@mohasinac/appkit 4.53.2 → 4.54.0-next.0

package/dist/features/reviews/api/[id]/route.js

@@ -11,8 +11,21 @@
 import { NextResponse } from "next/server.js";
 import { z } from "zod";
 import { mediaUrlSchema } from "../../../../validation/schemas.js";
-import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
+/*
+ * 🛑 The real repository, not `db.getRepository<Review>("reviews")`.
+ *
+ * The generic FirebaseRepository knows nothing about this collection, so every
+ * read and write through it skipped ReviewRepository's overrides:
+ *
+ *   - `update` encrypts `userName` (PII) and rebuilds `searchTxt`. Writing
+ *     through the generic repo left the tokens describing the OLD text, so an
+ *     edited review was findable only by what it used to say.
+ *   - `mapDoc` decrypts `userName` and strips `helpfulVoterIds`. Reading
+ *     through the generic repo returned the name as raw `enc:v1:…` ciphertext
+ *     and published the voter list.
+ */
+import { reviewRepository } from "../../repository/reviews.repository.js";
 import { normalizeError } from "../../../../errors/normalize.js";
 import { isAdminUser, isModeratorUser } from "../../../auth/role-predicates.js";
 const ERR_REVIEW_NOT_FOUND = "Review not found";
@@ -20,12 +33,14 @@ const ERR_REVIEW_NOT_FOUND = "Review not found";
 export async function GET(_request, context) {
     try {
         const { id } = await context.params;
-        const { db } = getProviders();
-        if (!db) {
-            return NextResponse.json({ success: false, error: "Database provider not registered" }, { status: 503 });
-        }
-        const repo = db.getRepository("reviews");
-        const review = await repo.findById(id);
+        /*
+         * Through `reviewRepository`, so `mapDoc` runs: `userName` is decrypted
+         * and `helpfulVoterIds` is stripped. The generic repo did neither, so this
+         * public endpoint returned the reviewer's name as raw `enc:v1:…`
+         * ciphertext and published the list of everyone who had voted the review
+         * helpful.
+         */
+        const review = await reviewRepository.findById(id);
         if (!review) {
             return NextResponse.json({ success: false, error: ERR_REVIEW_NOT_FOUND }, { status: 404 });
         }
@@ -39,6 +54,19 @@ export async function GET(_request, context) {
 }
 export { GET as reviewItemGET };
 // ---- PATCH /api/reviews/[id] -------------------------------------------------
+/*
+ * 🛑 `.strict()`, not `.passthrough()`.
+ *
+ * It was passthrough, so any unlisted key reached the write — including
+ * `userId`, `verified`, `helpfulCount` and `featured`. A reviewer could have
+ * marked their own review a verified purchase, or featured it on the homepage,
+ * by adding one field to the request body. Nothing in the handler below looked
+ * at the extra keys; they went straight into Firestore.
+ *
+ * `.strict()` rejects them with a 400 naming the field rather than silently
+ * dropping them, which is the honest answer to a caller sending something this
+ * endpoint does not own.
+ */
 const reviewUpdateSchema = z
     .object({
     rating: z
@@ -53,10 +81,28 @@ const reviewUpdateSchema = z
     title: z.string().min(1).max(100).optional(),
     comment: z.string().min(1).max(2000).optional(),
     images: z.array(mediaUrlSchema).max(10).optional(),
-    video: mediaUrlSchema.optional(),
     status: z.enum(["pending", "approved", "rejected"]).optional(),
 })
-    .passthrough();
+    .strict();
+/*
+ * 🛑 `video` is deliberately NOT accepted here, and that is a fix rather than
+ * an omission.
+ *
+ * It used to be declared as a bare `mediaUrlSchema` — a URL string — while
+ * `ReviewDocument.video` is a `ReviewVideoField` object. So a caller sending
+ * the real shape failed validation, and a caller sending a string wrote a
+ * string into a field every renderer reads as an object, leaving `video.url`
+ * undefined and the player with nothing.
+ *
+ * Accepting the object instead would still be wrong on this route: the URL
+ * would arrive as an unfinalised `tmp/` reference, because nothing here calls
+ * `finalizeStagedMediaUrl`. `updateReview` (features/reviews/actions) is the
+ * path that owns review media — it finalises the upload and builds the full
+ * field — and `REVIEW_UPDATABLE_FIELDS` already documents the updatable set as
+ * rating / title / comment / images, with no video in it.
+ *
+ * One owner for media writes, and this is not it.
+ */
 export const reviewItemPATCH = createRouteHandler({
     auth: true,
     schema: reviewUpdateSchema,
@@ -64,11 +110,7 @@ export const reviewItemPATCH = createRouteHandler({
         const url = new URL(request.url);
         const segments = url.pathname.split("/");
         const id = segments[segments.length - 1];
-        const { db } = getProviders();
-        if (!db)
-            return NextResponse.json({ success: false, error: "DB not configured" }, { status: 503 });
-        const repo = db.getRepository("reviews");
-        const review = await repo.findById(id);
+        const review = await reviewRepository.findById(id);
         if (!review)
             return NextResponse.json({ success: false, error: ERR_REVIEW_NOT_FOUND }, { status: 404 });
         const isOwner = review.userId === user.uid;
@@ -77,13 +119,34 @@ export const reviewItemPATCH = createRouteHandler({
         if (!isOwner && !isModerator && !isAdmin) {
             return NextResponse.json({ success: false, error: "Forbidden" }, { status: 403 });
         }
-        // Owners can only edit content fields, not status
+        /*
+         * Owners edit content, not moderation state. Pinning `status` rather than
+         * rejecting the field is deliberate and pre-existing: an approved review
+         * edited by its author stays approved and is NOT sent back for
+         * re-moderation.
+         */
         const patch = isOwner && !isModerator && !isAdmin
             ? { ...body, status: review.status }
             : body;
-        const updated = await repo.update(id, {
+        /*
+         * 🛑 `hasImages` is DERIVED and has to move with `images`, or the two
+         * disagree. It is a real queryable field (`hasImages` is `canFilter` in
+         * SIEVE_FIELDS and backs the "with photos" review filter), so a review
+         * whose last photo was removed stayed in that filter for ever, and one
+         * that gained its first was absent from it.
+         */
+        const nextImages = body?.images;
+        const derived = nextImages !== undefined ? { hasImages: nextImages.length > 0 } : {};
+        /*
+         * 🛑 A `Date`, not an ISO string. Everything else in this codebase writes
+         * `Date` to `updatedAt`, and `reviewRepository`'s own Sieve config marks it
+         * sortable — so a string here sorts lexicographically beside real
+         * timestamps and silently orders wrong.
+         */
+        const updated = await reviewRepository.update(id, {
             ...patch,
-            updatedAt: new Date().toISOString(),
+            ...derived,
+            updatedAt: new Date(),
         });
         return NextResponse.json({ success: true, data: updated });
     },
@@ -95,11 +158,8 @@ export const reviewItemDELETE = createRouteHandler({
         const url = new URL(request.url);
         const segments = url.pathname.split("/");
         const id = segments[segments.length - 1];
-        const { db } = getProviders();
-        if (!db)
-            return NextResponse.json({ success: false, error: "DB not configured" }, { status: 503 });
-        const repo = db.getRepository("reviews");
-        const review = await repo.findById(id);
+        // Same repository as GET and PATCH — one collection, one repository.
+        const review = await reviewRepository.findById(id);
         if (!review)
             return NextResponse.json({ success: false, error: ERR_REVIEW_NOT_FOUND }, { status: 404 });
         const isOwner = review.userId === user.uid;
@@ -108,7 +168,7 @@ export const reviewItemDELETE = createRouteHandler({
         if (!isOwner && !isModerator && !isAdmin) {
             return NextResponse.json({ success: false, error: "Forbidden" }, { status: 403 });
         }
-        await repo.delete(id);
+        await reviewRepository.delete(id);
         return NextResponse.json({ success: true });
     },
 });

package/dist/features/reviews/components/PurchaseReviewAffordance.d.ts

@@ -0,0 +1,6 @@
+export interface PurchaseReviewAffordanceProps {
+    productId: string;
+    storeId?: string;
+    className?: string;
+}
+export declare function PurchaseReviewAffordance({ productId, storeId, className, }: PurchaseReviewAffordanceProps): import("react").JSX.Element;

package/dist/features/reviews/components/PurchaseReviewAffordance.js

@@ -0,0 +1,42 @@
+"use client";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * The strip and the review drawer, connected.
+ *
+ * Exists because the two halves need shared client state (which review is
+ * open) while the product detail page that mounts them is an async Server
+ * Component. One small client island is cheaper than making the detail view
+ * take two render-prop slots and thread state between them.
+ *
+ * @tag domain:reviews
+ * @tag layer:components
+ * @tag access:client
+ */
+import { useCallback, useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { YourPurchaseStrip } from "../../orders/components/YourPurchaseStrip.js";
+import { ReviewFormDrawer } from "./ReviewFormDrawer.js";
+export function PurchaseReviewAffordance({ productId, storeId, className, }) {
+    const queryClient = useQueryClient();
+    const [open, setOpen] = useState(false);
+    const [editingId, setEditingId] = useState(undefined);
+    /*
+     * Invalidate the strip's own query, not just the reviews list. The strip is
+     * what shows "Your review: 4/5", so saving without invalidating it leaves
+     * the buyer looking at their old rating and reasonably concluding the edit
+     * did not take.
+     */
+    const handleSaved = useCallback(() => {
+        void queryClient.invalidateQueries({
+            queryKey: ["user", "purchases", productId],
+        });
+        void queryClient.invalidateQueries({ queryKey: ["reviews"] });
+    }, [queryClient, productId]);
+    return (_jsxs(_Fragment, { children: [_jsx(YourPurchaseStrip, { productId: productId, className: className, onEditReview: (reviewId) => {
+                    setEditingId(reviewId);
+                    setOpen(true);
+                }, onWriteReview: () => {
+                    setEditingId(undefined);
+                    setOpen(true);
+                } }), _jsx(ReviewFormDrawer, { isOpen: open, onClose: () => setOpen(false), reviewId: editingId, productId: productId, storeId: storeId, onSaved: handleSaved })] }));
+}

package/dist/features/reviews/components/ReviewFormDrawer.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+/**
+ * Mirrors the PATCH route's schema, which is `.strict()`. A field this form can
+ * send that the route does not accept is a 400 naming it — which is the point:
+ * the two were allowed to disagree before, and the route silently accepted
+ * anything.
+ */
+export declare const reviewFormSchema: z.ZodObject<{
+    rating: z.ZodNumber;
+    title: z.ZodString;
+    comment: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    title: string;
+    rating: number;
+    comment: string;
+}, {
+    title: string;
+    rating: number;
+    comment: string;
+}>;
+export type ReviewFormValues = z.infer<typeof reviewFormSchema>;
+export interface ReviewFormDrawerProps {
+    isOpen: boolean;
+    onClose: () => void;
+    /** Present = editing that review. Absent = writing a new one. */
+    reviewId?: string;
+    /** Required when writing; the review is filed against this product. */
+    productId?: string;
+    storeId?: string;
+    initialValues?: Partial<ReviewFormValues>;
+    /** Called after a successful save, so the caller can refetch. */
+    onSaved?: () => void;
+}
+export declare function ReviewFormDrawer({ isOpen, onClose, reviewId, productId, storeId, initialValues, onSaved, }: ReviewFormDrawerProps): import("react").JSX.Element;

package/dist/features/reviews/components/ReviewFormDrawer.js

@@ -0,0 +1,127 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Write or edit a review.
+ *
+ * ── This is the first review form the application has ever had ────────────
+ *
+ * 🛑 Measured before building: `useCreateReview` had ZERO component consumers,
+ * `ReviewForm` did not exist, `ViewReviewModal` is read-only, `/user/reviews`
+ * was index-only with no detail or edit route, and the ACTIONS registry had no
+ * REVIEW bucket. The repo already knew — a tester case records
+ * "createReviewAction, useCreateReview and the UI_TEXT.WRITE_REVIEW string all
+ * exist, but no .tsx consumes any of them". So there was a complete write path
+ * with nothing able to reach it.
+ *
+ * ── Field names, because the obvious guesses are all wrong ────────────────
+ *
+ *   body      → `comment`   (NOT `body`)
+ *   owner     → `userId`    (NOT `buyerId`)
+ *   verified  → `verified`  (there is no `isVerifiedPurchase`)
+ *   reply     → `sellerReply`
+ *
+ * `REVIEW_UPDATABLE_FIELDS` is already `["rating","title","comment","images"]`,
+ * so that is exactly what this form owns — and exactly what the PATCH route
+ * accepts now that it is `.strict()`.
+ *
+ * 🛑 Images are deliberately NOT edited here. The PATCH route does not finalise
+ * staged media, so a URL submitted through it would persist as a `tmp/`
+ * reference; `updateReview` owns review media. Rather than ship a picker whose
+ * uploads silently rot, this form edits the text and the rating.
+ *
+ * @tag domain:reviews
+ * @tag layer:components
+ * @tag access:client
+ */
+import { useEffect, useState } from "react";
+import { z } from "zod";
+import { apiClient } from "../../../http/index.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { REVIEW_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { Button, FieldInput, FieldTextarea, Form, Row, SideDrawer, Stack, Text, } from "../../../ui/index.js";
+import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary.js";
+// Keys errors by the FULL dotted path, so a nested issue cannot collapse onto
+// one map entry and lose all but the last.
+import { applyZodIssues } from "../../../ui/forms/apply-zod-issues.js";
+import { Icon } from "../../../ui/components/Icon.js";
+import { IconButton } from "../../../ui/components/IconButton.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+/**
+ * Mirrors the PATCH route's schema, which is `.strict()`. A field this form can
+ * send that the route does not accept is a 400 naming it — which is the point:
+ * the two were allowed to disagree before, and the route silently accepted
+ * anything.
+ */
+export const reviewFormSchema = z.object({
+    rating: z
+        .number()
+        .int()
+        .min(1, "Pick a rating from 1 to 5")
+        .max(5, "Pick a rating from 1 to 5"),
+    title: z.string().trim().min(1, "Give your review a title").max(100),
+    comment: z
+        .string()
+        .trim()
+        .min(1, "Say something about the item")
+        .max(2000, "Keep it under 2000 characters"),
+});
+const EMPTY = { rating: 0, title: "", comment: "" };
+export function ReviewFormDrawer({ isOpen, onClose, reviewId, productId, storeId, initialValues, onSaved, }) {
+    const editing = Boolean(reviewId);
+    const [values, setValues] = useState({
+        ...EMPTY,
+        ...initialValues,
+    });
+    const [busy, setBusy] = useState(false);
+    const [formError, setFormError] = useState(null);
+    /*
+     * Re-seed when the drawer is reopened for a DIFFERENT review. Without this
+     * the second review a buyer edits in one session shows the first one's text
+     * — the component stays mounted, so initial state alone is not enough.
+     */
+    useEffect(() => {
+        if (isOpen)
+            setValues({ ...EMPTY, ...initialValues });
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [isOpen, reviewId]);
+    async function submit({ setFieldError, clearErrors, markSubmitAttempted, }) {
+        clearErrors();
+        setFormError(null);
+        markSubmitAttempted?.();
+        const parsed = reviewFormSchema.safeParse(values);
+        if (!parsed.success) {
+            applyZodIssues(parsed.error.issues, setFieldError);
+            return;
+        }
+        setBusy(true);
+        try {
+            if (reviewId) {
+                await apiClient.patch(REVIEW_ENDPOINTS.BY_ID(reviewId), parsed.data);
+            }
+            else {
+                await apiClient.post(REVIEW_ENDPOINTS.LIST, {
+                    ...parsed.data,
+                    productId,
+                    storeId,
+                });
+            }
+            onSaved?.();
+            onClose();
+        }
+        catch (err) {
+            const normalized = normalizeError(err);
+            /*
+             * 🛑 toUserMessage, never the server's own message. A raw `?? error`
+             * fallback is what rendered a Node MODULE_NOT_FOUND with a require
+             * stack inside a bid modal (Root Cause #86); this resolves through
+             * errors.codes.* and terminates at UNKNOWN.
+             */
+            setFormError(toUserMessage(normalized.code ?? "UNKNOWN"));
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    return (_jsx(SideDrawer, { isOpen: isOpen, onClose: onClose, title: editing ? "Edit your review" : "Write a review", children: _jsx(Form, { schema: reviewFormSchema, onSubmit: (e) => e.preventDefault(), className: "space-y-4", children: ({ setFieldError, clearErrors, markSubmitAttempted }) => (_jsxs(Stack, { gap: "md", children: [_jsx(FormErrorSummary, {}), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Rating" }), _jsx(Row, { gap: "xs", align: "center", children: [1, 2, 3, 4, 5].map((n) => (_jsx(IconButton, { "aria-label": `${n} star${n === 1 ? "" : "s"}`, "aria-pressed": values.rating === n, size: "md", variant: "ghost", icon: _jsx(Icon, { name: "review", size: "lg", filled: n <= values.rating, tone: n <= values.rating ? "warning" : "faint" }), onClick: () => setValues((v) => ({ ...v, rating: n })) }, n))) })] }), _jsx(FieldInput, { name: "title", label: "Title", required: true, value: values.title, onChange: (title) => setValues((v) => ({ ...v, title })) }), _jsx(FieldTextarea, { name: "comment", label: "Your review", required: true, rows: 6, value: values.comment, onChange: (comment) => setValues((v) => ({ ...v, comment })) }), formError && (_jsx(Text, { size: "sm", color: "error", role: "alert", children: formError })), _jsx(Button, { type: "submit", isLoading: busy, action: editing ? ACTIONS.REVIEW.edit : ACTIONS.REVIEW.write, onClick: () => void submit({ setFieldError, clearErrors, markSubmitAttempted }) })] })) }) }));
+}

package/dist/features/reviews/components/index.d.ts

@@ -11,3 +11,7 @@ export type { ReviewsIndexListingProps } from "./ReviewsIndexListing";
 export { ReviewsListingPanel } from "./ReviewsListingPanel";
 export type { ReviewsListingPanelProps, ReviewsSource } from "./ReviewsListingPanel";
 export type { ReviewDetailPageViewProps } from "./ReviewDetailPageView";
+export { ReviewFormDrawer, reviewFormSchema } from "./ReviewFormDrawer";
+export type { ReviewFormDrawerProps, ReviewFormValues } from "./ReviewFormDrawer";
+export { PurchaseReviewAffordance } from "./PurchaseReviewAffordance";
+export type { PurchaseReviewAffordanceProps } from "./PurchaseReviewAffordance";

package/dist/features/reviews/components/index.js

@@ -4,3 +4,5 @@ export { ReviewSummary } from "./ReviewSummary.js";
 export { ViewReviewModal } from "./ReviewModal.js";
 export { ReviewsIndexListing } from "./ReviewsIndexListing.js";
 export { ReviewsListingPanel } from "./ReviewsListingPanel.js";
+export { ReviewFormDrawer, reviewFormSchema } from "./ReviewFormDrawer.js";
+export { PurchaseReviewAffordance } from "./PurchaseReviewAffordance.js";

package/dist/features/seller/actions/seller-actions.d.ts

@@ -130,7 +130,7 @@ export declare function bulkSellerOrder(userId: string, userRole: string, userDi
  * only safe shape — a caller-supplied `storeId` would let a seller file a
  * listing under someone else's store.
  */
-export declare function createSellerProduct(userId: string, userName: string, userEmail: string, input: Record<string, JsonValue>): Promise<void>;
+export declare function createSellerProduct(userId: string, userName: string, userEmail: string, input: Record<string, JsonValue>, userRole?: string): Promise<void>;
 export declare function getSellerStore(userId: string): Promise<StoreDocument | null>;
 export declare function getSellerShipping(userId: string): Promise<import("../../auth").SellerShippingConfig | null>;
 export declare function getSellerPayoutSettings(userId: string): Promise<SellerPayoutDetails | {

package/dist/features/seller/actions/seller-actions.js

@@ -13,6 +13,7 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { enqueueJob } from "../../jobs/actions/enqueue-job.js";
 import { isAdminUser, isStrictSellerUser, isTesterUser } from "../../auth/role-predicates.js";
 import { ApiError, AuthorizationError, NotFoundError, ValidationError, } from "../../../errors/index.js";
+import { assertListingTypeAllowed } from "../../../_internal/shared/listing-types/tiers.js";
 import { userRepository } from "../../auth/repository/user.repository.js";
 import { storeRepository } from "../../stores/repository/store.repository.js";
 import { productRepository } from "../../products/repository/products.repository.js";
@@ -427,7 +428,13 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
  * only safe shape — a caller-supplied `storeId` would let a seller file a
  * listing under someone else's store.
  */
-export async function createSellerProduct(userId, userName, userEmail, input) {
+export async function createSellerProduct(userId, userName, userEmail, input, 
+/*
+ * 🛑 Defaults to `"seller"`, which FAILS CLOSED. A caller that forgets to
+ * pass a role gets the gate, not a bypass — the opposite default would make
+ * every un-updated call site an admin.
+ */
+userRole = "seller") {
     const store = await storeRepository.findByOwnerId(userId);
     // Refuse rather than write an orphan. A listing with no store is invisible on
     // its own storefront, forms no order group at checkout, and cannot be paid
@@ -436,6 +443,19 @@ export async function createSellerProduct(userId, userName, userEmail, input) {
     if (!store) {
         throw new NotFoundError("No store found for this account. Create your store first.");
     }
+    /*
+     * The advanced-listing-type gate, at the choke point every create funnels
+     * through.
+     *
+     * It lives HERE rather than only in the consumer action because this is the
+     * one place all creates meet, and because the store document is already in
+     * scope — so the check costs no extra Firestore read (Rule #6). The caller's
+     * own gate is a nicety; this one is the guarantee.
+     */
+    assertListingTypeAllowed(input.listingType, {
+        isPrivileged: userRole === "admin",
+        capabilities: store.capabilities,
+    });
     const finalizedData = await finalizeProductMediaReferences(input);
     await productRepository.create({
         ...finalizedData,
@@ -592,11 +612,37 @@ export async function sellerUpdateProduct(userId, userRole, productId, input) {
     if (!existing)
         throw new NotFoundError("Product not found");
     // existing.storeId is the store slug, not the seller's Firebase UID.
-    if (userRole !== "admin") {
-        const store = await storeRepository.findByOwnerId(userId);
+    const isPrivileged = userRole === "admin";
+    let store = null;
+    if (!isPrivileged) {
+        store = await storeRepository.findByOwnerId(userId);
         if (!store || existing.storeId !== store.id)
             throw new AuthorizationError("You do not own this product");
     }
+    /*
+     * 🛑 The UPDATE path had no listing-type gate at all, which made the
+     * create-time one bypassable in a single request: create a `standard`
+     * listing, then PATCH `listingType: "auction"` onto it and the type stuck.
+     * Gating only creates is gating nothing.
+     *
+     * 🛑 But it fires only on a CHANGE of type, and that is load-bearing. Every
+     * per-type edit page spreads its own literal into the payload
+     * (`store/art/[id]/edit` sends `listingType: "art"`), so gating on the
+     * submitted value alone would lock a seller out of editing listings they
+     * already own the moment the capability was turned off — or an admin revoked
+     * it. The rule is "you may not create or convert INTO an advanced type",
+     * never "you may not touch one".
+     *
+     * Reuses the store already loaded for the ownership check above, so a
+     * non-admin update pays no extra read. An admin skips both.
+     */
+    if (typeof input.listingType === "string" &&
+        input.listingType !== existing.listingType) {
+        assertListingTypeAllowed(input.listingType, {
+            isPrivileged,
+            capabilities: store?.capabilities,
+        });
+    }
     if (typeof input.status === "string" &&
         input.status !== "published" &&
         existing.status === "published") {

package/dist/features/seller/components/SellerPayoutSettingsView.js

@@ -88,6 +88,23 @@ const payoutSettingsDraftSchema = z.object({
      */
     supportsShippingProtection: annotate(z.boolean(), { section: "preferences", order: 5, row: "quarter" }),
     supportsSaleProtection: annotate(z.boolean(), { section: "preferences", order: 6, row: "quarter" }),
+    /*
+     * Advanced listing types — pre-orders, prize draws, classifieds, digital
+     * codes, live items, art and stickers. Everyone can already list
+     * `standard`, `spares` and `auction`.
+     *
+     * 🛑 Alongside payout settings for the same reason the protections are:
+     * each of these carries an obligation, not just a form. A pre-order takes
+     * money for stock that does not exist yet, a prize draw is a regulated
+     * promotion, a classified happens off-platform with no escrow, a
+     * digital-code listing must be delivered from a pool the seller has to keep
+     * stocked, and a live listing is an animal. A new seller should meet those
+     * deliberately rather than by discovering a nav item.
+     *
+     * OFF by default, and the copy has to say what enabling ACCEPTS — the same
+     * reason the protection toggles say what declining costs.
+     */
+    advancedListingTypesEnabled: annotate(z.boolean(), { section: "preferences", order: 7, row: "quarter" }),
 }).superRefine((v, ctx) => {
     if (v.method === "upi") {
         if (!v.upiId.trim()) {
@@ -128,6 +145,13 @@ const DEFAULT_DRAFT = {
     // OFF by default — matches StoreDocument, and absence must read as declined.
     supportsShippingProtection: false,
     supportsSaleProtection: false,
+    /*
+     * OFF by default, which is also the direction the server gate fails. A
+     * default of `true` here would be worse than cosmetic: this draft is what
+     * gets PATCHed, so it would silently GRANT the capability on the next
+     * unrelated save of this form.
+     */
+    advancedListingTypesEnabled: false,
 };
 export function SellerPayoutSettingsView({ apiBase = SELLER_ENDPOINTS.PAYOUT_SETTINGS }) {
     const [draft, setDraft] = useState(DEFAULT_DRAFT);
@@ -175,6 +199,9 @@ export function SellerPayoutSettingsView({ apiBase = SELLER_ENDPOINTS.PAYOUT_SET
                 pricesIncludeGst: res?.data?.pricesIncludeGst ?? true,
                 supportsShippingProtection: res?.data?.supportsShippingProtection ?? false,
                 supportsSaleProtection: res?.data?.supportsSaleProtection ?? false,
+                // Absent means NOT entitled. Defaulting this to `true` would be a
+                // silent GRANT on the next save, since this draft is what gets sent.
+                advancedListingTypesEnabled: res?.data?.advancedListingTypesEnabled ?? false,
             });
         })
             .catch(console.error)
@@ -205,6 +232,7 @@ export function SellerPayoutSettingsView({ apiBase = SELLER_ENDPOINTS.PAYOUT_SET
                 pricesIncludeGst: draft.pricesIncludeGst,
                 supportsShippingProtection: draft.supportsShippingProtection,
                 supportsSaleProtection: draft.supportsSaleProtection,
+                advancedListingTypesEnabled: draft.advancedListingTypesEnabled,
                 // Flat, matching the route's schema. A nested `taxInfo` object was
                 // stripped by `z.object()` and never reached Firestore.
                 gstin: draft.gstin.trim(),
@@ -271,8 +299,8 @@ export function SellerPayoutSettingsView({ apiBase = SELLER_ENDPOINTS.PAYOUT_SET
         {
             id: "preferences",
             label: "Preferences",
-            fields: ["autoPayout", "minimumThreshold", "emiEnabled", "pricesIncludeGst", "supportsShippingProtection", "supportsSaleProtection"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Payout Preferences" }), _jsx(Toggle, { checked: values.autoPayout, onChange: (checked) => onChange({ autoPayout: checked }), label: "Enable auto-payout \u2014 automatically transfer earnings on schedule", disabled: busy }), _jsx(FormField, { name: "minimumThreshold", label: "Minimum Payout Threshold (\u20B9)", type: "number", value: values.minimumThreshold, onChange: (v) => onChange({ minimumThreshold: v }), placeholder: "e.g. 500", helpText: "Payouts are held until your balance exceeds this amount. Leave blank for no minimum.", disabled: busy }), _jsxs(Div, { className: `${__P.p3} bg-[var(--appkit-color-surface-alt)] border border-[var(--appkit-color-border)]`, rounded: "lg", children: [_jsx(Text, { className: "mb-1", size: "sm", weight: "medium", children: "Payout Schedule" }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "Auto-payouts run every Monday for the previous week's settled orders. Manual payouts can be requested from the Payouts page at any time." })] }), _jsx(Toggle, { checked: values.emiEnabled, onChange: (checked) => onChange({ emiEnabled: checked }), label: "Offer EMI financing on eligible orders", disabled: busy }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "Only shown to buyers when platform-wide EMI is also enabled and their cart subtotal from your store exceeds the site's minimum order value. Orders on an EMI plan hold your payout until every installment is paid, unless you mark the item \"ship before EMI completes\"." }), _jsx(Toggle, { checked: values.pricesIncludeGst, onChange: (checked) => onChange({ pricesIncludeGst: checked }), label: "The prices I enter already include GST", disabled: busy }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["Buyers always see a tax-inclusive price, so this only changes how your own entry is read. Leave it", " ", _jsx(Span, { weight: "semibold", children: "on" }), " and a \u20B9999 listing at 5% GST means the buyer pays \u20B9999 and you earn \u20B9951.43 \u2014 the \u20B947.57 is GST we collect and remit for you. Turn it", " ", _jsx(Span, { weight: "semibold", children: "off" }), " and \u20B9999 is treated as your ex-GST price: the listing is shown at \u20B91,048.95 and you earn \u20B9999."] }), _jsx(Heading, { level: 3, className: "mb-2 mt-4", children: "Buyer Protections" }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["Two separate covers a buyer can pay for at checkout. Supporting one earns a safety badge on your listings;", " ", _jsx(Span, { weight: "semibold", children: "declining shows buyers a risk notice instead" }), " \u2014 there is no neutral option, because a buyer who is told nothing cannot tell a seller who declined from one who was never asked."] }), _jsx(Toggle, { checked: values.supportsShippingProtection, onChange: (checked) => onChange({ supportsShippingProtection: checked }), label: "Offer shipment protection \u2014 loss or damage in transit", disabled: busy }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "The parcel never arrived or arrived damaged. We pursue the courier, not you, and the buyer is refunded from the funds we hold \u2014 so a genuine transit loss costs you the item, not an argument." }), _jsx(Toggle, { checked: values.supportsSaleProtection, onChange: (checked) => onChange({ supportsSaleProtection: checked }), label: "Offer sale protection \u2014 item not as described", disabled: busy }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["A no-questions-asked refund on the item itself. Be clear about what this means:", " ", _jsx(Span, { weight: "semibold", children: "a claim we inspect and find genuine is charged back to you" }), " ", "\u2014 that is the cover. A claim we find to be a change of mind is absorbed by us, which is what the buyer's fee pays for. Not offered on your final-sale listings, since \"no returns\" and \"no questions asked\" cannot both be true."] }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "Changing this does not re-price listings you have already published. It applies to products you save from now on." })] })),
+            fields: ["autoPayout", "minimumThreshold", "emiEnabled", "pricesIncludeGst", "supportsShippingProtection", "supportsSaleProtection", "advancedListingTypesEnabled"],
+            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Payout Preferences" }), _jsx(Toggle, { checked: values.autoPayout, onChange: (checked) => onChange({ autoPayout: checked }), label: "Enable auto-payout \u2014 automatically transfer earnings on schedule", disabled: busy }), _jsx(FormField, { name: "minimumThreshold", label: "Minimum Payout Threshold (\u20B9)", type: "number", value: values.minimumThreshold, onChange: (v) => onChange({ minimumThreshold: v }), placeholder: "e.g. 500", helpText: "Payouts are held until your balance exceeds this amount. Leave blank for no minimum.", disabled: busy }), _jsxs(Div, { className: `${__P.p3} bg-[var(--appkit-color-surface-alt)] border border-[var(--appkit-color-border)]`, rounded: "lg", children: [_jsx(Text, { className: "mb-1", size: "sm", weight: "medium", children: "Payout Schedule" }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "Auto-payouts run every Monday for the previous week's settled orders. Manual payouts can be requested from the Payouts page at any time." })] }), _jsx(Toggle, { checked: values.emiEnabled, onChange: (checked) => onChange({ emiEnabled: checked }), label: "Offer EMI financing on eligible orders", disabled: busy }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "Only shown to buyers when platform-wide EMI is also enabled and their cart subtotal from your store exceeds the site's minimum order value. Orders on an EMI plan hold your payout until every installment is paid, unless you mark the item \"ship before EMI completes\"." }), _jsx(Toggle, { checked: values.pricesIncludeGst, onChange: (checked) => onChange({ pricesIncludeGst: checked }), label: "The prices I enter already include GST", disabled: busy }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["Buyers always see a tax-inclusive price, so this only changes how your own entry is read. Leave it", " ", _jsx(Span, { weight: "semibold", children: "on" }), " and a \u20B9999 listing at 5% GST means the buyer pays \u20B9999 and you earn \u20B9951.43 \u2014 the \u20B947.57 is GST we collect and remit for you. Turn it", " ", _jsx(Span, { weight: "semibold", children: "off" }), " and \u20B9999 is treated as your ex-GST price: the listing is shown at \u20B91,048.95 and you earn \u20B9999."] }), _jsx(Heading, { level: 3, className: "mb-2 mt-4", children: "Buyer Protections" }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["Two separate covers a buyer can pay for at checkout. Supporting one earns a safety badge on your listings;", " ", _jsx(Span, { weight: "semibold", children: "declining shows buyers a risk notice instead" }), " \u2014 there is no neutral option, because a buyer who is told nothing cannot tell a seller who declined from one who was never asked."] }), _jsx(Toggle, { checked: values.supportsShippingProtection, onChange: (checked) => onChange({ supportsShippingProtection: checked }), label: "Offer shipment protection \u2014 loss or damage in transit", disabled: busy }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "The parcel never arrived or arrived damaged. We pursue the courier, not you, and the buyer is refunded from the funds we hold \u2014 so a genuine transit loss costs you the item, not an argument." }), _jsx(Toggle, { checked: values.supportsSaleProtection, onChange: (checked) => onChange({ supportsSaleProtection: checked }), label: "Offer sale protection \u2014 item not as described", disabled: busy }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["A no-questions-asked refund on the item itself. Be clear about what this means:", " ", _jsx(Span, { weight: "semibold", children: "a claim we inspect and find genuine is charged back to you" }), " ", "\u2014 that is the cover. A claim we find to be a change of mind is absorbed by us, which is what the buyer's fee pays for. Not offered on your final-sale listings, since \"no returns\" and \"no questions asked\" cannot both be true."] }), _jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: "Changing this does not re-price listings you have already published. It applies to products you save from now on." }), _jsx(Toggle, { checked: values.advancedListingTypesEnabled, onChange: (checked) => onChange({ advancedListingTypesEnabled: checked }), label: "Enable advanced listing types", disabled: busy }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["Adds pre-orders, prize draws, classifieds, digital codes, live items, art and stickers alongside the products, spares and auctions you can already list. Each carries its own obligation:", " ", _jsx(Span, { weight: "semibold", children: "a pre-order takes payment for stock you do not have yet, a prize draw is a regulated promotion, a classified happens off-platform with no escrow protection, a digital code must be delivered from a pool you keep stocked, and a live listing is an animal." }), " ", "Turning this off later does not unpublish listings you have already created \u2014 it only stops you making new ones."] })] })),
         },
     ], [busy, current]);
     const { openIds, setOpenIds, goToSection, fieldToSectionIndex, sectionMeta } = useSectionFormNav(sections, draft);

package/dist/features/seller/components/SellerProductShell.d.ts

@@ -1,6 +1,22 @@
 import React from "react";
 import type { MediaField } from "../../media/types";
-export type ProductListingMode = "standard" | "auction" | "pre-order" | "prize-draw" | "bundle" | "classified" | "digital-code" | "live" | "art" | "stickers" | "spares";
+import type { ListingType } from "../../products/types/index";
+/**
+ * What this shell is editing: any listing type, or a bundle.
+ *
+ * 🛑 DERIVED from `ListingType`, not restated. This was a hand-written copy of
+ * the union plus `"bundle"` — the eleventh such copy in the codebase — and the
+ * whole point of `ALL_LISTING_TYPES_MAP` being a `Record<ListingType, true>`
+ * is that a new member cannot be silently omitted from a list like this one.
+ * Root Cause #61.
+ *
+ * `"bundle"` is a deliberate EXTRA, not an oversight: bundles stopped being a
+ * `listingType` in SB-UNI-D (they are a `categoryType` on `categories` now),
+ * but this shell still edits them, which is what `pluginForMode`'s
+ * `BUNDLE_PLUGIN_FALLBACK` is for. Spelling it as a union with one added
+ * literal says that, where a twelve-item list said nothing.
+ */
+export type ProductListingMode = ListingType | "bundle";
 export interface SellerProductDraft {
     title?: string;
     slug?: string;

package/dist/features/seller/hooks/useStoreListingEntitlements.d.ts

@@ -0,0 +1,8 @@
+import type { ListingType } from "../../products/types/index";
+export interface StoreListingEntitlements {
+    /** Types this store may create. Never empty — basics are always included. */
+    allowed: Set<ListingType>;
+    advancedEnabled: boolean;
+    isLoading: boolean;
+}
+export declare function useStoreListingEntitlements(): StoreListingEntitlements;