@mohasinac/appkit 4.53.2 → 4.54.0-next.0

package/dist/features/addresses/utils/postal-autofill.d.ts

@@ -0,0 +1,39 @@
+interface CityState {
+    city: string;
+    state: string;
+}
+/**
+ * What the last autofill wrote, so a later one can tell its own output apart
+ * from a human's typing. A field is absent when the helper declined to write
+ * it — which makes it the human's, and untouchable.
+ */
+export type PostalAutofillMemo = Partial<CityState>;
+/**
+ * Merge `resolved` into `prev`, returning the new values and an updated memo.
+ *
+ * ── 🛑 THE BUG THIS EXISTS TO FIX ─────────────────────────────────────────
+ *
+ * Both address forms used `prev.city.trim() ? prev.city : city` — fill only
+ * an EMPTY field. That intent is right and is preserved here: correcting an
+ * address someone deliberately typed is a bug they cannot report, because
+ * they watch their own input vanish with no idea what did it.
+ *
+ * But "empty" cannot tell WHO filled the field. After the first lookup the
+ * city is non-empty — written by the autofill itself — so every subsequent
+ * lookup is refused. Enter 413001, get Solapur/Maharashtra; correct the PIN
+ * to 500005 (Hyderabad) and the form still shows Solapur. The PIN and the
+ * city now disagree, the form validates, and the parcel ships to the wrong
+ * city — worse than never autofilling at all.
+ *
+ * ── The rule ──────────────────────────────────────────────────────────────
+ *
+ * A field is ours to overwrite when it is EMPTY, or when it still holds
+ * exactly what we last wrote into it. The moment a human edits it, it stops
+ * matching the memo and becomes untouchable again — the original guarantee,
+ * now actually enforceable rather than approximated by "is it blank".
+ */
+export declare function applyPostalAutofill<T extends CityState>(prev: T, resolved: Partial<CityState>, memo: PostalAutofillMemo): {
+    next: T;
+    memo: PostalAutofillMemo;
+};
+export {};

package/dist/features/addresses/utils/postal-autofill.js

@@ -0,0 +1,54 @@
+/*
+ * WHY: A postal lookup must fill the city/state it knows WITHOUT overwriting
+ *      what the person typed — and the obvious test for that ("is the field
+ *      empty?") silently breaks every lookup after the first.
+ * WHAT: `applyPostalAutofill` — merge a resolved city/state into form values,
+ *       overwriting only values this helper itself wrote earlier.
+ *
+ * EXPORTS: applyPostalAutofill, type PostalAutofillMemo
+ *
+ * @tag domain:addresses
+ * @tag layer:utils
+ * @tag pattern:pure
+ * @tag sideEffects:none
+ */
+/**
+ * Merge `resolved` into `prev`, returning the new values and an updated memo.
+ *
+ * ── 🛑 THE BUG THIS EXISTS TO FIX ─────────────────────────────────────────
+ *
+ * Both address forms used `prev.city.trim() ? prev.city : city` — fill only
+ * an EMPTY field. That intent is right and is preserved here: correcting an
+ * address someone deliberately typed is a bug they cannot report, because
+ * they watch their own input vanish with no idea what did it.
+ *
+ * But "empty" cannot tell WHO filled the field. After the first lookup the
+ * city is non-empty — written by the autofill itself — so every subsequent
+ * lookup is refused. Enter 413001, get Solapur/Maharashtra; correct the PIN
+ * to 500005 (Hyderabad) and the form still shows Solapur. The PIN and the
+ * city now disagree, the form validates, and the parcel ships to the wrong
+ * city — worse than never autofilling at all.
+ *
+ * ── The rule ──────────────────────────────────────────────────────────────
+ *
+ * A field is ours to overwrite when it is EMPTY, or when it still holds
+ * exactly what we last wrote into it. The moment a human edits it, it stops
+ * matching the memo and becomes untouchable again — the original guarantee,
+ * now actually enforceable rather than approximated by "is it blank".
+ */
+export function applyPostalAutofill(prev, resolved, memo) {
+    const nextMemo = {};
+    const merge = (field) => {
+        const current = prev[field];
+        const incoming = resolved[field];
+        const ours = current.trim() === "" || current === memo[field];
+        if (!ours || !incoming)
+            return current; // human's value, or nothing to say
+        nextMemo[field] = incoming;
+        return incoming;
+    };
+    return {
+        next: { ...prev, city: merge("city"), state: merge("state") },
+        memo: nextMemo,
+    };
+}

package/dist/features/admin/components/AdminStoreEditorView.js

@@ -6,11 +6,20 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Checkbox, Details, Div, SideDrawer, Span, Stack, Summary, useToast } from "../../../ui/index.js";
 import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { ALL_STORE_CAPABILITIES, DEFAULT_STORE_CAPABILITIES, } from "../../auth/permissions/constants.js";
 import { adminStoreUpdateSchema } from "../schemas/admin-editor-forms.js";
 import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary.js";
 import { FormShellContext, useFormShellState } from "../../../ui/forms/FormShell.js";
 import { SectionForm, useSectionFormNav, buildSectionsFromSchema } from "../../shell/index.js";
-const DEFAULT_CAPABILITIES = ["suggest_brands", "create_coupons"];
+/*
+ * 🛑 Imported, not restated. This value is the `??` fallback on the load path
+ * below, so whatever it holds is what gets SAVED BACK for a store whose
+ * `capabilities` field is absent. A local copy that drifted from
+ * `DEFAULT_STORE_CAPABILITIES` would silently rewrite entitlements on the next
+ * unrelated edit — Root Cause #38's re-save shape, with two owners of one
+ * default as the cause.
+ */
+const DEFAULT_CAPABILITIES = [...DEFAULT_STORE_CAPABILITIES];
 /** Add or remove one capability, returning the new list. */
 function toggleCapability(current, key) {
     const next = new Set(current);
@@ -20,41 +29,71 @@ function toggleCapability(current, key) {
         next.add(key);
     return Array.from(next);
 }
-const CAPABILITY_GROUPS = [
-    {
-        label: "Listings",
-        caps: [
-            { key: "host_auctions", label: "Host Auctions" },
-            { key: "host_preorders", label: "Host Pre-orders" },
-            { key: "create_categories", label: "Request New Categories" },
-            { key: "suggest_brands", label: "Suggest Brands" },
-            { key: "create_coupons", label: "Create Coupons" },
-            { key: "bulk_listing_import", label: "Bulk Listing Import" },
-            { key: "extended_return_window", label: "Extended Return Window" },
-        ],
-    },
-    {
-        label: "Trust & Visibility",
-        caps: [
-            { key: "verified_seller", label: "Verified Seller Badge" },
-            { key: "featured_placement", label: "Featured Placement" },
-            { key: "promotional_banner", label: "Promotional Banner" },
-            { key: "priority_support", label: "Priority Support" },
-        ],
-    },
-    {
-        label: "Platform",
-        caps: [
-            { key: "multiple_stores", label: "Multiple Stores" },
-            { key: "custom_store_slug", label: "Custom Store Slug" },
-            { key: "api_access", label: "API Access" },
-            { key: "lower_commission_rate", label: "Lower Commission Rate" },
-            { key: "early_access_features", label: "Early Access Features" },
-            { key: "advanced_analytics", label: "Advanced Analytics" },
-            { key: "whatsapp_catalog_sync", label: "WhatsApp Catalog Sync" },
-        ],
+/**
+ * The three capability groups, named once.
+ *
+ * A literal repeated per capability is how a group silently splits in two the
+ * day someone types "Trust and Visibility" in one of nineteen entries — the
+ * `CAPABILITY_GROUPS` derivation below filters on equality, so the typo'd entry
+ * would land in no rendered group at all and that capability would vanish from
+ * the admin UI without any error.
+ */
+const CAP_GROUP = {
+    LISTINGS: "Listings",
+    TRUST: "Trust & Visibility",
+    PLATFORM: "Platform",
+};
+/**
+ * Every capability's group and label.
+ *
+ * 🛑 `Record<StoreCapability, …>`, so a capability added to the union MUST be
+ * given a home here or this file does not compile. The groups used to be three
+ * hand-written arrays, which meant a new capability could be granted in code,
+ * checked by a server gate, and remain **unreachable from the admin UI** — the
+ * only place it can be turned on. That is the whole drift class in one
+ * sentence, and it had already happened: `advanced_listing_types` is the
+ * nineteenth member and the arrays listed eighteen.
+ */
+const CAPABILITY_META = {
+    advanced_listing_types: {
+        group: CAP_GROUP.LISTINGS,
+        label: "Advanced Listing Types (pre-orders, prize draws, classifieds, digital codes, live, art, stickers)",
     },
+    // Legacy: no longer checked anywhere — `auction` is a basic type now.
+    host_auctions: { group: CAP_GROUP.LISTINGS, label: "Host Auctions (legacy — no longer required)" },
+    // Legacy per-type grant, still honoured so existing stores keep access.
+    host_preorders: { group: CAP_GROUP.LISTINGS, label: "Host Pre-orders (legacy grant)" },
+    create_categories: { group: CAP_GROUP.LISTINGS, label: "Request New Categories" },
+    suggest_brands: { group: CAP_GROUP.LISTINGS, label: "Suggest Brands" },
+    create_coupons: { group: CAP_GROUP.LISTINGS, label: "Create Coupons" },
+    bulk_listing_import: { group: CAP_GROUP.LISTINGS, label: "Bulk Listing Import" },
+    extended_return_window: { group: CAP_GROUP.LISTINGS, label: "Extended Return Window" },
+    verified_seller: { group: CAP_GROUP.TRUST, label: "Verified Seller Badge" },
+    featured_placement: { group: CAP_GROUP.TRUST, label: "Featured Placement" },
+    promotional_banner: { group: CAP_GROUP.TRUST, label: "Promotional Banner" },
+    priority_support: { group: CAP_GROUP.TRUST, label: "Priority Support" },
+    multiple_stores: { group: CAP_GROUP.PLATFORM, label: "Multiple Stores" },
+    custom_store_slug: { group: CAP_GROUP.PLATFORM, label: "Custom Store Slug" },
+    api_access: { group: CAP_GROUP.PLATFORM, label: "API Access" },
+    lower_commission_rate: { group: CAP_GROUP.PLATFORM, label: "Lower Commission Rate" },
+    early_access_features: { group: CAP_GROUP.PLATFORM, label: "Early Access Features" },
+    advanced_analytics: { group: CAP_GROUP.PLATFORM, label: "Advanced Analytics" },
+    whatsapp_catalog_sync: { group: CAP_GROUP.PLATFORM, label: "WhatsApp Catalog Sync" },
+};
+const CAPABILITY_GROUP_ORDER = [
+    CAP_GROUP.LISTINGS,
+    CAP_GROUP.TRUST,
+    CAP_GROUP.PLATFORM,
 ];
+/**
+ * Derived, so every capability appears in exactly one group by construction.
+ * Keeps the `{ label, caps: [{ key, label }] }` shape the renderer below
+ * already expects.
+ */
+const CAPABILITY_GROUPS = CAPABILITY_GROUP_ORDER.map((group) => ({
+    label: group,
+    caps: ALL_STORE_CAPABILITIES.filter((key) => CAPABILITY_META[key].group === group).map((key) => ({ key, label: CAPABILITY_META[key].label })),
+}));
 const STATUS_OPTIONS = [
     { label: "Active", value: "active" },
     { label: "Pending", value: "pending" },

package/dist/features/admin/components/OwnerQuickActions.d.ts

@@ -0,0 +1,29 @@
+/** Which registry bucket supplies the labels and the confirm copy. */
+export type OwnerQuickActionsResource = "PRODUCT" | "CATEGORY" | "BRAND" | "BUNDLE" | "GROUP" | "SUBLISTING" | "EVENT" | "BLOG" | "REVIEW";
+export interface OwnerQuickActionsProps {
+    resource: OwnerQuickActionsResource;
+    /** Where the pencil goes — that record's dashboard editor. */
+    editHref: string;
+    /** Called after the confirm is accepted. Must do the DELETE itself. */
+    onDelete?: () => void | Promise<void>;
+    /**
+     * Admin-only clone. Omit entirely for resources with no duplicate endpoint —
+     * categories, bundles, carousel slides and homepage sections all have
+     * derived or positional state that a copy would carry wrongly, so the
+     * absence is deliberate rather than unfinished.
+     */
+    onClone?: () => void | Promise<void>;
+    /** Auth UID of the owner, when the record has one. Admins pass regardless. */
+    ownerId?: string;
+    /** Store SLUG for store-owned records — `SessionUser.storeId` is the slug. */
+    storeId?: string;
+    /** Names the thing in the confirm dialog: "Delete Dranzer S?" */
+    recordLabel?: string;
+    /**
+     * `card` sits in a hero corner and uses a scrim so it reads on photography;
+     * `detail` sits in a header row beside the title.
+     */
+    placement?: "card" | "detail";
+    className?: string;
+}
+export declare function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, placement, className, }: OwnerQuickActionsProps): import("react").JSX.Element | null;

package/dist/features/admin/components/OwnerQuickActions.js

@@ -0,0 +1,142 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * Pencil / clone / bin, on a PUBLIC surface, for whoever owns the record.
+ *
+ * ── What this is for ──────────────────────────────────────────────────────
+ *
+ * An admin or seller spots a problem on the page a visitor sees — a wrong
+ * price, a typo, a bad photo — and today has to navigate to the dashboard,
+ * find the list, search for the row and open it. This is the two-click path to
+ * the editor from where the problem was noticed.
+ *
+ * ── Why it is a new component and not a slot on each card ─────────────────
+ *
+ * 🛑 Measured before building: ZERO public detail views render any owner-only
+ * control, and the only precedent anywhere is `CouponCard`, which has had
+ * `onEdit` / `onToggleActive` / `onDelete` props the whole time and whose two
+ * public consumers pass NONE of them. So there was no pattern to follow and no
+ * second implementation to reconcile — one component, used by every surface,
+ * is what keeps the visibility rule and the confirm copy in one place.
+ *
+ * ── The visibility rule, and why it has three states ──────────────────────
+ *
+ * 🛑 Public pages are static or ISR (`products/[slug]` is `revalidate = 3600`
+ * and reads no session), so `SessionProvider` mounts `initialUser={null}` and
+ * `loading` starts TRUE on every hard load — for signed-in users too. A
+ * two-state `!user → hide` gate therefore renders nothing, then pops the
+ * toolbar in a few hundred milliseconds later, on every single page load.
+ *
+ * So: render NOTHING while `isAuthResolving`. Appearing late is invisible;
+ * appearing with a flash is a bug people report. Same reasoning as
+ * `useCanSeePrices`, which exists for the mirror-image problem.
+ *
+ * ── Who sees what ─────────────────────────────────────────────────────────
+ *
+ *   pencil + bin   the record's owner, or any admin
+ *   clone          admins ONLY
+ *
+ * 🛑 Clone is gated on `useIsAdmin()`, NOT on the same check as the other two.
+ * `useIsOwner` returns `true` for admins AND for the owner, so reusing it
+ * would hand every seller a button that is meant to be a staff tool.
+ *
+ * @tag domain:admin
+ * @tag layer:components
+ * @tag access:client
+ */
+import { useCallback, useState } from "react";
+import { useIsAdmin, useIsOwner } from "../../auth/hooks/useRBAC.js";
+import { useOptionalSession } from "../../../react/contexts/SessionContext.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { ConfirmDeleteModal } from "../../../ui/components/ConfirmDeleteModal.js";
+import { Icon } from "../../../ui/components/Icon.js";
+import { IconButton } from "../../../ui/components/IconButton.js";
+import { Row, useToast } from "../../../ui/index.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+export function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, placement = "card", className = "", }) {
+    const session = useOptionalSession();
+    const isOwnerOrAdmin = useIsOwner(ownerId);
+    const isAdmin = useIsAdmin();
+    const { showToast } = useToast();
+    const [confirmOpen, setConfirmOpen] = useState(false);
+    const [deleting, setDeleting] = useState(false);
+    const bucket = ACTIONS[resource];
+    const handleConfirmedDelete = useCallback(async () => {
+        if (!onDelete)
+            return;
+        setDeleting(true);
+        try {
+            await onDelete();
+            setConfirmOpen(false);
+        }
+        catch (err) {
+            const normalized = normalizeError(err);
+            /*
+             * 🛑 A failed delete MUST say so. Without this the dialog simply closed
+             * its spinner and the record was still there — and because the caller
+             * navigates away on success, "nothing happened" is indistinguishable
+             * from "it worked but the page did not move". This is a destructive
+             * action on a public page; silence is the worst available answer.
+             */
+            showToast(toUserMessage(normalized.code ?? "UNKNOWN"), "error");
+        }
+        finally {
+            // Always clears, so a failed delete leaves a usable dialog rather than a
+            // permanently-spinning button the user cannot dismiss or retry.
+            setDeleting(false);
+        }
+    }, [onDelete, showToast]);
+    /*
+     * 🛑 Nothing at all until auth resolves — see the header. `loading` starts
+     * true on every hard load of a static page, so this is the common path on
+     * first paint, not an edge case.
+     */
+    if (!session || session.loading)
+        return null;
+    /*
+     * A store-owned record is also "mine" when I own that store.
+     * `SessionUser.storeId` holds the store SLUG and `StoreDocument.storeId` is
+     * the slug too, while `ownerId` is the Auth UID — two different id spaces,
+     * so both have to be checked rather than one standing in for the other.
+     */
+    const ownsStore = Boolean(storeId && session.user?.storeId === storeId);
+    /*
+     * 🛑 `isAdmin` is its OWN term, not folded into `useIsOwner`.
+     *
+     * `useIsOwner` early-returns `false` when `resourceOwnerId` is falsy — BEFORE
+     * it checks admin — so for a record with no owner at all it denies admins
+     * too. Categories, brands, franchises, carousel slides and homepage sections
+     * have no `ownerId`, and those are precisely the collections an admin needs
+     * this toolbar on. Relying on `useIsOwner` alone would have hidden it from
+     * the only person who can edit them.
+     */
+    if (!isAdmin && !isOwnerOrAdmin && !ownsStore)
+        return null;
+    const editDef = bucket.edit;
+    const deleteDef = bucket.delete;
+    const confirmation = deleteDef?.confirmation;
+    const showClone = Boolean(onClone) && isAdmin;
+    return (_jsxs(_Fragment, { children: [_jsxs(Row, { gap: "xs", align: "center", className: className, 
+                /*
+                 * Stops the click reaching an ancestor `<Link>` or the card's own
+                 * `onClick`. Without it, pressing Edit on a card both navigates to the
+                 * editor AND opens the public detail page behind it.
+                 */
+                onClick: (e) => {
+                    e.stopPropagation();
+                }, children: [_jsx(IconButton, { "aria-label": editDef?.ariaLabel ?? editDef?.label ?? "Edit", size: "touch", variant: placement === "card" ? "scrim" : "ghost", icon: _jsx(Icon, { name: "edit" }), onClick: () => {
+                            /*
+                             * `window.location`, not `next/link`. This component is rendered
+                             * inside cards whose whole body is already an anchor, and nesting
+                             * an `<a>` in an `<a>` is invalid HTML that browsers resolve by
+                             * closing the outer one early — which breaks the card's own
+                             * navigation, not just this button's.
+                             */
+                            if (typeof window !== "undefined")
+                                window.location.assign(editHref);
+                        } }), showClone && (_jsx(IconButton, { "aria-label": (bucket.duplicate?.ariaLabel ?? bucket.duplicate?.label) ||
+                            "Duplicate", size: "touch", variant: placement === "card" ? "scrim" : "ghost", icon: _jsx(Icon, { name: "duplicate" }), onClick: () => void onClone?.() })), onDelete && (_jsx(IconButton, { "aria-label": deleteDef?.ariaLabel ?? deleteDef?.label ?? "Delete", size: "touch", variant: placement === "card" ? "scrim" : "danger", icon: _jsx(Icon, { name: "delete" }), onClick: () => setConfirmOpen(true) }))] }), onDelete && (_jsx(ConfirmDeleteModal, { isOpen: confirmOpen, onClose: () => setConfirmOpen(false), onConfirm: handleConfirmedDelete, isDeleting: deleting, title: confirmation?.title ?? "Delete this record?", message: recordLabel && confirmation
+                    ? `${confirmation.body}\n\nDeleting: ${recordLabel}`
+                    : confirmation?.body, confirmText: confirmation?.confirmLabel ?? deleteDef?.label ?? "Delete", variant: "danger" }))] }));
+}

package/dist/features/admin/schemas/admin-editor-forms.d.ts

@@ -12,7 +12,7 @@ export declare const adminStoreUpdateSchema: z.ZodEffects<z.ZodObject<{
     isVerified: z.ZodOptional<z.ZodBoolean>;
     isFeatured: z.ZodOptional<z.ZodBoolean>;
     suspensionReason: z.ZodOptional<z.ZodString>;
-    capabilities: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<[string, ...string[]]>, "many">>;
     adminNotes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     storeStatus: StoreStatus;

package/dist/features/admin/schemas/admin-editor-forms.js

@@ -29,6 +29,7 @@ import { z } from "zod";
 import { annotate } from "../../shell/field-ui-meta.js";
 import { mediaUrlSchema } from "../../../validation/schemas.js";
 import { StoreStatusValues } from "../../stores/schemas/firestore.js";
+import { ALL_STORE_CAPABILITIES } from "../../auth/permissions/constants.js";
 const PHONE_RE = /^(\+?91[-\s]?)?[6-9]\d{9}$/;
 /*
  * `adminAddressFormSchema` is DELETED (W5 / D19).
@@ -84,7 +85,9 @@ export const adminStoreUpdateSchema = z
         section: "standing", order: 4, row: "full", kind: "textarea",
         when: (v) => v.storeStatus === "suspended",
     }),
-    capabilities: annotate(z.array(z.string().min(1)).max(50).optional(), {
+    // 🛑 z.enum, not z.string().min(1) — see storeFirestoreSchema. A typo'd
+    // capability used to save cleanly and grant nothing.
+    capabilities: annotate(z.array(z.enum(ALL_STORE_CAPABILITIES)).max(50).optional(), {
         section: "capabilities", sectionLabel: "Capabilities", order: 1, row: "full", kind: "list",
     }),
     adminNotes: annotate(z.string().trim().max(2000).optional(), {

package/dist/features/auctions/components/MarketplaceAuctionCard.d.ts

@@ -74,5 +74,15 @@ export interface MarketplaceAuctionCardProps {
     onNavigate?: (href: string) => void;
     wishlistActions?: WishlistToggleActions;
     labels?: MarketplaceAuctionCardLabels;
+    /**
+     * Owner-only pencil / clone / bin. Pass `<OwnerQuickActions>`; it renders
+     * nothing for a visitor who does not own the record.
+     *
+     * 🛑 Rendered OUTSIDE this card's own anchor, as a sibling. A `<button>`
+     * inside an `<a>` is invalid HTML that browsers resolve by closing the
+     * anchor early, which breaks the CARD's navigation rather than just the
+     * button's — `stopPropagation` stops a click but cannot fix a parse.
+     */
+    renderOwnerActions?: () => React.ReactNode;
 }
-export declare function MarketplaceAuctionCard({ product, buyoutPrice, className, variant, selectable, isSelected, onSelect, inWishlist: initialInWishlist, href, hrefBuilder, onNavigate, wishlistActions, labels, }: MarketplaceAuctionCardProps): import("react").JSX.Element;
+export declare function MarketplaceAuctionCard({ product, buyoutPrice, className, variant, selectable, isSelected, onSelect, inWishlist: initialInWishlist, href, hrefBuilder, onNavigate, wishlistActions, labels, renderOwnerActions, }: MarketplaceAuctionCardProps): import("react").JSX.Element;

package/dist/features/auctions/components/MarketplaceAuctionCard.js

@@ -94,7 +94,7 @@ function formatCountdownLabel(remaining, endedLabel) {
         return `${hours}h ${minutes}m ${seconds}s`;
     return `${minutes}m ${seconds}s`;
 }
-export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", variant = "grid", selectable = false, isSelected = false, onSelect, inWishlist: initialInWishlist = false, href, hrefBuilder, onNavigate, wishlistActions, labels, }) {
+export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", variant = "grid", selectable = false, isSelected = false, onSelect, inWishlist: initialInWishlist = false, href, hrefBuilder, onNavigate, wishlistActions, labels, renderOwnerActions, }) {
     const router = useRouter();
     const mergedLabels = { ...DEFAULT_LABELS, ...labels };
     const baseVariant = variant === "list" ? "list" : "grid";
@@ -180,5 +180,12 @@ export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", v
         remaining, resolvedBuyoutPrice, inWishlist, wishlistLoading, wishlistActions,
         countdownClass, mergedLabels, handleWishlist, handleNavigate,
     };
-    return (_jsxs(BaseListingCard, { isSelected: isSelected, isDisabled: isEnded, variant: baseVariant, className: className, onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [renderAuctionCardHero({ product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect }), _jsx(BaseListingCard.Info, { variant: baseVariant, children: baseVariant === "list" ? renderAuctionCardInfoList(cardInfoProps) : renderAuctionCardInfoGrid(cardInfoProps) })] }));
+    const card = (_jsxs(BaseListingCard, { isSelected: isSelected, isDisabled: isEnded, variant: baseVariant, className: className, onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [renderAuctionCardHero({ product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect }), _jsx(BaseListingCard.Info, { variant: baseVariant, children: baseVariant === "list" ? renderAuctionCardInfoList(cardInfoProps) : renderAuctionCardInfoGrid(cardInfoProps) })] }));
+    if (!renderOwnerActions)
+        return card;
+    /*
+     * Sibling of the card, never a child — see the prop's docstring. `z-20`
+     * clears this card's own overlays, which all sit at `z-10`.
+     */
+    return (_jsxs(Div, { className: "relative h-full", children: [card, _jsx(Div, { className: "absolute right-2 bottom-2 z-20", children: renderOwnerActions() })] }));
 }

package/dist/features/auth/permissions/constants.d.ts

@@ -67,8 +67,18 @@ export declare const ROUTE_PERMISSION_MAP: Record<string, Permission>;
  *
  * Defaults on store creation: ["suggest_brands", "create_coupons"]
  */
-export type StoreCapability = "host_auctions" | "host_preorders" | "create_categories" | "suggest_brands" | "create_coupons" | "bulk_listing_import" | "extended_return_window" | "verified_seller" | "featured_placement" | "promotional_banner" | "priority_support" | "multiple_stores" | "custom_store_slug" | "api_access" | "lower_commission_rate" | "early_access_features" | "advanced_analytics" | "whatsapp_catalog_sync";
-/** Default capabilities granted to every new store on creation. */
+export type StoreCapability = "advanced_listing_types" | "host_auctions" | "host_preorders" | "create_categories" | "suggest_brands" | "create_coupons" | "bulk_listing_import" | "extended_return_window" | "verified_seller" | "featured_placement" | "promotional_banner" | "priority_support" | "multiple_stores" | "custom_store_slug" | "api_access" | "lower_commission_rate" | "early_access_features" | "advanced_analytics" | "whatsapp_catalog_sync";
+export declare const ALL_STORE_CAPABILITIES: StoreCapability[];
+/** Narrow an untrusted string to a real capability. */
+export declare function isStoreCapability(value: unknown): value is StoreCapability;
+/**
+ * Default capabilities granted to every new store on creation.
+ *
+ * 🛑 THE one definition. `AdminStoreEditorView` hardcoded its own copy, which
+ * is also the `??` fallback on its load path — so the two could disagree about
+ * what a store with no `capabilities` field is entitled to, and the admin
+ * editor's copy is the one that gets SAVED BACK. Import this; never restate it.
+ */
 export declare const DEFAULT_STORE_CAPABILITIES: StoreCapability[];
 /**
  * Check whether a permission array includes a required permission.
@@ -87,6 +97,23 @@ export declare function hasAllPermissions(permissions: Permission[], required: P
  * Check whether a store's capabilities include a specific capability.
  */
 export declare function hasCapability(capabilities: StoreCapability[], required: StoreCapability): boolean;
+/**
+ * Resolve a store's stored `capabilities` array to its effective set.
+ *
+ * 🛑 The PURE half of `getStoreCapabilities`, extracted so a caller that
+ * already holds the store document does not pay a second Firestore read to ask
+ * what it is entitled to (Rule #6). Three WhatsApp routes were reading
+ * `store.capabilities ?? []` inline for exactly that reason, which made them a
+ * second, divergent reader of the field — they skipped the default merge, so
+ * they and `getStoreCapabilities` could disagree about the same store.
+ *
+ * Note the empty-array case falls back to the defaults, matching
+ * `getStoreCapabilities`' long-standing `raw.length > 0` test. That is
+ * arguably the wrong call — an admin who deliberately unticks everything gets
+ * the defaults handed back — but it is the established behaviour and changing
+ * it would silently re-grant capabilities on stores that had them removed.
+ */
+export declare function resolveStoreCapabilities(raw: readonly string[] | null | undefined): StoreCapability[];
 /**
  * Groups permission prefixes into human-labeled domains for display —
  * used by the employee-permission editor and the read-only permissions

package/dist/features/auth/permissions/constants.js

@@ -319,7 +319,53 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/maintenance/payment-rollbacks": "admin:maintenance:view-payment-rollbacks",
     "/admin/maintenance/analysis": "admin:maintenance:run-analysis",
 };
-/** Default capabilities granted to every new store on creation. */
+/**
+ * Every capability, as a runtime value.
+ *
+ * 🛑 `Record<StoreCapability, true>` rather than a plain array, for the same
+ * reason `ALL_LISTING_TYPES_MAP` is: adding a member to the union without
+ * adding it here is then a COMPILE error, not a silent omission. This is what
+ * lets `capabilities` be validated as a `z.enum` instead of
+ * `z.array(z.string())` — which accepted any string, so a typo'd capability
+ * saved successfully and the gate it was meant to open never opened, silently.
+ *
+ * It also backs the admin editor's grouping, so a new capability cannot be
+ * granted in code and remain unreachable from the admin UI.
+ */
+const STORE_CAPABILITY_MAP = {
+    advanced_listing_types: true,
+    host_auctions: true,
+    host_preorders: true,
+    create_categories: true,
+    suggest_brands: true,
+    create_coupons: true,
+    bulk_listing_import: true,
+    extended_return_window: true,
+    verified_seller: true,
+    featured_placement: true,
+    promotional_banner: true,
+    priority_support: true,
+    multiple_stores: true,
+    custom_store_slug: true,
+    api_access: true,
+    lower_commission_rate: true,
+    early_access_features: true,
+    advanced_analytics: true,
+    whatsapp_catalog_sync: true,
+};
+export const ALL_STORE_CAPABILITIES = Object.keys(STORE_CAPABILITY_MAP);
+/** Narrow an untrusted string to a real capability. */
+export function isStoreCapability(value) {
+    return typeof value === "string" && value in STORE_CAPABILITY_MAP;
+}
+/**
+ * Default capabilities granted to every new store on creation.
+ *
+ * 🛑 THE one definition. `AdminStoreEditorView` hardcoded its own copy, which
+ * is also the `??` fallback on its load path — so the two could disagree about
+ * what a store with no `capabilities` field is entitled to, and the admin
+ * editor's copy is the one that gets SAVED BACK. Import this; never restate it.
+ */
 export const DEFAULT_STORE_CAPABILITIES = [
     "suggest_brands",
     "create_coupons",
@@ -352,6 +398,27 @@ export function hasAllPermissions(permissions, required) {
 export function hasCapability(capabilities, required) {
     return capabilities.includes(required);
 }
+/**
+ * Resolve a store's stored `capabilities` array to its effective set.
+ *
+ * 🛑 The PURE half of `getStoreCapabilities`, extracted so a caller that
+ * already holds the store document does not pay a second Firestore read to ask
+ * what it is entitled to (Rule #6). Three WhatsApp routes were reading
+ * `store.capabilities ?? []` inline for exactly that reason, which made them a
+ * second, divergent reader of the field — they skipped the default merge, so
+ * they and `getStoreCapabilities` could disagree about the same store.
+ *
+ * Note the empty-array case falls back to the defaults, matching
+ * `getStoreCapabilities`' long-standing `raw.length > 0` test. That is
+ * arguably the wrong call — an admin who deliberately unticks everything gets
+ * the defaults handed back — but it is the established behaviour and changing
+ * it would silently re-grant capabilities on stores that had them removed.
+ */
+export function resolveStoreCapabilities(raw) {
+    if (Array.isArray(raw) && raw.length > 0)
+        return raw;
+    return [...DEFAULT_STORE_CAPABILITIES];
+}
 // ============================================================================
 // PERMISSION DOMAINS — display grouping (S-ADMIN-7, 2026-08-19)
 // ============================================================================

package/dist/features/blog/components/BlogFeaturedCard.d.ts

@@ -17,5 +17,15 @@ export interface BlogFeaturedCardProps {
     showAuthor?: boolean;
     /** Show the cover image. Defaults to `true`. */
     showThumbnail?: boolean;
+    /**
+     * Owner-only pencil / clone / bin, for an admin or whoever owns this record.
+     * Pass `<OwnerQuickActions>`; it renders nothing for anyone else.
+     *
+     * 🛑 Rendered OUTSIDE this card's own `<Link>`/`<TextLink>`, as a sibling.
+     * A `<button>` inside an `<a>` is invalid HTML that browsers resolve by
+     * closing the anchor early, which breaks the CARD's navigation rather than
+     * just the button's — `stopPropagation` stops a click but cannot fix a parse.
+     */
+    renderOwnerActions?: () => React.ReactNode;
 }
-export declare function BlogFeaturedCard({ post, href, labels, className, selectable, isSelected, onSelect, showReadTime, showAuthor, showThumbnail, }: BlogFeaturedCardProps): React.JSX.Element;
+export declare function BlogFeaturedCard({ post, href, labels, className, selectable, isSelected, onSelect, showReadTime, showAuthor, showThumbnail, renderOwnerActions, }: BlogFeaturedCardProps): React.JSX.Element;