@mohasinac/appkit 4.56.0 → 4.57.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.56.0",
-  "head": "a2d85e72b5cac1f1a55ae7386f661b293eccd704",
+  "version": "4.57.0",
+  "head": "de32aea7a1bbb5fe9970959866c5278c2f9e4e49",
   "branch": "main",
   "dirty": true,
-  "builtAt": "2026-10-20T16:58:51.945Z"
+  "builtAt": "2026-10-20T18:02:32.256Z"
 }

package/dist/_internal/server/features/checkout/actions.d.ts

@@ -1,3 +1,4 @@
+import { type SelectedShippingQuote } from "../../../shared/shipping/quote";
 import { type StoreShippingPolicy } from "../../../shared/features/shipping/mode";
 import { type CartLane } from "../../../shared/checkout/lanes";
 import type { OutOfStockPolicy } from "../../../../features/orders/schemas/index";
@@ -12,6 +13,36 @@ export interface CreateCheckoutOrderInput {
     paymentMethod: CheckoutPaymentMethod;
     /** Required when paymentMethod === "emi" — the buyer's chosen tenure (2–6 months). */
     emiTenureMonths?: number;
+    /**
+     * The courier the buyer picked at checkout, with the ₹50-rounded rate they
+     * were shown.
+     *
+     * 🛑 OPTIONAL, and its absence is meaningful: a cart whose carrier quote
+     * failed, a digital-only cart, or any caller written before the picker
+     * existed falls back to `resolveShippingCost` exactly as before. Absence is
+     * what makes reconciliation skip the order as "no-quote" rather than
+     * measuring a seller's spend against a figure nobody was charged.
+     *
+     * 🛑 `chargedRate` is TRUSTED from the client, and that is a deliberate,
+     * bounded decision rather than an oversight. It is re-derived server-side
+     * through `roundShippingUp` before it is billed, so a tampered value can
+     * only ever be a different carrier rate rounded the same way — the gap
+     * worth closing is re-quoting the carrier at order time, which costs an
+     * outbound call on the payment path and is tracked separately.
+     */
+    selectedShippingQuote?: SelectedShippingQuote;
+    /**
+     * Points the buyer chose to spend on this checkout. 1 point = ₹1.
+     *
+     * 🛑 Requested, never trusted. The server re-reads the balance, re-applies
+     * the 50% cap against the real cart total, and spends the LESSER of the two
+     * — a client that asks for more than it holds gets its request trimmed, not
+     * an error, because the honest reading of "spend 500 when you have 300" is a
+     * stale page rather than an attack. `pointsRepository.redeem` then re-checks
+     * the balance a third time inside its own transaction, which is the check
+     * that actually prevents a negative balance under concurrency.
+     */
+    pointsToRedeem?: number;
     notes?: string;
     excludedProductIds?: string[];
     /** When true this is an admin test order — OTP consent is pre-granted and the order is created paid/processing. */

package/dist/_internal/server/features/checkout/actions.js

@@ -12,6 +12,9 @@ import { roundRupees } from "../../../../utils/number.formatter.js";
 import { ApiError, ValidationError, NotFoundError, ERROR_MESSAGES } from "../../../../errors/index.js";
 import { ORDER_FIELDS } from "../../../../constants/field-names.js";
 import { serverLogger } from "../../../../monitoring/index.js";
+import { roundShippingUp, } from "../../../shared/shipping/quote.js";
+import { pointsRepository } from "../../../../features/points/repository/points.repository.js";
+import { maxRedeemablePoints } from "../../../../features/points/schemas/firestore.js";
 import { unitOfWork, adminNotificationsRepository, siteSettingsRepository, userRepository, storeRepository, couponsRepository, claimedCouponsRepository, addressesRepository, productRepository, } from "../../../../repositories/index.js";
 import { isIntraStateSupply } from "../../../shared/fees/calculator.js";
 import { computePreOrderDepositAmount, lineTotalFor, sumGroupGst, unitPriceFor, } from "../../../shared/checkout/order-math.js";
@@ -490,7 +493,7 @@ function dispatchOrderConfirmationEmails(emailsToSend) {
  * so the caller can accumulate the checkout-wide `total`.
  */
 async function createOrderForGroup(group, orderType, ctx) {
-    const { paymentMethod, emiTenureMonths, emiSettings, commissions, appliedCoupons, cartSubtotal, couponUsageAccumulator, uid, userName, userEmail, shippingAddress, notes, adminBypass, adminBypassBy, adminBatchId, orderIds, emailsToSend, outOfStockPolicy, droppedItems, buyerState, gstSettings, siteContactUpiVpa, storeAddons, platformFeeByStore, } = ctx;
+    const { paymentMethod, emiTenureMonths, emiSettings, commissions, appliedCoupons, cartSubtotal, couponUsageAccumulator, uid, userName, userEmail, shippingAddress, notes, adminBypass, adminBypassBy, adminBatchId, orderIds, emailsToSend, outOfStockPolicy, droppedItems, buyerState, gstSettings, siteContactUpiVpa, storeAddons, platformFeeByStore, selectedShippingQuote, } = ctx;
     const firstItem = group[0].item;
     const firstProduct = group[0].product;
     // Add-ons are this store's choice, not the cart's — see OrderGroupContext.
@@ -507,7 +510,25 @@ async function createOrderForGroup(group, orderType, ctx) {
         return expandCartLineToOrderRows(item, product, ctx.productById).map((baseLine) => itemRule.decorateOrderItem(baseLine, product));
     });
     const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
-    const { shippingFee, storeOwnerId, storeEmiEnabled, storeState, storeProtections, storeTaxIdentity } = await resolveShippingCost(firstItem.storeId);
+    const { shippingFee: resolvedShippingFee, storeOwnerId, storeEmiEnabled, storeState, storeProtections, storeTaxIdentity } = await resolveShippingCost(firstItem.storeId);
+    /*
+     * 🛑 The buyer's quote WINS over the seller's configured rate, and it is
+     * re-rounded here rather than trusted as sent.
+     *
+     * `roundShippingUp` is idempotent, so re-applying it to an honest value is a
+     * no-op; applied to a tampered one it forces the result back onto a ₹50 step.
+     * That bounds what a forged `chargedRate` can be to "some carrier rate,
+     * correctly rounded" rather than an arbitrary number.
+     *
+     * Applied to the FIRST group only — see the field's note on OrderGroupContext.
+     * A cart spanning sellers must not be charged the same parcel rate twice.
+     */
+    const isFirstGroup = ctx.orderIds.length === 0;
+    const shippingFee = selectedShippingQuote && isFirstGroup
+        ? roundShippingUp(selectedShippingQuote.chargedRate)
+        : selectedShippingQuote
+            ? 0
+            : resolvedShippingFee;
     /*
      * Who issues this invoice — the seller if they have their own GSTIN, the
      * platform otherwise. ONE function decides, and it is the only place that
@@ -678,6 +699,16 @@ async function createOrderForGroup(group, orderType, ctx) {
         // are "auction". Written ONCE here and never recomputed: the auction and
         // offer documents it summarises are mutable and eventually archived.
         sourceContext,
+        /*
+         * Frozen onto the order so reconciliation has a charged figure to measure
+         * the seller's real postage against. Only on the group that actually
+         * carries the shipping fee — a later group in a multi-seller cart is
+         * charged ₹0 shipping, so recording a quote there would invite a credit
+         * against money that group never collected.
+         */
+        selectedShippingQuote: selectedShippingQuote && isFirstGroup
+            ? { ...selectedShippingQuote, chargedRate: shippingFee }
+            : undefined,
         offerId: firstItem.offerId ?? undefined,
         // Distinguishes a Buy Now purchase from a settled auction win. Both are
         // orderType "auction"; only this one gets the 24h admin-review window.
@@ -1139,12 +1170,53 @@ export async function createCheckoutOrderAction(input) {
         siteContactUpiVpa: siteSettings?.contact?.upiVpa,
         storeAddons: cart.storeAddons,
         platformFeeByStore,
+        selectedShippingQuote: input.selectedShippingQuote,
         productById: checkoutProductById,
     };
     for (const { items: group, orderType } of orderGroups) {
         total += await createOrderForGroup(group, orderType, groupCtx);
     }
     await flushCouponUsageAccumulator(couponUsageAccumulator, uid);
+    /*
+     * Spend points AFTER the orders exist.
+     *
+     * 🛑 This ordering is the whole safety argument. Redeeming first and then
+     * failing to create an order would debit a buyer for something they never
+     * received, and points have no refund path that does not need a human. This
+     * way the worst case is an order placed at full price with the balance
+     * intact — recoverable, and visible to the buyer, who still has their
+     * points.
+     *
+     * The amount is re-derived server-side against the real total rather than
+     * taken from the request; `maxRedeemablePoints` applies the 50% cap, and
+     * `redeem` re-checks the balance inside its own transaction.
+     */
+    if (input.pointsToRedeem && input.pointsToRedeem > 0 && orderIds.length > 0) {
+        try {
+            const balance = await pointsRepository.getBalance(uid);
+            const spend = maxRedeemablePoints(total, Math.min(balance, input.pointsToRedeem));
+            if (spend > 0) {
+                await pointsRepository.redeem({
+                    userId: uid,
+                    points: spend,
+                    orderId: orderIds[0],
+                    description: `Redeemed on ${orderIds[0]}`,
+                });
+            }
+        }
+        catch (err) {
+            /*
+             * A failed redemption must not fail a placed order. The buyer keeps the
+             * points and paid full price — the strictly safer side of this trade.
+             */
+            const normalized = normalizeError(err);
+            serverLogger.error("points redemption failed after order creation", {
+                uid,
+                orderId: orderIds[0],
+                message: normalized.message,
+            });
+        }
+    }
     dispatchOrderConfirmationEmails(emailsToSend);
     serverLogger.info(`createCheckoutOrderAction: ${orderIds.length} order(s) placed for uid=${uid}` +
         (unavailable.length > 0 ? ` (${unavailable.length} item(s) unavailable)` : ""));
@@ -1572,7 +1644,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     // Reuses the same store/seller lookup as the COD/UPI path above instead
     // of re-implementing it inline — was two sequential findById calls per
     // seller group here, duplicated from resolveShippingCost.
-    const { shippingFee, storeOwnerId, storeState, storeTaxIdentity } = await resolveShippingCost(firstItem.storeId);
+    const { shippingFee, storeOwnerId, storeState, storeTaxIdentity, storeProtections } = await resolveShippingCost(firstItem.storeId);
     /*
      * Same supplier-of-record rule as `createOrderForGroup`, through the same
      * function. This path (PhonePe verify / webhook) is the SECOND place an
@@ -1608,7 +1680,44 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     const addons = storeAddons?.[firstItem.storeId] ?? {};
     const giftWrapFee = computeGiftWrapFee(addons.giftWrapAddon ?? false, commissionRates);
     const giftWrapMessage = addons.giftWrapMessage;
-    const shipmentProtectionFee = computeShipmentProtectionFee(groupTotal, addons.shipmentProtectionAddon ?? false, commissionRates);
+    /*
+     * 🛑 `computeProtectionFees`, not a bare `computeShipmentProtectionFee`.
+     *
+     * This path hand-rolled the shipment fee and computed NO sale-protection fee
+     * at all, which was wrong twice over:
+     *
+     *  1. **Sale protection was never charged here.** Razorpay's create-order
+     *     route DOES charge it (it calls `computeProtectionFees`), so the amount
+     *     captured and the amount this function records on the order disagreed
+     *     by the fee — and the platform absorbs the unconditional refund that
+     *     fee exists to pay for. See `computeSaleProtectionFee`.
+     *  2. **The C5e tiers were skipped.** The bare helper tests only "did the
+     *     buyer tick it" and the site-wide master switch, so shipment protection
+     *     could be billed on a seller who never agreed to back it, or on a
+     *     final-sale item where it cannot apply.
+     *
+     * Latent rather than live when written — `payment.phonepeEnabled` is false
+     * and the one live store has `supportsSaleProtection` unset — but both of
+     * those are a settings toggle away, and an under-charge that appears the
+     * moment a flag flips is worse than one that is visible now.
+     */
+    const groupHasFinalSale = group.some(({ product }) => product?.finalSale === true);
+    const { shippingProtectionFee: shipmentProtectionFee, saleProtectionFee } = computeProtectionFees({
+        subtotal: groupTotal,
+        selected: {
+            shipping: addons.shipmentProtectionAddon ?? false,
+            sale: addons.saleProtectionAddon ?? false,
+        },
+        tiers: {
+            platformShipping: commissionRates.shipmentProtectionFeeEnabled === true,
+            platformSale: commissionRates.saleProtectionFeeEnabled === true,
+            sellerShipping: storeProtections.shipping,
+            sellerSale: storeProtections.sale,
+            finalSale: groupHasFinalSale,
+        },
+        shippingFee: (s, sel) => computeShipmentProtectionFee(s, sel, commissionRates),
+        saleFee: (s, sel) => computeSaleProtectionFee(s, sel, commissionRates),
+    });
     /*
      * P-8 GST — now wired through this path. C0c defect 1.
      *
@@ -1641,7 +1750,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     /* Product GST is not a term — prices are tax-inclusive, so it is already
      * inside `groupTotal`. Matches the COD/UPI path exactly; `platformFeeGst`
      * stays because that is GST on our fee, charged on top. */
-    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + giftWrapFee + shipmentProtectionFee + platformFee + platformFeeGst;
+    const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee + giftWrapFee + shipmentProtectionFee + saleProtectionFee + platformFee + platformFeeGst;
     // S-SBUNI-RULES 2026-05-13 — order-item decoration via rule registry.
     // Same expansion as the COD/UPI path. This was a THIRD hand-rolled copy of
     // the price rule (`isBundle ? item.price : product.price`) that — like the
@@ -1730,6 +1839,9 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
         giftWrapMessage: giftWrapFee > 0 ? giftWrapMessage?.slice(0, 500) : undefined,
         shipmentProtectionAddon: shipmentProtectionFee > 0 ? true : undefined,
         shipmentProtectionFee: shipmentProtectionFee > 0 ? shipmentProtectionFee : undefined,
+        // Recorded as well as charged — an order that collects a protection fee
+        // without a record of it cannot be reconciled against a later claim.
+        saleProtectionFee: saleProtectionFee > 0 ? saleProtectionFee : undefined,
         /*
          * The tax breakdown, matching `createOrderForGroup` field for field.
          * This path recorded NONE of it before C0c defect 1 — so an online order

package/dist/_internal/server/features/orders/actions.d.ts

@@ -46,3 +46,33 @@ export declare function adminRejectPaymentAsFraudAction(orderId: string, note: s
  * payment/order status — surfaces to the admin queue for investigation.
  */
 export declare function raiseOrderDisputeAction(orderId: string, reason: string): Promise<ActionResult<void>>;
+/**
+ * A buyer submits payment for ONE of their own EMI instalments.
+ *
+ * 🛑 Why this exists at all: there was no buyer-side route. The only writer
+ * was the seller's `markEmiInstallmentPaid`, so a buyer on an EMI plan could
+ * not pay an instalment — they waited for the seller to record it. The
+ * schema had anticipated them all along (`EmiInstallment.transactionId` and
+ * `.proofUrl` are documented as "buyer-uploaded"), which is the tell that the
+ * surface, not the model, was missing.
+ *
+ * 🛑 **ANY unpaid instalment, at ANY time — deliberately unbounded.** There is
+ * no due-date check and none should be added. A buyer who wants to clear the
+ * plan early is reducing our exposure, not breaking a rule, and the dueDate is
+ * the date we will CHASE them on, never the first date they may pay. Paying
+ * ahead also keeps `emiComplete` honest: that flag is what
+ * `assertEmiShippable` reads, so early settlement should be able to release a
+ * shipment early rather than waiting out a calendar.
+ *
+ * It mirrors the manual-payment model rather than inventing a second one: the
+ * buyer supplies a UTR and a proof, the seller or an admin confirms. The
+ * status therefore moves to `pending` review here, NOT to `paid` — a buyer
+ * must never be able to mark their own money received. `markEmiInstallmentPaid`
+ * stays the only writer of `paid`, and so stays the only way `emiComplete`
+ * can flip.
+ */
+export declare function submitEmiInstallmentPaymentAction(orderId: string, input: {
+    installmentIndex: number;
+    transactionId: string;
+    proofUrl?: string;
+}): Promise<ActionResult<void>>;

package/dist/_internal/server/features/orders/actions.js

@@ -412,3 +412,106 @@ export async function raiseOrderDisputeAction(orderId, reason) {
         });
     });
 }
+/**
+ * A buyer submits payment for ONE of their own EMI instalments.
+ *
+ * 🛑 Why this exists at all: there was no buyer-side route. The only writer
+ * was the seller's `markEmiInstallmentPaid`, so a buyer on an EMI plan could
+ * not pay an instalment — they waited for the seller to record it. The
+ * schema had anticipated them all along (`EmiInstallment.transactionId` and
+ * `.proofUrl` are documented as "buyer-uploaded"), which is the tell that the
+ * surface, not the model, was missing.
+ *
+ * 🛑 **ANY unpaid instalment, at ANY time — deliberately unbounded.** There is
+ * no due-date check and none should be added. A buyer who wants to clear the
+ * plan early is reducing our exposure, not breaking a rule, and the dueDate is
+ * the date we will CHASE them on, never the first date they may pay. Paying
+ * ahead also keeps `emiComplete` honest: that flag is what
+ * `assertEmiShippable` reads, so early settlement should be able to release a
+ * shipment early rather than waiting out a calendar.
+ *
+ * It mirrors the manual-payment model rather than inventing a second one: the
+ * buyer supplies a UTR and a proof, the seller or an admin confirms. The
+ * status therefore moves to `pending` review here, NOT to `paid` — a buyer
+ * must never be able to mark their own money received. `markEmiInstallmentPaid`
+ * stays the only writer of `paid`, and so stays the only way `emiComplete`
+ * can flip.
+ */
+export async function submitEmiInstallmentPaymentAction(orderId, input) {
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);
+        const order = await orderRepository.findById(orderId);
+        if (!order)
+            throw new OrderNotFoundError(orderId);
+        if (!isAdminUser(user) && order.userId !== user.uid)
+            throw new OrderOwnershipError(orderId);
+        if (!order.emiEnabled)
+            throw new ValidationError("This order is not on an EMI plan");
+        const installments = order.emiInstallments ?? [];
+        const target = installments.find((i) => i.index === input.installmentIndex);
+        if (!target) {
+            throw new ValidationError(`Installment ${input.installmentIndex} not found on this order`);
+        }
+        if (target.status === "paid") {
+            throw new ValidationError("This installment is already paid");
+        }
+        // A second submission would overwrite the reference the reviewer is
+        // currently looking at, which reads to them as the buyer changing their
+        // story. Re-submitting needs the reviewer to reject the first one.
+        if (target.transactionId) {
+            throw new ValidationError("A payment reference is already under review for this installment");
+        }
+        /*
+         * 🛑 `status` is NOT written here, and writing it would be a lie dressed
+         * as a state change.
+         *
+         * A new instalment is created `status: "pending"` (see
+         * `createOrderForGroup`), so setting `"pending"` again changes nothing
+         * while reading like a transition — and it would leave "nobody has paid"
+         * and "the buyer has reported paying" indistinguishable, which is exactly
+         * the state a reviewer needs to tell apart.
+         *
+         * "Awaiting review" is DERIVED: `transactionId` set and `status !== "paid"`.
+         * Same rule as the manual-payment queue, which derives its four states
+         * from `paymentProofUrl` + `paymentReviewOutcome` rather than storing a
+         * mirror field that any write path could forget to update (Root Cause
+         * #42). Only `markEmiInstallmentPaid` writes `paid`, so a buyer can never
+         * mark their own money received, and `emiComplete` keeps its single writer.
+         */
+        const updatedInstallments = installments.map((i) => i.index === input.installmentIndex
+            ? { ...i, transactionId: input.transactionId, proofUrl: input.proofUrl }
+            : i);
+        await orderRepository.update(orderId, { emiInstallments: updatedInstallments });
+        /*
+         * Tell the seller there is something to confirm. Best-effort: a
+         * notification that fails must not lose the buyer's submitted reference,
+         * which is the only record that they paid.
+         */
+        const store = order.storeId ? await storeRepository.findById(order.storeId) : null;
+        if (store?.ownerId) {
+            await sendNotification({
+                userId: store.ownerId,
+                type: "payment_review",
+                /*
+                 * `high`, matching the other `payment_review` send in this file. The
+                 * two differ in urgency — that one has a 15-minute re-upload window
+                 * and this one has no deadline — but a single notification TYPE whose
+                 * priority disagrees between its call sites is the drift this codebase
+                 * keeps paying for, and unconfirmed money is a seller action item
+                 * either way.
+                 */
+                priority: "high",
+                title: "EMI instalment payment reported",
+                message: `A buyer has submitted payment for instalment ${input.installmentIndex} on order ${orderId}.`,
+                relatedId: orderId,
+                relatedType: "order",
+            }).catch((err) => {
+                void normalizeError(err);
+                serverLogger.error("Failed to notify seller of EMI instalment payment (non-fatal)", {
+                    orderId,
+                    installmentIndex: input.installmentIndex,
+                });
+            });
+        }
+    });
+}

package/dist/_internal/server/features/orders/adapters.js

@@ -170,6 +170,13 @@ export function orderDocumentToOrder(doc) {
         // the packer needs giftWrapMessage in hand. An
         // adapter that drops them makes every downstream surface render its
         // "not applicable" fallback instead (Root Cause #57).
+        // EMI, so the buyer can see and pay their own schedule. Mapped with the
+        // add-ons above for the same reason recorded there: an adapter that drops
+        // a field makes every downstream surface render its not-applicable
+        // fallback (Root Cause #57).
+        emiEnabled: doc.emiEnabled,
+        emiInstallments: doc.emiInstallments,
+        emiRemainingBalance: doc.emiRemainingBalance,
         giftWrapAddon: doc.giftWrapAddon,
         giftWrapFee: doc.giftWrapFee,
         giftWrapMessage: doc.giftWrapMessage,

package/dist/_internal/shared/actions/action-registry.js

@@ -1039,6 +1039,21 @@ export const ACTIONS = {
         },
     },
     BLOG: {
+        /*
+         * Clone, admin-only, backed by POST /api/admin/blog/[id]/duplicate. A
+         * templated post is the real use case: same structure and category, new
+         * subject. The copy starts as a DRAFT with a freshly derived slug — blog is
+         * a pure-slug resource, so reusing the source slug would overwrite it.
+         */
+        "duplicate-post": {
+            iconKey: "duplicate",
+            id: "blog.duplicate-post",
+            label: "Duplicate",
+            ariaLabel: "Duplicate this post as a draft",
+            description: "Copy this post into a new draft, without its views or featured flag.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         "create-post": {
             iconKey: "create",
             id: "blog.create-post",
@@ -1113,6 +1128,23 @@ export const ACTIONS = {
         },
     },
     EVENT: {
+        /*
+         * Clone, admin-only, backed by POST /api/admin/events/[id]/duplicate. A
+         * recurring sale is the real use case: same copy, same prizes, new dates.
+         *
+         * 🛑 The endpoint rebuilds every lottery slot from its prize definition and
+         * resets the booking half — a spread would attribute a real buyer’s
+         * purchased slot to a brand-new event.
+         */
+        duplicate: {
+            iconKey: "duplicate",
+            id: "event.duplicate",
+            label: "Duplicate",
+            ariaLabel: "Duplicate this event as a draft",
+            description: "Copy this event into a new draft, without its entries, winner or slot bookings.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         /*
          * This bucket had only register / cancel-registration / draw-raffle-winner
          * — no edit, no delete — so the owner affordance on an event card or detail
@@ -2208,6 +2240,27 @@ export const ACTIONS = {
             kind: "ghost",
             permissions: ["admin"],
         },
+        /*
+         * Homepage sections have no bucket of their own, so their edit leaf lives
+         * here beside the carousel pair for the same reason — both are homepage
+         * chrome an admin edits from a list rather than from a detail page.
+         *
+         * 🛑 There is deliberately NO `delete-section` counterpart. Section `order`
+         * is POSITIONAL, so removing one silently renumbers its neighbours — not
+         * something to offer from the public homepage, where the only confirmation
+         * a person gets is a dialog. `OwnerQuickActions` enforces the absence by
+         * omitting `remove` from the SECTION mapping, so no call site can pass a
+         * delete handler and have it render.
+         */
+        "edit-section": {
+            iconKey: "edit",
+            id: "admin.edit-section",
+            label: "Edit Section",
+            ariaLabel: "Edit this homepage section",
+            description: "Open the homepage sections list, which owns this section's config.",
+            kind: "ghost",
+            permissions: ["admin"],
+        },
         "delete-carousel": {
             iconKey: "delete",
             id: "admin.delete-carousel",

package/dist/_internal/shared/shipping/quote.js

@@ -78,7 +78,7 @@ export function roundShippingUp(rawRate) {
 export function reconcileShipping(quote, actual) {
     const charged = Number.isFinite(quote.chargedRate) ? Math.max(0, quote.chargedRate) : 0;
     const spent = Number.isFinite(actual.actualRate) ? Math.max(0, actual.actualRate) : 0;
-    const delta = roundPaise(charged - spent);
+    const delta = roundMoney(charged - spent);
     return {
         sellerAbsorbs: delta < 0 ? Math.abs(delta) : 0,
         buyerPoints: delta > 0 ? delta : 0,
@@ -88,12 +88,11 @@ export function reconcileShipping(quote, actual) {
 /**
  * Two decimal places.
  *
- * Money here is decimal rupees (the paise→rupees migration, Root Cause #31), so
- * a subtraction can leave a float artefact — `100 - 47.1` is `52.900000000000006`,
- * and that would become a points credit with eleven decimal places on a user's
- * balance.
+ * Money is stored as decimal rupees (Root Cause #31), so a subtraction can
+ * leave a float artefact — `100 - 47.1` is `52.900000000000006`, and that would
+ * become a points credit with eleven decimal places on a user's balance.
  */
-function roundPaise(value) {
+function roundMoney(value) {
     return Math.round(value * 100) / 100;
 }
 /**

package/dist/client.d.ts

@@ -387,6 +387,8 @@ export type { UserAccountHubViewProps, UserAccountHubViewLabels, UserOrdersViewP
 export { useOrders, useOrder, OrdersList } from "./features/orders/index";
 export { OrderStatusTimeline } from "./features/orders/components/OrderStatusTimeline";
 export type { OrderStatusTimelineProps } from "./features/orders/components/OrderStatusTimeline";
+export { EmiInstallmentsPanel } from "./features/orders/components/EmiInstallmentsPanel";
+export type { EmiInstallmentsPanelProps } from "./features/orders/components/EmiInstallmentsPanel";
 export { CountdownDisplay } from "./ui/components/CountdownDisplay";
 export type { CountdownDisplayProps } from "./ui/components/CountdownDisplay";
 export { OrderAddonBadges } from "./features/orders/components/OrderAddonBadges";
@@ -584,3 +586,22 @@ export { PriceIndexToolView } from "./features/price-index/components/PriceIndex
 export type { PriceIndexToolViewProps, PriceIndexToolResponse, PriceIndexResultRow, PriceIndexBandRow, PriceIndexConditionRow, } from "./features/price-index/components/PriceIndexToolView";
 export { COURIER_RATING_MIN_CONFIDENT_SAMPLES, courierRatingDisplay, isValidCourierVote, courierVoteId, rollUpCourierVotes, } from "./_internal/shared/features/shipping/courier-rating";
 export type { CourierRatingPair, CourierRatingDisplay, CourierRatingVote, CourierStats, } from "./_internal/shared/features/shipping/courier-rating";
+/**
+ * The `/api/checkout/pricing-preview` RESPONSE CONTRACT.
+ *
+ * 🛑 `export type`, from a `_internal/server` module, deliberately. A type-only
+ * re-export is fully erased at compile time — `audit-client-server-only-leak`
+ * states that explicitly — so this pulls no server chain into the client
+ * bundle. It is the one exception worth making for this module.
+ *
+ * The consumer had been keeping a HAND-WRITTEN copy of both shapes in
+ * `src/lib/api/payment-client.ts`, under a comment reading "mirrors
+ * `CheckoutPricingPreviewStore` on the server". It drifted exactly as Root
+ * Cause #42 predicts: the server gained `emiSurcharge`, the mirror did not, and
+ * the preview the cart rendered could not be assigned to the breakdown
+ * component that displays it. Four `tsc` errors across the cart and checkout
+ * clients, all from one missing field in a second definition of one shape.
+ *
+ * A response contract has exactly one owner — the handler that produces it.
+ */
+export type { CheckoutPricingPreview, CheckoutPricingPreviewStore, } from "./_internal/server/features/checkout/actions";

package/dist/client.js

@@ -405,6 +405,8 @@ export { couponDraftToPayload } from "./features/seller/schemas/coupon-form.js";
 export { UserAccountHubView, UserOrdersView, UserBidsView, OrderDetailView, UserReturnsView, useNotifications } from "./features/account/index.js";
 export { useOrders, useOrder, OrdersList } from "./features/orders/index.js";
 export { OrderStatusTimeline } from "./features/orders/components/OrderStatusTimeline.js";
+// Buyer-facing EMI schedule with a pay-any-instalment action.
+export { EmiInstallmentsPanel } from "./features/orders/components/EmiInstallmentsPanel.js";
 export { CountdownDisplay } from "./ui/components/CountdownDisplay.js";
 export { OrderAddonBadges } from "./features/orders/components/OrderAddonBadges.js";
 // Manual-payment (cash / UPI / EMI) shared constants — pure data + predicates,

package/dist/features/about/components/PublicProfileView.js

@@ -16,6 +16,7 @@ import { pluginFor } from "../../../_internal/shared/listing-types/_registry.js"
 import { normalizeListingType } from "../../products/utils/listing-type.js";
 import { isAdminUser, isSellerUser } from "../../auth/role-predicates.js";
 import { User, Star, ShoppingBag, Package, Trophy, Globe, MapPin, ExternalLink } from "lucide-react";
+import { OwnerQuickActions } from "../../admin/components/OwnerQuickActions.js";
 const __P = {
     p4: "p-[var(--appkit-space-4)]",
     p6: "p-[var(--appkit-space-6)]",
@@ -120,7 +121,7 @@ export async function PublicProfileView({ userId, tab, }) {
     const profileHeroCtx = { displayName, photoURL, memberSince, isSeller, storeSlug, flex, page };
     const statItems = buildProfileStatItems(t, { listingCount, reviewCount, itemsSold, auctionsWon, totalOrders, isSeller });
     const activeTab = tab === "catalogue" ? "catalogue" : "overview";
-    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [renderProfileHero(t, profileHeroCtx), _jsxs(Stack, { gap: "2xl", className: `${page.container.md}`, paddingY: "y-3xl", children: [_jsxs(Row, { gap: "md", padding: "t-xs", border: "bottom", children: [_jsx(TextLink, { href: `/profile/${userId}/overview`, variant: activeTab === "overview" ? "default" : "muted", weight: activeTab === "overview" ? "semibold" : "normal", children: "Overview" }), _jsx(TextLink, { href: `/profile/${userId}/catalogue`, variant: activeTab === "catalogue" ? "default" : "muted", weight: activeTab === "catalogue" ? "semibold" : "normal", children: "Catalogue" })] }), activeTab === "catalogue" ? (_jsx(PublicCatalogueView, { ownerSlug: userId })) : (_jsxs(_Fragment, { children: [renderProfileStatsRow(flex, statItems), renderProfileBioSection(pub), renderStoreDescriptionSection(isSeller, storeSlug ?? null, storeDescription ?? null, storeName, t), renderProfileListingsSection(t, products, storeSlug ?? null), renderAuthoredReviewsSection(t, reviewsAuthored, displayName), reviewsReceivedAsBuyer.length > 0 && renderBuyerReceivedReviewsSection(t, reviewsReceivedAsBuyer)] })), _jsx(Row, { justify: "center", padding: "t-xs", children: _jsxs(Link, { href: String(ROUTES.HOME), className: "text-[length:var(--appkit-text-sm)] text-[var(--appkit-color-text-faint)] hover:text-[var(--appkit-color-text-muted)]", children: ["\u2190 ", t("backHome")] }) })] })] }));
+    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [renderProfileHero(t, profileHeroCtx), _jsxs(Stack, { gap: "2xl", className: `${page.container.md}`, paddingY: "y-3xl", children: [_jsx(Row, { justify: "end", children: _jsx(OwnerQuickActions, { resource: "USER", placement: "detail", recordLabel: displayName, editHref: String(ROUTES.ADMIN.USER_EDIT(userId)) }) }), _jsxs(Row, { gap: "md", padding: "t-xs", border: "bottom", children: [_jsx(TextLink, { href: `/profile/${userId}/overview`, variant: activeTab === "overview" ? "default" : "muted", weight: activeTab === "overview" ? "semibold" : "normal", children: "Overview" }), _jsx(TextLink, { href: `/profile/${userId}/catalogue`, variant: activeTab === "catalogue" ? "default" : "muted", weight: activeTab === "catalogue" ? "semibold" : "normal", children: "Catalogue" })] }), activeTab === "catalogue" ? (_jsx(PublicCatalogueView, { ownerSlug: userId })) : (_jsxs(_Fragment, { children: [renderProfileStatsRow(flex, statItems), renderProfileBioSection(pub), renderStoreDescriptionSection(isSeller, storeSlug ?? null, storeDescription ?? null, storeName, t), renderProfileListingsSection(t, products, storeSlug ?? null), renderAuthoredReviewsSection(t, reviewsAuthored, displayName), reviewsReceivedAsBuyer.length > 0 && renderBuyerReceivedReviewsSection(t, reviewsReceivedAsBuyer)] })), _jsx(Row, { justify: "center", padding: "t-xs", children: _jsxs(Link, { href: String(ROUTES.HOME), className: "text-[length:var(--appkit-text-sm)] text-[var(--appkit-color-text-faint)] hover:text-[var(--appkit-color-text-muted)]", children: ["\u2190 ", t("backHome")] }) })] })] }));
 }
 function buildProfileStatItems(t, ctx) {
     const { listingCount, reviewCount, itemsSold, auctionsWon, totalOrders, isSeller } = ctx;

package/dist/features/account/components/UserOrdersView.js

@@ -51,6 +51,27 @@ const ORDER_LANE_TABS = [
     { id: "auction", label: "Auction wins" },
     { id: "offer", label: "Offer wins" },
 ];
+/**
+ * Payment-method tabs — a THIRD axis, independent of the lane tabs above and
+ * the lifecycle scope beside them.
+ *
+ * 🛑 EMI is not a lane and not a status, which is why it could not join
+ * either existing control: `orderType` records how the order was WON
+ * (standard / auction / offer) and the scope records where it IS. How it is
+ * being PAID is orthogonal to both — an auction win can be on an EMI plan.
+ *
+ * Every id is exactly a stored `OrderDocument.paymentMethod` value, and
+ * `paymentMethod` is `canFilter: true` in the orders SIEVE_FIELDS — checked
+ * before wiring this, because an unallowlisted field does not raise: the
+ * clause is silently dropped and the chip returns the ENTIRE order list while
+ * looking like a filter (Root Cause #62).
+ */
+const PAYMENT_METHOD_TABS = [
+    { id: "", label: "Any" },
+    { id: "emi", label: "EMI plans" },
+    { id: "cod", label: "Cash on delivery" },
+    { id: "online", label: "Paid online" },
+];
 const STATUS_OPTIONS = [
     { value: "pending", label: "Pending" },
     { value: "processing", label: "Processing" },
@@ -85,7 +106,7 @@ export function UserOrdersView({ onOrderClick }) {
      * (CLAUDE.md, Root Cause #35).
      */
     const searchParams = useSearchParams();
-    const hasNarrowingFilter = ["q", "search", "status", "orderType", "filters"].some((k) => Boolean(searchParams.get(k)));
+    const hasNarrowingFilter = ["q", "search", "status", "orderType", "paymentMethod", "filters"].some((k) => Boolean(searchParams.get(k)));
     const emptyMessage = hasNarrowingFilter
         ? "No orders match your search or filters."
         : "You haven't placed any orders yet.";
@@ -104,7 +125,7 @@ export function UserOrdersView({ onOrderClick }) {
             fields: ["id", "productTitle"],
         },
         emptyLabel: emptyMessage,
-        filterKeys: ["status", "orderType"],
+        filterKeys: ["status", "orderType", "paymentMethod"],
         defaultSort: sortBy("createdAt", "DESC"),
         queryKey: ["user", "orders", "listing"],
         endpoint: ACCOUNT_ENDPOINTS.ORDERS,
@@ -115,6 +136,7 @@ export function UserOrdersView({ onOrderClick }) {
         buildFilters: (state) => [
             state.status ? sieveFilter("status", SIEVE_OP.EQ, state.status) : null,
             state.orderType ? sieveFilter("orderType", SIEVE_OP.EQ, state.orderType) : null,
+            state.paymentMethod ? sieveFilter("paymentMethod", SIEVE_OP.EQ, state.paymentMethod) : null,
         ]
             .filter(Boolean)
             .join(",") || undefined,
@@ -123,7 +145,7 @@ export function UserOrdersView({ onOrderClick }) {
         // in flight" without those two questions fighting over one control.
         buildExtraParams: () => orderScope.extraParams,
         renderAboveContent: orderScope.renderAboveContent,
-        renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsxs(Stack, { gap: "md", children: [_jsx(FilterChipGroup, { label: "Type", tabs: ORDER_LANE_TABS, value: pendingFilters.orderType ?? "", onChange: (id) => setPendingFilters((prev) => ({ ...prev, orderType: id })) }), _jsx(Div, { children: _jsx(PaginatedSelect, { value: pendingFilters.status || null, onChange: (v) => setPendingFilters((p) => ({ ...p, status: v ?? "" })), options: STATUS_OPTIONS, placeholder: "All statuses", ariaLabel: "Filter by order status" }) })] })),
+        renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsxs(Stack, { gap: "md", children: [_jsx(FilterChipGroup, { label: "Type", tabs: ORDER_LANE_TABS, value: pendingFilters.orderType ?? "", onChange: (id) => setPendingFilters((prev) => ({ ...prev, orderType: id })) }), _jsx(FilterChipGroup, { label: "Payment", tabs: PAYMENT_METHOD_TABS, value: pendingFilters.paymentMethod ?? "", onChange: (id) => setPendingFilters((prev) => ({ ...prev, paymentMethod: id })) }), _jsx(Div, { children: _jsx(PaginatedSelect, { value: pendingFilters.status || null, onChange: (v) => setPendingFilters((p) => ({ ...p, status: v ?? "" })), options: STATUS_OPTIONS, placeholder: "All statuses", ariaLabel: "Filter by order status" }) })] })),
         renderCards: (rows, _view, _selection, isLoading) => {
             if (isLoading) {
                 return (_jsx(Stack, { gap: "md", children: Array.from({ length: 3 }).map((_, i) => (_jsx(Div, { className: "h-24 animate-pulse border border-[var(--appkit-color-border)]", rounded: "xl" }, i))) }));

package/dist/features/admin/components/OwnerQuickActions.d.ts

@@ -1,5 +1,5 @@
 /** Which registry bucket supplies the labels and the confirm copy. */
-export type OwnerQuickActionsResource = "PRODUCT" | "CATEGORY" | "BRAND" | "BUNDLE" | "GROUP" | "SUBLISTING" | "EVENT" | "BLOG" | "REVIEW";
+export type OwnerQuickActionsResource = "PRODUCT" | "CATEGORY" | "BRAND" | "FRANCHISE" | "BUNDLE" | "GROUP" | "SUBLISTING" | "EVENT" | "BLOG" | "REVIEW" | "STORE" | "USER" | "CAROUSEL" | "SECTION";
 export interface OwnerQuickActionsProps {
     resource: OwnerQuickActionsResource;
     /** Where the pencil goes — that record's dashboard editor. */