@mohasinac/appkit 4.60.1 → 4.62.0

package/dist/_internal/server/features/raffle/actions.js

@@ -6,7 +6,18 @@
  * handlers also work in a Vercel lambda (10s cap honoured by raffle pool
  * size).
  */
-import { wrapAction } from "@mohasinac/appkit/server";
+/*
+ * 🛑 From the DEFINING module, never "@mohasinac/appkit/server".
+ *
+ * appkit importing its own public server barrel is a self-reference that drags
+ * the whole server surface in behind it — `dist/server.js` reaches next/og,
+ * next/navigation, next/headers and driver.js. Twenty `actions.ts` files did
+ * this for two symbols, and because `obligationSweep` reaches one of them, the
+ * Firebase Functions tsup bundle (noExternal: appkit) had to resolve Next:
+ * it failed on two `react-server-dom-webpack/*` requires and two @vercel/og
+ * .wasm files, naming none of the responsible files. Root Cause #18.
+ */
+import { wrapAction } from "../../../shared/types/action-result.js";
 import { getAdminDb } from "../../../../providers/db-firebase/admin.js";
 import { runTriggerEventRaffle, } from "../../jobs/core/triggerEventRaffle.js";
 import { runAssignSpinPrize, } from "../../jobs/core/assignSpinPrize.js";

package/dist/_internal/server/features/refunds/actions.d.ts

@@ -1,9 +1,7 @@
-import { type ActionResult } from "@mohasinac/appkit/server";
-import type { RefundType } from "../../../../features/orders/schemas";
+import { type ActionResult } from "../../../shared/types/action-result";
 import { type ReturnReason } from "../../../shared/features/orders/return-reasons";
 export type ProcessRefundInput = {
     orderId: string;
-    type: RefundType;
     /** Decimal rupees. Must be > 0 and ≤ remaining refundable amount on the order. */
     amount: number;
     /**

package/dist/_internal/server/features/refunds/actions.js

@@ -1,5 +1,16 @@
 "use server";
-import { wrapAction } from "@mohasinac/appkit/server";
+/*
+ * 🛑 From the DEFINING module, never "@mohasinac/appkit/server".
+ *
+ * appkit importing its own public server barrel is a self-reference that drags
+ * the whole server surface in behind it — `dist/server.js` reaches next/og,
+ * next/navigation, next/headers and driver.js. Twenty `actions.ts` files did
+ * this for two symbols, and because `obligationSweep` reaches one of them, the
+ * Firebase Functions tsup bundle (noExternal: appkit) had to resolve Next:
+ * it failed on two `react-server-dom-webpack/*` requires and two @vercel/og
+ * .wasm files, naming none of the responsible files. Root Cause #18.
+ */
+import { wrapAction } from "../../../shared/types/action-result.js";
 /**
  * processRefundAction — append a refund event to an order.
  *
@@ -235,7 +246,8 @@ export async function processRefundAction(input) {
         const isFull = wouldBeFullRefund(order, input.amount, siteSettings?.commissions?.gstPercent);
         const event = {
             refundId,
-            type: input.type,
+            // Derived from the authoritative `isFull` above, never from a caller.
+            type: isFull ? "full" : "partial",
             amount: input.amount,
             ...(input.itemIds?.length ? { itemIds: input.itemIds } : {}),
             reasonCode: input.reasonCode,

package/dist/_internal/server/features/reviews/actions.d.ts

@@ -1,4 +1,4 @@
-import { type ActionResult } from "@mohasinac/appkit/server";
+import { type ActionResult } from "../../../shared/types/action-result";
 export declare function createReviewAction(input: unknown): Promise<ActionResult<unknown>>;
 export declare function replyToReviewAction(input: unknown): Promise<ActionResult<unknown>>;
 export declare function deleteReviewAction(input: unknown): Promise<ActionResult<unknown>>;

package/dist/_internal/server/features/reviews/actions.js

@@ -1,5 +1,16 @@
 "use server";
-import { wrapAction } from "@mohasinac/appkit/server";
+/*
+ * 🛑 From the DEFINING module, never "@mohasinac/appkit/server".
+ *
+ * appkit importing its own public server barrel is a self-reference that drags
+ * the whole server surface in behind it — `dist/server.js` reaches next/og,
+ * next/navigation, next/headers and driver.js. Twenty `actions.ts` files did
+ * this for two symbols, and because `obligationSweep` reaches one of them, the
+ * Firebase Functions tsup bundle (noExternal: appkit) had to resolve Next:
+ * it failed on two `react-server-dom-webpack/*` requires and two @vercel/og
+ * .wasm files, naming none of the responsible files. Root Cause #18.
+ */
+import { wrapAction } from "../../../shared/types/action-result.js";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
 import { isAdminUser } from "../../../../features/auth/role-predicates.js";
 import { reviewRepository, productRepository, userRepository, } from "../../../../repositories/index.js";

package/dist/_internal/server/features/wishlist/actions.d.ts

@@ -1,4 +1,4 @@
-import { type ActionResult } from "@mohasinac/appkit/server";
+import { type ActionResult } from "../../../shared/types/action-result";
 import { type WishlistItem } from "../../../../repositories";
 export declare function addToWishlistAction(productId: string, extras?: {
     productType?: WishlistItem["productType"];

package/dist/_internal/server/features/wishlist/actions.js

@@ -1,6 +1,17 @@
 "use server";
 import { normalizeError } from "../../../../errors/normalize.js";
-import { wrapAction } from "@mohasinac/appkit/server";
+/*
+ * 🛑 From the DEFINING module, never "@mohasinac/appkit/server".
+ *
+ * appkit importing its own public server barrel is a self-reference that drags
+ * the whole server surface in behind it — `dist/server.js` reaches next/og,
+ * next/navigation, next/headers and driver.js. Twenty `actions.ts` files did
+ * this for two symbols, and because `obligationSweep` reaches one of them, the
+ * Firebase Functions tsup bundle (noExternal: appkit) had to resolve Next:
+ * it failed on two `react-server-dom-webpack/*` requires and two @vercel/og
+ * .wasm files, naming none of the responsible files. Root Cause #18.
+ */
+import { wrapAction } from "../../../shared/types/action-result.js";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
 import { wishlistRepository, WishlistFullError, } from "../../../../repositories/index.js";
 import { WISHLIST_MAX } from "../../../shared/features/wishlist/config.js";

package/dist/_internal/server/jobs/core/obligationSweep.js

@@ -279,7 +279,6 @@ async function performAction(ctx, obligation, order) {
             }
             const result = await processRefundAction({
                 orderId: order.id,
-                type: "full",
                 amount: capacity.remaining,
                 reasonCode: order.returnReasonCode ?? "not_as_described",
                 reasonNote: `Auto-resolved in the buyer's favour — ${policy.describe}`,

package/dist/_internal/server/jobs/core/paymentReconcile.js

@@ -36,7 +36,8 @@ import { gatewayEventsRepository } from "../../../../features/gateway-events/rep
 import { GATEWAY_EVENT_MAX_ATTEMPTS, } from "../../../../features/gateway-events/schemas/firestore.js";
 import { paymentCasesRepository } from "../../../../features/payment-cases/repository/payment-cases.repository.js";
 import { orderRepository } from "../../../../features/orders/repository/orders.repository.js";
-import { REFUND_CLAIMS_COLLECTION } from "../../../../features/orders/schemas/firestore.js";
+import { REFUND_CLAIMS_COLLECTION, REFUND_CLAIM_FIELDS, ORDER_COLLECTION, } from "../../../../features/orders/schemas/firestore.js";
+import { ORDER_FIELDS } from "../../../../constants/field-names.js";
 import { reconcileDisputes } from "../../features/payment-cases/disputes.js";
 import { refundableBase, committedRefundTotal, MONEY_EPSILON, } from "../../../shared/checkout/refundable-base.js";
 /** How far back R2 looks. Two days of overlap, so a run that fails is covered by the next. */
@@ -223,76 +224,9 @@ async function reconcileGatewayPayments(ctx) {
                 continue;
             }
             for (const order of orders) {
-                /*
-                 * Amount check. Compared against the order's own recorded total rather
-                 * than recomputed from its lines — recomputing would re-derive the
-                 * pricing pipeline here and disagree with it the day a rate changes,
-                 * which is a sixth copy of the money rule (Root Cause #75).
-                 */
-                const recorded = order.totalPrice ?? 0;
-                if (Math.abs(recorded - record.amount) > MONEY_EPSILON) {
-                    amountMismatch += 1;
-                    await paymentCasesRepository().openOrObserve({
-                        kind: "amount_mismatch",
-                        subjectId: `${record.id}:${order.id}`,
-                        severity: "error",
-                        title: `Captured ${record.amount} but recorded ${recorded} — ${order.id}`,
-                        detail: [
-                            `The gateway captured a different amount from the one the order records.`,
-                            `Either the buyer was over-charged or the order under-states what was paid.`,
-                            "",
-                            `Gateway: ${record.gateway}`,
-                            `Payment: ${record.id}`,
-                            `Order: ${order.id}`,
-                            `Captured: ${record.amount} ${record.currency}`,
-                            `Order total: ${recorded}`,
-                            `Difference: ${(record.amount - recorded).toFixed(2)}`,
-                        ].join("\n"),
-                        entityType: "order",
-                        entityId: order.id,
-                        amountAtRisk: Math.abs(record.amount - recorded),
-                        orderIds: [order.id],
-                        gatewayPaymentId: record.id,
-                        now: ctx.now,
-                    });
-                }
-                /*
-                 * Refund check — the gateway's `amount_refunded` against our own
-                 * non-failed refund events. `committedRefundTotal` is the same helper
-                 * the refund cap uses, so "what we think we refunded" has ONE
-                 * definition rather than a second one written here.
-                 */
-                const ours = committedRefundTotal(order);
-                if (Math.abs(ours - record.amountRefunded) > MONEY_EPSILON) {
-                    refundMismatch += 1;
-                    await paymentCasesRepository().openOrObserve({
-                        kind: "refund_mismatch",
-                        subjectId: `${record.id}:refunds`,
-                        severity: record.amountRefunded > ours ? "error" : "warning",
-                        title: `Refund total disagrees with the gateway — ${order.id}`,
-                        detail: [
-                            record.amountRefunded > ours
-                                ? `🛑 The gateway has refunded MORE than our records show. Money has left that we did not record.`
-                                : `Our records show more refunded than the gateway did — a refund may have been reserved and never completed.`,
-                            "",
-                            `Gateway: ${record.gateway}`,
-                            `Payment: ${record.id}`,
-                            `Order: ${order.id}`,
-                            `Gateway refunded: ${record.amountRefunded}`,
-                            `Our committed refunds: ${ours}`,
-                            `Refundable base: ${refundableBase(order)}`,
-                            record.refundStatus ? `Gateway refund status: ${record.refundStatus}` : null,
-                        ]
-                            .filter((l) => l !== null)
-                            .join("\n"),
-                        entityType: "order",
-                        entityId: order.id,
-                        amountAtRisk: Math.abs(record.amountRefunded - ours),
-                        orderIds: [order.id],
-                        gatewayPaymentId: record.id,
-                        now: ctx.now,
-                    });
-                }
+                const outcome = await reconcilePaymentAgainstOrder(record, order, ctx);
+                amountMismatch += outcome.amountMismatch;
+                refundMismatch += outcome.refundMismatch;
             }
         }
         catch (err) {
@@ -304,6 +238,89 @@ async function reconcileGatewayPayments(ctx) {
     }
     return { examined, missing, amountMismatch, refundMismatch, reads };
 }
+/**
+ * The two per-order checks R2 runs against one gateway record.
+ *
+ * Extracted so each `openOrObserve` call is a statement in a function body
+ * rather than five braces deep inside `for record -> try -> for order -> if`.
+ * Returns the counts rather than mutating the caller's accumulators, so the
+ * loop above reads as a sum rather than as two side effects.
+ */
+async function reconcilePaymentAgainstOrder(record, order, ctx) {
+    let amountMismatch = 0;
+    let refundMismatch = 0;
+    /*
+     * Amount check. Compared against the order's own recorded total rather
+     * than recomputed from its lines — recomputing would re-derive the
+     * pricing pipeline here and disagree with it the day a rate changes,
+     * which is a sixth copy of the money rule (Root Cause #75).
+     */
+    const recorded = order.totalPrice ?? 0;
+    if (Math.abs(recorded - record.amount) > MONEY_EPSILON) {
+        amountMismatch += 1;
+        await paymentCasesRepository().openOrObserve({
+            kind: "amount_mismatch",
+            subjectId: `${record.id}:${order.id}`,
+            severity: "error",
+            title: `Captured ${record.amount} but recorded ${recorded} — ${order.id}`,
+            detail: [
+                `The gateway captured a different amount from the one the order records.`,
+                `Either the buyer was over-charged or the order under-states what was paid.`,
+                "",
+                `Gateway: ${record.gateway}`,
+                `Payment: ${record.id}`,
+                `Order: ${order.id}`,
+                `Captured: ${record.amount} ${record.currency}`,
+                `Order total: ${recorded}`,
+                `Difference: ${(record.amount - recorded).toFixed(2)}`,
+            ].join("\n"),
+            entityType: "order",
+            entityId: order.id,
+            amountAtRisk: Math.abs(record.amount - recorded),
+            orderIds: [order.id],
+            gatewayPaymentId: record.id,
+            now: ctx.now,
+        });
+    }
+    /*
+     * Refund check — the gateway's `amount_refunded` against our own
+     * non-failed refund events. `committedRefundTotal` is the same helper
+     * the refund cap uses, so "what we think we refunded" has ONE
+     * definition rather than a second one written here.
+     */
+    const ours = committedRefundTotal(order);
+    if (Math.abs(ours - record.amountRefunded) > MONEY_EPSILON) {
+        refundMismatch += 1;
+        await paymentCasesRepository().openOrObserve({
+            kind: "refund_mismatch",
+            subjectId: `${record.id}:refunds`,
+            severity: record.amountRefunded > ours ? "error" : "warning",
+            title: `Refund total disagrees with the gateway — ${order.id}`,
+            detail: [
+                record.amountRefunded > ours
+                    ? `🛑 The gateway has refunded MORE than our records show. Money has left that we did not record.`
+                    : `Our records show more refunded than the gateway did — a refund may have been reserved and never completed.`,
+                "",
+                `Gateway: ${record.gateway}`,
+                `Payment: ${record.id}`,
+                `Order: ${order.id}`,
+                `Gateway refunded: ${record.amountRefunded}`,
+                `Our committed refunds: ${ours}`,
+                `Refundable base: ${refundableBase(order)}`,
+                record.refundStatus ? `Gateway refund status: ${record.refundStatus}` : null,
+            ]
+                .filter((l) => l !== null)
+                .join("\n"),
+            entityType: "order",
+            entityId: order.id,
+            amountAtRisk: Math.abs(record.amountRefunded - ours),
+            orderIds: [order.id],
+            gatewayPaymentId: record.id,
+            now: ctx.now,
+        });
+    }
+    return { amountMismatch, refundMismatch };
+}
 /* ──────────────── R3: refund claimed, never settled ─────────────────────── */
 /**
  * A `refundClaims` row still `claimed` an hour later is a crash between
@@ -321,8 +338,8 @@ async function reconcileStaleRefundClaims(ctx) {
     try {
         const snap = await ctx.db
             .collection(REFUND_CLAIMS_COLLECTION)
-            .where("state", "==", "claimed")
-            .where("claimedAt", "<", cutoff)
+            .where(REFUND_CLAIM_FIELDS.STATE, "==", "claimed")
+            .where(REFUND_CLAIM_FIELDS.CLAIMED_AT, "<", cutoff)
             .limit(50)
             .get();
         for (const doc of snap.docs) {
@@ -404,9 +421,9 @@ async function reconcileUnpaidCancellations(ctx) {
     let stale = 0;
     try {
         const snap = await ctx.db
-            .collection("orders")
-            .where("status", "==", "cancelled")
-            .where("refundStatus", "==", "pending")
+            .collection(ORDER_COLLECTION)
+            .where(ORDER_FIELDS.STATUS, "==", "cancelled")
+            .where(ORDER_FIELDS.REFUND_STATUS, "==", "pending")
             .limit(100)
             .get();
         /*

package/dist/_internal/server/jobs/core/testDataCleanup.d.ts

@@ -14,7 +14,7 @@ import type { JobContext } from "../runtime/types";
  * (This used to be shared with testerSandboxRefresh.ts, which was removed when
  * the tester runner took over fixture state — see scheduled.ts.)
  */
-export declare const TEST_DATA_COLLECTIONS: readonly ["categories", "stores", "products", "blogPosts", "events"];
+export declare const TEST_DATA_COLLECTIONS: readonly ["categories", "stores", "products", "blogPosts", "events", "orders", "obligations", "protectionClaims"];
 export interface TestDataCleanupOptions {
     /** true = wipe every isTestData:true doc regardless of testDataExpiresAt (manual force-purge). */
     force?: boolean;

package/dist/_internal/server/jobs/core/testDataCleanup.js

@@ -41,7 +41,28 @@ import { BID_FIELDS } from "../../../../constants/field-names.js";
  * is both `test` AND `isTestData`. `audit-seed-purpose` R6 now asserts every
  * entry here declares the field, so the `offers` shape cannot return.
  */
-export const TEST_DATA_COLLECTIONS = ["categories", "stores", "products", "blogPosts", "events"];
+/*
+ * 🛑 Every schema that declares `isTestData` must appear here, or the field is
+ * WRITE-ONLY and the row is never swept — a flag that reads as "this will be
+ * cleaned up" and never is.
+ *
+ * `orders`, `obligations` and `protectionClaims` were added 2026-10-22 after
+ * `audit-seed-purpose`'s inverse rule found all three declaring the field with
+ * no entry. They are the propagation chain: an order carries the flag, writing
+ * an obligation copies it (`orders.repository.ts` → `repo.open({ …isTestData
+ * })`), and a claim inherits it in turn — so a test order left three
+ * generations of descendants behind that nothing would ever collect.
+ */
+export const TEST_DATA_COLLECTIONS = [
+    "categories",
+    "stores",
+    "products",
+    "blogPosts",
+    "events",
+    "orders",
+    "obligations",
+    "protectionClaims",
+];
 const BID_CHUNK_SIZE = 30; // Firestore `in` query cap
 export async function runTestDataCleanup(ctx, opts = {}) {
     const cutoff = opts.force ? null : new Date();

package/dist/_internal/server/jobs/handlers/onShipmentAllocationSync.js

@@ -1,5 +1,6 @@
 import { allocateShipmentCosts } from "../../../../features/shipments/utils/cost-allocation.js";
 import { siteSettingsRepository } from "../../../../features/admin/repository/site-settings.repository.js";
+import { safeRead } from "../../../../errors/safe-read.js";
 /*
  * ── D58: the admin saw 6 while this used 4 ───────────────────────────────
  *
@@ -97,10 +98,21 @@ async function recomputeShipmentAllocation(shipmentId, ctx) {
      * single shipment, not a sweep, so the read is bounded — and the
      * alternative (keep ignoring the admin control) is the defect.
      */
-    const laborSettings = await siteSettingsRepository
-        .getSingleton()
-        .then((s) => s.laborRate)
-        .catch(() => undefined);
+    /*
+     * `safeRead`, not `.catch(() => undefined)`.
+     *
+     * The fallback is unchanged — a settings read that fails must not stop the
+     * allocation, and `settingsMaxHours` being absent simply means "no admin
+     * ceiling". What changes is that the failure is now RECORDED: a bare catch
+     * returning `undefined` is indistinguishable from an admin who never set a
+     * ceiling, so the labour cap could silently stop being enforced with
+     * nothing anywhere to say so. `installDegradedReadReporter` persists it.
+     */
+    const laborSettings = await safeRead(() => siteSettingsRepository.getSingleton().then((s) => s.laborRate), {
+        route: "job:onShipmentAllocationSync",
+        key: "siteSettings:laborRate",
+        fallback: undefined,
+    });
     const settingsMaxHours = laborSettings?.maxHoursPerDay;
     const { perLot, totals } = allocateShipmentCosts({
         lots: allocationInputs,

package/dist/_internal/shared/actions/action-registry.js

@@ -1427,6 +1427,40 @@ export const ACTIONS = {
                 confirmKind: "danger",
             },
         },
+        /*
+         * 🛑 The confirmation names the consequence rather than the mechanism.
+         * "Revoke session" means nothing to a buyer; "that device is signed out"
+         * is the fact they need to weigh, and the warning about their own device
+         * is the one mistake this control makes easy to make.
+         */
+        "revoke-session": {
+            iconKey: "lock",
+            id: "user.revoke-session",
+            label: "Sign out device",
+            ariaLabel: "Sign out this device",
+            description: "End an active session so that device has to sign in again.",
+            kind: "danger",
+            confirmation: {
+                title: "Sign out this device?",
+                body: "Whoever is using it will be signed out and will need your password to get back in. If this is the device you are on right now, you will be signed out too.",
+                confirmLabel: "Sign out device",
+                confirmKind: "danger",
+            },
+        },
+        "delete-payment-method": {
+            iconKey: "delete",
+            id: "user.delete-payment-method",
+            label: "Remove card",
+            ariaLabel: "Remove this saved payment method",
+            description: "Remove a saved payment method from the account.",
+            kind: "danger",
+            confirmation: {
+                title: "Remove this payment method?",
+                body: "It will no longer appear at checkout. Any order already placed with it is unaffected.",
+                confirmLabel: "Remove",
+                confirmKind: "danger",
+            },
+        },
         "set-default-address": {
             iconKey: "confirm",
             id: "user.set-default-address",
@@ -2397,17 +2431,44 @@ export const ACTIONS = {
             kind: "ghost",
             permissions: ["admin"],
         },
+        "activate-carousel": {
+            iconKey: "resume",
+            id: "admin.activate-carousel",
+            label: "Activate",
+            ariaLabel: "Show this slide in the carousel",
+            description: "Set a carousel slide to active so the hero carousel renders it.",
+            kind: "primary",
+            permissions: ["admin"],
+        },
+        "deactivate-carousel": {
+            iconKey: "hide",
+            id: "admin.deactivate-carousel",
+            label: "Deactivate",
+            ariaLabel: "Hide this slide from the carousel",
+            description: "Set a carousel slide to inactive without deleting it.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         /*
-         * Homepage sections have no bucket of their own, so their edit leaf lives
-         * here beside the carousel pair for the same reason — both are homepage
-         * chrome an admin edits from a list rather than from a detail page.
+         * Homepage sections have no bucket of their own, so their leaves live here
+         * beside the carousel ones for the same reason — both are homepage chrome
+         * an admin edits from a list rather than from a detail page.
+         *
+         * 🛑 `delete-section` exists but is NOT reachable from the public homepage.
+         * Section `order` is POSITIONAL, so removing one leaves a gap in its
+         * neighbours' numbering — not something to offer from a public page, where
+         * the only confirmation a person gets is a dialog.
+         *
+         * That prohibition is enforced INDEPENDENTLY of this registry, which is
+         * why the leaf can exist: `RESOURCE_LEAVES.SECTION` in `OwnerQuickActions`
+         * omits `remove`, and `showDelete` gates on `leaves.remove` rather than on
+         * what a call site passes — so the pencil strip renders no bin regardless.
+         * This comment read "there is deliberately NO delete-section counterpart"
+         * until 2026-10-22, when the admin sections listing gained a real one.
          *
-         * 🛑 There is deliberately NO `delete-section` counterpart. Section `order`
-         * is POSITIONAL, so removing one silently renumbers its neighbours — not
-         * something to offer from the public homepage, where the only confirmation
-         * a person gets is a dialog. `OwnerQuickActions` enforces the absence by
-         * omitting `remove` from the SECTION mapping, so no call site can pass a
-         * delete handler and have it render.
+         * The listing is the right home for it: it owns these records, it shows
+         * the `order` column the gap appears in, and its Reorder panel has a
+         * Reindex 1..N button beside it to close one.
          */
         "edit-section": {
             iconKey: "edit",
@@ -2418,6 +2479,62 @@ export const ACTIONS = {
             kind: "ghost",
             permissions: ["admin"],
         },
+        "enable-section": {
+            iconKey: "resume",
+            id: "admin.enable-section",
+            label: "Enable",
+            ariaLabel: "Enable this homepage section",
+            description: "Render this section on its surface again.",
+            kind: "primary",
+            permissions: ["admin"],
+        },
+        "disable-section": {
+            iconKey: "hide",
+            id: "admin.disable-section",
+            label: "Disable",
+            ariaLabel: "Disable this homepage section",
+            description: "Stop rendering this section without deleting it or its saved config.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
+        "delete-section": {
+            iconKey: "delete",
+            id: "admin.delete-section",
+            label: "Delete Section",
+            ariaLabel: "Delete this homepage section",
+            description: "Permanently remove this homepage section and its saved config.",
+            kind: "danger",
+            permissions: ["admin"],
+            confirmation: {
+                title: "Delete this section?",
+                /*
+                 * The last sentence is load-bearing: it names the reversible
+                 * alternative at the moment of the irreversible choice, and that
+                 * alternative is one click away in the same row.
+                 */
+                body: "The section and its saved config are removed permanently. Display order is positional, so the sections after it keep their current numbers and a gap is left — Reorder sections → Reindex 1..N closes it. To hide the section from the homepage while keeping its config, disable it instead.",
+                confirmLabel: "Delete section",
+                confirmKind: "danger",
+            },
+        },
+        "show-nav-item": {
+            iconKey: "view",
+            id: "admin.show-nav-item",
+            label: "Show",
+            ariaLabel: "Show this navigation item",
+            description: "Make a navigation item visible in the sidebar and menus.",
+            kind: "primary",
+            permissions: ["admin"],
+        },
+        "hide-nav-item": {
+            iconKey: "hide",
+            id: "admin.hide-nav-item",
+            label: "Hide",
+            ariaLabel: "Hide this navigation item",
+            description: "Hide a navigation item without deleting it.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         "delete-carousel": {
             iconKey: "delete",
             id: "admin.delete-carousel",
@@ -3085,6 +3202,29 @@ export const ACTIONS = {
                 confirmKind: "danger",
             },
         },
+        /*
+         * 🛑 Distinct from `clear-previews` and `discard-staged`, which are
+         * SESSION/STAGING operations over files no record points at yet. This one
+         * removes a FINALISED asset, so the confirmation has to say what nothing
+         * else in this bucket has to: the bytes are referenced by whatever already
+         * embedded them, and the proxy resolves `/media/<shortId>` through the
+         * `mediaAssets` row — so deleting is how a live page gets a broken image.
+         */
+        "delete-media": {
+            iconKey: "delete",
+            id: "media.delete-media",
+            label: "Delete file",
+            ariaLabel: "Delete this media file",
+            description: "Permanently delete a media file and the asset row that resolves it.",
+            kind: "danger",
+            permissions: ["admin"],
+            confirmation: {
+                title: "Delete this file?",
+                body: "The file is removed from storage and stops resolving. Any product, blog post or section still embedding it will show a broken image — this cannot be undone.",
+                confirmLabel: "Delete file",
+                confirmKind: "danger",
+            },
+        },
     },
     SUPPORT: {
         "create-ticket": {