@mohasinac/appkit 4.57.0 → 4.59.0

package/dist/features/admin/components/OwnerQuickActions.js

@@ -57,6 +57,15 @@ import { toUserMessage } from "../../../errors/error-display-map.js";
 const RESOURCE_LEAVES = {
     PRODUCT: { bucket: "PRODUCT", edit: "edit", remove: "delete", duplicate: "duplicate" },
     CATEGORY: { bucket: "CATEGORY", edit: "edit", remove: "delete" },
+    /*
+     * Both get a bin. Unlike the three pencil-only resources below, the blast
+     * radius of removing one reference row is SMALL and bounded: a bey keeps
+     * its parts list (`partName` sits beside `partId` for exactly this), a
+     * boxed set keeps its contents, and a category page keeps its listings.
+     * Nothing cascades, and the committed seed can put the row back.
+     */
+    PART: { bucket: "PART", edit: "edit", remove: "delete" },
+    BEY: { bucket: "BEY", edit: "edit", remove: "delete" },
     BRAND: { bucket: "BRAND", edit: "edit", remove: "delete" },
     BUNDLE: { bucket: "BUNDLE", edit: "edit", remove: "delete" },
     GROUP: { bucket: "GROUP", edit: "edit", remove: "delete" },
@@ -93,7 +102,7 @@ const RESOURCE_LEAVES = {
     USER: { bucket: "ADMIN", edit: "manage-user" },
     SECTION: { bucket: "ADMIN", edit: "edit-section" },
 };
-export function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, placement = "card", className = "", }) {
+export function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, placement = "card", onMedia = false, className = "", }) {
     const session = useOptionalSession();
     const isOwnerOrAdmin = useIsOwner(ownerId);
     const isAdmin = useIsAdmin();
@@ -164,6 +173,25 @@ export function OwnerQuickActions({ resource, editHref, onDelete, onClone, owner
      * resource, not to each of its call sites, or the next call site re-opens it.
      */
     const showDelete = Boolean(onDelete) && Boolean(leaves.remove);
+    /*
+     * 🛑 The scrim is for ANY dark backdrop, not only a card.
+     *
+     * `detail` used to hard-map to `ghost` (`color: var(--appkit-color-zinc-600)`),
+     * which is right on a page-surface header row and invisible on a cover photo
+     * — and every detail view with a hero puts this toolbar inside that hero,
+     * beside siblings it has already flipped to `color="inverse"`. The pencil
+     * therefore rendered near-black on near-black and read as "admins get no
+     * edit button at all". See `onMedia` above and Root Cause #67.
+     */
+    const onDark = placement === "card" || onMedia;
+    const neutralVariant = onDark ? "scrim" : "ghost";
+    /*
+     * Danger ink is dropped on a dark backdrop for the same reason: `danger`
+     * resolves to a theme-relative red that disappears against the hero. The bin
+     * keeps its confirm dialog, which is where the destructive intent is
+     * actually communicated — colour was never the safeguard.
+     */
+    const dangerVariant = onDark ? "scrim" : "danger";
     return (_jsxs(_Fragment, { children: [_jsxs(Row, { gap: "xs", align: "center", className: className, 
                 /*
                  * Stops the click reaching an ancestor `<Link>` or the card's own
@@ -172,7 +200,7 @@ export function OwnerQuickActions({ resource, editHref, onDelete, onClone, owner
                  */
                 onClick: (e) => {
                     e.stopPropagation();
-                }, children: [_jsx(IconButton, { "aria-label": editDef?.ariaLabel ?? editDef?.label ?? "Edit", size: "touch", variant: placement === "card" ? "scrim" : "ghost", icon: _jsx(Icon, { name: "edit" }), onClick: () => {
+                }, children: [_jsx(IconButton, { "aria-label": editDef?.ariaLabel ?? editDef?.label ?? "Edit", size: "touch", variant: neutralVariant, icon: _jsx(Icon, { name: "edit" }), onClick: () => {
                             /*
                              * `window.location`, not `next/link`. This component is rendered
                              * inside cards whose whole body is already an anchor, and nesting
@@ -183,7 +211,7 @@ export function OwnerQuickActions({ resource, editHref, onDelete, onClone, owner
                             if (typeof window !== "undefined")
                                 window.location.assign(editHref);
                         } }), showClone && (_jsx(IconButton, { "aria-label": (leaves.duplicate ? bucket[leaves.duplicate]?.ariaLabel ?? bucket[leaves.duplicate]?.label : undefined) ||
-                            "Duplicate", size: "touch", variant: placement === "card" ? "scrim" : "ghost", icon: _jsx(Icon, { name: "duplicate" }), onClick: () => void onClone?.() })), showDelete && (_jsx(IconButton, { "aria-label": deleteDef?.ariaLabel ?? deleteDef?.label ?? "Delete", size: "touch", variant: placement === "card" ? "scrim" : "danger", icon: _jsx(Icon, { name: "delete" }), onClick: () => setConfirmOpen(true) }))] }), showDelete && (_jsx(ConfirmDeleteModal, { isOpen: confirmOpen, onClose: () => setConfirmOpen(false), onConfirm: handleConfirmedDelete, isDeleting: deleting, title: confirmation?.title ?? "Delete this record?", message: recordLabel && confirmation
+                            "Duplicate", size: "touch", variant: neutralVariant, icon: _jsx(Icon, { name: "duplicate" }), onClick: () => void onClone?.() })), showDelete && (_jsx(IconButton, { "aria-label": deleteDef?.ariaLabel ?? deleteDef?.label ?? "Delete", size: "touch", variant: dangerVariant, icon: _jsx(Icon, { name: "delete" }), onClick: () => setConfirmOpen(true) }))] }), showDelete && (_jsx(ConfirmDeleteModal, { isOpen: confirmOpen, onClose: () => setConfirmOpen(false), onConfirm: handleConfirmedDelete, isDeleting: deleting, title: confirmation?.title ?? "Delete this record?", message: recordLabel && confirmation
                     ? `${confirmation.body}\n\nDeleting: ${recordLabel}`
                     : confirmation?.body, confirmText: confirmation?.confirmLabel ?? deleteDef?.label ?? "Delete", variant: "danger" }))] }));
 }

package/dist/features/admin/components/RecordOwnerQuickActions.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The admin-owned resources this wrapper can delete.
+ *
+ * 🛑 Deliberately NOT every `OwnerQuickActionsResource`. `STORE`, `USER` and
+ * `SECTION` omit a `remove` leaf in `RESOURCE_LEAVES` because their blast
+ * radius is far wider than the page a bin would sit on, and `REVIEW` has no
+ * admin edit route to send the pencil to. Adding one here without adding its
+ * leaf there still renders no bin — the resource owns that decision, which is
+ * the point of gating it in two places.
+ */
+export type RecordQuickActionResource = "CATEGORY" | "BRAND" | "BUNDLE" | "GROUP" | "EVENT" | "BLOG" | "FRANCHISE" | "SUBLISTING" | "PART" | "BEY";
+export interface RecordOwnerQuickActionsProps {
+    resource: RecordQuickActionResource;
+    /** The record's document id — what the endpoint and the editor are keyed on. */
+    recordId: string;
+    /** Names the record in the delete confirmation. */
+    recordLabel?: string;
+    /**
+     * Forwarded to `OwnerQuickActions` so a store-owned record (a grouped
+     * listing, a store-authored bundle) stays visible to the seller who owns it
+     * and not only to an admin. `SessionUser.storeId` holds the store SLUG, not
+     * the Auth UID — two different id spaces, hence two props.
+     */
+    ownerId?: string;
+    storeId?: string;
+    placement?: "card" | "detail";
+    /** Pass the hero's own `hasCover` flag. See `OwnerQuickActions.onMedia`. */
+    onMedia?: boolean;
+    className?: string;
+}
+export declare function RecordOwnerQuickActions({ resource, recordId, recordLabel, ownerId, storeId, placement, onMedia, className, }: RecordOwnerQuickActionsProps): import("react").JSX.Element;

package/dist/features/admin/components/RecordOwnerQuickActions.js

@@ -0,0 +1,128 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * The client half of `OwnerQuickActions` for every admin-owned collection.
+ *
+ * ## 🛑 Why a wrapper is REQUIRED, not a convenience
+ *
+ * `OwnerQuickActions` takes `onDelete` / `onClone` as FUNCTIONS, and every
+ * detail view that renders it (`CategoryDetailPageView`, `BrandDetailPageView`,
+ * `BundleDetailView`, …) is a Server Component. A closure cannot cross that
+ * boundary — React throws
+ *
+ *     Event handlers cannot be passed to Client Component props.
+ *
+ * at render. `ProductOwnerQuickActions` records that this exact mistake took
+ * down every `/products/[slug]` page in production, with an opaque digest per
+ * handler.
+ *
+ * That is why ten detail views were passing `editHref` and nothing else: the
+ * bin and the clone are rendered behind `{showDelete && …}` / `{showClone && …}`,
+ * so with no handler they silently do not exist. It read as "admins get no
+ * delete button", and the cause was a serialization boundary, not a permission.
+ *
+ * ## 🛑 Why ONE wrapper and not one per resource
+ *
+ * `ProductOwnerQuickActions` is resource-specific because products are the one
+ * collection a SELLER can also own, so its endpoints live under
+ * `SELLER_ENDPOINTS` and its clone has a bespoke redirect to the copy's editor.
+ * Everything here is admin-owned and differs only by three strings, so eight
+ * near-identical files would trip the Duplication Framework's Rule of Three
+ * immediately. One table, one component.
+ *
+ * ## Why the redirect lands on the ADMIN list
+ *
+ * You deleted the record from its own public page, so that page is now a 404 —
+ * staying is not an option and the public index tells you nothing about whether
+ * the delete worked. The admin list is where the absence is verifiable.
+ * `ProductOwnerQuickActions` differs deliberately: a seller may delete a
+ * product and has no admin list to land on.
+ *
+ * @tag domain:admin
+ * @tag layer:components
+ * @tag access:client
+ */
+import { useCallback } from "react";
+import { OwnerQuickActions } from "./OwnerQuickActions.js";
+import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
+const WIRING = {
+    CATEGORY: {
+        endpoint: ADMIN_ENDPOINTS.CATEGORY_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.CATEGORIES_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.CATEGORIES),
+    },
+    PART: {
+        endpoint: ADMIN_ENDPOINTS.PART_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.PARTS_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.PARTS),
+    },
+    BEY: {
+        endpoint: ADMIN_ENDPOINTS.BEY_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.BEYS_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.BEYS),
+    },
+    BRAND: {
+        endpoint: ADMIN_ENDPOINTS.BRAND_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.BRANDS_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.BRANDS),
+    },
+    BUNDLE: {
+        endpoint: ADMIN_ENDPOINTS.BUNDLE_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.BUNDLES_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.BUNDLES),
+    },
+    GROUP: {
+        endpoint: ADMIN_ENDPOINTS.GROUPED_LISTING_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.GROUPED_LISTINGS_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.GROUPED_LISTINGS),
+    },
+    EVENT: {
+        endpoint: ADMIN_ENDPOINTS.EVENT_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.EVENTS_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.EVENTS),
+    },
+    BLOG: {
+        endpoint: ADMIN_ENDPOINTS.BLOG_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.BLOG_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.BLOG),
+    },
+    /*
+     * A franchise row IS a category (`categoryType: "franchise"`), so it shares
+     * the category endpoint and editor — the same reasoning `RESOURCE_LEAVES`
+     * uses to give it the category copy. Only the landing page differs.
+     */
+    FRANCHISE: {
+        endpoint: ADMIN_ENDPOINTS.CATEGORY_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.CATEGORIES_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.CATEGORIES),
+    },
+    SUBLISTING: {
+        endpoint: ADMIN_ENDPOINTS.SUBLISTING_CATEGORY_BY_ID,
+        editHref: (id) => String(ROUTES.ADMIN.SUBLISTING_CATEGORIES_EDIT(id)),
+        afterDelete: String(ROUTES.ADMIN.SUBLISTING_CATEGORIES),
+    },
+};
+export function RecordOwnerQuickActions({ resource, recordId, recordLabel, ownerId, storeId, placement = "detail", onMedia, className, }) {
+    const wiring = WIRING[resource];
+    /*
+     * 🛑 THROWS on a failed DELETE rather than returning quietly.
+     *
+     * `OwnerQuickActions.handleConfirmedDelete` catches and toasts, and success
+     * navigates away — so a swallowed failure is indistinguishable from "it
+     * worked but the page did not move", and the obvious user response is to
+     * press the button again. Returning early on `!res.ok` is the bug
+     * `ProductOwnerQuickActions` documents having had.
+     */
+    const handleDelete = useCallback(async () => {
+        const res = await fetch(wiring.endpoint(recordId), { method: "DELETE" });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => null));
+            throw Object.assign(new Error("Delete failed"), { code: body?.code });
+        }
+        if (typeof window !== "undefined") {
+            window.location.assign(wiring.afterDelete);
+        }
+    }, [wiring, recordId]);
+    return (_jsx(OwnerQuickActions, { resource: resource, placement: placement, onMedia: onMedia, className: className, recordLabel: recordLabel, ownerId: ownerId, storeId: storeId, editHref: wiring.editHref(recordId), onDelete: handleDelete }));
+}

package/dist/features/admin/components/ReferenceRecordEditor.d.ts

@@ -0,0 +1,45 @@
+/**
+ * ReferenceRecordEditor — correct one row of a GENERATED reference database.
+ *
+ * ── 🛑 ONE COMPONENT, TWO FIELD LISTS ────────────────────────────────────
+ *
+ * Parts and beys differ only in WHICH fields a human may own. Loading the row,
+ * PATCHing it, surfacing a server error on the right field, and telling the
+ * operator what a correction means for the next reseed are identical — so they
+ * are written once. The Duplication Framework's "same prop surface, same
+ * return shape" test points here, and the alternative was two files whose
+ * error handling would drift.
+ *
+ * ── 🛑 WHAT THIS DELIBERATELY IS NOT ─────────────────────────────────────
+ *
+ * It is not a create form. Both collections are generated, so a row authored
+ * by hand has no source and vanishes on the next regeneration. There is no
+ * code path here that POSTs.
+ *
+ * It also shows no DERIVED field as editable. A bey's summed mass, its ratings
+ * and its coverage records are computed from the composition and each carries a
+ * coverage claim; a hand-typed derived value is a number whose stated
+ * provenance is no longer true.
+ *
+ * @tag domain:admin
+ * @tag layer:feature
+ * @tag access:client
+ */
+import React from "react";
+/** One editable field. `kind` picks the input, nothing more. */
+export interface ReferenceEditorField {
+    name: string;
+    label: string;
+    kind?: "text" | "number";
+    hint?: string;
+}
+export interface ReferenceRecordEditorProps {
+    /** `ADMIN_ENDPOINTS.PART_BY_ID(id)` / `BEY_BY_ID(id)` — already applied. */
+    endpoint: string;
+    /** What the record is called, for copy. "part" / "Beyblade". */
+    noun: string;
+    fields: readonly ReferenceEditorField[];
+    /** Where the reference page for this record lives, so the operator can check their work. */
+    publicHref?: string;
+}
+export declare function ReferenceRecordEditor({ endpoint, noun, fields, publicHref, }: ReferenceRecordEditorProps): React.JSX.Element;

package/dist/features/admin/components/ReferenceRecordEditor.js

@@ -0,0 +1,153 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * ReferenceRecordEditor — correct one row of a GENERATED reference database.
+ *
+ * ── 🛑 ONE COMPONENT, TWO FIELD LISTS ────────────────────────────────────
+ *
+ * Parts and beys differ only in WHICH fields a human may own. Loading the row,
+ * PATCHing it, surfacing a server error on the right field, and telling the
+ * operator what a correction means for the next reseed are identical — so they
+ * are written once. The Duplication Framework's "same prop surface, same
+ * return shape" test points here, and the alternative was two files whose
+ * error handling would drift.
+ *
+ * ── 🛑 WHAT THIS DELIBERATELY IS NOT ─────────────────────────────────────
+ *
+ * It is not a create form. Both collections are generated, so a row authored
+ * by hand has no source and vanishes on the next regeneration. There is no
+ * code path here that POSTs.
+ *
+ * It also shows no DERIVED field as editable. A bey's summed mass, its ratings
+ * and its coverage records are computed from the composition and each carries a
+ * coverage claim; a hand-typed derived value is a number whose stated
+ * provenance is no longer true.
+ *
+ * @tag domain:admin
+ * @tag layer:feature
+ * @tag access:client
+ */
+import React from "react";
+import { Alert, Button, Form, FieldInput, Stack, Text, TextLink } from "../../../ui/index.js";
+import { apiClient } from "../../../http/index.js";
+import { useToast } from "../../../ui/components/toast-context.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+export function ReferenceRecordEditor({ endpoint, noun, fields, publicHref, }) {
+    const { showToast } = useToast();
+    const [values, setValues] = React.useState({});
+    const [owned, setOwned] = React.useState([]);
+    const [loading, setLoading] = React.useState(true);
+    const [saving, setSaving] = React.useState(false);
+    const [loadError, setLoadError] = React.useState(null);
+    React.useEffect(() => {
+        let cancelled = false;
+        (async () => {
+            try {
+                const row = await apiClient.get(endpoint);
+                if (cancelled)
+                    return;
+                const next = {};
+                for (const f of fields) {
+                    const v = row?.[f.name];
+                    /*
+                     * 🛑 An ABSENT field becomes an empty string, not "undefined". Both
+                     * render, and only one of them is honest — and on save an empty
+                     * string is dropped rather than written, so an untouched empty field
+                     * cannot blank a value the generator owns.
+                     */
+                    next[f.name] = v === null || v === undefined ? "" : String(v);
+                }
+                setValues(next);
+                setOwned(Array.isArray(row?.adminEditedFields) ? row.adminEditedFields : []);
+            }
+            catch (err) {
+                const e = normalizeError(err);
+                if (!cancelled)
+                    setLoadError(e.message);
+            }
+            finally {
+                if (!cancelled)
+                    setLoading(false);
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, [endpoint, fields]);
+    /**
+     * Build the PATCH body.
+     *
+     * 🛑 Only NON-EMPTY values are sent, and numbers are coerced.
+     *
+     * An empty input means "I did not set this", not "write an empty string".
+     * Sending it would both blank a real value AND mark the field as
+     * admin-owned, freezing the blank in place against every future reseed —
+     * a one-click way to permanently delete data from a generated row.
+     */
+    const buildPatch = React.useCallback(() => {
+        const patch = {};
+        for (const f of fields) {
+            const raw = (values[f.name] ?? "").trim();
+            if (!raw)
+                continue;
+            patch[f.name] = f.kind === "number" ? Number(raw) : raw;
+        }
+        return patch;
+    }, [fields, values]);
+    /**
+     * Put a failure where the operator can act on it.
+     *
+     * 🛑 Zod issues go to their OWN FIELD; everything else becomes one toast
+     * built by `toUserMessage`. Never the server's own message: a raw fallback
+     * is what rendered a Node MODULE_NOT_FOUND with a full require stack inside
+     * a bid modal (Root Cause #86), and `mapToHttpError` scrubs 5xx text in
+     * production anyway.
+     */
+    const reportFailure = React.useCallback((err, 
+    /** Already normalized by the caller — see the note at the catch site. */
+    fallbackMessage, setFieldError) => {
+        const issues = err?.issues;
+        if (issues?.length) {
+            for (const issue of issues)
+                setFieldError(String(issue.path?.[0] ?? ""), issue.message);
+            return;
+        }
+        const code = err?.code;
+        const message = code ? toUserMessage(code, undefined) : fallbackMessage;
+        showToast(message, "error");
+    }, [showToast]);
+    const save = React.useCallback(async (setFieldError, clearErrors) => {
+        clearErrors();
+        setSaving(true);
+        try {
+            await apiClient.patch(endpoint, buildPatch());
+            showToast(`${noun[0].toUpperCase()}${noun.slice(1)} updated.`, "success");
+        }
+        catch (err) {
+            const e = normalizeError(err);
+            reportFailure(err, e.message, setFieldError);
+        }
+        finally {
+            setSaving(false);
+        }
+    }, [endpoint, buildPatch, noun, showToast, reportFailure]);
+    if (loading)
+        return _jsx(Text, { color: "muted", children: "Loading\u2026" });
+    if (loadError) {
+        return (_jsx(Alert, { variant: "error", title: `Could not load this ${noun}`, children: _jsx(Text, { size: "sm", children: loadError }) }));
+    }
+    /*
+     * 🛑 No `className` on `<Form>` — the `<Stack gap="md">` inside already owns
+     * the spacing, so `space-y-4` was a second, competing source of it
+     * (audit-variant-prop-coverage: a layout token belongs in a variant prop).
+     *
+     * 🛑 And this is a PLAIN comment, above the `return`, not a `{/* … *␣/}` JSX
+     * one below it. I wrote it as JSX first and it broke the parse: a JSX comment
+     * between `return (` and the root element is a second expression, so the
+     * return has two children and no wrapper. `tsc` caught it — the first
+     * typecheck this session was allowed to run — which is exactly the class of
+     * error the 4 GB no-build cap was hiding.
+     */
+    return (_jsx(Form, { children: ({ setFieldError, clearErrors }) => (_jsxs(Stack, { gap: "md", className: "min-w-0", children: [_jsxs(Alert, { variant: "info", title: "This record is generated", children: [_jsxs(Text, { size: "sm", children: [`This ${noun} is built from a crawled source by a committed generator. A field you `, "change here is marked as yours and will not be overwritten the next time the database is regenerated \u2014 every field you leave alone keeps getting the generator's improvements."] }), owned.length > 0 && (_jsx(Text, { size: "sm", color: "muted", children: `Already corrected by hand: ${owned.join(", ")}` }))] }), fields.map((f) => (_jsx(FieldInput, { name: f.name, label: f.label, type: f.kind === "number" ? "number" : "text", hint: f.hint, value: values[f.name] ?? "", onChange: (v) => setValues((p) => ({ ...p, [f.name]: v })) }, f.name))), _jsx(Button, { type: "button", isLoading: saving, onClick: () => save(setFieldError, clearErrors), children: "Save correction" }), publicHref && (_jsx(Text, { size: "sm", color: "muted", children: _jsx(TextLink, { href: publicHref, children: "View the public reference page" }) }))] })) }));
+}

package/dist/features/admin/schemas/firestore.d.ts

@@ -73,7 +73,7 @@ export type NotificationUpdateInput = Partial<Pick<NotificationDocument, "isRead
 export declare const notificationQueryHelpers: {
     readonly byUser: (userId: string) => readonly ["userId", "==", string];
     readonly unread: (userId: string) => readonly [readonly ["userId", "==", string], readonly ["isRead", "==", false]];
-    readonly byType: (type: NotificationType) => readonly ["type", "==", "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "system" | "account_action" | "support_ticket_update" | "scam_report_update" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale" | "message_received"];
+    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "support_ticket_update" | "scam_report_update" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale" | "message_received"];
 };
 export interface TrustBarItem {
     icon: string;

package/dist/features/auctions/components/MarketplaceAuctionCard.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { ProductOwnerQuickActions } from "../../products/components/ProductOwnerQuickActions.js";
 import { normalizeError } from "../../../errors/normalize.js";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useRouter } from "next/navigation.js";
@@ -181,11 +182,23 @@ export function MarketplaceAuctionCard({ product, buyoutPrice, className = "", v
         countdownClass, mergedLabels, handleWishlist, handleNavigate,
     };
     const card = (_jsxs(BaseListingCard, { isSelected: isSelected, isDisabled: isEnded, variant: baseVariant, className: className, onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [renderAuctionCardHero({ product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect }), _jsx(BaseListingCard.Info, { variant: baseVariant, children: baseVariant === "list" ? renderAuctionCardInfoList(cardInfoProps) : renderAuctionCardInfoGrid(cardInfoProps) })] }));
-    if (!renderOwnerActions)
+    /*
+     * 🛑 Default, not opt-in. Nothing in either repo ever passed
+     * `renderOwnerActions`, so this toolbar was unreachable on every grid that
+     * mounts this card (Root Cause #8 — a slot shell rendered with zero render
+     * props). A card is resource-specific by construction, so it names its own
+     * resource rather than being threaded one; the prop stays as an override.
+     */
+    const ownerActions = renderOwnerActions
+        ? renderOwnerActions()
+        : product.id
+            ? (_jsx(ProductOwnerQuickActions, { productId: String(product.id), storeId: product.storeId ? String(product.storeId) : undefined, recordLabel: product.title, placement: "card" }))
+            : null;
+    if (!ownerActions)
         return card;
     /*
      * Sibling of the card, never a child — see the prop's docstring. `z-20`
      * clears this card's own overlays, which all sit at `z-10`.
      */
-    return (_jsxs(Div, { className: "relative h-full", children: [card, _jsx(Div, { className: "absolute right-2 bottom-2 z-20", children: renderOwnerActions() })] }));
+    return (_jsxs(Div, { className: "relative h-full", children: [card, _jsx(Div, { className: "absolute right-2 bottom-2 z-20", children: ownerActions })] }));
 }

package/dist/features/auth/permissions/constants.d.ts

@@ -11,7 +11,7 @@
  * Permission naming: admin:resource:action
  * Ban action naming: plain verb phrase — write_reviews, place_bids, etc.
  */
-export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:offers:read" | "admin:offers:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read"
+export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:parts:read" | "admin:parts:write" | "admin:parts:delete" | "admin:beys:read" | "admin:beys:write" | "admin:beys:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:offers:read" | "admin:offers:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read"
 /** Destructive/mutating contact-submission actions. Added 2026-08-29 —
  * `DELETE /api/admin/contact-submissions/[id]` declared `admin:contact:delete`,
  * which is not a member of this union and therefore could never be granted. */

package/dist/features/auth/permissions/constants.js

@@ -131,6 +131,12 @@ export const PERMISSION_GROUPS = {
         "admin:categories:read",
         "admin:categories:write",
         "admin:categories:delete",
+        "admin:parts:read",
+        "admin:parts:write",
+        "admin:parts:delete",
+        "admin:beys:read",
+        "admin:beys:write",
+        "admin:beys:delete",
         "admin:brands:read",
         "admin:brands:write",
         "admin:brands:delete",
@@ -281,6 +287,8 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/catalogue-approvals": "admin:catalogue:read",
     "/admin/grouped-listings": "admin:grouped-listings:read",
     "/admin/categories": "admin:categories:read",
+    "/admin/parts": "admin:parts:read",
+    "/admin/beys": "admin:beys:read",
     "/admin/brands": "admin:brands:read",
     "/admin/coupons": "admin:coupons:read",
     "/admin/deals": "admin:deals:read",
@@ -437,7 +445,10 @@ export const PERMISSION_DOMAINS = [
     { label: "Orders & Returns", prefix: "admin:orders:|admin:returns:|admin:offers:" },
     { label: "Stores", prefix: "admin:stores:|admin:store-addresses:" },
     { label: "Finance", prefix: "admin:analytics:|admin:payouts:" },
-    { label: "Catalog", prefix: "admin:categories:|admin:brands:|admin:coupons:|admin:deals:|admin:featured:" },
+    {
+        label: "Catalog",
+        prefix: "admin:categories:|admin:parts:|admin:beys:|admin:brands:|admin:coupons:|admin:deals:|admin:featured:",
+    },
     {
         label: "Content",
         prefix: "admin:reviews:|admin:blog:|admin:bids:|admin:media:",

package/dist/features/beys/components/BeyDetailPageView.d.ts

@@ -0,0 +1,50 @@
+/**
+ * One bey's public page — what it is, what it is built from, who used it.
+ *
+ * ── 🛑 NO MONEY ON THIS PAGE, DELIBERATELY ─────────────────────────────────
+ *
+ * Prices are hidden from signed-out visitors, so any amount here would need
+ * `<GatedPrice>` and make this a client component. Listing rows carry a title,
+ * a condition and a link; the price lives one click away on the listing, where
+ * the gate already is. Same rule as `PartDetailPageView` and `/search`: a row
+ * with nothing to gate has nothing to leak, and no `offers.price` is emitted
+ * so no paywall declaration is needed either.
+ *
+ * 🛑 `price` IS on the document and is deliberately not rendered. It is the
+ * source's original retail price (`1404¥`), not our listing price — showing it
+ * beside real listings would read as an offer.
+ *
+ * ── 🛑 THE SOURCE LINK IS NOT OPTIONAL ────────────────────────────────────
+ *
+ * The facts here are extracted from a CC-BY-SA corpus. Taking facts only and
+ * linking back is what keeps us clear of share-alike, and `sourceUrl` was
+ * stored on ~5,500 rows while being rendered on NONE of them. Storing it is
+ * not discharging the obligation.
+ */
+import React from "react";
+import type { BeyDocument, BeyProductDocument } from "../schemas/firestore";
+/** One live listing row. Deliberately money-free — see the header. */
+export interface BeyListingRow {
+    id: string;
+    title: string;
+    slug?: string;
+    condition?: string;
+    href: string;
+}
+export interface BeyDetailPageViewProps {
+    bey: BeyDocument;
+    /** Products whose assortment contains this bey. */
+    products: readonly BeyProductDocument[];
+    /** Live listings, from the shared public product query. */
+    listings: readonly BeyListingRow[];
+    /** `total` is a FLOOR when the bounded fetch saturated. */
+    listingsTruncated?: boolean;
+    allListingsHref: string;
+    /** A part's own page, when the composition entry resolved to a glossary id. */
+    hrefForPart: (partId: string) => string | null;
+    /** This bey's category leaf, when one exists (116 beys have no leaf). */
+    categoryHref?: string | null;
+    /** A character's page, for a resolved owner. */
+    hrefForCharacter?: (slug: string) => string;
+}
+export declare function BeyDetailPageView({ bey, products, listings, listingsTruncated, allListingsHref, hrefForPart, categoryHref, hrefForCharacter, }: BeyDetailPageViewProps): React.JSX.Element;