@mohasinac/appkit 4.53.2 → 4.54.0-next.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.53.2",
-  "head": "94f4715428f35ab362a11a468072ef933ca8a46d",
-  "branch": "main",
-  "dirty": false,
-  "builtAt": "2026-10-19T22:24:09.397Z"
+  "version": "4.54.0-next.0",
+  "head": "91b142ab99bc17b915e4f285d548d9f0cd36d4ea",
+  "branch": "feat/mohasinac-site",
+  "dirty": true,
+  "builtAt": "2026-10-20T12:40:18.408Z"
 }

package/dist/_internal/server/features/auth/capabilities.js

@@ -5,7 +5,7 @@
  * Call this server-side only — never trust client-provided capability arrays.
  */
 import { storeRepository } from "../../../../repositories/index.js";
-import { DEFAULT_STORE_CAPABILITIES, } from "../../../../features/auth/permissions/constants.js";
+import { DEFAULT_STORE_CAPABILITIES, resolveStoreCapabilities, } from "../../../../features/auth/permissions/constants.js";
 /**
  * Return the resolved capability set for a store.
  * Falls back to DEFAULT_STORE_CAPABILITIES when the store has no capabilities field.
@@ -16,10 +16,12 @@ export async function getStoreCapabilities(storeId) {
     const store = await storeRepository.findById(storeId);
     if (!store)
         return [...DEFAULT_STORE_CAPABILITIES];
-    const raw = store.capabilities;
-    if (Array.isArray(raw) && raw.length > 0)
-        return raw;
-    return [...DEFAULT_STORE_CAPABILITIES];
+    /*
+     * The merge itself lives in `resolveStoreCapabilities` so a caller holding
+     * the store document already can run the same rule without a second read.
+     * This function is now just "fetch, then resolve".
+     */
+    return resolveStoreCapabilities(store.capabilities);
 }
 /**
  * Check whether a store has a specific capability.

package/dist/_internal/server/features/checkout/supplier-identity.js

@@ -29,6 +29,7 @@
  * registration as it stood at the moment of supply" — an admin correcting a
  * typo in the GSTIN must not silently reissue every invoice ever produced.
  */
+import { getPlatformSupplier } from "../../../shared/features/site-settings/supplier-of-record.js";
 const trimmed = (v) => {
     const s = (v ?? "").trim();
     return s.length > 0 ? s : undefined;
@@ -61,18 +62,39 @@ export function resolveSupplierIdentity(store, settings) {
         };
     }
     /*
-     * Platform branch. Gated on `gst.enabled`, matching what the checkout
-     * already did before sellers could have a GSTIN at all — disabling GST must
-     * continue to produce plain invoices rather than tax invoices.
+     * Platform branch. Still gated on `gst.enabled` — disabling GST must
+     * continue to produce plain invoices rather than tax invoices, and
+     * `source: "none"` must stay reachable.
+     *
+     * 🛑 But the IDENTITY now comes from `appkit.config.js → business`, not from
+     * `siteSettings.gst.*`.
+     *
+     * That block documents itself as "THE one owner of the business's statutory
+     * identity", and records that before it existed the legal name, address,
+     * GSTIN and support channels lived in five places that already disagreed —
+     * four different support addresses published, the registered address saying
+     * Solapur while the warehouse said Hyderabad. Reading the GSTIN from site
+     * settings here made this invoice path a SIXTH owner, and the one that
+     * decides what a tax invoice says.
+     *
+     * `siteSettings.gst.enabled` stays the switch because whether to charge GST
+     * at all is an operational decision an admin makes. WHO the supplier is, is
+     * not: it is a fact about the registered entity, it is legally required to be
+     * published, and it belongs in a committed, code-reviewed file.
+     *
+     * The snapshot contract is unchanged — the caller writes the result onto the
+     * order at creation and never recomputes it, so correcting a typo in the
+     * business block does not reissue historical invoices.
      */
     const gst = settings?.gst;
     if (gst?.enabled) {
-        const platformGstin = trimmed(gst.gstin);
+        const platform = getPlatformSupplier();
+        const platformGstin = trimmed(platform.gstin);
         if (platformGstin) {
             return {
                 gstin: platformGstin,
-                legalName: trimmed(gst.legalName),
-                address: trimmed(gst.address),
+                legalName: trimmed(platform.legalName),
+                address: trimmed(platform.address),
                 source: "platform",
             };
         }

package/dist/_internal/server/features/products/listing-tab-counts.js

@@ -28,7 +28,7 @@ import { serverLogger } from "../../../../monitoring/index.js";
 import { normalizeError } from "../../../../errors/normalize.js";
 import { sieveAnd, sieveFilter, SIEVE_OP, sortBy } from "../../../../utils/sieve-builder.js";
 import { PRODUCT_FIELDS } from "../../../../constants/field-names.js";
-import { isListingRowAvailable, unavailableClausesFor, } from "../../../shared/listing-types/_registry.js";
+import { isListingRowAvailable, pluginFor, } from "../../../shared/listing-types/_registry.js";
 import { normalizeListingType } from "../../../../features/products/utils/listing-type.js";
 import { clauseToSieve, PUBLIC_PRODUCT_MAX_PAGE_SIZE } from "./list-public.js";
 const DEFAULT_STATUS = "published";
@@ -105,21 +105,63 @@ function bundleMatchesScope(bundle, scope) {
  */
 async function unavailableByType(scope, types, now) {
     const byType = new Map();
-    const clauses = unavailableClausesFor(types);
-    if (clauses.length === 0)
-        return { byType, truncated: false };
+    const unknown = new Set();
+    /*
+     * One entry per DISTINCT clause, remembering which types depend on it, so a
+     * clause that cannot run takes down only those types' badges.
+     */
+    const distinct = new Map();
+    for (const type of types) {
+        for (const clause of pluginFor(type).unavailableClauses) {
+            const key = clause.field + "|" + clause.op + "|" + String(clause.value);
+            const entry = distinct.get(key) ?? { clause, types: new Set() };
+            entry.types.add(type);
+            distinct.set(key, entry);
+        }
+    }
+    if (distinct.size === 0)
+        return { byType, unknown };
     const status = scope.status ?? DEFAULT_STATUS;
-    const results = await Promise.all(clauses.map(async (clause) => {
-        // An inequality must be ordered by its own field — Firestore appends it
-        // to the `orderBy` implicitly, so any other sort demands a composite
-        // index nobody declared (Root Cause #59).
+    const results = await Promise.all([...distinct.values()].map(async (entry) => {
+        const { clause } = entry;
+        /*
+         * 🛑 NO SORT on an equality clause — load-bearing, not an omission.
+         *
+         * A tally does not care about order, and adding `orderBy createdAt`
+         * turns a query Firestore can merge-join from single-field indexes into
+         * one demanding a composite index PER CLAUSE PER SCOPE: fifteen new
+         * indexes on a collection already carrying 223, every one of them write
+         * amplification on every product write. Measured against the live
+         * project: all four equality clauses run index-free without the sort and
+         * return FAILED_PRECONDITION with it.
+         *
+         * An inequality is the exception Firestore forces — its first `orderBy`
+         * must be its own field (Root Cause #59) — so that one clause does need
+         * an index, which is exactly why `unknown` is tracked per type.
+         *
+         * 🛑 THE AUCTION INDEXES ARE NOT DECLARED, deliberately. Until they are,
+         * the auction clause returns FAILED_PRECONDITION, `unknown` gains
+         * `auction`, and that ONE badge falls back to its total — every other
+         * type stays exact. Adding them to
+         * `appkit/firebase/base/firestore.indexes.json` is only half the change:
+         * an undeployed index file fails `audit-firebase-rules-deployed`, so the
+         * three entries below and `npm run firebase -- deploy --only
+         * firestore:indexes` belong in the same session.
+         *
+         *   products: status ASC, categorySlugs CONTAINS, auctionEndDate DESC
+         *   products: brand  ASC, status ASC,             auctionEndDate DESC
+         *   products: storeId ASC, status ASC,            auctionEndDate DESC
+         *
+         * One per scope the tab bars count in, because `buildScopedQuery` leads
+         * with a different equality for each.
+         */
         const sorts = clause.op === "lt" && clause.sortField
             ? sortBy(clause.sortField, "DESC")
-            : sortBy(PRODUCT_FIELDS.CREATED_AT, "DESC");
+            : undefined;
         try {
-            return await productRepository.list({
+            const result = await productRepository.list({
                 filters: sieveAnd(sieveFilter(PRODUCT_FIELDS.STATUS, SIEVE_OP.EQ, status), clauseToSieve(clause, now)),
-                sorts,
+                ...(sorts ? { sorts } : {}),
                 page: 1,
                 pageSize: PUBLIC_PRODUCT_MAX_PAGE_SIZE,
             }, {
@@ -127,26 +169,37 @@ async function unavailableByType(scope, types, now) {
                 categoriesIn: scope.categoriesIn,
                 brandName: scope.brandName,
             });
+            return { entry, result };
         }
         catch (error) {
             const e = normalizeError(error);
             // ERROR, not warn: a clause that cannot run is almost always a missing
-            // composite index — a permanent, silent skew of every badge on the
-            // page rather than a transient blip.
-            serverLogger.error(`listingTabCounts: unavailable clause failed (${clause.field} ${clause.op}); badges fall back to totals`, { field: clause.field, op: clause.op, error: e.message });
-            return null;
+            // composite index — a permanent, silent skew of the badges that depend
+            // on it rather than a transient blip. The fields are named so the log
+            // says which index to create.
+            serverLogger.error("listingTabCounts: unavailable clause failed; those badges fall back to totals", {
+                field: clause.field,
+                op: clause.op,
+                types: [...entry.types],
+                error: e.message,
+            });
+            return { entry, result: null };
         }
     }));
     const merged = new Map();
-    let truncated = false;
-    for (const result of results) {
+    for (const { entry, result } of results) {
         if (!result) {
-            truncated = true;
+            for (const type of entry.types)
+                unknown.add(type);
             continue;
         }
         const rows = result.items;
-        if (rows.length >= PUBLIC_PRODUCT_MAX_PAGE_SIZE)
-            truncated = true;
+        // A saturated window means there are more unavailable rows than were seen,
+        // so the tally is a floor for every type this clause serves.
+        if (rows.length >= PUBLIC_PRODUCT_MAX_PAGE_SIZE) {
+            for (const type of entry.types)
+                unknown.add(type);
+        }
         for (const row of rows) {
             const id = typeof row.id === "string" ? row.id : JSON.stringify(row.id);
             if (!merged.has(id))
@@ -160,7 +213,7 @@ async function unavailableByType(scope, types, now) {
         const type = normalizeListingType(row);
         byType.set(type, (byType.get(type) ?? 0) + 1);
     }
-    return { byType, truncated };
+    return { byType, unknown };
 }
 /** The listing types one tab spans — `"art|stickers"` is a pipe OR-group. */
 function typesOf(tab) {
@@ -194,15 +247,18 @@ export async function listingTabCounts(tabs, scope, opts) {
     const total = {};
     const available = {};
     for (const tab of listingTabs) {
+        const tabTypes = typesOf(tab);
         const totalForTab = typeCounts[String(tab.listingType)];
         total[tab.id] = totalForTab;
-        if (totalForTab === undefined || unavailable.truncated) {
-            // Unknown beats a number that is quietly too high. Falling back to the
-            // total reproduces the pre-2026-10-20 badge rather than inventing one.
+        if (totalForTab === undefined ||
+            tabTypes.some((t) => unavailable.unknown.has(t))) {
+            // Falling back to the total reproduces the pre-split badge rather than
+            // inventing a number — and it keeps the hint silent, because the hint
+            // only speaks when both figures are known.
             available[tab.id] = totalForTab;
             continue;
         }
-        const gone = typesOf(tab).reduce((sum, type) => sum + (unavailable.byType.get(type) ?? 0), 0);
+        const gone = tabTypes.reduce((sum, type) => sum + (unavailable.byType.get(type) ?? 0), 0);
         available[tab.id] = Math.max(0, totalForTab - gone);
     }
     if (wantsBundles) {

package/dist/_internal/server/features/search/index-build/sources.js

@@ -195,7 +195,26 @@ export const PUBLIC_INDEX_SOURCES = [
     {
         typeKey: "part",
         collection: "partGlossary",
-        select: ["name", "code", "classification", "slot"],
+        /*
+         * 🛑 `aliases` IS IN THE SELECT BECAUSE AN ABBREVIATION IS HOW PEOPLE
+         * SEARCH FOR A PART.
+         *
+         * The wiki states a part's short form outright, and it reaches 1,072 of
+         * 2,490 rows: `EWD` is Eternal Wide Defense, `BWD` is Big Wide Defense,
+         * `ES` is Eternal Spike. Those are the names printed on the part and the
+         * names the community uses — but they lived only in Firestore, because
+         * this select carried name/code/classification/slot and nothing else.
+         *
+         * So the data was there, the page was there, and searching `EWD` found
+         * NOTHING. A gap between holding a fact and being able to find it is
+         * invisible from either end.
+         *
+         * 🛑 It must be `aliases`, not `aka`. The generator UNIONS the wiki's
+         * `aka` into the pre-existing `aliases` array rather than replacing it,
+         * so `aliases` is the superset — selecting `aka` would silently drop
+         * every alias the corpus contributed.
+         */
+        select: ["name", "code", "classification", "slot", "aliases"],
         slugOf: (id) => (id.includes("--") ? id.replace("--", "/") : null),
         toRecord: (id, d) => {
             const name = str(d.name);
@@ -214,11 +233,33 @@ export const PUBLIC_INDEX_SOURCES = [
                 return null;
             const code = str(d.code);
             const classification = str(d.classification);
+            /*
+             * The abbreviations, appended to `detail` because that is the only
+             * other field the record carries and the matcher reads both.
+             *
+             * 🛑 Bounded to four and de-duplicated against the name and code. A
+             * part can carry a dozen aliases, and the artifact is a public file
+             * fetched by every visitor — the whole point of it is that it stays
+             * small enough to ship whole. Four covers the abbreviation plus the
+             * other vendor's name, which is what anyone actually types.
+             */
+            const aliases = Array.isArray(d.aliases) ? d.aliases.map(str).filter(Boolean) : [];
+            const seen = new Set([name.toLowerCase(), (code ?? "").toLowerCase()]);
+            const extra = [];
+            for (const a of aliases) {
+                const k = String(a).toLowerCase();
+                if (seen.has(k))
+                    continue;
+                seen.add(k);
+                extra.push(String(a));
+                if (extra.length === 4)
+                    break;
+            }
             return {
                 title: name,
                 // The classification IS the disambiguation — it is why a user
                 // searching "105" can tell three results apart.
-                detail: [classification, code].filter(Boolean).join(" · "),
+                detail: [classification, code, ...extra].filter(Boolean).join(" · "),
             };
         },
     },

package/dist/_internal/server/jobs/core/jobRunners.js

@@ -11,9 +11,7 @@
 import { runWeeklyPayoutEligibility } from "./weeklyPayoutEligibility.js";
 import { runHardBanCascade } from "./hardBanCascade.js";
 import { runResetOtpVerification } from "./resetOtpVerification.js";
-import { runWhatsAppNotify } from "./whatsappNotify.js";
 import { runNewsletterExport } from "./newsletterExport.js";
-import { runWhatsAppCatalogImport } from "./whatsappCatalogImport.js";
 import { runStoreNameBackfill } from "./storeNameBackfill.js";
 import { runCategoryTaxonomyBackfill } from "./categoryTaxonomyBackfill.js";
 async function runPayoutsWeeklyJob(_payload, ctx) {
@@ -42,15 +40,9 @@ async function runHardBanCascadeJob(payload, ctx) {
 async function runResetOtpVerificationJob(_payload, ctx) {
     return runResetOtpVerification(ctx);
 }
-async function runWhatsAppNotifyJob(payload, ctx) {
-    return runWhatsAppNotify(payload, ctx);
-}
 async function runNewsletterExportJob(_payload, ctx) {
     return runNewsletterExport(ctx);
 }
-async function runWhatsAppCatalogImportJob(payload, ctx) {
-    return runWhatsAppCatalogImport({ storeSlug: String(payload.storeSlug ?? "") }, ctx);
-}
 async function runStoreNameBackfillJob(payload, ctx) {
     return runStoreNameBackfill({ storeId: String(payload.storeId ?? "") }, ctx);
 }
@@ -68,9 +60,7 @@ export const JOB_RUNNERS = {
     payoutsWeekly: runPayoutsWeeklyJob,
     hardBanCascade: runHardBanCascadeJob,
     resetOtpVerification: runResetOtpVerificationJob,
-    whatsappNotify: runWhatsAppNotifyJob,
     newsletterExport: runNewsletterExportJob,
-    whatsappCatalogImport: runWhatsAppCatalogImportJob,
     storeNameBackfill: runStoreNameBackfillJob,
     categoryTaxonomyBackfill: runCategoryTaxonomyBackfillJob,
 };

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -1,77 +1,7 @@
 import { normalizeError } from "../../../../errors/normalize.js";
 import { ORDER_PII_FIELDS, revealPii } from "../../../../security/index.js";
-import { adminNotificationsRepository, storeRepository, userRepository } from "../../../../repositories/index.js";
-import { decryptPii } from "../../../../security/index.js";
-import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server.js";
-import { resolveKeys } from "../../../../core/integration-keys.js";
-import { guardSend, logSuppressedSend } from "../../notifications/send-guard.js";
-async function sendAnnouncement(ctx, toPhone, message, phoneNumberId, accessToken, label, orderId) {
-    try {
-        const sent = await sendWhatsAppBusinessMessage({
-            toPhone,
-            message,
-            phoneNumberId,
-            accessToken,
-        });
-        if (sent) {
-            ctx.logger.info(`Announcement sent to ${label}`, {
-                orderId,
-                toPhone: `...${toPhone.slice(-4)}`,
-            });
-        }
-        else {
-            ctx.logger.error(`Announcement delivery failed for ${label} (non-fatal)`, null, { orderId });
-        }
-    }
-    catch (err) {
-        void normalizeError(err);
-        ctx.logger.error(`Announcement send threw for ${label} (non-fatal)`, err, { orderId });
-    }
-}
-async function notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId) {
-    try {
-        const store = await storeRepository.findBySlug(storeId);
-        if (!store?.ownerId)
-            return;
-        const owner = await userRepository.findById(store.ownerId);
-        const encryptedPhone = owner?.phoneNumber;
-        if (!encryptedPhone)
-            return;
-        const ownerPhone = decryptPii(encryptedPhone);
-        if (ownerPhone) {
-            await sendAnnouncement(ctx, ownerPhone, message, phoneNumberId, accessToken, "store-owner", orderId);
-        }
-    }
-    catch (err) {
-        void normalizeError(err);
-        ctx.logger.error("Store owner lookup failed (non-fatal)", err, { orderId, storeId });
-    }
-}
-/**
- * Seeded credentials are `*_PLACEHOLDER` strings rather than empty, so an
- * emptiness test alone would happily send with a fake token. Mirrors the guard
- * in checkout-value-otp-actions.ts.
- */
-function usable(value) {
-    const v = value?.trim() ?? "";
-    return v && !v.includes("PLACEHOLDER") ? v : "";
-}
-async function resolveWhatsAppCredentials(ctx, orderId) {
-    let db = {};
-    try {
-        db = await resolveKeys();
-    }
-    catch (err) {
-        void normalizeError(err);
-        // Firestore unreachable from the Functions runtime — env-only is still a
-        // valid configuration, so this is a warning, not a failure.
-        ctx.logger.warn("Credential lookup failed — falling back to env", { orderId });
-    }
-    return {
-        phoneNumberId: usable(db.whatsappPhoneNumberId) || usable(ctx.env("WHATSAPP_PHONE_NUMBER_ID")),
-        accessToken: usable(db.whatsappCloudApiToken) || usable(ctx.env("WHATSAPP_CLOUD_API_TOKEN")),
-    };
-}
+import { adminNotificationsRepository } from "../../../../repositories/index.js";
+import { buildPurchaseAnnouncementMessage } from "../../../../features/orders/utils/order-announcement-message.js";
 export async function handleOrderCreate(input, ctx) {
     const { orderId, order } = input;
     const items = order.items ?? [];
@@ -140,37 +70,13 @@ export async function handleOrderCreate(input, ctx) {
         ctx.logger.error("Failed to write admin order notification (non-fatal)", err, { orderId });
     }
     /*
-     * Seller side keeps WhatsApp: it is ONE message to ONE person about their
-     * own sale, which is the case the channel is good at. Credentials resolve
-     * DB-first (Admin → Site Settings → WhatsApp) with an env fallback — this
-     * read `ctx.env()` only until 2026-08-22, so credentials saved in Site
-     * Settings never reached the announcement and it silently no-op'd.
+     * The seller is told about their own sale by the `order_placed`
+     * notification `createOrderForGroup` already sends (in-app + email). This
+     * handler used to ALSO push a WhatsApp Cloud API message here — a duplicate
+     * channel for the same event, and the only thing in this file that needed a
+     * Meta token, a registered number and a billing relationship. Removed with
+     * the rest of the WhatsApp integration on 2026-10-20; no signal was lost,
+     * because the notification path is independent and unchanged.
      */
-    const storeId = order.storeId;
-    if (!storeId) {
-        ctx.logger.info("Order has no storeId — nothing to announce to a seller", { orderId });
-        return;
-    }
-    const { phoneNumberId, accessToken } = await resolveWhatsAppCredentials(ctx, orderId);
-    if (!phoneNumberId || !accessToken) {
-        ctx.logger.info("WhatsApp Cloud API not configured — skipping seller announcement", { orderId });
-        return;
-    }
-    // Audience is "user": a seller receiving news of their own sale is a
-    // marketplace participant, not an operator of the site. Staff exemption is
-    // for the digest and the payout summary, and widening it to "anyone we think
-    // ought to see this" would make the kill switch mean nothing.
-    const guard = {
-        channel: "whatsapp",
-        feature: "order_placed_seller",
-        audience: "user",
-    };
-    const decision = await guardSend(guard);
-    if (!decision.allow) {
-        logSuppressedSend(guard, decision);
-        ctx.logger.info("Seller order announcement suppressed by messaging guard", { orderId, storeId });
-        return;
-    }
-    await notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId);
-    ctx.logger.info(`Order announcement complete`, { orderId, storeId });
+    ctx.logger.info("Order announcement complete", { orderId, storeId: order.storeId ?? null });
 }

package/dist/_internal/shared/actions/action-registry.d.ts

@@ -29,7 +29,7 @@ import type { IconKey } from "../../../ui/icons/icon-registry";
 /** What KIND of action — drives default UI affordance (link vs button vs danger). */
 export type ActionKind = "primary" | "secondary" | "danger" | "ghost" | "link" | "chip";
 /** Resource bucket — keyed top-level in the ACTIONS tree. */
-export type ActionResource = "PRODUCT" | "AUCTION" | "PRE_ORDER" | "PRIZE_DRAW" | "DIGITAL_CODE" | "BUNDLE" | "GROUP" | "CATEGORY" | "BRAND" | "SUBLISTING" | "STORE" | "BLOG" | "EVENT" | "SHIPMENT" | "CATALOGUE" | "USER" | "SELLER" | "ADMIN" | "CART" | "CHECKOUT" | "NAV" | "MEDIA" | "SUPPORT" | "LOTTERY" | "TESTER";
+export type ActionResource = "PRODUCT" | "AUCTION" | "PRE_ORDER" | "PRIZE_DRAW" | "DIGITAL_CODE" | "BUNDLE" | "GROUP" | "CATEGORY" | "BRAND" | "SUBLISTING" | "STORE" | "BLOG" | "EVENT" | "REVIEW" | "SHIPMENT" | "CATALOGUE" | "USER" | "SELLER" | "ADMIN" | "CART" | "CHECKOUT" | "NAV" | "MEDIA" | "SUPPORT" | "LOTTERY" | "TESTER";
 /** Confirmation modal config — when set, <Button action={...}> opens
  *  a confirm dialog before firing the actual handler. */
 export interface ActionConfirmation {

package/dist/_internal/shared/actions/action-registry.js

@@ -111,6 +111,28 @@ export const ACTIONS = {
                 confirmLabel: "Delete listing",
             },
         },
+        /*
+         * Clone — ADMIN ONLY, and no confirmation.
+         *
+         * `POST /api/store/products/[id]/duplicate` already strips identity,
+         * analytics, auction bid state and group membership, titles the copy
+         * "… (Copy)" and forces `status: "draft"`. So it creates a draft and
+         * destroys nothing: a confirm dialog on a non-destructive action trains
+         * people to dismiss confirm dialogs.
+         *
+         * 🛑 `permissions: ["admin"]` is narrower than `edit`/`delete` above on
+         * purpose. A seller editing or deleting their own listing is ordinary;
+         * duplicating across the catalogue is a staff tool.
+         */
+        duplicate: {
+            iconKey: "duplicate",
+            id: "product.duplicate",
+            label: "Duplicate",
+            ariaLabel: "Duplicate this listing as a draft",
+            description: "Copy this listing into a new draft, without its bids, analytics or group membership.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         "add-to-cart": {
             iconKey: "cart",
             id: "product.add-to-cart",
@@ -321,6 +343,43 @@ export const ACTIONS = {
             kind: "primary",
             categoryTypeScope: ["bundle"],
         },
+        /*
+         * Edit and delete lived only in the ADMIN bucket (`delete-bundle`,
+         * `activate-bundle`, …), so a bundle's own surfaces had nothing
+         * resource-scoped to resolve against. Added here beside `buy-now` so the
+         * owner affordance keys on the resource it is acting on, like every other
+         * bucket.
+         *
+         * 🛑 No `duplicate`. A bundle's members, `bundleCategorySlugs` and
+         * `display.mosaicImages` are all resolved at WRITE time, so a copy would
+         * carry another bundle's resolved state.
+         */
+        edit: {
+            iconKey: "edit",
+            id: "bundle.edit",
+            label: "Edit",
+            ariaLabel: "Edit bundle",
+            description: "Edit this bundle.",
+            kind: "secondary",
+            permissions: ["admin", "seller"],
+            categoryTypeScope: ["bundle"],
+        },
+        delete: {
+            iconKey: "delete",
+            id: "bundle.delete",
+            label: "Delete",
+            ariaLabel: "Delete bundle",
+            description: "Permanently delete this bundle.",
+            kind: "danger",
+            permissions: ["admin", "seller"],
+            categoryTypeScope: ["bundle"],
+            confirmation: {
+                title: "Delete this bundle?",
+                body: "This cannot be undone. The products inside it are NOT deleted — only the bundle that groups them and its discounted price.",
+                confirmLabel: "Delete bundle",
+                confirmKind: "danger",
+            },
+        },
     },
     /*
      * These four buckets were literally `{}` for months while their editors
@@ -1042,7 +1101,76 @@ export const ACTIONS = {
             },
         },
     },
+    /*
+     * There was no REVIEW bucket at all, while review actions sat scattered
+     * across three others — ADMIN (approve / reject / feature), STORE (reply /
+     * contest) and USER (write-review) — and NOTHING anywhere for a reviewer
+     * editing or deleting their own review. That is the gap a buyer hits on a
+     * product page, so it is the one this bucket is for.
+     */
+    REVIEW: {
+        edit: {
+            iconKey: "edit",
+            id: "review.edit",
+            label: "Edit review",
+            ariaLabel: "Edit your review",
+            description: "Edit a review you wrote.",
+            kind: "secondary",
+        },
+        delete: {
+            iconKey: "delete",
+            id: "review.delete",
+            label: "Delete review",
+            ariaLabel: "Delete your review",
+            description: "Permanently delete a review you wrote.",
+            kind: "danger",
+            confirmation: {
+                title: "Delete your review?",
+                body: "This cannot be undone. The seller's reply to it goes too, and the product's rating is recalculated without your score.",
+                confirmLabel: "Delete review",
+                confirmKind: "danger",
+            },
+        },
+        write: {
+            iconKey: "review",
+            id: "review.write",
+            label: "Write a review",
+            ariaLabel: "Write a review for this item",
+            description: "Write a review for an item you bought.",
+            kind: "primary",
+        },
+    },
     EVENT: {
+        /*
+         * This bucket had only register / cancel-registration / draw-raffle-winner
+         * — no edit, no delete — so the owner affordance on an event card or detail
+         * page had no registry entry to resolve its label and confirm copy from,
+         * and Rule #7 forbids inlining them.
+         */
+        edit: {
+            iconKey: "edit",
+            id: "event.edit",
+            label: "Edit",
+            ariaLabel: "Edit event",
+            description: "Edit this event.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
+        delete: {
+            iconKey: "delete",
+            id: "event.delete",
+            label: "Delete",
+            ariaLabel: "Delete event",
+            description: "Permanently delete this event.",
+            kind: "danger",
+            permissions: ["admin"],
+            confirmation: {
+                title: "Delete this event?",
+                body: "This cannot be undone. Entries already recorded against it are removed with it, so a participant loses their place.",
+                confirmLabel: "Delete event",
+                confirmKind: "danger",
+            },
+        },
         "register": {
             iconKey: "user",
             id: "event.register",

package/dist/_internal/shared/features/categories/bundle-copy.d.ts

@@ -72,7 +72,7 @@ export declare const BUNDLE_COPY: {
     readonly adminEditor: {
         readonly loading: "Loading bundle…";
         readonly saveButton: (saving: boolean, isEdit: boolean) => "Save changes" | "Saving…" | "Create bundle";
-        readonly deleteButton: (deleting: boolean) => "Deleting…" | "Delete bundle";
+        readonly deleteButton: (deleting: boolean) => "Delete bundle" | "Deleting…";
         readonly deleteConfirm: "Delete this bundle? This action cannot be undone.";
         readonly fields: {
             readonly nameLabel: "Name *";