@mohasinac/appkit 4.53.2 → 4.54.1

package/dist/features/admin/schemas/firestore.d.ts

@@ -31,10 +31,6 @@ export interface NotificationDocument extends BaseDocument {
     readAt?: Date;
     relatedId?: string;
     relatedType?: NotificationRelatedType;
-    /** Outcome of the async whatsappNotify job for this notification's WhatsApp send, if one was enqueued. */
-    whatsappStatus?: "queued" | "sent" | "failed" | "skipped";
-    /** jobs/{id} doc that ran (or is running) the WhatsApp send for this notification. */
-    whatsappJobId?: string;
 }
 export declare const NOTIFICATIONS_COLLECTION: "notifications";
 export declare const NOTIFICATIONS_INDEXED_FIELDS: readonly ["userId", "isRead", "createdAt", "type"];
@@ -99,8 +95,20 @@ export interface SiteSettingsCredentials {
     /** Username/password pair configured in the PhonePe dashboard's Webhook tab (SHA/Basic auth mode) — verified via the SDK's `validateCallback()`. */
     phonepeWebhookUsername?: string;
     phonepeWebhookPassword?: string;
+    /**
+     * Razorpay publishable key (`rzp_test_…` / `rzp_live_…`).
+     *
+     * 🛑 The ONLY credential in this interface that is deliberately sent to the
+     * browser — Razorpay's `checkout.js` needs it to open the modal. It is
+     * published by `/api/payment/create-order`, not by the site-settings
+     * projection, so it stays in `PRIVATE_SITE_SETTINGS_FIELDS` like every
+     * other credential (see CLAUDE.md § Public Data Projections).
+     */
+    razorpayKeyId?: string;
+    razorpayKeySecret?: string;
+    /** Webhook signing secret from Razorpay's dashboard → Webhooks. Without it `verifyWebhook()` fails closed. */
+    razorpayWebhookSecret?: string;
     resendApiKey?: string;
-    whatsappApiKey?: string;
     metaAppId?: string;
     metaAppSecret?: string;
     metaPageAccessToken?: string;
@@ -115,28 +123,6 @@ export interface SiteSettingsCredentials {
     /** Google Places API for Google Business Reviews (HS4) */
     googleMapsApiKey?: string;
     googlePlaceId?: string;
-    /** WhatsApp Business Cloud API — platform level (for admin purchase announcements) */
-    whatsappPhoneNumberId?: string;
-    whatsappCloudApiToken?: string;
-    /** Comma-separated digits-only phone numbers that receive order announcements */
-    whatsappAdminNotifyNumbers?: string;
-    /**
-     * Approved Meta message-template names, one flat string field per
-     * order-lifecycle notification type — every `SiteSettingsCredentials`
-     * field is stored as an individually-encrypted string (see
-     * `getDecryptedCredentials`/`getCredentialsMasked`, which iterate + mask
-     * every field as a string), so this can't be a `Record<string,string>`
-     * map. Business-initiated WhatsApp sends outside the 24h customer-service
-     * window require a pre-approved template.
-     */
-    whatsappTemplateOrderPlaced?: string;
-    whatsappTemplateOrderConfirmed?: string;
-    whatsappTemplateOrderShipped?: string;
-    whatsappTemplateOrderDelivered?: string;
-    whatsappTemplateOrderCancelled?: string;
-    whatsappTemplateRefundInitiated?: string;
-    /** BCP-47 language code the templates above were approved in, e.g. "en" or "en_US". */
-    whatsappTemplateLanguage?: string;
 }
 export interface SiteSettingsCredentialsMasked {
     phonepeClientId?: string;
@@ -145,8 +131,10 @@ export interface SiteSettingsCredentialsMasked {
     phonepeEnvironment?: string;
     phonepeWebhookUsername?: string;
     phonepeWebhookPassword?: string;
+    razorpayKeyId?: string;
+    razorpayKeySecret?: string;
+    razorpayWebhookSecret?: string;
     resendApiKey?: string;
-    whatsappApiKey?: string;
     metaAppId?: string;
     metaAppSecret?: string;
     metaPageAccessToken?: string;
@@ -158,16 +146,6 @@ export interface SiteSettingsCredentialsMasked {
     deviantartClientSecret?: string;
     googleMapsApiKey?: string;
     googlePlaceId?: string;
-    whatsappPhoneNumberId?: string;
-    whatsappCloudApiToken?: string;
-    whatsappAdminNotifyNumbers?: string;
-    whatsappTemplateOrderPlaced?: string;
-    whatsappTemplateOrderConfirmed?: string;
-    whatsappTemplateOrderShipped?: string;
-    whatsappTemplateOrderDelivered?: string;
-    whatsappTemplateOrderCancelled?: string;
-    whatsappTemplateRefundInitiated?: string;
-    whatsappTemplateLanguage?: string;
 }
 export interface NotificationChannelConfig {
     inApp: {
@@ -183,15 +161,6 @@ export interface NotificationChannelConfig {
         /** Subset of NotificationTypes to email — absent means all types. */
         types?: NotificationType[];
     };
-    whatsapp: {
-        enabled: boolean;
-        /** Minimum priority that triggers a WhatsApp message (default: "high"). */
-        minPriority?: NotificationPriority;
-        /** Subset of NotificationTypes to WhatsApp — absent means all types. */
-        types?: NotificationType[];
-        /** When true, WhatsApp OTP is offered as an alternative to email OTP at checkout. */
-        otpEnabled?: boolean;
-    };
     sms: {
         enabled: boolean;
         /** Minimum priority that triggers an SMS (default: "high"). */
@@ -368,6 +337,18 @@ export interface SiteSettingsDocument extends BaseDocument {
         supportHours?: string;
     };
     payment: {
+        /**
+         * Razorpay (client-side card/UPI/netbanking modal).
+         *
+         * 🛑 Checked BEFORE `phonepeEnabled` in `providers.config.ts` — exactly
+         * one online gateway can be registered per process, so the order is the
+         * tie-break when both are on, not a precedence anyone should rely on.
+         * Turning this on with no credentials makes the provider constructor
+         * throw at boot; `resolveKeys()` treats a seeded `*_PLACEHOLDER` as
+         * absent, so a placeholder reads as "unconfigured" rather than failing
+         * mid-checkout.
+         */
+        razorpayEnabled: boolean;
         phonepeEnabled: boolean;
         upiManualEnabled: boolean;
         codEnabled: boolean;
@@ -433,10 +414,6 @@ export interface SiteSettingsDocument extends BaseDocument {
         /** COD handling fee charged to the buyer: max(codHandlingFeeMin, subtotal × codHandlingFeePercent / 100). */
         codHandlingFeeMin: number;
         codHandlingFeePercent: number;
-        /** Admin master toggle — whether the WhatsApp order-updates addon is offered at checkout at all. */
-        whatsappNotifyFeeEnabled: boolean;
-        /** Flat rupee fee charged to the buyer when they opt into the WhatsApp order-updates addon. */
-        whatsappNotifyFee: number;
         /** Admin master toggle — whether the gift-wrap addon is offered at checkout at all. */
         giftWrapFeeEnabled: boolean;
         /** Flat rupee fee charged to the buyer when they opt into gift wrap. */
@@ -522,8 +499,6 @@ export interface SiteSettingsDocument extends BaseDocument {
     messaging?: {
         /** User-facing email. Staff mail (daily digest, payout summary) ignores this. */
         emailEnabled: boolean;
-        /** User-facing WhatsApp. Same exemption for staff. */
-        whatsappEnabled: boolean;
         /**
          * Reserved sends allowed per channel per day. Applies to staff and
          * transactional mail too — the ceiling exists to stay inside the
@@ -531,7 +506,6 @@ export interface SiteSettingsDocument extends BaseDocument {
          */
         dailyCeiling: {
             email: number;
-            whatsapp: number;
             sms: number;
         };
     };

package/dist/features/admin/schemas/firestore.js

@@ -15,7 +15,7 @@ export const ADMIN_CHECKOUT_BYPASS_FLAG_KEY = "adminCheckoutBypass";
  *   · `constants/notification-types.ts` (9) — fed the admin filter chips and
  *     the per-channel allow-list, so the admin list could not filter 18 of
  *     the 27 real types and an admin literally could not allow-list
- *     `offer_received` or `payment_review` for email or WhatsApp
+ *     `offer_received` or `payment_review` for email
  *   · `features/account/types/index.ts` (5: order|offer|promo|system|message)
  *     — a different vocabulary entirely, on a `UserNotification` type with
  *     zero real consumers
@@ -195,7 +195,6 @@ export const notificationQueryHelpers = {
 export const DEFAULT_NOTIFICATION_CHANNELS = {
     inApp: { enabled: true, readOnly: true },
     email: { enabled: false, minPriority: "normal" },
-    whatsapp: { enabled: false, minPriority: "high", otpEnabled: false },
     sms: { enabled: false, minPriority: "high" },
 };
 const PRIORITY_ORDER = {
@@ -231,6 +230,7 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
     motto: "Your Marketplace, Your Rules",
     theme: DEFAULT_SITE_SETTINGS_THEME,
     payment: {
+        razorpayEnabled: false,
         phonepeEnabled: false,
         upiManualEnabled: true,
         codEnabled: true,
@@ -243,8 +243,7 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
     // half-configured site.
     messaging: {
         emailEnabled: false,
-        whatsappEnabled: false,
-        dailyCeiling: { email: 80, whatsapp: 200, sms: 50 },
+        dailyCeiling: { email: 80, sms: 50 },
     },
     emi: {
         enabled: false,
@@ -267,11 +266,9 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         // The buyer add-ons ship ENABLED. They were `false`, which made
         // StoreAddonsPicker return null on both the cart and checkout, so a fresh
         // install had no add-ons at all and no indication why. `undefined` still
-        // means disabled everywhere (computeWhatsAppNotifyFee et al. read
+        // means disabled everywhere (computeGiftWrapFee et al. read
         // `if (!rates.XEnabled) return 0`) — only the DEFAULT changed, so an
         // existing siteSettings document keeps whatever it already stored.
-        whatsappNotifyFeeEnabled: true,
-        whatsappNotifyFee: 10,
         giftWrapFeeEnabled: true,
         giftWrapFee: 49,
         shipmentProtectionFeeEnabled: true,
@@ -306,28 +303,53 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         autoExtendWindowMinutes: 5,
         settlementGracePeriodHours: 24,
     },
-    // Every type on by default. `isListingTypeEnabled` treats a MISSING key as
-    // enabled, so this block is documentation of the full set rather than the
-    // mechanism — a type absent here still renders. `art` and `stickers` were
-    // missing from the old `featureFlags.listingTypes` literal for exactly that
-    // reason: nothing broke, so nobody noticed (Root Cause #58).
+    /*
+     * 🛑 THIS BLOCK IS NOW LOAD-BEARING, and it was not before.
+     *
+     * `isListingTypeEnabled` treats a MISSING key as ENABLED, so while every
+     * value here was `true` the block was pure documentation — a type left out
+     * rendered anyway, which is how `art`, `stickers` and `spares` sat outside it
+     * for months with nothing breaking (Root Cause #58). Now that five types ship
+     * `false`, an omission is no longer harmless in one direction only: a new
+     * union member added to `ListingType` and forgotten here goes LIVE on every
+     * site, which is the opposite of the intended default.
+     *
+     * So: every member of `ListingType` gets an explicit line, including the ones
+     * that are `true`. `spares` was missing entirely and is spelled out now.
+     *
+     * 2026-10-20 — open for business: standard, spares, pre-order, art, stickers.
+     * The other five are built, routed and reachable by URL; what is switched off
+     * is the site OFFERING them. An admin flips any of them back in
+     * Admin → Site Settings → Listings without a deploy, which is the whole point
+     * of this living in settings rather than in a constant.
+     *
+     * ⚠️ A default only reaches a site that has never written its settings
+     * document. An existing deployment already has a singleton with the old
+     * all-true map, and changing this file does NOT rewrite it — flip those in the
+     * admin UI, or re-seed.
+     */
     listings: {
         listingTypes: {
             standard: true,
-            auction: true,
+            spares: true,
             "pre-order": true,
-            "prize-draw": true,
-            classified: true,
-            "digital-code": true,
-            live: true,
             art: true,
             stickers: true,
+            auction: false,
+            "prize-draw": false,
+            classified: false,
+            "digital-code": false,
+            live: false,
         },
+        // `bundle: false` is the admin-side switch for bundles, which are a
+        // CATEGORY type rather than a listing type — it is what hides the
+        // homepage's featured-bundles rail and the bundle tabs on category and
+        // brand pages. Same reasoning as the five listing types above.
         categoryTypes: {
             category: true,
             sublisting: true,
             brand: true,
-            bundle: true,
+            bundle: false,
         },
     },
     shipping: {

package/dist/features/auctions/components/AuctionDetailPageView.js

@@ -42,6 +42,7 @@ import { GroupedListingsCarousel } from "../../grouped/components/GroupedListing
 import { getGroupsWithItemsForProduct } from "../../../_internal/server/features/grouped/data.js";
 import { SublistingCarouselSection } from "../../products/components/SublistingCarouselSection.js";
 import { isFinalSale } from "../../products/constants/final-sale.js";
+import { OwnerQuickActions } from "../../admin/components/OwnerQuickActions.js";
 function toDescriptionHtml(raw) {
     if (!raw)
         return "";
@@ -49,8 +50,8 @@ function toDescriptionHtml(raw) {
     return normalizeRichTextHtml(s);
 }
 function renderAuctionInfoPanel(props) {
-    const { productId, title, currentBid, currency, bidCount, isEnded, endDate, buyNowPrice, buyNowAvailable, featured, freeShipping, condition, finalSale, category, categoryName, brand, brandSlug, productFeatures, features, descriptionHtml, safeSeller, storeHref } = props;
-    return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_LIVE_BADGE, children: "\uD83C\uDFF7\uFE0F Live Auction" }), _jsx(AuctionLiveStatusBadge, { auctionEndDate: endDate, initialIsEnded: isEnded })] }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-0.5", color: "muted", size: "xs", children: "Current bid" }), _jsx(LiveBidPrice, { productId: productId, currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "2xl", badgeSize: "sm" }), endDate && !isEnded && (_jsxs(Text, { className: "mt-1.5", color: "muted", size: "sm", children: ["Ends in ", _jsx(Span, { weight: "medium", color: "muted", children: _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" }) })] })), endDate && _jsxs(Text, { className: "mt-0.5", color: "faint", size: "xs", children: [isEnded ? "Ended" : "Ends", " ", endDate.toLocaleString()] })] }), buyNowAvailable && buyNowPrice !== null && (_jsxs(Row, { align: "center", gap: "sm", className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)] bg-primary-50 dark:bg-primary-900/20", padding: "inlineSm", rounded: "lg", children: [_jsx(Span, { size: "xs", color: "muted", children: "Buy Now:" }), _jsx(Span, { size: "base", weight: "bold", className: "text-primary-700 dark:text-primary-300", children: _jsx(GatedPrice, { label: "Sign in to see the Buy Now price", children: formatCurrency(buyNowPrice, currency) }) }), _jsx(Span, { size: "xs", color: "faint", children: "\u2014 in \u201CPlace a bid\u201D" })] })), _jsx(ProductFeatureBadges, { featured: featured, freeShipping: freeShipping, condition: condition ?? undefined, finalSale: finalSale, labels: { featured: "Featured", fasterDelivery: "Faster Delivery", ratedSeller: "Rated Seller", condition: "Condition", conditionNew: "New", conditionUsed: "Used", conditionBroken: "For Parts", conditionRefurbished: "Refurbished", returnable: "Returnable", finalSale: "Final Sale", freeShipping: "Free Shipping", codAvailable: "Cash on Delivery", emiAvailable: "EMI Available", wishlistCount: (n) => `${n} wishlisted`, categoryProductCount: (n, cat) => `${n} in ${cat}` } }), (categoryName || category || brand) && (_jsxs(Row, { gap: "sm", wrap: true, children: [category && _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: categoryName || category }), !category && categoryName && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: categoryName }), brand && brandSlug && _jsx(Link, { href: String(ROUTES.PUBLIC.BRAND_DETAIL(brandSlug)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: brand }), brand && !brandSlug && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: brand })] })), productFeatures && features.length > 0 && _jsx(FeatureBadgeList, { productFeatureIds: features, features: productFeatures }), !productFeatures && features.length > 0 && (_jsxs(Div, { border: "subtle", surface: "muted", padding: "inline", rounded: "xl", children: [_jsx(Text, { className: "mb-2 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "About this item" }), _jsx(Ul, { spacing: "comfortable", size: "sm", color: "primary", children: features.map((f, i) => _jsxs(Li, { layout: "flex-start", gap: "2", children: [_jsx(Span, { className: "mt-0.5 flex-shrink-0 text-primary-500", children: "\u2022" }), f] }, i)) })] })), descriptionHtml && _jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" }), safeSeller && (_jsx(Div, { className: `${__P.p3}`, border: "subtle", rounded: "xl", surface: "muted", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Listed by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && _jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" })] }) }))] }));
+    const { productId, storeId, title, currentBid, currency, bidCount, isEnded, endDate, buyNowPrice, buyNowAvailable, featured, freeShipping, condition, finalSale, category, categoryName, brand, brandSlug, productFeatures, features, descriptionHtml, safeSeller, storeHref } = props;
+    return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_LIVE_BADGE, children: "\uD83C\uDFF7\uFE0F Live Auction" }), _jsx(AuctionLiveStatusBadge, { auctionEndDate: endDate, initialIsEnded: isEnded })] }), _jsx(OwnerQuickActions, { resource: "PRODUCT", placement: "detail", recordLabel: title, storeId: storeId, editHref: String(ROUTES.STORE.PRODUCTS_EDIT(productId)) }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-0.5", color: "muted", size: "xs", children: "Current bid" }), _jsx(LiveBidPrice, { productId: productId, currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "2xl", badgeSize: "sm" }), endDate && !isEnded && (_jsxs(Text, { className: "mt-1.5", color: "muted", size: "sm", children: ["Ends in ", _jsx(Span, { weight: "medium", color: "muted", children: _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" }) })] })), endDate && _jsxs(Text, { className: "mt-0.5", color: "faint", size: "xs", children: [isEnded ? "Ended" : "Ends", " ", endDate.toLocaleString()] })] }), buyNowAvailable && buyNowPrice !== null && (_jsxs(Row, { align: "center", gap: "sm", className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)] bg-primary-50 dark:bg-primary-900/20", padding: "inlineSm", rounded: "lg", children: [_jsx(Span, { size: "xs", color: "muted", children: "Buy Now:" }), _jsx(Span, { size: "base", weight: "bold", className: "text-primary-700 dark:text-primary-300", children: _jsx(GatedPrice, { label: "Sign in to see the Buy Now price", children: formatCurrency(buyNowPrice, currency) }) }), _jsx(Span, { size: "xs", color: "faint", children: "\u2014 in \u201CPlace a bid\u201D" })] })), _jsx(ProductFeatureBadges, { featured: featured, freeShipping: freeShipping, condition: condition ?? undefined, finalSale: finalSale, labels: { featured: "Featured", fasterDelivery: "Faster Delivery", ratedSeller: "Rated Seller", condition: "Condition", conditionNew: "New", conditionUsed: "Used", conditionBroken: "For Parts", conditionRefurbished: "Refurbished", returnable: "Returnable", finalSale: "Final Sale", freeShipping: "Free Shipping", codAvailable: "Cash on Delivery", emiAvailable: "EMI Available", wishlistCount: (n) => `${n} wishlisted`, categoryProductCount: (n, cat) => `${n} in ${cat}` } }), (categoryName || category || brand) && (_jsxs(Row, { gap: "sm", wrap: true, children: [category && _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: categoryName || category }), !category && categoryName && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: categoryName }), brand && brandSlug && _jsx(Link, { href: String(ROUTES.PUBLIC.BRAND_DETAIL(brandSlug)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: brand }), brand && !brandSlug && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: brand })] })), productFeatures && features.length > 0 && _jsx(FeatureBadgeList, { productFeatureIds: features, features: productFeatures }), !productFeatures && features.length > 0 && (_jsxs(Div, { border: "subtle", surface: "muted", padding: "inline", rounded: "xl", children: [_jsx(Text, { className: "mb-2 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "About this item" }), _jsx(Ul, { spacing: "comfortable", size: "sm", color: "primary", children: features.map((f, i) => _jsxs(Li, { layout: "flex-start", gap: "2", children: [_jsx(Span, { className: "mt-0.5 flex-shrink-0 text-primary-500", children: "\u2022" }), f] }, i)) })] })), descriptionHtml && _jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" }), safeSeller && (_jsx(Div, { className: `${__P.p3}`, border: "subtle", rounded: "xl", surface: "muted", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Listed by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && _jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" })] }) }))] }));
 }
 /**
  * Store reviews for the auction's seller.
@@ -215,7 +216,7 @@ export async function AuctionDetailPageView({ id, initialAuction, onPlaceBid, on
                     price: typeof p.price === "number" ? p.price : undefined,
                     storeId: typeof p.storeId === "string" ? p.storeId : undefined,
                     storeName: typeof p.storeName === "string" ? p.storeName : undefined,
-                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.AUCTIONS), className: CLS_BREADCRUMB_LINK, children: "Auctions" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(AuctionDetailView, { renderGallery: () => (_jsx(ProductGalleryClient, { images: images, video: productVideo, productName: title })), renderInfo: () => renderAuctionInfoPanel({ productId: String(product.id), title, currentBid, currency, bidCount, isEnded, endDate, buyNowPrice, buyNowAvailable, featured, freeShipping, condition, finalSale: isFinalSale(p), category, categoryName, brand, brandSlug, productFeatures, features, descriptionHtml, safeSeller, storeHref }), renderBidForm: () => onPlaceBid ? (_jsx(Stack, { id: "auction-bid-form", gap: "3", children: _jsxs(Stack, { className: `${__P.p5}`, border: "subtle", gap: "3", rounded: "xl", surface: "muted", children: [_jsxs(Row, { justify: "between", align: "baseline", children: [_jsx(LiveBidPrice, { productId: String(product.id), currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "xl", badgeSize: "xs" }), !isEnded && (_jsx(LiveMinIncrement, { productId: String(product.id), currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, tiers: bidIncrementTiers, minBidIncrementOverride: minBidIncrementOverride }))] }), !isEnded && endDate && (_jsxs(Text, { align: "center", size: "xs", color: "muted", children: ["Ends in ", _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" })] })), _jsx(PlaceBidModalButton, { productId: String(product.id), currentBid: currentBid, startingBid: startingBid, tiers: bidIncrementTiers, minBidIncrementOverride: minBidIncrementOverride, currency: currency, isEnded: isEnded, auctionEndDate: endDate, buyNowPrice: buyNowPrice, bidCount: bidCount, tags: tags, onPlaceBid: onPlaceBid, onBuyNow: onBuyNow, triggerClassName: "w-full" })] }) })) : (
+                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.AUCTIONS), className: CLS_BREADCRUMB_LINK, children: "Auctions" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(AuctionDetailView, { renderGallery: () => (_jsx(ProductGalleryClient, { images: images, video: productVideo, productName: title })), renderInfo: () => renderAuctionInfoPanel({ productId: String(product.id), storeId: product.storeId ? String(product.storeId) : undefined, title, currentBid, currency, bidCount, isEnded, endDate, buyNowPrice, buyNowAvailable, featured, freeShipping, condition, finalSale: isFinalSale(p), category, categoryName, brand, brandSlug, productFeatures, features, descriptionHtml, safeSeller, storeHref }), renderBidForm: () => onPlaceBid ? (_jsx(Stack, { id: "auction-bid-form", gap: "3", children: _jsxs(Stack, { className: `${__P.p5}`, border: "subtle", gap: "3", rounded: "xl", surface: "muted", children: [_jsxs(Row, { justify: "between", align: "baseline", children: [_jsx(LiveBidPrice, { productId: String(product.id), currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "xl", badgeSize: "xs" }), !isEnded && (_jsx(LiveMinIncrement, { productId: String(product.id), currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, tiers: bidIncrementTiers, minBidIncrementOverride: minBidIncrementOverride }))] }), !isEnded && endDate && (_jsxs(Text, { align: "center", size: "xs", color: "muted", children: ["Ends in ", _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" })] })), _jsx(PlaceBidModalButton, { productId: String(product.id), currentBid: currentBid, startingBid: startingBid, tiers: bidIncrementTiers, minBidIncrementOverride: minBidIncrementOverride, currency: currency, isEnded: isEnded, auctionEndDate: endDate, buyNowPrice: buyNowPrice, bidCount: bidCount, tags: tags, onPlaceBid: onPlaceBid, onBuyNow: onBuyNow, triggerClassName: "w-full" })] }) })) : (
                         /* Read-only bid panel — shown when no bid action is wired (preview/demo) */
                         _jsxs(Stack, { className: `${__P.p5}`, border: "subtle", gap: "md", rounded: "xl", surface: "muted", children: [_jsx(Stack, { gap: "xs", children: _jsx(Text, { size: "xs", color: "muted", children: _jsxs(GatedPrice, { label: "Sign in to see the starting bid", children: ["Starting bid: ", formatCurrency(startingBid, currency), !isEnded && _jsxs(_Fragment, { children: [" \u00B7 min increment ", formatCurrency(initialMinBidIncrement, currency)] })] }) }) }), _jsxs(Stack, { gap: "sm", children: [_jsx(Input, { type: "number", 
                                             // The minimum is stated in the gated line above rather than

package/dist/features/auctions/components/MarketplaceAuctionCard.d.ts

@@ -74,5 +74,15 @@ export interface MarketplaceAuctionCardProps {
     onNavigate?: (href: string) => void;
     wishlistActions?: WishlistToggleActions;
     labels?: MarketplaceAuctionCardLabels;
+    /**
+     * Owner-only pencil / clone / bin. Pass `<OwnerQuickActions>`; it renders
+     * nothing for a visitor who does not own the record.
+     *
+     * 🛑 Rendered OUTSIDE this card's own anchor, as a sibling. A `<button>`
+     * inside an `<a>` is invalid HTML that browsers resolve by closing the
+     * anchor early, which breaks the CARD's navigation rather than just the
+     * button's — `stopPropagation` stops a click but cannot fix a parse.
+     */
+    renderOwnerActions?: () => React.ReactNode;
 }
-export declare function MarketplaceAuctionCard({ product, buyoutPrice, className, variant, selectable, isSelected, onSelect, inWishlist: initialInWishlist, href, hrefBuilder, onNavigate, wishlistActions, labels, }: MarketplaceAuctionCardProps): import("react").JSX.Element;
+export declare function MarketplaceAuctionCard({ product, buyoutPrice, className, variant, selectable, isSelected, onSelect, inWishlist: initialInWishlist, href, hrefBuilder, onNavigate, wishlistActions, labels, renderOwnerActions, }: MarketplaceAuctionCardProps): import("react").JSX.Element;

package/dist/features/auctions/components/MarketplaceAuctionCard.js

@@ -94,7 +94,7 @@ function formatCountdownLabel(remaining, endedLabel) {
         return `${hours}h ${minutes}m ${seconds}s`;
     return `${minutes}m ${seconds}s`;
 }
-export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", variant = "grid", selectable = false, isSelected = false, onSelect, inWishlist: initialInWishlist = false, href, hrefBuilder, onNavigate, wishlistActions, labels, }) {
+export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", variant = "grid", selectable = false, isSelected = false, onSelect, inWishlist: initialInWishlist = false, href, hrefBuilder, onNavigate, wishlistActions, labels, renderOwnerActions, }) {
     const router = useRouter();
     const mergedLabels = { ...DEFAULT_LABELS, ...labels };
     const baseVariant = variant === "list" ? "list" : "grid";
@@ -180,5 +180,12 @@ export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", v
         remaining, resolvedBuyoutPrice, inWishlist, wishlistLoading, wishlistActions,
         countdownClass, mergedLabels, handleWishlist, handleNavigate,
     };
-    return (_jsxs(BaseListingCard, { isSelected: isSelected, isDisabled: isEnded, variant: baseVariant, className: className, onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [renderAuctionCardHero({ product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect }), _jsx(BaseListingCard.Info, { variant: baseVariant, children: baseVariant === "list" ? renderAuctionCardInfoList(cardInfoProps) : renderAuctionCardInfoGrid(cardInfoProps) })] }));
+    const card = (_jsxs(BaseListingCard, { isSelected: isSelected, isDisabled: isEnded, variant: baseVariant, className: className, onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [renderAuctionCardHero({ product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect }), _jsx(BaseListingCard.Info, { variant: baseVariant, children: baseVariant === "list" ? renderAuctionCardInfoList(cardInfoProps) : renderAuctionCardInfoGrid(cardInfoProps) })] }));
+    if (!renderOwnerActions)
+        return card;
+    /*
+     * Sibling of the card, never a child — see the prop's docstring. `z-20`
+     * clears this card's own overlays, which all sit at `z-10`.
+     */
+    return (_jsxs(Div, { className: "relative h-full", children: [card, _jsx(Div, { className: "absolute right-2 bottom-2 z-20", children: renderOwnerActions() })] }));
 }

package/dist/features/auth/checkout-value-otp.d.ts

@@ -44,6 +44,6 @@ export interface CheckoutValueOtpDoc {
  * making the whole feature look broken.
  */
 export declare function enforceCheckoutValueOtpRateLimit(db: Db, uid: string): Promise<void>;
-/** Build the checkout-value OTP WhatsApp/SMS message body. */
+/** Build the checkout-value OTP message body. */
 export declare function buildCheckoutValueOtpMessage(code: string, siteName: string): string;
 export {};

package/dist/features/auth/checkout-value-otp.js

@@ -75,7 +75,7 @@ export async function enforceCheckoutValueOtpRateLimit(db, uid) {
         tx.set(metaRef, { lastSentAt: new Date() }, { merge: true });
     });
 }
-/** Build the checkout-value OTP WhatsApp/SMS message body. */
+/** Build the checkout-value OTP message body. */
 export function buildCheckoutValueOtpMessage(code, siteName) {
     return (`*${siteName} — Order Verification*\n\n` +
         `Your verification code for this high-value order is: *${code}*\n\n` +

package/dist/features/auth/permissions/constants.d.ts

@@ -67,8 +67,18 @@ export declare const ROUTE_PERMISSION_MAP: Record<string, Permission>;
  *
  * Defaults on store creation: ["suggest_brands", "create_coupons"]
  */
-export type StoreCapability = "host_auctions" | "host_preorders" | "create_categories" | "suggest_brands" | "create_coupons" | "bulk_listing_import" | "extended_return_window" | "verified_seller" | "featured_placement" | "promotional_banner" | "priority_support" | "multiple_stores" | "custom_store_slug" | "api_access" | "lower_commission_rate" | "early_access_features" | "advanced_analytics" | "whatsapp_catalog_sync";
-/** Default capabilities granted to every new store on creation. */
+export type StoreCapability = "advanced_listing_types" | "host_auctions" | "host_preorders" | "create_categories" | "suggest_brands" | "create_coupons" | "bulk_listing_import" | "extended_return_window" | "verified_seller" | "featured_placement" | "promotional_banner" | "priority_support" | "multiple_stores" | "custom_store_slug" | "api_access" | "lower_commission_rate" | "early_access_features" | "advanced_analytics";
+export declare const ALL_STORE_CAPABILITIES: StoreCapability[];
+/** Narrow an untrusted string to a real capability. */
+export declare function isStoreCapability(value: unknown): value is StoreCapability;
+/**
+ * Default capabilities granted to every new store on creation.
+ *
+ * 🛑 THE one definition. `AdminStoreEditorView` hardcoded its own copy, which
+ * is also the `??` fallback on its load path — so the two could disagree about
+ * what a store with no `capabilities` field is entitled to, and the admin
+ * editor's copy is the one that gets SAVED BACK. Import this; never restate it.
+ */
 export declare const DEFAULT_STORE_CAPABILITIES: StoreCapability[];
 /**
  * Check whether a permission array includes a required permission.
@@ -87,6 +97,23 @@ export declare function hasAllPermissions(permissions: Permission[], required: P
  * Check whether a store's capabilities include a specific capability.
  */
 export declare function hasCapability(capabilities: StoreCapability[], required: StoreCapability): boolean;
+/**
+ * Resolve a store's stored `capabilities` array to its effective set.
+ *
+ * 🛑 The PURE half of `getStoreCapabilities`, extracted so a caller that
+ * already holds the store document does not pay a second Firestore read to ask
+ * what it is entitled to (Rule #6). Several routes were reading
+ * `store.capabilities ?? []` inline for exactly that reason, which made them a
+ * second, divergent reader of the field — they skipped the default merge, so
+ * they and `getStoreCapabilities` could disagree about the same store.
+ *
+ * Note the empty-array case falls back to the defaults, matching
+ * `getStoreCapabilities`' long-standing `raw.length > 0` test. That is
+ * arguably the wrong call — an admin who deliberately unticks everything gets
+ * the defaults handed back — but it is the established behaviour and changing
+ * it would silently re-grant capabilities on stores that had them removed.
+ */
+export declare function resolveStoreCapabilities(raw: readonly string[] | null | undefined): StoreCapability[];
 /**
  * Groups permission prefixes into human-labeled domains for display —
  * used by the employee-permission editor and the read-only permissions

package/dist/features/auth/permissions/constants.js

@@ -319,7 +319,52 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/maintenance/payment-rollbacks": "admin:maintenance:view-payment-rollbacks",
     "/admin/maintenance/analysis": "admin:maintenance:run-analysis",
 };
-/** Default capabilities granted to every new store on creation. */
+/**
+ * Every capability, as a runtime value.
+ *
+ * 🛑 `Record<StoreCapability, true>` rather than a plain array, for the same
+ * reason `ALL_LISTING_TYPES_MAP` is: adding a member to the union without
+ * adding it here is then a COMPILE error, not a silent omission. This is what
+ * lets `capabilities` be validated as a `z.enum` instead of
+ * `z.array(z.string())` — which accepted any string, so a typo'd capability
+ * saved successfully and the gate it was meant to open never opened, silently.
+ *
+ * It also backs the admin editor's grouping, so a new capability cannot be
+ * granted in code and remain unreachable from the admin UI.
+ */
+const STORE_CAPABILITY_MAP = {
+    advanced_listing_types: true,
+    host_auctions: true,
+    host_preorders: true,
+    create_categories: true,
+    suggest_brands: true,
+    create_coupons: true,
+    bulk_listing_import: true,
+    extended_return_window: true,
+    verified_seller: true,
+    featured_placement: true,
+    promotional_banner: true,
+    priority_support: true,
+    multiple_stores: true,
+    custom_store_slug: true,
+    api_access: true,
+    lower_commission_rate: true,
+    early_access_features: true,
+    advanced_analytics: true,
+};
+export const ALL_STORE_CAPABILITIES = Object.keys(STORE_CAPABILITY_MAP);
+/** Narrow an untrusted string to a real capability. */
+export function isStoreCapability(value) {
+    return typeof value === "string" && value in STORE_CAPABILITY_MAP;
+}
+/**
+ * Default capabilities granted to every new store on creation.
+ *
+ * 🛑 THE one definition. `AdminStoreEditorView` hardcoded its own copy, which
+ * is also the `??` fallback on its load path — so the two could disagree about
+ * what a store with no `capabilities` field is entitled to, and the admin
+ * editor's copy is the one that gets SAVED BACK. Import this; never restate it.
+ */
 export const DEFAULT_STORE_CAPABILITIES = [
     "suggest_brands",
     "create_coupons",
@@ -352,6 +397,27 @@ export function hasAllPermissions(permissions, required) {
 export function hasCapability(capabilities, required) {
     return capabilities.includes(required);
 }
+/**
+ * Resolve a store's stored `capabilities` array to its effective set.
+ *
+ * 🛑 The PURE half of `getStoreCapabilities`, extracted so a caller that
+ * already holds the store document does not pay a second Firestore read to ask
+ * what it is entitled to (Rule #6). Several routes were reading
+ * `store.capabilities ?? []` inline for exactly that reason, which made them a
+ * second, divergent reader of the field — they skipped the default merge, so
+ * they and `getStoreCapabilities` could disagree about the same store.
+ *
+ * Note the empty-array case falls back to the defaults, matching
+ * `getStoreCapabilities`' long-standing `raw.length > 0` test. That is
+ * arguably the wrong call — an admin who deliberately unticks everything gets
+ * the defaults handed back — but it is the established behaviour and changing
+ * it would silently re-grant capabilities on stores that had them removed.
+ */
+export function resolveStoreCapabilities(raw) {
+    if (Array.isArray(raw) && raw.length > 0)
+        return raw;
+    return [...DEFAULT_STORE_CAPABILITIES];
+}
 // ============================================================================
 // PERMISSION DOMAINS — display grouping (S-ADMIN-7, 2026-08-19)
 // ============================================================================

package/dist/features/blog/components/BlogFeaturedCard.d.ts

@@ -17,5 +17,15 @@ export interface BlogFeaturedCardProps {
     showAuthor?: boolean;
     /** Show the cover image. Defaults to `true`. */
     showThumbnail?: boolean;
+    /**
+     * Owner-only pencil / clone / bin, for an admin or whoever owns this record.
+     * Pass `<OwnerQuickActions>`; it renders nothing for anyone else.
+     *
+     * 🛑 Rendered OUTSIDE this card's own `<Link>`/`<TextLink>`, as a sibling.
+     * A `<button>` inside an `<a>` is invalid HTML that browsers resolve by
+     * closing the anchor early, which breaks the CARD's navigation rather than
+     * just the button's — `stopPropagation` stops a click but cannot fix a parse.
+     */
+    renderOwnerActions?: () => React.ReactNode;
 }
-export declare function BlogFeaturedCard({ post, href, labels, className, selectable, isSelected, onSelect, showReadTime, showAuthor, showThumbnail, }: BlogFeaturedCardProps): React.JSX.Element;
+export declare function BlogFeaturedCard({ post, href, labels, className, selectable, isSelected, onSelect, showReadTime, showAuthor, showThumbnail, renderOwnerActions, }: BlogFeaturedCardProps): React.JSX.Element;

package/dist/features/blog/components/BlogFeaturedCard.js

@@ -20,7 +20,7 @@ const CATEGORY_BADGE = {
     community: "bg-warning-surface text-warning dark:bg-warning-surface dark:text-warning",
 };
 const CLS_FEATURED_BADGE = "bg-warning-surface text-warning dark:bg-warning-surface dark:text-warning px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] rounded-full";
-export function BlogFeaturedCard({ post, href, labels = {}, className = "", selectable = false, isSelected = false, onSelect, showReadTime = true, showAuthor = true, showThumbnail = true, }) {
+export function BlogFeaturedCard({ post, href, labels = {}, className = "", selectable = false, isSelected = false, onSelect, showReadTime = true, showAuthor = true, showThumbnail = true, renderOwnerActions, }) {
     const longPress = useLongPress(() => onSelect?.(post.id, !isSelected));
     const safeTitle = post.title?.trim() || "Untitled post";
     const coverImageUrl = showThumbnail ? getMediaUrl(post.coverImage) : undefined;
@@ -31,5 +31,12 @@ export function BlogFeaturedCard({ post, href, labels = {}, className = "", sele
             day: "numeric",
         })
         : "";
-    return (_jsxs(Article, { rounded: "xl", shadow: "hover-md", className: `group relative h-full overflow-hidden border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] ${isSelected ? "ring-2 ring-primary outline outline-2 outline-primary" : ""} ${className}`, onMouseDown: onSelect && !isSelected ? longPress.onMouseDown : undefined, onMouseUp: onSelect && !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: onSelect && !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: onSelect && !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: onSelect && !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: onSelect && !isSelected ? longPress.onTouchCancel : undefined, children: [onSelect && (_jsx(BaseListingCard.Checkbox, { selected: isSelected, onSelect: (e) => { e.preventDefault(); onSelect(post.id, !isSelected); }, label: isSelected ? "Deselect post" : "Select post", position: "top-2 left-2", className: selectable || isSelected ? "opacity-100" : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto transition-opacity" })), _jsxs(TextLink, { href: href, layout: "flex-col", className: "h-full", children: [showThumbnail && (_jsx(Div, { className: `relative aspect-video ${__O.hidden} flex-shrink-0`, children: coverImageUrl ? (_jsx(MediaImage, { src: coverImageUrl, alt: safeTitle, size: "card", className: "transition-transform duration-300 group-hover:scale-105" })) : (_jsx(Div, { role: "img", "aria-label": safeTitle, surface: "muted", className: "h-full w-full" })) })), _jsxs(Stack, { className: `flex-1 ${__P.p4}`, children: [_jsxs(Row, { gap: "xs", className: "mb-2", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-block capitalize ${CATEGORY_BADGE[post.category] ?? "bg-[var(--appkit-color-bg)] text-[var(--appkit-color-text-muted)]"}`, rounded: "full", padding: "pill-xs", children: post.category }), post.isFeatured && (_jsx(Span, { size: "xs", weight: "medium", className: CLS_FEATURED_BADGE, children: labels.featuredBadge ?? "Featured" }))] }), _jsx(Heading, { level: 3, className: `leading-snug mb-1`, color: "primary", truncate: 2, size: "base", weight: "semibold", children: safeTitle }), post.excerpt && (_jsx(Text, { className: `mb-3`, color: "muted", truncate: 2, size: "sm", children: post.excerpt })), _jsxs(Row, { color: "muted", textSize: "xs", className: "mt-auto", gap: "3", wrap: true, children: [showAuthor && post.authorName && (_jsx(Span, { children: safeDisplayName(post.authorName, "Author") })), showReadTime && post.readTimeMinutes != null && (_jsxs(Span, { children: [post.readTimeMinutes, " ", labels.readTime ?? "min read"] })), date && _jsx(Span, { children: date })] })] })] })] }));
+    const card = (_jsxs(Article, { rounded: "xl", shadow: "hover-md", className: `group relative h-full overflow-hidden border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] ${isSelected ? "ring-2 ring-primary outline outline-2 outline-primary" : ""} ${className}`, onMouseDown: onSelect && !isSelected ? longPress.onMouseDown : undefined, onMouseUp: onSelect && !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: onSelect && !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: onSelect && !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: onSelect && !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: onSelect && !isSelected ? longPress.onTouchCancel : undefined, children: [onSelect && (_jsx(BaseListingCard.Checkbox, { selected: isSelected, onSelect: (e) => { e.preventDefault(); onSelect(post.id, !isSelected); }, label: isSelected ? "Deselect post" : "Select post", position: "top-2 left-2", className: selectable || isSelected ? "opacity-100" : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto transition-opacity" })), _jsxs(TextLink, { href: href, layout: "flex-col", className: "h-full", children: [showThumbnail && (_jsx(Div, { className: `relative aspect-video ${__O.hidden} flex-shrink-0`, children: coverImageUrl ? (_jsx(MediaImage, { src: coverImageUrl, alt: safeTitle, size: "card", className: "transition-transform duration-300 group-hover:scale-105" })) : (_jsx(Div, { role: "img", "aria-label": safeTitle, surface: "muted", className: "h-full w-full" })) })), _jsxs(Stack, { className: `flex-1 ${__P.p4}`, children: [_jsxs(Row, { gap: "xs", className: "mb-2", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-block capitalize ${CATEGORY_BADGE[post.category] ?? "bg-[var(--appkit-color-bg)] text-[var(--appkit-color-text-muted)]"}`, rounded: "full", padding: "pill-xs", children: post.category }), post.isFeatured && (_jsx(Span, { size: "xs", weight: "medium", className: CLS_FEATURED_BADGE, children: labels.featuredBadge ?? "Featured" }))] }), _jsx(Heading, { level: 3, className: `leading-snug mb-1`, color: "primary", truncate: 2, size: "base", weight: "semibold", children: safeTitle }), post.excerpt && (_jsx(Text, { className: `mb-3`, color: "muted", truncate: 2, size: "sm", children: post.excerpt })), _jsxs(Row, { color: "muted", textSize: "xs", className: "mt-auto", gap: "3", wrap: true, children: [showAuthor && post.authorName && (_jsx(Span, { children: safeDisplayName(post.authorName, "Author") })), showReadTime && post.readTimeMinutes != null && (_jsxs(Span, { children: [post.readTimeMinutes, " ", labels.readTime ?? "min read"] })), date && _jsx(Span, { children: date })] })] })] })] }));
+    if (!renderOwnerActions)
+        return card;
+    /*
+     * Sibling of the card, never a child — see the prop's docstring. `z-20`
+     * beats this card's own overlays, which all sit at `z-10`.
+     */
+    return (_jsxs(Div, { className: "relative h-full", children: [card, _jsx(Div, { className: "absolute right-2 top-2 z-20", children: renderOwnerActions() })] }));
 }

package/dist/features/cart/components/CartDrawer.js

@@ -3,6 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { Aside, Button, Div, Heading, Row, Span, Stack, Text, TextLink } from "../../../ui/index.js";
 import { MediaImage } from "../../media/MediaImage.js";
 import { QuantityStepper } from "../../../ui/components/QuantityStepper.js";
+import { GatedPrice } from "../../../ui/components/GatedPrice.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
 import { useHandMode } from "../../../_internal/client/hand-mode/index.js";
@@ -19,11 +20,11 @@ export function CartItemRow({ item, onQtyChange, onRemove, href, isOutOfStock =
     return (_jsxs(Div, { layout: "flex", gap: isRow ? "3" : "4", surface: isRow ? "none" : "card", padding: isRow ? "none" : "sm", className: `min-w-0 transition-opacity ${isOutOfStock ? "opacity-60" : ""}`, children: [_jsx(Div, { surface: "muted", className: `relative ${isRow ? "h-16 w-16" : "h-20 w-20"} flex-shrink-0 ${__O.hidden}`, rounded: "lg", children: item.meta.image && (_jsx(MediaImage, { src: item.meta.image, alt: item.meta.title, size: "thumbnail" })) }), _jsxs(Stack, { justify: "between", className: "flex-1 min-w-0", children: [_jsxs(Row, { gap: "xs", className: "min-w-0", align: "start", children: [href ? (_jsx(TextLink, { href: href, target: "_blank", rel: "noopener noreferrer", weight: "medium", className: "text-[var(--appkit-color-text)] hover:underline underline-offset-2 line-clamp-2", children: item.meta.title })) : (_jsx(Text, { truncate: 2, weight: "medium", color: "primary", children: item.meta.title })), isOutOfStock && (_jsx(Span, { padding: "pill-2xs", color: "error", surface: "danger-surface", weight: "semibold", className: "flex-shrink-0 text-[10px] tracking-wide", rounded: "default", transform: "uppercase", children: "Out of Stock" }))] }), item.meta.attributes &&
                         Object.keys(item.meta.attributes).length > 0 && (_jsx(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "xs", truncate: 1, children: Object.entries(item.meta.attributes)
                             .map(([k, v]) => `${k}: ${v}`)
-                            .join(", ") })), _jsxs(Row, { justify: "between", className: "min-w-0", gap: "sm", children: [_jsx(Text, { className: "text-[var(--appkit-color-text)]", weight: "semibold", children: formatCurrency(item.meta.price * item.quantity, item.meta.currency) }), onQtyChange && !isOutOfStock && (_jsx(QuantityStepper, { value: item.quantity, onChange: (next) => onQtyChange(item.id, next), min: 1, ariaLabel: `Quantity for ${item.meta.title}`, decrementLabel: ACTIONS.CART["decrease-quantity"].ariaLabel, incrementLabel: ACTIONS.CART["increase-quantity"].ariaLabel })), isOutOfStock && (_jsxs(Span, { size: "xs", color: "muted", children: ["Qty: ", item.quantity] }))] })] }), onRemove && (_jsx(Button, { onClick: () => onRemove(item.id), variant: "ghost", size: "sm", "aria-label": ACTIONS.CART["remove-item"].ariaLabel, className: CLS_REMOVE_BTN, children: "\u2715" }))] }));
+                            .join(", ") })), _jsxs(Row, { justify: "between", className: "min-w-0", gap: "sm", children: [_jsx(Text, { className: "text-[var(--appkit-color-text)]", weight: "semibold", children: _jsx(GatedPrice, { children: formatCurrency(item.meta.price * item.quantity, item.meta.currency) }) }), onQtyChange && !isOutOfStock && (_jsx(QuantityStepper, { value: item.quantity, onChange: (next) => onQtyChange(item.id, next), min: 1, ariaLabel: `Quantity for ${item.meta.title}`, decrementLabel: ACTIONS.CART["decrease-quantity"].ariaLabel, incrementLabel: ACTIONS.CART["increase-quantity"].ariaLabel })), isOutOfStock && (_jsxs(Span, { size: "xs", color: "muted", children: ["Qty: ", item.quantity] }))] })] }), onRemove && (_jsx(Button, { onClick: () => onRemove(item.id), variant: "ghost", size: "sm", "aria-label": ACTIONS.CART["remove-item"].ariaLabel, className: CLS_REMOVE_BTN, children: "\u2715" }))] }));
 }
 export function CartDrawer({ isOpen, onClose, items, subtotal = 0, currency, isLoading, onQtyChange, onRemove, onCheckout, labels = {}, }) {
     const { hand } = useHandMode();
     if (!isOpen)
         return null;
-    return (_jsxs(_Fragment, { children: [_jsx(Div, { surface: "overlay-xs", role: "presentation", className: "fixed inset-0 z-40", onClick: onClose }), _jsx(Aside, { surface: "sidePanel", shadow: "xl", className: `fixed inset-y-0 ${hand === "left" ? "left-0" : "right-0"} z-50 w-full max-w-sm`, children: _jsxs(Stack, { className: "h-full", children: [_jsxs(Row, { justify: "between", border: "bottom", className: __P.p4, reverse: hand === "left", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", children: labels.title ?? "Cart" }), _jsx(Button, { onClick: onClose, variant: "ghost", size: "sm", "aria-label": "Close cart", textColor: "faint", className: "hover:text-[var(--appkit-color-text)] dark:hover:text-[var(--appkit-color-text)]", children: "\u2715" })] }), _jsx(Stack, { className: `flex-1 ${__O.yAuto} ${__P.p4}`, gap: "3", children: isLoading ? (_jsx(Row, { justify: "center", padding: "y-3xl", children: _jsx(Div, { className: "h-8 w-8 animate-spin border-2 border-neutral-300 border-t-neutral-800 dark:border-t-zinc-200", rounded: "full" }) })) : items.length === 0 ? (_jsx(Text, { paddingY: "3xl", className: "text-[var(--appkit-color-text-muted)]", size: "sm", align: "center", children: labels.empty ?? "Your cart is empty" })) : (items.map((item) => (_jsx(CartItemRow, { item: item, onQtyChange: onQtyChange, onRemove: onRemove }, item.id)))) }), items.length > 0 && (_jsxs(Stack, { border: "top", className: __P.p4, gap: "md", children: [_jsxs(Row, { textSize: "sm", justify: "between", children: [_jsx(Span, { className: "text-[var(--appkit-color-text-muted)]", children: labels.subtotal ?? "Subtotal" }), _jsx(Span, { weight: "semibold", children: formatCurrency(subtotal, currency) })] }), onCheckout && (_jsx(Button, { rounded: "xl", onClick: onCheckout, variant: "primary", textSize: "sm", className: "w-full bg-neutral-900 py-[0.75rem] font-[600] text-white transition hover:bg-neutral-800", children: labels.checkout ?? ACTIONS.CART["checkout"].label }))] }))] }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(Div, { surface: "overlay-xs", role: "presentation", className: "fixed inset-0 z-40", onClick: onClose }), _jsx(Aside, { surface: "sidePanel", shadow: "xl", className: `fixed inset-y-0 ${hand === "left" ? "left-0" : "right-0"} z-50 w-full max-w-sm`, children: _jsxs(Stack, { className: "h-full", children: [_jsxs(Row, { justify: "between", border: "bottom", className: __P.p4, reverse: hand === "left", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", children: labels.title ?? "Cart" }), _jsx(Button, { onClick: onClose, variant: "ghost", size: "sm", "aria-label": "Close cart", textColor: "faint", className: "hover:text-[var(--appkit-color-text)] dark:hover:text-[var(--appkit-color-text)]", children: "\u2715" })] }), _jsx(Stack, { className: `flex-1 ${__O.yAuto} ${__P.p4}`, gap: "3", children: isLoading ? (_jsx(Row, { justify: "center", padding: "y-3xl", children: _jsx(Div, { className: "h-8 w-8 animate-spin border-2 border-neutral-300 border-t-neutral-800 dark:border-t-zinc-200", rounded: "full" }) })) : items.length === 0 ? (_jsx(Text, { paddingY: "3xl", className: "text-[var(--appkit-color-text-muted)]", size: "sm", align: "center", children: labels.empty ?? "Your cart is empty" })) : (items.map((item) => (_jsx(CartItemRow, { item: item, onQtyChange: onQtyChange, onRemove: onRemove }, item.id)))) }), items.length > 0 && (_jsxs(Stack, { border: "top", className: __P.p4, gap: "md", children: [_jsxs(Row, { textSize: "sm", justify: "between", children: [_jsx(Span, { className: "text-[var(--appkit-color-text-muted)]", children: labels.subtotal ?? "Subtotal" }), _jsx(Span, { weight: "semibold", children: _jsx(GatedPrice, { children: formatCurrency(subtotal, currency) }) })] }), onCheckout && (_jsx(Button, { rounded: "xl", onClick: onCheckout, variant: "primary", textSize: "sm", className: "w-full bg-neutral-900 py-[0.75rem] font-[600] text-white transition hover:bg-neutral-800", children: labels.checkout ?? ACTIONS.CART["checkout"].label }))] }))] }) })] }));
 }