server/features/bundles/index.js

@@ -1,5 +1,5 @@
-export { getBundleForDetail, listBundleMembers, listFeaturedBundles, getRelatedBundles, resolveBundleMemberIds, resolveBundleOriginalTotal, findBundleMemberStores, resolveBundleCategorySlugs, } from "./data";
-export { buildBundleMetadata } from "./metadata";
+export { getBundleForDetail, listBundleMembers, listFeaturedBundles, getRelatedBundles, resolveBundleMemberIds, resolveBundleOriginalTotal, findBundleMemberStores, resolveBundleCategorySlugs, } from "./data.js";
+export { buildBundleMetadata } from "./metadata.js";
 // S-SBUNI-4 2026-05-13 — bundle OG renderer.
-export { renderBundleOg, renderBundleOgImage, } from "./og";
-export { addBundleToCartAction } from "./actions";
+export { renderBundleOg, renderBundleOgImage, } from "./og.js";
+export { addBundleToCartAction } from "./actions.js";

package/dist/_internal/server/features/bundles/og.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { resolveOgImageUrl } from "../seo/og";
+import { resolveOgImageUrl } from "../seo/og.js";
 export function renderBundleOg(doc, opts) {
     const name = doc?.name ?? "Bundle";
     return renderBundleOgImage({

package/dist/_internal/server/features/cart/actions.js

@@ -1,10 +1,10 @@
 "use server";
 import { wrapAction } from "@mohasinac/appkit/server";
-import { cartRepository } from "../../../../repositories";
-import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
-import { addToCartSchema, removeFromCartSchema, mergeGuestCartSchema } from "../../../shared/features/cart/schema";
-import { upsertCartItem, mergeGuestItems } from "./service";
-import { ValidationError } from "../../../shared/errors/index";
+import { cartRepository } from "../../../../repositories/index.js";
+import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
+import { addToCartSchema, removeFromCartSchema, mergeGuestCartSchema } from "../../../shared/features/cart/schema.js";
+import { upsertCartItem, mergeGuestItems } from "./service.js";
+import { ValidationError } from "../../../shared/errors/index.js";
 export async function addToCartAction(input) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);

package/dist/_internal/server/features/cart/data.js

@@ -1,5 +1,5 @@
 import { cache } from "react";
-import { cartRepository } from "../../../../repositories";
+import { cartRepository } from "../../../../repositories/index.js";
 export const getCartForUser = cache(async (userId) => {
     // No catch: this cart IS the page. Degrading a Firestore failure to null
     // renders an EMPTY CART to someone whose cart is full — money path.

package/dist/_internal/server/features/cart/index.js

@@ -1,4 +1,4 @@
-export { getCartForUser } from "./data";
-export { assertCartCapacity, upsertCartItem, mergeGuestItems } from "./service";
-export { addToCartAction, removeFromCartAction, clearCartAction, mergeGuestCartAction } from "./actions";
-export { CART_MAX_ITEMS, CART_GUEST_STORAGE_KEY } from "../../../shared/features/cart/config";
+export { getCartForUser } from "./data.js";
+export { assertCartCapacity, upsertCartItem, mergeGuestItems } from "./service.js";
+export { addToCartAction, removeFromCartAction, clearCartAction, mergeGuestCartAction } from "./actions.js";
+export { CART_MAX_ITEMS, CART_GUEST_STORAGE_KEY } from "../../../shared/features/cart/config.js";

package/dist/_internal/server/features/cart/service.js

@@ -1,8 +1,8 @@
-import { cartRepository } from "../../../../repositories";
-import { CART_MAX_ITEMS } from "../../../shared/features/cart/config";
-import { CartFullError, CartQuantityError } from "../../../shared/features/cart/errors";
-import { normalizeError } from "../../../../errors/normalize";
-import { serverLogger } from "../../../../monitoring/server-logger";
+import { cartRepository } from "../../../../repositories/index.js";
+import { CART_MAX_ITEMS } from "../../../shared/features/cart/config.js";
+import { CartFullError, CartQuantityError } from "../../../shared/features/cart/errors.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { serverLogger } from "../../../../monitoring/server-logger.js";
 export async function assertCartCapacity(userId, addingQty) {
     // No catch. Swallowing to null made `currentItemCount` 0, so a Firestore
     // failure silently DISABLED the cart cap and let the add through — a guard

package/dist/_internal/server/features/catalogue/og.js

@@ -1,5 +1,5 @@
-import { renderOgLayout } from "../seo/og-layout";
-import { resolveOgImageUrl } from "../seo/og";
+import { renderOgLayout } from "../seo/og-layout.js";
+import { resolveOgImageUrl } from "../seo/og.js";
 export function renderCatalogueItemOg(doc, opts) {
     return renderCatalogueItemOgImage({
         title: doc?.title ?? "Catalogue Item",

package/dist/_internal/server/features/categories/adapters.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Category adapters — the single allow-list projection for every public
+ * category response.
+ *
+ * Every field of `CategoryDocument` is triaged into exactly one of
+ * `PUBLIC_CATEGORY_FIELDS` (mapped into the returned literal) or
+ * `PRIVATE_CATEGORY_FIELDS` (with a stated reason), mirroring the store and
+ * site-settings adapters. A field added to the schema and to neither list
+ * fails `scripts/audit-public-projection-parity.mjs`, so new fields are
+ * private by default.
+ *
+ * Why this exists (2026-10-10): `GET /api/categories` returned `result.data`
+ * raw — the whole document — on an unauthenticated, hour-edge-cached route.
+ * That published `createdBy` (a uid), `createdByStoreId`, `createdByStoreName`
+ * and, worst, `metrics.productIds[]` / `metrics.auctionIds[]`: two UNBOUNDED
+ * arrays that grow with the catalogue. `CategoryInlineSelect` calls that route
+ * with `pageSize=200` on every seller-form open, so the payload scaled with
+ * both the number of categories and the number of products in each.
+ *
+ * 🛑 There is an older `CATEGORIES_PUBLIC_FIELDS` in
+ * `features/categories/schemas/firestore.ts`. It has ZERO runtime consumers,
+ * predates `categoryType` / `highlights` / `faqs` / `itemCode` / the brand and
+ * bundle fields, and is a `.select()`-style dot-path list rather than a
+ * projection. It is deliberately not reused here; this module is the one the
+ * route actually calls.
+ */
+import type { CategoryDocument } from "../../../../features/categories/schemas/firestore";
+import type { CategoryItem } from "../../../../features/categories/types/index";
+/**
+ * Document fields that may reach an unauthenticated client. Keep in sync with
+ * the object literal in `toCategoryListItem` — the audit asserts both
+ * directions.
+ */
+export declare const PUBLIC_CATEGORY_FIELDS: readonly ["id", "name", "slug", "description", "rootId", "parentIds", "childrenIds", "tier", "path", "order", "isLeaf", "ancestors", "categoryType", "itemCode", "isFeatured", "featuredPriority", "seo", "display", "isActive", "highlights", "faqs", "brandWebsite", "brandCountry", "brandFounded", "metrics", "createdAt", "updatedAt"];
+/**
+ * Fields withheld, each with the reason. Never remove one without replacing
+ * the reason — "it seemed unused" is how a field ends up public by accident.
+ */
+export declare const PRIVATE_CATEGORY_FIELDS: readonly ["position", "subtreeSize", "createdBy", "createdByType", "createdByStoreId", "createdByStoreName", "viewCount", "isBrand", "showOnHomepage", "isSearchable", "searchTxt", "aliases", "brandSlug", "bundleKind", "bundlePrice", "bundleStockStatus", "bundleProductIds", "bundleCategorySlugs", "bundleOriginalTotal", "bundleItemDetails", "contentBody", "descriptionTemplates", "productDefaults", "isTestData", "testDataExpiresAt", "bundleQueryRule", "bundleQueryResolvedAt"];
+/**
+ * Project a stored category into the public shape.
+ *
+ * Built by NAMING each field, never by spreading and deleting — a deny-list
+ * publishes every field nobody thought to remove, including ones the
+ * interface does not declare (Root Cause #70).
+ */
+export declare function toCategoryListItem(doc: CategoryDocument): CategoryItem;

package/dist/_internal/server/features/categories/adapters.js

@@ -0,0 +1,235 @@
+/**
+ * Document fields that may reach an unauthenticated client. Keep in sync with
+ * the object literal in `toCategoryListItem` — the audit asserts both
+ * directions.
+ */
+export const PUBLIC_CATEGORY_FIELDS = [
+    "id",
+    "name",
+    "slug",
+    "description",
+    // Structure. The client builds its own tree and breadcrumbs from these.
+    "rootId",
+    "parentIds",
+    "childrenIds",
+    "tier",
+    "path",
+    "order",
+    "isLeaf",
+    "ancestors",
+    // Discriminator — public because every consumer must tell a listing
+    // category apart from a brand/bundle/sublisting row, and a plain category
+    // OMITS the field, so the test can only be done client-side.
+    "categoryType",
+    "itemCode",
+    // Presentation.
+    "isFeatured",
+    "featuredPriority",
+    "seo",
+    "display",
+    // Read by `AdminCategoriesView`'s Status column off this very route.
+    "isActive",
+    // Editorial copy — already rendered publicly by
+    // `CategoryHighlightsAndFaqSection` on the category and brand pages.
+    "highlights",
+    "faqs",
+    // Brand-row fields, rendered in the "About this brand" panel.
+    "brandWebsite",
+    "brandCountry",
+    "brandFounded",
+    // Rollup counts only — see `metrics` in the private list.
+    "metrics",
+    "createdAt",
+    "updatedAt",
+];
+/**
+ * Fields withheld, each with the reason. Never remove one without replacing
+ * the reason — "it seemed unused" is how a field ends up public by accident.
+ */
+export const PRIVATE_CATEGORY_FIELDS = [
+    // Internal DFS coordinates. Useful only to `onCategoryWrite` and
+    // `positionsReconcile`; publishing them invites a client to depend on an
+    // ordering we renumber on every reseed.
+    "position",
+    "subtreeSize",
+    // Operator identity. `createdBy` is a raw uid.
+    "createdBy",
+    "createdByType",
+    "createdByStoreId",
+    "createdByStoreName",
+    // Analytics, not content.
+    "viewCount",
+    // @deprecated duplicate of `categoryType === "brand"`.
+    "isBrand",
+    /*
+     * The next four are withheld NOT because they are sensitive but because
+     * no client reads them off THIS route — verified by grep, per consumer:
+     *
+     *   showOnHomepage  — homepage curation runs server-side; `CategoryItem`
+     *                     declares no such field and nothing reads one.
+     *   isSearchable    — a query-time flag. No client branches on it.
+     *   brandSlug       — a bundle's own brand tag. Its two readers are
+     *                     `AdminBundleEditorView` (via ADMIN_ENDPOINTS.BUNDLES,
+     *                     a different route) and `BrandDetailPageView` (which
+     *                     holds the raw `CategoryDocument` server-side).
+     *   bundle*         — same story: every bundle surface is fed by
+     *                     ADMIN_ENDPOINTS.BUNDLES or by a server-side read.
+     *
+     * 🛑 If a bundle card is ever fed from `/api/categories`, promote the
+     * bundle fields HERE and add them to `CategoryItem` — do not reach for a
+     * cast at the call site, which is Root Cause #70's exact mechanism.
+     */
+    "showOnHomepage",
+    "isSearchable",
+    /*
+     * The prefix-expanded search index. Withheld for two reasons, not one:
+     *
+     *   - No client reads it. Searching is a SERVER concern — the term is pushed
+     *     down as an `array-contains` on `CATEGORY_FIELDS.SEARCH_TXT`; a browser
+     *     has no use for the token array.
+     *   - It is 53–160 tokens per row (measured, cap 600). Publishing it would
+     *     roughly double this payload on a route `CategoryInlineSelect` hits
+     *     with `pageSize=200` on every seller-form open — the exact cost
+     *     Root Cause #104 was about.
+     */
+    "searchTxt",
+    /*
+     * `aliases` — B5. The alternate names a leaf is searched by ("Lost
+     * Longinus" for the row stored as "Luinor L2", plus its product code).
+     *
+     * Withheld from THIS route because nothing reads it here: the aliases exist
+     * to be folded into `searchTxt` at write time, and the matching happens
+     * server-side. `CategoryItem` declares no such field, and the only consumer
+     * of this route at scale is `CategoryInlineSelect` at `pageSize=200`, which
+     * shows a name and nothing else.
+     *
+     * 🛑 Not secret, and the distinction matters for the next person: every
+     * alias is ALREADY inferable from search results, because it is tokenised
+     * into the index this route helps query. If a detail page ever wants to
+     * render an "also known as" line — which would be genuinely useful on a
+     * named-model leaf — promote it here AND add it to `CategoryItem`, rather
+     * than casting at the call site (Root Cause #70's exact mechanism).
+     */
+    "aliases",
+    "brandSlug",
+    "bundleKind",
+    "bundlePrice",
+    "bundleStockStatus",
+    "bundleProductIds",
+    "bundleCategorySlugs",
+    "bundleOriginalTotal",
+    "bundleItemDetails",
+    /*
+     * ── Category-owned content (B3) ──────────────────────────────────────────
+     *
+     * All three are PRIVATE on this route and that is a payload decision, not a
+     * secrecy one — they are genuinely public content, just not from here.
+     *
+     * This is the LIST projection, and `CategoryInlineSelect` calls it with
+     * `pageSize=200` on every seller-form open. `contentBody` alone is 400–900
+     * chars of HTML per row, so publishing it here would add ~180 KB to a
+     * response whose only job is to fill a picker — the Fast-Origin-Transfer
+     * shape of Root Cause #104, on the resource this project is most over on.
+     *
+     * Each has exactly one real reader and neither is this route:
+     *
+     *   contentBody          — the category DETAIL page, which holds the raw
+     *                          CategoryDocument server-side (getCategoryBySlug).
+     *   descriptionTemplates — the seller form, via the narrow
+     *                          /api/categories/[id]/description-template
+     *                          endpoint (C2), one category at a time, edge-cached
+     *                          for an hour.
+     *   productDefaults      — `deriveTaxonomy`, server-side, on the product
+     *                          write path; plus the same narrow endpoint for the
+     *                          seller-facing price hint.
+     *
+     * 🛑 If a surface ever needs one of these from the list route, promote it
+     * here AND add it to `CategoryItem` AND to the literal in
+     * `toCategoryListItem` — do not cast at the call site, which is Root Cause
+     * #70's exact mechanism.
+     */
+    "contentBody",
+    "descriptionTemplates",
+    "productDefaults",
+    // Test-data plumbing. `hidePublicTestData()` filters on these server-side;
+    // a client has no business branching on them.
+    "isTestData",
+    "testDataExpiresAt",
+    // The rule that resolves a dynamic bundle's members. Publishing it hands
+    // out the query, and the resolved `bundleProductIds` is already public.
+    "bundleQueryRule",
+    "bundleQueryResolvedAt",
+];
+/**
+ * Rollup counters only.
+ *
+ * 🛑 `metrics.productIds[]` and `metrics.auctionIds[]` are deliberately
+ * dropped. They are unbounded arrays — one entry per product in the category
+ * — and they were the bulk of the raw payload. Nothing client-side reads them
+ * that a query cannot answer, and a category page already fetches its own
+ * products.
+ */
+function toPublicMetrics(m) {
+    return {
+        productCount: m?.productCount ?? 0,
+        auctionCount: m?.auctionCount ?? 0,
+        totalProductCount: m?.totalProductCount ?? 0,
+        totalAuctionCount: m?.totalAuctionCount ?? 0,
+        totalItemCount: m?.totalItemCount ?? 0,
+    };
+}
+/**
+ * Project a stored category into the public shape.
+ *
+ * Built by NAMING each field, never by spreading and deleting — a deny-list
+ * publishes every field nobody thought to remove, including ones the
+ * interface does not declare (Root Cause #70).
+ */
+export function toCategoryListItem(doc) {
+    /*
+     * No `as CategoryItem` on the literal below, on purpose. The cast is what
+     * lets a shape drift silently; without it tsc checks every key, and it
+     * already caught `createdAt` being a Date where the contract wants a
+     * string.
+     */
+    return {
+        id: doc.id,
+        name: doc.name,
+        slug: doc.slug,
+        description: doc.description,
+        rootId: doc.rootId,
+        parentIds: doc.parentIds,
+        childrenIds: doc.childrenIds,
+        tier: doc.tier,
+        path: doc.path,
+        order: doc.order,
+        isLeaf: doc.isLeaf,
+        ancestors: doc.ancestors,
+        categoryType: doc.categoryType,
+        itemCode: doc.itemCode,
+        isFeatured: doc.isFeatured,
+        featuredPriority: doc.featuredPriority,
+        seo: doc.seo,
+        display: doc.display,
+        isActive: doc.isActive,
+        highlights: doc.highlights,
+        faqs: doc.faqs,
+        brandWebsite: doc.brandWebsite,
+        brandCountry: doc.brandCountry,
+        brandFounded: doc.brandFounded,
+        metrics: toPublicMetrics(doc.metrics),
+        // 🛑 `CategoryDocument` stores Dates; `CategoryItem` declares strings —
+        // this projection is also the serialisation boundary. Converting here
+        // rather than casting is deliberate: `as unknown as CategoryItem` has no
+        // runtime effect and would have shipped raw `Timestamp`/`Date` objects
+        // into an RSC payload, which is Root Cause #70's exact mechanism.
+        createdAt: toIsoString(doc.createdAt),
+        updatedAt: toIsoString(doc.updatedAt),
+    };
+}
+/** Firestore hands back `Date`; the client contract is an ISO string. */
+function toIsoString(value) {
+    if (!value)
+        return undefined;
+    return value instanceof Date ? value.toISOString() : String(value);
+}

package/dist/_internal/server/features/categories/data.js

@@ -1,9 +1,9 @@
 "use server";
 import { cache } from "react";
-import { categoriesRepository } from "../../../../repositories";
-import { safeRead } from "../../../../errors/safe-read";
-import { CATEGORIES_FEATURED_LIMIT, CATEGORIES_MENU_LIMIT, CATEGORIES_SITEMAP_LIMIT } from "../../../shared/features/categories/config";
-import { hidePublicTestData } from "../tester/visibility";
+import { categoriesRepository } from "../../../../repositories/index.js";
+import { safeRead } from "../../../../errors/safe-read.js";
+import { CATEGORIES_FEATURED_LIMIT, CATEGORIES_MENU_LIMIT, CATEGORIES_SITEMAP_LIMIT } from "../../../shared/features/categories/config.js";
+import { hidePublicTestData } from "../tester/visibility.js";
 /** Full category document by slug — deduped per request via React.cache(). */
 export const getCategoryForDetail = cache(async (slug) => {
     /*

package/dist/_internal/server/features/categories/index.js

@@ -1,2 +1,2 @@
-export { getCategoryForDetail, listRootCategories, listFeaturedCategories, listMenuCategories, getCategoryTree, listSitemapCategories, } from "./data";
-export { CATEGORIES_PAGE_SIZE, CATEGORIES_ROOT_TIER, CATEGORIES_MAX_DEPTH, CATEGORIES_SITEMAP_LIMIT, CATEGORIES_FEATURED_LIMIT, CATEGORIES_MENU_LIMIT, } from "../../../shared/features/categories/config";
+export { getCategoryForDetail, listRootCategories, listFeaturedCategories, listMenuCategories, getCategoryTree, listSitemapCategories, } from "./data.js";
+export { CATEGORIES_PAGE_SIZE, CATEGORIES_ROOT_TIER, CATEGORIES_MAX_DEPTH, CATEGORIES_SITEMAP_LIMIT, CATEGORIES_FEATURED_LIMIT, CATEGORIES_MENU_LIMIT, } from "../../../shared/features/categories/config.js";

package/dist/_internal/server/features/categories/og.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { resolveOgImageUrl } from "../seo/og";
+import { resolveOgImageUrl } from "../seo/og.js";
 export function renderCategoryOg(doc, opts) {
     const name = doc?.name ?? "Category";
     return renderCategoryOgImage({

package/dist/_internal/server/features/checkout/actions.d.ts

@@ -1,3 +1,4 @@
+import { type StoreShippingPolicy } from "../../../shared/features/shipping/mode";
 import { type CartLane } from "../../../shared/checkout/lanes";
 import type { OutOfStockPolicy } from "../../../../features/orders/schemas/index";
 import { type CheckoutPaymentMethod } from "../../../shared/features/checkout/config";
@@ -36,6 +37,33 @@ export declare function resolveShippingCost(storeId: string | undefined): Promis
     storeOwnerId: string | undefined;
     storeEmiEnabled: boolean;
     storeState: string | undefined;
+    /** C5b — the resolved policy, so a caller can quote with the cart in hand. */
+    shippingPolicy: StoreShippingPolicy;
+    /**
+     * 🛑 True when the mode is `estimate` and no carrier rate was supplied.
+     *
+     * The caller MUST act on this rather than trusting `shippingFee: 0` — a
+     * zero there would ship every parcel free at our expense, silently, until
+     * somebody noticed. Returning both is what makes the distinction visible.
+     */
+    shippingUnavailable: boolean;
+    /**
+     * C5e tier 2 — which protections this seller has agreed to be held to.
+     *
+     * Carried here rather than read separately because this function already
+     * holds the store document, and a second `findById` per order group would
+     * spend a Firestore read against Rule #6's ~3-round-trip budget to learn two
+     * booleans. (The function already returns `storeEmiEnabled` and `storeState`
+     * for the same reason; it resolves per-store checkout facts, and its name is
+     * narrower than its job.)
+     *
+     * 🛑 Absence resolves to `false` HERE, once, so no caller has to decide what
+     * `undefined` means on a liability flag.
+     */
+    storeProtections: {
+        shipping: boolean;
+        sale: boolean;
+    };
 }>;
 export interface DroppedCoupon {
     code: string;
@@ -74,9 +102,30 @@ export interface CheckoutPricingPreviewStore {
     whatsappNotifyFee: number;
     giftWrapFee: number;
     shipmentProtectionFee: number;
+    saleProtectionFee: number;
     gstAmount: number;
     couponDiscount: number;
     total: number;
+    /**
+     * ── C5e tiers 2 and 3, resolved SERVER-SIDE for this store ───────────────
+     *
+     * 🛑 Carried on the preview rather than fetched by the client, for two
+     * reasons that both matter. The cart has neither the store document nor the
+     * products — `CartItemDocument` snapshots only `storeId`/`storeName` — so a
+     * client-side gate would need a store fetch per seller, which is both a
+     * read per render and an invitation to pass a raw `StoreDocument` into a
+     * `"use client"` component (Root Cause #70, the leak this plan's projection
+     * work exists to close).
+     *
+     * And the tiers are already computed here to price the fee. Returning the
+     * same three booleans the fee was computed from is what makes the checkbox
+     * the buyer sees and the amount they are charged provably the same decision
+     * — rather than two gates that agree by discipline.
+     */
+    supportsShippingProtection: boolean;
+    supportsSaleProtection: boolean;
+    /** True when any of this store's priced lines is `finalSale`. */
+    hasFinalSaleItem: boolean;
 }
 export interface CheckoutPricingPreview {
     subtotal: number;
@@ -85,6 +134,7 @@ export interface CheckoutPricingPreview {
     whatsappNotifyFee: number;
     giftWrapFee: number;
     shipmentProtectionFee: number;
+    saleProtectionFee: number;
     gstAmount: number;
     couponDiscount: number;
     /** Buyer-facing platform commission, capped, charged once for this checkout. */