@mohasinac/appkit 4.55.0-next.0 → 4.56.0

package/dist/features/products/components/ProductsIndexListing.js

@@ -1,6 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useState, useCallback } from "react";
+import { useState, useCallback, useMemo } from "react";
 import { ShoppingCart, Heart, Columns } from "lucide-react";
 import { useRouter } from "next/navigation.js";
 import { useUrlTable } from "../../../react/hooks/useUrlTable.js";
@@ -31,6 +31,7 @@ import { PRODUCT_FIELDS } from "../../../constants/field-names.js";
 import { useBottomActions } from "../../layout/index.js";
 import { GENERIC_PRODUCT_LISTING_TYPES, PRODUCT_TYPE_FILTER_TABS } from "../constants/listing-tabs.js";
 import { parseSelectedListingTypes } from "../utils/listing-type.js";
+import { useListingTypeFlags } from "../../../react/hooks/useListingTypeFlags.js";
 import { commonSortOptionsFor } from "../../../_internal/shared/listing-types/_registry.js";
 import { AVAILABILITY_VALUES } from "../../../constants/field-names.js";
 import { AvailabilityTabs } from "./AvailabilityTabs.js";
@@ -77,13 +78,42 @@ export function ProductsIndexListing({ initialData, listingTypes = GENERIC_PRODU
     const [filterOpen, setFilterOpen] = useState(false);
     const [compareIds, setCompareIds] = useState([]);
     const [view, setView] = useState(table.get(TABLE_KEYS.VIEW) || VIEW_MODE.GRID);
+    /*
+     * ── What this page actually spans ────────────────────────────────────────
+     *
+     * 🛑 A type an admin has switched OFF must not appear as a filter option.
+     * `listingTypes` / `typeTabs` describe what the page covers by DESIGN
+     * (`GENERIC_PRODUCT_LISTING_TYPES`, or a store tab's own set); the flags
+     * describe what this site offers. Only the intersection is real.
+     *
+     * Ticking a disabled type was not merely untidy — `listPublicProducts`
+     * narrows the request to `selected ∩ span` and falls back to the FULL span
+     * when that intersection is empty, so a chip for a disabled type silently
+     * WIDENED the results instead of narrowing them (the same trap documented
+     * for out-of-span types on `/products`).
+     *
+     * Falling back to the ungated sets when the filter empties them is
+     * deliberate: an empty span is not "show nothing", it is a settings document
+     * that disabled everything this page covers, and rendering a type-less
+     * listing is more useful than rendering an empty one. `useListingTypeFlags`
+     * already fails open while settings load, so there is no first-paint flash.
+     */
+    const listingTypeFlags = useListingTypeFlags();
+    const enabledSpan = useMemo(() => {
+        const kept = listingTypes.filter((t) => listingTypeFlags[t]);
+        return (kept.length > 0 ? kept : listingTypes);
+    }, [listingTypes, listingTypeFlags]);
+    const enabledTypeTabs = useMemo(() => {
+        const kept = typeTabs.filter((tab) => enabledSpan.includes(tab.id));
+        return kept.length > 0 ? kept : typeTabs;
+    }, [typeTabs, enabledSpan]);
     // ── Type filter (multi-select) ───────────────────────────────────────────
     // The URL value is a pipe-joined set; empty means "every type this page
     // spans". Unknown tokens are dropped rather than passed through to a
     // Firestore `==` that could never match (Root Cause #33).
     const typeParam = table.get(TABLE_KEYS.LISTING_TYPE);
-    const selectedTypes = parseSelectedListingTypes(typeParam).filter((t) => listingTypes.includes(t));
-    const effectiveTypes = (selectedTypes.length > 0 ? selectedTypes : listingTypes);
+    const selectedTypes = parseSelectedListingTypes(typeParam).filter((t) => enabledSpan.includes(t));
+    const effectiveTypes = (selectedTypes.length > 0 ? selectedTypes : enabledSpan);
     // Sorts valid across every selected type. Pick Auctions alone and you get
     // "Ending Soon"; pick Auctions + Products and you get only what both
     // support, because a sort on `auctionEndDate` would order the products
@@ -109,9 +139,9 @@ export function ProductsIndexListing({ initialData, listingTypes = GENERIC_PRODU
     // The drawer's own, uncommitted type selection. The "Full <type> filters →"
     // link tracks THIS rather than the applied URL value, so it appears the
     // moment the user ticks a single type instead of only after Apply.
-    const pendingTypes = parseSelectedListingTypes(pendingTable.get(TABLE_KEYS.LISTING_TYPE)).filter((t) => listingTypes.includes(t));
+    const pendingTypes = parseSelectedListingTypes(pendingTable.get(TABLE_KEYS.LISTING_TYPE)).filter((t) => enabledSpan.includes(t));
     const dedicatedPage = dedicatedPageFor(pendingTypes);
-    const listingTypeOptions = typeTabs.map((t) => ({ value: t.id, label: t.label }));
+    const listingTypeOptions = enabledTypeTabs.map((t) => ({ value: t.id, label: t.label }));
     const openFilters = useCallback(() => {
         onFilterReset();
         setFilterOpen(true);

package/dist/features/products/components/ProductsIndexPageView.js

@@ -10,6 +10,9 @@ import { GENERIC_PRODUCT_LISTING_TYPES } from "../constants/listing-tabs.js";
 import { pluginFor } from "../../../_internal/shared/listing-types/_registry.js";
 import { listPublicProducts, parsePublicProductParams, defaultAvailabilityForListingTypes, } from "../../../_internal/server/features/products/list-public.js";
 import { parseSelectedListingTypes } from "../utils/listing-type.js";
+import { isListingTypeEnabled } from "../../../_internal/shared/listing-types/feature-flags.js";
+import { siteSettingsRepository } from "../../../repositories/index.js";
+import { safeRead } from "../../../errors/safe-read.js";
 const DEFAULT_PAGE_SIZE = 24;
 const DEFAULT_SORT = sortBy(PRODUCT_FIELDS.CREATED_AT);
 export async function ProductsIndexPageView({ searchParams = {} }) {
@@ -47,11 +50,41 @@ export async function ProductsIndexPageView({ searchParams = {} }) {
     const effectiveTypes = selectedTypes.length > 0 ? selectedTypes : GENERIC_PRODUCT_LISTING_TYPES;
     // See ArtStickersListView — one shared filter implementation with
     // /api/products, so SSR and the client refetch agree by construction.
-    const products = await listPublicProducts(parsePublicProductParams(searchParams, {
-        listingTypes: GENERIC_PRODUCT_LISTING_TYPES,
-        pageSize: DEFAULT_PAGE_SIZE,
-        sorts: DEFAULT_SORT,
-        ...defaultAvailabilityForListingTypes(effectiveTypes),
-    }));
-    return (_jsxs(Main, { children: [_jsx(Section, { border: "bottom-subtle", paddingY: "b-md", padding: "t-xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "bold", color: "primary", children: "Products" }), _jsx(Text, { className: "mt-1", color: "muted", size: "sm", children: "Discover amazing products and deals" }), _jsx(Div, { className: "mt-3", children: _jsx(TextLink, { variant: "bare", href: String(ROUTES.PUBLIC.AUCTIONS), rounded: "full", paddingX: "sm", paddingY: "2xs", size: "xs", weight: "medium", layout: "inline-flex", align: "center", gap: "sm", className: "border border-primary/30 bg-primary/10 text-primary-700 dark:text-primary-400 hover:bg-primary/15 transition-colors", children: "\uD83C\uDFF7\uFE0F Looking for unique deals? Browse Auctions \u2192" }) })] }) }), _jsxs(Container, { size: "xl", padding: "x-md", children: [_jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-4 mt-4" }), _jsx(ProductsIndexListing, { initialData: products ?? undefined }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] })] }));
+    const [products, settings] = await Promise.all([
+        listPublicProducts(parsePublicProductParams(searchParams, {
+            listingTypes: GENERIC_PRODUCT_LISTING_TYPES,
+            pageSize: DEFAULT_PAGE_SIZE,
+            sorts: DEFAULT_SORT,
+            ...defaultAvailabilityForListingTypes(effectiveTypes),
+        })),
+        /*
+         * Read in parallel with the listing — the banner below is the only
+         * consumer, and serialising a settings read in front of the page's main
+         * query would spend a round trip against Rule #6's budget for one link.
+         *
+         * 🛑 `safeRead`, so a settings failure hides the banner rather than
+         * failing the catalogue. Auctions have their own nav entry and their own
+         * page; the banner is a shortcut, and a shortcut is the correct thing to
+         * lose when its gate cannot be evaluated.
+         */
+        safeRead(() => siteSettingsRepository.findById("global"), {
+            route: "/products",
+            key: "products.siteSettings",
+            fallback: null,
+        }),
+    ]);
+    /*
+     * 🛑 Auctions are a LISTING TYPE an admin can switch off, and this banner
+     * advertised them unconditionally.
+     *
+     * Every other auction entry point already respects the flag — the navbar
+     * child (filtered by key in `LayoutShellClient`), the footer link
+     * (`FOOTER_LINK_LISTING_TYPES`), the store tabs (`tabs.ts`), the
+     * category/brand tabs, and the homepage section (`gatedListing`). This was
+     * the one surface left promoting a page that renders nothing on a site with
+     * auctions disabled, which is Root Cause #37's dead-link shape reached from
+     * the other direction.
+     */
+    const showAuctionsBanner = isListingTypeEnabled("auction", settings);
+    return (_jsxs(Main, { children: [_jsx(Section, { border: "bottom-subtle", paddingY: "b-md", padding: "t-xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "bold", color: "primary", children: "Products" }), _jsx(Text, { className: "mt-1", color: "muted", size: "sm", children: "Discover amazing products and deals" }), showAuctionsBanner && (_jsx(Div, { className: "mt-3", children: _jsx(TextLink, { variant: "bare", href: String(ROUTES.PUBLIC.AUCTIONS), rounded: "full", paddingX: "sm", paddingY: "2xs", size: "xs", weight: "medium", layout: "inline-flex", align: "center", gap: "sm", className: "border border-primary/30 bg-primary/10 text-primary-700 dark:text-primary-400 hover:bg-primary/15 transition-colors", children: "\uD83C\uDFF7\uFE0F Looking for unique deals? Browse Auctions \u2192" }) }))] }) }), _jsxs(Container, { size: "xl", padding: "x-md", children: [_jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-4 mt-4" }), _jsx(ProductsIndexListing, { initialData: products ?? undefined }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] })] }));
 }

package/dist/features/seller/actions/seller-actions.d.ts

@@ -83,6 +83,23 @@ export interface CustomShipOrderInput {
     shippingCarrier: string;
     trackingNumber: string;
     trackingUrl: string;
+    /**
+     * What this parcel actually cost the seller to post, in decimal rupees.
+     *
+     * 🛑 OPTIONAL, and that is the whole design. Making it required would break
+     * every existing dispatch and would force a number out of sellers who ship
+     * manually and have no quote to be measured against. Supplying it is what
+     * opts the order into reconciliation: the buyer gets points back when the
+     * seller spent less than was charged, and the seller absorbs the overage
+     * when they spent more.
+     *
+     * Absence therefore means "not reconciled", never "cost nothing" — the same
+     * distinction `resolveShippingCost.shippingUnavailable` exists to preserve,
+     * where a silent zero "would ship every parcel free at our expense".
+     */
+    actualShippingCost?: number;
+    /** The courier actually used, when it differs from the one the buyer picked. */
+    actualCourierName?: string;
 }
 export interface MarkEmiInstallmentPaidInput {
     /** 1-based installment number, matches EmiInstallment.index. */

package/dist/features/seller/actions/seller-actions.js

@@ -10,6 +10,7 @@
  */
 import { serverLogger } from "../../../monitoring/index.js";
 import { normalizeError } from "../../../errors/normalize.js";
+import { reconcileOrderShipping } from "../../../_internal/server/features/shipping/reconcile.js";
 import { enqueueJob } from "../../jobs/actions/enqueue-job.js";
 import { isAdminUser, isStrictSellerUser, isTesterUser } from "../../auth/role-predicates.js";
 import { ApiError, AuthorizationError, NotFoundError, ValidationError, } from "../../../errors/index.js";
@@ -712,6 +713,38 @@ export async function customShipOrder(userId, userRole, orderId, input) {
         shippingDate: new Date(),
         payoutStatus: "eligible",
     });
+    /*
+     * 🛑 AFTER the order is marked shipped, and never allowed to fail the
+     * dispatch.
+     *
+     * The parcel has physically gone. If reconciliation throws — the points
+     * ledger is unreachable, the order read fails — the correct outcome is a
+     * shipped order that has not been reconciled yet, which is recoverable by
+     * re-running it. Letting it propagate would leave the seller unable to mark
+     * a parcel shipped because of an accounting step they have no control over,
+     * and they would retry the dispatch, which is the one thing that must not
+     * happen twice.
+     *
+     * `reconcileOrderShipping` is itself idempotent on
+     * `order.shippingReconciliation`, so a retry is safe.
+     */
+    if (typeof input.actualShippingCost === "number") {
+        try {
+            const outcome = await reconcileOrderShipping(orderId, {
+                courierId: input.actualCourierName ?? input.shippingCarrier,
+                courierName: input.actualCourierName ?? input.shippingCarrier,
+                actualRate: input.actualShippingCost,
+            });
+            serverLogger.info("shipping reconciled", { orderId, ...outcome });
+        }
+        catch (err) {
+            const normalized = normalizeError(err);
+            serverLogger.error("shipping reconciliation failed after dispatch", {
+                orderId,
+                message: normalized.message,
+            });
+        }
+    }
     serverLogger.info("customShipOrder", {
         orderId,
         userId,

package/dist/index.d.ts

@@ -3123,6 +3123,7 @@ export { withRetry } from "./http/retry";
 export { normalizeError, getErrorMessage, isApiNormalized, isAppNormalized, isFirebaseAuthNormalized, isFirebaseFirestoreNormalized, isFirebaseStorageNormalized, isNativeNormalized, isNetworkNormalized, isUnknownNormalized, isZodNormalized, } from "./errors/normalize";
 export type { NormalizedError, NormalizedApiError, NormalizedAppError, NormalizedFirebaseAuthError, NormalizedFirebaseFirestoreError, NormalizedFirebaseStorageError, NormalizedNativeError, NormalizedNetworkError, NormalizedUnknownThrownValue, NormalizedZodError, } from "./errors/normalize";
 export { CART_LANE, CART_LANE_PRIORITY, CART_LANE_LABELS, laneOf, activeLane, laneItems, laneCounts, isLaneCheckoutable, laneBlockReason, isLockedLane, canAddNewItems, type CartLane, type LaneAssignable, } from "./_internal/shared/checkout/lanes";
+export { roundShippingUp, toQuoteOptions, reconcileShipping, SHIPPING_ROUND_UP_TO, type ShippingQuoteOption, type SelectedShippingQuote, type ActualShipmentCost, type ShippingReconciliation, } from "./_internal/shared/shipping/quote";
 export { newsletterSubscribeSchema, quickCreateTaxonomySchema, payoutMarkPaidSchema, } from "./features/admin/schemas/small-forms";
 export { raffleEntrySchema } from "./features/contact/schemas/inquiry-forms";
 export { orderCancelSchema, paymentProofSchema, } from "./features/orders/schemas/buyer-forms";

package/dist/index.js

@@ -5559,6 +5559,14 @@ export { normalizeError, getErrorMessage, isApiNormalized, isAppNormalized, isFi
 // Checkout lanes — the derived auction > offer > standard partition of the
 // cart, and the priority rule that decides which one may be checked out.
 export { CART_LANE, CART_LANE_PRIORITY, CART_LANE_LABELS, laneOf, activeLane, laneItems, laneCounts, isLaneCheckoutable, laneBlockReason, isLockedLane, canAddNewItems, } from "./_internal/shared/checkout/lanes.js";
+/*
+ * Shipping quote model. Public because the CONSUMER owns the route that asks
+ * the carrier for rates (`/api/shipping/quote`) and the checkout UI that
+ * renders them — the rounding rule has to be reachable from both, and it must
+ * be the same rule the server-side reconciliation uses, or the buyer is
+ * credited against a figure they were never charged.
+ */
+export { roundShippingUp, toQuoteOptions, reconcileShipping, SHIPPING_ROUND_UP_TO, } from "./_internal/shared/shipping/quote.js";
 export { newsletterSubscribeSchema, quickCreateTaxonomySchema, payoutMarkPaidSchema, } from "./features/admin/schemas/small-forms.js";
 export { raffleEntrySchema } from "./features/contact/schemas/inquiry-forms.js";
 export { orderCancelSchema, paymentProofSchema, } from "./features/orders/schemas/buyer-forms.js";

package/dist/providers/shipping-shiprocket/index.d.ts

@@ -12,10 +12,19 @@
  *    `loginResponse` requires — the rest are ignored, as Zod ignores unknown
  *    keys by default.
  *
- * 🛑 NOT VERIFIED: every other endpoint. Order creation, AWB assignment,
- *    tracking, serviceability and label generation all MUTATE or bill against
- *    a real carrier account, so none was called. Their field names below are
- *    claims taken from the published docs, not facts read off a payload.
+ * ✅ ALSO VERIFIED (2026-10-20): `GET /courier/serviceability/` from pickup
+ *    `413001`. HTTP 200, and `data.available_courier_companies` came back with
+ *    10-11 entries for Mumbai, Bengaluru and Delhi carrying `courier_name`,
+ *    `rate` and `estimated_delivery_days` — so `serviceabilityResponse` below
+ *    is read off a real payload, not inferred. It is a read-only quote: no
+ *    shipment is created and nothing is booked.
+ *
+ * 🛑 NOT VERIFIED: order creation, AWB assignment, tracking and label
+ *    generation. Each MUTATES or bills a real carrier account — creating an
+ *    order can schedule a pickup, an AWB can consume an allocation, a cancel
+ *    may still bill — so none was called, and none is discoverable without
+ *    incurring it. Their field names below are claims from the published docs,
+ *    not facts read off a payload.
  *
  * That asymmetry is the reason every response is parsed through Zod rather
  * than cast: an unverified contract that is wrong surfaces as a named error at

package/dist/providers/shipping-shiprocket/index.js

@@ -12,10 +12,19 @@
  *    `loginResponse` requires — the rest are ignored, as Zod ignores unknown
  *    keys by default.
  *
- * 🛑 NOT VERIFIED: every other endpoint. Order creation, AWB assignment,
- *    tracking, serviceability and label generation all MUTATE or bill against
- *    a real carrier account, so none was called. Their field names below are
- *    claims taken from the published docs, not facts read off a payload.
+ * ✅ ALSO VERIFIED (2026-10-20): `GET /courier/serviceability/` from pickup
+ *    `413001`. HTTP 200, and `data.available_courier_companies` came back with
+ *    10-11 entries for Mumbai, Bengaluru and Delhi carrying `courier_name`,
+ *    `rate` and `estimated_delivery_days` — so `serviceabilityResponse` below
+ *    is read off a real payload, not inferred. It is a read-only quote: no
+ *    shipment is created and nothing is booked.
+ *
+ * 🛑 NOT VERIFIED: order creation, AWB assignment, tracking and label
+ *    generation. Each MUTATES or bills a real carrier account — creating an
+ *    order can schedule a pickup, an AWB can consume an allocation, a cancel
+ *    may still bill — so none was called, and none is discoverable without
+ *    incurring it. Their field names below are claims from the published docs,
+ *    not facts read off a payload.
  *
  * That asymmetry is the reason every response is parsed through Zod rather
  * than cast: an unverified contract that is wrong surfaces as a named error at
@@ -312,15 +321,30 @@ export class ShiprocketShippingProvider extends IShippingProvider {
     }
     async checkServiceability(pincode, weight) {
         /*
-         * 🛑 `pickup_postcode` is required by their API and we do not have it on
-         * this contract. Taken from the registered pickup location's name is NOT
-         * possible — it is a nickname, not a pincode — so this returns
-         * "unserviceable" rather than guessing a origin pincode, which would
-         * produce confidently wrong rates.
+         * `pickup_postcode` is required by their API and comes from
+         * `SHIPROCKET_PICKUP_PINCODE`.
+         *
+         * 🛑 This comment used to say "we do not have it on this contract", which
+         * was wrong and cost the whole method: the consumer's `appkit.config.js →
+         * business.registeredAddress` has carried `postalCode` all along. Nothing
+         * set the var, so every call returned `{ isServiceable: false }` WITHOUT
+         * calling the API — checkout would have told every buyer we cannot ship to
+         * them, for every destination. A quote that is silently always "no" is
+         * indistinguishable from a carrier with no coverage, which is why it had no
+         * symptom. Verified live once the var was populated: 10-11 couriers quoted
+         * from 413001 to Mumbai, Bengaluru and Delhi.
+         *
+         * 🛑 appkit has no reader for a consumer config file, so the DEFAULT is the
+         * consumer's job: `src/providers.config.ts` populates this var from the
+         * business block at boot. Deliberately not threaded through
+         * `configurePlatformSupplier` — that seam's own 🛑 says it "is NOT a cache
+         * of site settings and must not become one"; it answers *who the invoice
+         * supplier is*, and a carrier pickup field there is mission creep on a seam
+         * with one stated purpose. One var, one reader, no precedence rule.
          */
         const origin = process.env.SHIPROCKET_PICKUP_PINCODE?.trim();
         if (!origin) {
-            serverLogger.warn("shiprocket: SHIPROCKET_PICKUP_PINCODE unset — serviceability cannot be checked", { pincode });
+            serverLogger.warn("shiprocket: no pickup postcode — set business.registeredAddress.postalCode in appkit.config.js, or SHIPROCKET_PICKUP_PINCODE directly", { pincode });
             return { isServiceable: false, couriers: [] };
         }
         try {

package/dist/security/csp.d.ts

@@ -12,20 +12,5 @@
  */
 /** Generate a 16-byte base64 nonce for a single request. */
 export declare function generateNonce(): string;
-export interface BuildCSPOptions {
-    /**
-     * Add `'wasm-unsafe-eval'` to `script-src`, permitting
-     * `WebAssembly.compile`/`instantiate` from bytes.
-     *
-     * Required by any page that compiles WebAssembly at runtime — without it the
-     * production policy (`script-src 'self' 'nonce-…'`) blocks compilation
-     * outright, because WebAssembly compilation counts as script evaluation.
-     *
-     * Narrower than `'unsafe-eval'` on purpose: it unblocks WASM only and still
-     * forbids `eval` and `new Function` for JavaScript. Default `false`, so
-     * existing consumers are unaffected.
-     */
-    wasm?: boolean;
-}
 /** Build the full CSP header value for the given nonce. */
-export declare function buildCSP(nonce: string, options?: BuildCSPOptions): string;
+export declare function buildCSP(nonce: string): string;

package/dist/security/csp.js

@@ -17,15 +17,13 @@ export function generateNonce() {
     return btoa(String.fromCharCode(...bytes));
 }
 /** Build the full CSP header value for the given nonce. */
-export function buildCSP(nonce, options = {}) {
+export function buildCSP(nonce) {
     const isDev = process.env.NODE_ENV === "development";
-    const wasm = options.wasm === true ? " 'wasm-unsafe-eval'" : "";
     return [
         "default-src 'self'",
         isDev
-            ? // 'unsafe-eval' already subsumes 'wasm-unsafe-eval' in dev.
-                "script-src 'self' 'unsafe-eval' 'unsafe-inline'"
-            : `script-src 'self' 'nonce-${nonce}'${wasm}`,
+            ? "script-src 'self' 'unsafe-eval' 'unsafe-inline'"
+            : `script-src 'self' 'nonce-${nonce}'`,
         "style-src 'self' 'unsafe-inline'",
         "img-src 'self' data: https: blob:",
         "font-src 'self' data:",

package/dist/seed/carousel-slides-seed-data.js

@@ -1,8 +1,15 @@
 /*
  * WHY: Seeds 6 carousel slides for the marketplace homepage promo carousel.
- * WHAT: 5 active + 1 inactive. Deterministic Picsum backgrounds with a dim
+ * WHAT: 4 active + 2 inactive. Deterministic Picsum backgrounds with a dim
  * overlay, plus a headline / supporting line / CTA on each.
  *
+ * 🛑 FOUR ACTIVE, NOT FIVE, SINCE 2026-10-20. `MAX_ACTIVE_SLIDES` is a
+ * ceiling, not a quota — `slide-beyblade-auction` went inactive with
+ * `listings.listingTypes.auction: false` and nothing was promoted to backfill
+ * it. Do NOT activate `slide-upcoming-promo` to get back to five: that one is
+ * the fixture `getActiveSlides()`' own filter is tested against, and it says
+ * "A draft slide kept unpublished so admins have a starting point to copy."
+ *
  * 🛑 EVERY ACTIVE SLIDE MUST CARRY AN `overlay` OR `cards`, OR IT RENDERS BLANK.
  * `HeroCarousel` gates all slide copy on `slide.overlay` (line ~412) and the
  * card grid on `slide.cards.length` (line ~451). Before this pass every seeded
@@ -107,16 +114,34 @@ const _rawSlides = [
                 hover: { effect: "scale" },
             },
             {
-                id: "card-hero-bid",
+                /*
+                 * 🛑 THIS WAS THE AUCTIONS CARD ("Bid / Live auctions / Place a bid
+                 * before the timer runs out" → `/auctions`), and it was still on the
+                 * first screen of the site weeks after `listings.listingTypes.auction`
+                 * went `false`. The section-level gate in `MarketplaceHomepageView` is
+                 * keyed on `SectionType` and a carousel is type `carousel` whatever it
+                 * contains, so nothing could see it. `gateCarouselSlides` now can — but
+                 * a filter that leaves a hole in a `repeat(3, 1fr)` row is a fallback,
+                 * not a fix, so the slot gets real content instead.
+                 *
+                 * 🛑 NOT `/spares` and NOT `/art`, which were the obvious swaps: both
+                 * types are ENABLED, both have a working browse page, and both held
+                 * ZERO published products when this was written (measured against
+                 * production, 2026-10-20). Replacing a dead-end card with a different
+                 * dead-end card is not a fix. `/categories` is populated — six roots,
+                 * 28 brands, 8 franchises — and browsing the tree is genuinely the
+                 * third way to shop here.
+                 */
+                id: "card-hero-browse",
                 zone: 2,
                 mobileZone: 2,
                 background: { type: "image", url: MEDIA.lDrago, dimOverlay: { enabled: true, opacity: 0.45 } },
                 content: {
-                    eyebrow: "Bid",
-                    title: "Live auctions",
-                    description: "Place a bid before the timer runs out.",
+                    eyebrow: "Explore",
+                    title: "Shop by category",
+                    description: "Walk the tree from generation down to a single part.",
                 },
-                buttons: [{ id: "card-hero-bid-cta", text: "Browse auctions", href: String(ROUTES.PUBLIC.AUCTIONS), variant: "primary" }],
+                buttons: [{ id: "card-hero-browse-cta", text: "Browse categories", href: String(ROUTES.PUBLIC.CATEGORIES), variant: "primary" }],
                 hover: { effect: "scale" },
             },
             {
@@ -139,10 +164,26 @@ const _rawSlides = [
         updatedAt: daysAgo(3),
     },
     {
+        /*
+         * 🛑 DISABLED, NOT DELETED — the same arrangement the auctions RAIL uses in
+         * `homepage-sections-seed-data.ts`, and for the same reason. Every word of
+         * the copy, the video background and the CTA stay exactly as they were, so
+         * flipping `listings.listingTypes.auction` back to `true` and this flag
+         * with it restores the slide intact.
+         *
+         * Two locks, deliberately. `gateCarouselSlides` already drops this at
+         * render because `overlay.button.link` and `link.url` both resolve to
+         * `/auctions` — but that one is invisible, and a slide listed as active in
+         * the carousel admin while never appearing on the page reads as a bug in
+         * the admin. `active: false` is the lock a human sees.
+         *
+         * 🛑 The copy names no listing type — "Win it at your price" — which is
+         * exactly why the gate matches on the LINK and not on the words.
+         */
         id: "slide-beyblade-auction",
         title: "Live auctions",
         order: 2,
-        active: true,
+        active: false,
         background: {
             type: "video",
             // Direct MP4 URL, deliberately NOT wrapped in seedExtMedia() — that

package/dist/seed/faq-seed-data.js

@@ -525,7 +525,7 @@ const faqSeedRecords = [
     {
         id: "faq-emi-installments",
         question: "Can I pay in installments (EMI)?",
-        answer: html(`<p>Yes — on eligible orders. If the seller has EMI enabled and your order with them meets the minimum order value, "Pay in EMI" appears as a payment option at checkout. Choose a tenure of 2–6 months, pay a small token amount upfront, and the remaining balance plus a small monthly surcharge is billed automatically in equal installments each month. Your order ships as soon as the token payment is confirmed — you don't wait for the full amount to be paid.</p>`),
+        answer: html(`<p>Yes — on eligible orders. If the seller has EMI enabled and your order with them meets the minimum order value, "Pay in EMI" appears as a payment option at checkout. Choose a tenure of 2–6 months, pay a small token amount upfront, and the remaining balance plus a small monthly surcharge is billed automatically in equal installments each month. Your order ships once the EMI is fully paid — the token confirms your commitment and secures the item, it is not a dispatch trigger. A seller may opt an individual listing into earlier dispatch, and that is stated on the listing.</p>`),
         category: "orders_payment",
         showOnHomepage: false,
         showInFooter: false,

package/dist/seed/site-settings-seed-data.js

@@ -474,7 +474,7 @@ export const siteSettingsSeedData = {
         minimumTransactionFee: 0,
         gatewayFeePercent: 2,
         codDepositPercent: 10,
-        codHandlingFeeMin: 200,
+        codHandlingFeeCap: 200,
         codHandlingFeePercent: 10,
         // Enabled so a seeded install actually shows the add-ons — see the matching
         // comment on DEFAULT_SITE_SETTINGS_DATA.commissions.

package/dist/seo/json-ld.d.ts

@@ -29,7 +29,14 @@ export interface ProductJsonLdInput {
     price: number;
     currency: string;
     mainImage?: string;
-    images?: string[];
+    /**
+     * Prefer `productImageUrls(doc.images)`. The object form is accepted so a
+     * document holding `ProductImage[]` cannot take the page down — see the
+     * note on `imageUrlOf` in `productJsonLd`.
+     */
+    images?: readonly (string | {
+        url?: string;
+    })[];
     sellerName?: string;
     category?: string;
     status?: string;

package/dist/seo/json-ld.js

@@ -27,7 +27,27 @@ const SITE_NAME = process.env.NEXT_PUBLIC_SITE_NAME ?? "App";
  * an empty value so `JSON.stringify` drops the key rather than emitting `""`.
  */
 function absoluteUrl(value, base = SITE_URL) {
-    const v = value?.trim();
+    /*
+     * 🛑 `unknown` + a typeof test, NOT `string | null | undefined` + `?.trim()`.
+     *
+     * This took production down for hours. The signature said `string`, every
+     * caller type-checked, and then `ProductImage[]` replaced `string[]` on the
+     * product document — so `images.map(absoluteUrl)` received OBJECTS, `?.trim`
+     * was not a function, and the throw escaped into the RSC render and 500'd
+     * `/[locale]/products/[slug]` and `/[locale]/auctions/[id]`: **72 recorded
+     * failures**, the whole page lost to a decorative metadata field.
+     *
+     * A declared parameter type is a compile-time claim about CALLERS. It is
+     * worth nothing at the boundary where data arrives from Firestore, which is
+     * exactly where this function sits — and a schema migration is precisely the
+     * event that makes the claim false everywhere at once.
+     *
+     * So the contract is now behavioural: anything that is not a usable string
+     * is DROPPED, and the key is omitted. JSON-LD is optional enrichment —
+     * losing one image costs a rich-result thumbnail, while throwing costs the
+     * entire page. Those are not close.
+     */
+    const v = typeof value === "string" ? value.trim() : undefined;
     if (!v)
         return undefined;
     if (/^(https?:)?\/\//i.test(v) || v.startsWith("data:"))
@@ -92,11 +112,28 @@ export function productJsonLd(product) {
     const url = `${SITE_URL}${product.detailPath ?? `/products/${product.slug}`}`;
     // Absolutise, then de-duplicate: `mainImage` is very often also `images[0]`,
     // which produced the same URL twice in the emitted array.
+    /*
+     * 🛑 Accepts BOTH shapes on purpose. `absoluteUrl` now drops a non-string
+     * instead of throwing, which stops the 500 — but silently dropping every
+     * image would trade a crash for an invisible loss of the `image` property
+     * that Product rich results REQUIRE. Reading `.url` off an object keeps the
+     * rich result working whichever shape the document holds, so a caller that
+     * forgets `productImageUrls()` degrades to nothing worse than correct.
+     */
+    /*
+     * The cast narrows to `{ url?: string }` rather than `{ url?: unknown }`
+     * (`audit-unknown-leakage` blocks the latter, correctly — an `unknown` in a
+     * member position defeats checking on every read below it). The assertion is
+     * safe without being trusted: `absoluteUrl` tests `typeof value === "string"`
+     * itself, so a document whose `url` is a number is dropped rather than
+     * reaching `.trim()`. Narrow for the compiler, verify at runtime.
+     */
+    const imageUrlOf = (entry) => typeof entry === "string" ? entry : entry?.url;
     const images = [
         ...(product.mainImage ? [product.mainImage] : []),
         ...(product.images || []),
     ]
-        .map((img) => absoluteUrl(img))
+        .map((img) => absoluteUrl(imageUrlOf(img)))
         .filter((img) => Boolean(img))
         .filter((img, i, arr) => arr.indexOf(img) === i);
     return {