@mohasinac/appkit 4.62.1 → 4.63.0

package/dist/client.js

@@ -440,6 +440,9 @@ export { PROTECTION_CLAIM_REASON_LABEL } from "./features/protection-claims/sche
 export { OrderCompletionPanel } from "./features/orders/components/OrderCompletionPanel.js";
 // Buyer-facing EMI schedule with a pay-any-instalment action.
 export { EmiInstallmentsPanel } from "./features/orders/components/EmiInstallmentsPanel.js";
+// D55 — the pre-order balance collector's buyer panel and its write shapes.
+export { BalancePaymentPanel } from "./features/orders/components/BalancePaymentPanel.js";
+export { balanceProofSchema, balanceReviewSchema, } from "./features/orders/schemas/balance.js";
 export { CountdownDisplay } from "./ui/components/CountdownDisplay.js";
 export { OrderAddonBadges } from "./features/orders/components/OrderAddonBadges.js";
 // Manual-payment (cash / UPI / EMI) shared constants — pure data + predicates,
@@ -567,6 +570,15 @@ export { useProduct } from "./features/products/index.js";
 export { BUNDLE_COPY } from "./_internal/shared/features/categories/bundle-copy.js";
 export { useSiteSettings } from "./core/index.js";
 export { checkEmiEligibility, computeEmiSchedule, computeBuyerEmiQuote, } from "./_internal/shared/features/emi/schedule.js";
+/*
+ * 0f — the checkout client needs to know which tenders can carry instalments
+ * so it can DISABLE an incompatible one with a reason rather than let the
+ * buyer pick it and be refused at submit. Same map the server refuses from, so
+ * the affordance and the rule cannot disagree.
+ */
+export { emiTenderBlockReason, isTenderCompatibleWithEmi } from "./_internal/shared/features/emi/choice.js";
+/* The derivation strings for the fee breakdown — pure, no I/O. */
+export { explainCodHandlingFee, explainEmiSurcharge, explainGstOnPlatformFee, explainPlatformFee, } from "./_internal/shared/fees/explain.js";
 export { computeCodHandlingFee } from "./_internal/shared/fees/calculator.js"; // reexport-from-internal-ok: pure fee-calc utility consumed directly by public checkout UI (CheckoutRouteClient.tsx), same category as the sibling computeEmiSchedule/checkEmiEligibility re-export two lines above
 export { FAQPageContent } from "./features/faq/index.js";
 export { CategoryInlineSelect } from "./features/seller/components/CategoryInlineSelect.js";
@@ -603,6 +615,7 @@ export { raffleEntrySchema } from "./features/contact/schemas/inquiry-forms.js";
 export { orderCancelSchema, paymentProofSchema, } from "./features/orders/schemas/buyer-forms.js";
 export { scamReportFormSchema } from "./features/scams/schemas/report-form.js";
 export { sublistingCategoryFormSchema } from "./features/store-extensions/schemas/sublisting-category-form.js";
+export { adCreativeFormSchema } from "./features/ads/schemas/creative-form.js";
 export { adminStoreUpdateSchema, announcementBarSchema, } from "./features/admin/schemas/admin-editor-forms.js";
 export { adminOrderUpdateSchema, employeeInviteSchema, hardBanReasonSchema, featureFlagsUpdateSchema, adminAdFormSchema, } from "./features/admin/schemas/admin-ops-forms.js";
 export { changeEmailSchema } from "./features/account/schemas/index.js";

package/dist/constants/api-endpoints.d.ts

@@ -98,6 +98,10 @@ export declare const ADMIN_ENDPOINTS: {
     /** The action-index control plane (W7 / D7) — GET the whole index, PATCH one override. */
     readonly ACTION_INDEX: "/api/admin/action-index";
     readonly AD_BY_ID: (id: string) => string;
+    /** D56 — the self-serve creative moderation queue. */
+    readonly AD_BOOKINGS: "/api/admin/ads/bookings";
+    /** D56 — approve or reject one creative. A rejection REQUIRES a note. */
+    readonly AD_BOOKING_MODERATE: (id: string) => string;
     readonly PAYMENTS_SETTINGS: "/api/admin/payments/settings";
     readonly PRODUCTS: "/api/admin/products";
     readonly PRODUCT_BY_ID: (id: string) => string;
@@ -110,6 +114,7 @@ export declare const ADMIN_ENDPOINTS: {
     readonly ORDER_PAYMENT_VERIFY: (id: string) => string;
     readonly ORDER_PAYMENT_REUPLOAD: (id: string) => string;
     readonly ORDER_PAYMENT_REJECT_FRAUD: (id: string) => string;
+    readonly ORDER_BALANCE_REVIEW: (id: string) => string;
     readonly USERS: "/api/admin/users";
     readonly USERS_BULK: "/api/admin/users/bulk";
     readonly USER_BY_ID: (uid: string) => string;
@@ -286,6 +291,13 @@ export declare const CART_ENDPOINTS: {
      * is why there is no `/api/cart/points/amount`.
      */
     readonly POINTS: "/api/cart/points";
+    /**
+     * The instalment plan — a TENURE and nothing else. It lives on the cart,
+     * not in a checkout body, because the online path needs the same answer in
+     * two requests (`/api/payment/create-order` captures, `/api/payment/verify`
+     * writes the order). Same reasoning as `POINTS` and `ADDONS` above.
+     */
+    readonly EMI: "/api/cart/emi";
     readonly COUPON: "/api/cart/coupon";
     /**
      * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
@@ -461,6 +473,7 @@ export declare const ORDER_ENDPOINTS: {
     readonly BY_ID: (id: string) => string;
     readonly TRACK: (trackingId: string) => string;
     readonly PAYMENT_PROOF: (id: string) => string;
+    readonly BALANCE_PROOF: (id: string) => string;
     readonly DISPUTE: (id: string) => string;
 };
 export declare const PREORDER_ENDPOINTS: {
@@ -502,6 +515,17 @@ export declare const SELLER_ENDPOINTS: {
     readonly PRODUCTS: "/api/store/products";
     readonly ORDERS: "/api/store/orders";
     readonly ORDERS_BY_ID: (orderId: string) => string;
+    /**
+     * Dispatch — BOTH branches of `shipOrderSchema`'s discriminated union.
+     *
+     * `method: "custom"` records a carrier the seller posted themselves;
+     * `method: "platform"` enqueues a booking through our own account. One
+     * route, because they are one decision — a second endpoint for the
+     * platform branch would be the same handler behind two ceilings, which is
+     * Root Cause #85.
+     */
+    readonly ORDER_SHIP: (orderId: string) => string;
+    readonly ORDER_OPEN_BALANCE: (orderId: string) => string;
     readonly AUCTIONS: "/api/store/products";
     readonly COUPONS: "/api/store/coupons";
     readonly COUPON_BY_ID: (id: string) => string;
@@ -695,6 +719,10 @@ export declare const API_ENDPOINTS: {
         /** The action-index control plane (W7 / D7) — GET the whole index, PATCH one override. */
         readonly ACTION_INDEX: "/api/admin/action-index";
         readonly AD_BY_ID: (id: string) => string;
+        /** D56 — the self-serve creative moderation queue. */
+        readonly AD_BOOKINGS: "/api/admin/ads/bookings";
+        /** D56 — approve or reject one creative. A rejection REQUIRES a note. */
+        readonly AD_BOOKING_MODERATE: (id: string) => string;
         readonly PAYMENTS_SETTINGS: "/api/admin/payments/settings";
         readonly PRODUCTS: "/api/admin/products";
         readonly PRODUCT_BY_ID: (id: string) => string;
@@ -707,6 +735,7 @@ export declare const API_ENDPOINTS: {
         readonly ORDER_PAYMENT_VERIFY: (id: string) => string;
         readonly ORDER_PAYMENT_REUPLOAD: (id: string) => string;
         readonly ORDER_PAYMENT_REJECT_FRAUD: (id: string) => string;
+        readonly ORDER_BALANCE_REVIEW: (id: string) => string;
         readonly USERS: "/api/admin/users";
         readonly USERS_BULK: "/api/admin/users/bulk";
         readonly USER_BY_ID: (uid: string) => string;
@@ -883,6 +912,13 @@ export declare const API_ENDPOINTS: {
          * is why there is no `/api/cart/points/amount`.
          */
         readonly POINTS: "/api/cart/points";
+        /**
+         * The instalment plan — a TENURE and nothing else. It lives on the cart,
+         * not in a checkout body, because the online path needs the same answer in
+         * two requests (`/api/payment/create-order` captures, `/api/payment/verify`
+         * writes the order). Same reasoning as `POINTS` and `ADDONS` above.
+         */
+        readonly EMI: "/api/cart/emi";
         readonly COUPON: "/api/cart/coupon";
         /**
          * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
@@ -1005,6 +1041,7 @@ export declare const API_ENDPOINTS: {
         readonly BY_ID: (id: string) => string;
         readonly TRACK: (trackingId: string) => string;
         readonly PAYMENT_PROOF: (id: string) => string;
+        readonly BALANCE_PROOF: (id: string) => string;
         readonly DISPUTE: (id: string) => string;
     };
     readonly PREORDERS: {
@@ -1043,6 +1080,17 @@ export declare const API_ENDPOINTS: {
         readonly PRODUCTS: "/api/store/products";
         readonly ORDERS: "/api/store/orders";
         readonly ORDERS_BY_ID: (orderId: string) => string;
+        /**
+         * Dispatch — BOTH branches of `shipOrderSchema`'s discriminated union.
+         *
+         * `method: "custom"` records a carrier the seller posted themselves;
+         * `method: "platform"` enqueues a booking through our own account. One
+         * route, because they are one decision — a second endpoint for the
+         * platform branch would be the same handler behind two ceilings, which is
+         * Root Cause #85.
+         */
+        readonly ORDER_SHIP: (orderId: string) => string;
+        readonly ORDER_OPEN_BALANCE: (orderId: string) => string;
         readonly AUCTIONS: "/api/store/products";
         readonly COUPONS: "/api/store/coupons";
         readonly COUPON_BY_ID: (id: string) => string;
@@ -1257,6 +1305,10 @@ export declare const API_ROUTES: {
         /** The action-index control plane (W7 / D7) — GET the whole index, PATCH one override. */
         readonly ACTION_INDEX: "/api/admin/action-index";
         readonly AD_BY_ID: (id: string) => string;
+        /** D56 — the self-serve creative moderation queue. */
+        readonly AD_BOOKINGS: "/api/admin/ads/bookings";
+        /** D56 — approve or reject one creative. A rejection REQUIRES a note. */
+        readonly AD_BOOKING_MODERATE: (id: string) => string;
         readonly PAYMENTS_SETTINGS: "/api/admin/payments/settings";
         readonly PRODUCTS: "/api/admin/products";
         readonly PRODUCT_BY_ID: (id: string) => string;
@@ -1269,6 +1321,7 @@ export declare const API_ROUTES: {
         readonly ORDER_PAYMENT_VERIFY: (id: string) => string;
         readonly ORDER_PAYMENT_REUPLOAD: (id: string) => string;
         readonly ORDER_PAYMENT_REJECT_FRAUD: (id: string) => string;
+        readonly ORDER_BALANCE_REVIEW: (id: string) => string;
         readonly USERS: "/api/admin/users";
         readonly USERS_BULK: "/api/admin/users/bulk";
         readonly USER_BY_ID: (uid: string) => string;
@@ -1445,6 +1498,13 @@ export declare const API_ROUTES: {
          * is why there is no `/api/cart/points/amount`.
          */
         readonly POINTS: "/api/cart/points";
+        /**
+         * The instalment plan — a TENURE and nothing else. It lives on the cart,
+         * not in a checkout body, because the online path needs the same answer in
+         * two requests (`/api/payment/create-order` captures, `/api/payment/verify`
+         * writes the order). Same reasoning as `POINTS` and `ADDONS` above.
+         */
+        readonly EMI: "/api/cart/emi";
         readonly COUPON: "/api/cart/coupon";
         /**
          * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
@@ -1567,6 +1627,7 @@ export declare const API_ROUTES: {
         readonly BY_ID: (id: string) => string;
         readonly TRACK: (trackingId: string) => string;
         readonly PAYMENT_PROOF: (id: string) => string;
+        readonly BALANCE_PROOF: (id: string) => string;
         readonly DISPUTE: (id: string) => string;
     };
     readonly PREORDERS: {
@@ -1605,6 +1666,17 @@ export declare const API_ROUTES: {
         readonly PRODUCTS: "/api/store/products";
         readonly ORDERS: "/api/store/orders";
         readonly ORDERS_BY_ID: (orderId: string) => string;
+        /**
+         * Dispatch — BOTH branches of `shipOrderSchema`'s discriminated union.
+         *
+         * `method: "custom"` records a carrier the seller posted themselves;
+         * `method: "platform"` enqueues a booking through our own account. One
+         * route, because they are one decision — a second endpoint for the
+         * platform branch would be the same handler behind two ceilings, which is
+         * Root Cause #85.
+         */
+        readonly ORDER_SHIP: (orderId: string) => string;
+        readonly ORDER_OPEN_BALANCE: (orderId: string) => string;
         readonly AUCTIONS: "/api/store/products";
         readonly COUPONS: "/api/store/coupons";
         readonly COUPON_BY_ID: (id: string) => string;

package/dist/constants/api-endpoints.js

@@ -129,6 +129,10 @@ export const ADMIN_ENDPOINTS = {
     /** The action-index control plane (W7 / D7) — GET the whole index, PATCH one override. */
     ACTION_INDEX: "/api/admin/action-index",
     AD_BY_ID: (id) => `/api/admin/ads/${id}`,
+    /** D56 — the self-serve creative moderation queue. */
+    AD_BOOKINGS: "/api/admin/ads/bookings",
+    /** D56 — approve or reject one creative. A rejection REQUIRES a note. */
+    AD_BOOKING_MODERATE: (id) => `/api/admin/ads/bookings/${id}/moderate`,
     PAYMENTS_SETTINGS: "/api/admin/payments/settings",
     PRODUCTS: "/api/admin/products",
     PRODUCT_BY_ID: (id) => `/api/admin/products/${id}`,
@@ -141,6 +145,12 @@ export const ADMIN_ENDPOINTS = {
     ORDER_PAYMENT_VERIFY: (id) => `/api/admin/orders/${id}/payment-verify`,
     ORDER_PAYMENT_REUPLOAD: (id) => `/api/admin/orders/${id}/payment-reupload`,
     ORDER_PAYMENT_REJECT_FRAUD: (id) => `/api/admin/orders/${id}/payment-reject-fraud`,
+    /*
+     * D55 — approve or reject a pre-order BALANCE proof. Separate from the
+     * three `ORDER_PAYMENT_*` routes above, which review the DEPOSIT: the two
+     * payments are months apart and each carries its own proof, status and note.
+     */
+    ORDER_BALANCE_REVIEW: (id) => `/api/admin/orders/${id}/balance-review`,
     USERS: "/api/admin/users",
     USERS_BULK: "/api/admin/users/bulk",
     USER_BY_ID: (uid) => `/api/admin/users/${uid}`,
@@ -339,6 +349,13 @@ export const CART_ENDPOINTS = {
      * is why there is no `/api/cart/points/amount`.
      */
     POINTS: "/api/cart/points",
+    /**
+     * The instalment plan — a TENURE and nothing else. It lives on the cart,
+     * not in a checkout body, because the online path needs the same answer in
+     * two requests (`/api/payment/create-order` captures, `/api/payment/verify`
+     * writes the order). Same reasoning as `POINTS` and `ADDONS` above.
+     */
+    EMI: "/api/cart/emi",
     COUPON: "/api/cart/coupon",
     /**
      * Add a buyer-assembled group selection as ONE line. Separate from `GET`'s
@@ -589,6 +606,13 @@ export const ORDER_ENDPOINTS = {
     BY_ID: (id) => `/api/orders/${id}`,
     TRACK: (trackingId) => `/api/orders/track/${trackingId}`,
     PAYMENT_PROOF: (id) => `/api/orders/${id}/payment-proof`,
+    /*
+     * D55 — proof of paying a pre-order BALANCE. Deliberately a separate
+     * endpoint from `PAYMENT_PROOF`, which is the DEPOSIT's: a pre-order has
+     * two payments months apart, and writing the second over the first would
+     * destroy the evidence for the payment that created the order.
+     */
+    BALANCE_PROOF: (id) => `/api/orders/${id}/balance-proof`,
     DISPUTE: (id) => `/api/orders/${id}/dispute`,
 };
 // ---------------------------------------------------------------------------
@@ -657,6 +681,23 @@ export const SELLER_ENDPOINTS = {
     PRODUCTS: "/api/store/products",
     ORDERS: "/api/store/orders",
     ORDERS_BY_ID: (orderId) => `/api/store/orders/${orderId}`,
+    /**
+     * Dispatch — BOTH branches of `shipOrderSchema`'s discriminated union.
+     *
+     * `method: "custom"` records a carrier the seller posted themselves;
+     * `method: "platform"` enqueues a booking through our own account. One
+     * route, because they are one decision — a second endpoint for the
+     * platform branch would be the same handler behind two ceilings, which is
+     * Root Cause #85.
+     */
+    ORDER_SHIP: (orderId) => `/api/store/orders/${orderId}/ship`,
+    /*
+     * D55 — "the goods have landed, the balance is now payable". An EVENT, not
+     * a derived state: a pre-order's premise is that the item does not exist
+     * yet, so the balance becomes collectable when the seller says stock
+     * arrived, and the buyer's 7-day window runs from that moment.
+     */
+    ORDER_OPEN_BALANCE: (orderId) => `/api/store/orders/${orderId}/open-balance`,
     AUCTIONS: "/api/store/products",
     COUPONS: "/api/store/coupons",
     COUPON_BY_ID: (id) => `/api/store/coupons/${id}`,

package/dist/constants/field-names.d.ts

@@ -230,6 +230,17 @@ export declare const ORDER_FIELDS: {
     readonly TOTAL_AMOUNT: "totalAmount";
     readonly BUYER_ID: "buyerId";
     readonly BUNDLE_ID: "bundleId";
+    /**
+     * Which checkout LANE produced this order (`standard` / `auction` / `offer`
+     * / `preorder` / `prize-draw`) — see § "Checkout Lanes".
+     *
+     * 🛑 Never filter `orderType == "standard"` in a query. Orders written
+     * before the field existed carry no value at all, and a Firestore equality
+     * cannot match an absent field, so that filter silently drops every legacy
+     * order. `UserOrdersView` filters the standard lane in memory for exactly
+     * this reason; the other four values are safe as equalities.
+     */
+    readonly ORDER_TYPE: "orderType";
     readonly CREATED_AT: "createdAt";
     readonly UPDATED_AT: "updatedAt";
     readonly PAYMENT_DEADLINE: "paymentDeadline";
@@ -1000,6 +1011,36 @@ export declare const REFUND_CLAIM_FIELDS: {
 export declare const PRICE_OBSERVATION_FIELDS: {
     readonly CATEGORY_ID: "categoryId";
 };
+/**
+ * A TTL-bounded hold on units of a product. See
+ * `features/inventory/schemas/stock-reservation.ts` for why a reservation is
+ * its own document rather than a counter on the product: the row and the
+ * counter move in ONE transaction, so a crash between them is impossible.
+ */
+export declare const STOCK_RESERVATION_FIELDS: {
+    readonly PRODUCT_ID: "productId";
+    readonly QUANTITY: "quantity";
+    readonly HOLDER_KIND: "holderKind";
+    readonly HOLDER_ID: "holderId";
+    readonly CREATED_BY: "createdBy";
+    readonly STATUS: "status";
+    readonly EXPIRES_AT: "expiresAt";
+    readonly ENDED_AT: "endedAt";
+    readonly ENDED_REASON: "endedReason";
+};
+/**
+ * One advertiser's booking of one placement for one period. The document id
+ * IS the lock (`adBookingId`), so there is deliberately no `period`+`placementId`
+ * uniqueness query to write — see `features/ads/schemas/firestore.ts`.
+ */
+export declare const AD_BOOKING_FIELDS: {
+    readonly PLACEMENT_ID: "placementId";
+    readonly PERIOD: "period";
+    readonly ADVERTISER_UID: "advertiserUid";
+    readonly PAYMENT_STATE: "paymentState";
+    readonly CANCELLED_AT: "cancelledAt";
+    readonly CREATED_AT: "createdAt";
+};
 export declare const OAUTH_STATE_VALUES: {
     readonly PENDING: "pending";
     readonly USED: "used";

package/dist/constants/field-names.js

@@ -258,6 +258,17 @@ export const ORDER_FIELDS = {
     TOTAL_AMOUNT: "totalAmount",
     BUYER_ID: "buyerId",
     BUNDLE_ID: "bundleId",
+    /**
+     * Which checkout LANE produced this order (`standard` / `auction` / `offer`
+     * / `preorder` / `prize-draw`) — see § "Checkout Lanes".
+     *
+     * 🛑 Never filter `orderType == "standard"` in a query. Orders written
+     * before the field existed carry no value at all, and a Firestore equality
+     * cannot match an absent field, so that filter silently drops every legacy
+     * order. `UserOrdersView` filters the standard lane in memory for exactly
+     * this reason; the other four values are safe as equalities.
+     */
+    ORDER_TYPE: "orderType",
     CREATED_AT: "createdAt",
     UPDATED_AT: "updatedAt",
     PAYMENT_DEADLINE: "paymentDeadline",
@@ -1203,6 +1214,42 @@ export const PRICE_OBSERVATION_FIELDS = {
     CATEGORY_ID: "categoryId",
 };
 // ============================================================================
+// STOCK RESERVATIONS
+// ============================================================================
+/**
+ * A TTL-bounded hold on units of a product. See
+ * `features/inventory/schemas/stock-reservation.ts` for why a reservation is
+ * its own document rather than a counter on the product: the row and the
+ * counter move in ONE transaction, so a crash between them is impossible.
+ */
+export const STOCK_RESERVATION_FIELDS = {
+    PRODUCT_ID: "productId",
+    QUANTITY: "quantity",
+    HOLDER_KIND: "holderKind",
+    HOLDER_ID: "holderId",
+    CREATED_BY: "createdBy",
+    STATUS: "status",
+    EXPIRES_AT: "expiresAt",
+    ENDED_AT: "endedAt",
+    ENDED_REASON: "endedReason",
+};
+// ============================================================================
+// AD BOOKINGS
+// ============================================================================
+/**
+ * One advertiser's booking of one placement for one period. The document id
+ * IS the lock (`adBookingId`), so there is deliberately no `period`+`placementId`
+ * uniqueness query to write — see `features/ads/schemas/firestore.ts`.
+ */
+export const AD_BOOKING_FIELDS = {
+    PLACEMENT_ID: "placementId",
+    PERIOD: "period",
+    ADVERTISER_UID: "advertiserUid",
+    PAYMENT_STATE: "paymentState",
+    CANCELLED_AT: "cancelledAt",
+    CREATED_AT: "createdAt",
+};
+// ============================================================================
 // OAUTH STATE VALUES
 // ============================================================================
 export const OAUTH_STATE_VALUES = {

package/dist/features/account/components/UserOrdersView.js

@@ -64,9 +64,25 @@ const SORT_OPTIONS = [
  * clause is silently dropped and the chip returns the ENTIRE order list while
  * looking like a filter (Root Cause #62).
  */
+/*
+ * 🛑 MEASURED 2026-10-22 — this chip group was INERT, and the comment above it
+ * explained why it should not have been while describing the wrong half.
+ *
+ * `buildFilters` emits `paymentMethod==emi` inside `filters`, and
+ * `/api/user/orders` regex-extracts only `status==` and `orderType==` from
+ * that string. Every other clause is silently dropped — so all three chips
+ * returned the buyer's ENTIRE order list while looking exactly like a working
+ * filter. The note above was careful about the SIEVE allowlist (Root Cause
+ * #62) and the route's own parser was the break, one layer earlier.
+ *
+ * 🛑 And "EMI plans" could not be a `paymentMethod` value any more regardless:
+ * since 0f an instalment order's tender is `online` / `upi_manual` / `cash`,
+ * so the id is now `emiEnabled`, refined in memory by the route alongside the
+ * other two. `cod` and `online` stay real stored `paymentMethod` values.
+ */
 const PAYMENT_METHOD_TABS = [
     { id: "", label: "Any" },
-    { id: "emi", label: "EMI plans" },
+    { id: "emiEnabled", label: "EMI plans" },
     { id: "cod", label: "Cash on delivery" },
     { id: "online", label: "Paid online" },
 ];
@@ -134,7 +150,17 @@ export function UserOrdersView({ onOrderClick }) {
         buildFilters: (state) => [
             state.status ? sieveFilter("status", SIEVE_OP.EQ, state.status) : null,
             state.orderType ? sieveFilter("orderType", SIEVE_OP.EQ, state.orderType) : null,
-            state.paymentMethod ? sieveFilter("paymentMethod", SIEVE_OP.EQ, state.paymentMethod) : null,
+            /*
+             * 🛑 `emiEnabled` is NOT a `paymentMethod`, so it gets its own clause
+             * key — the route refines both in memory (see its note), and emitting
+             * `paymentMethod==emiEnabled` would be a filter for a value no order
+             * can hold.
+             */
+            state.paymentMethod
+                ? state.paymentMethod === "emiEnabled"
+                    ? sieveFilter("emiEnabled", SIEVE_OP.EQ, "true")
+                    : sieveFilter("paymentMethod", SIEVE_OP.EQ, state.paymentMethod)
+                : null,
         ]
             .filter(Boolean)
             .join(",") || undefined,

package/dist/features/admin/components/AdminIntegrationsView.d.ts

@@ -0,0 +1,55 @@
+import React from "react";
+import { type IntegrationPatch } from "../../../_internal/shared/features/admin/integrations";
+import type { SiteSettingsDocument } from "../schemas/firestore";
+/**
+ * Admin → Site → Integrations. The four switches that decide whether we take
+ * money online, send customer email, book couriers, and offer buyers a support
+ * surface.
+ *
+ * ## Why this page exists rather than a Site Settings tab
+ *
+ * A kill switch for payments has to be findable without hunting a tab strip.
+ * It is also the one surface where the four switches are visible TOGETHER,
+ * which matters because their off-states are not comparable: three of them
+ * stop something and one of them selects a working alternative.
+ *
+ * ## 🛑 The model is the authority; this file renders it
+ *
+ * Every label, summary, consequence, severity and settings path comes from
+ * `INTEGRATIONS`, and the current state comes from `readIntegrationStates` —
+ * **the same expression the route guards resolve through**. That is the whole
+ * point: `withOnlinePaymentEnabled` used to hand-write the payments half, and
+ * the first draft of the model reproduced it WRONG (it read `razorpayEnabled`
+ * alone against a guard that is an OR across both gateways), so with PhonePe
+ * on and Razorpay off a page would have reported "payments OFF" while all six
+ * `/api/payment` routes were open and taking money.
+ *
+ * So this view must never derive a state, a consequence or a field name of its
+ * own. If a row needs a new fact, it goes on the descriptor.
+ *
+ * ## 🛑 `offConsequence` IS the confirmation body
+ *
+ * The registry's `disable-integration` ActionDef deliberately ships an empty
+ * `body`, because the consequence differs per integration and copying each
+ * string into the registry would be a second place for it to drift from. The
+ * dialog is composed here, from the descriptor, at render time.
+ */
+export interface AdminIntegrationsViewProps {
+    /**
+     * The settings document, server-fetched.
+     *
+     * 🛑 `Partial` because this page must render against an older document that
+     * predates `support.enabled`. `readIntegrationStates` chooses a per-field
+     * default for exactly that case — and they are NOT a uniform `?? false`:
+     * email and support default ON, because a missing field must not read as
+     * "we stopped talking to customers".
+     */
+    settings: Partial<SiteSettingsDocument> | null;
+    /**
+     * Persist a settings patch. Supplied by the consumer page so this component
+     * carries no endpoint and no fetch — `PUT /api/admin/site`, which already
+     * records one `recordAdminAction` per write.
+     */
+    onSave: (patch: IntegrationPatch) => Promise<void>;
+}
+export declare function AdminIntegrationsView({ settings, onSave }: AdminIntegrationsViewProps): React.JSX.Element;

package/dist/features/admin/components/AdminIntegrationsView.js

@@ -0,0 +1,74 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useMemo, useState } from "react";
+import { Alert, Badge, Button, Div, Heading, Row, Stack, Text, } from "../../../ui/index.js";
+import { useToast } from "../../../ui/components/Toast.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { INTEGRATIONS, INTEGRATION_ORDER, allIntegrationsPatch, integrationPatch, readIntegrationStates, } from "../../../_internal/shared/features/admin/integrations.js";
+/** What the switch currently is, in the admin's vocabulary rather than a boolean. */
+function stateLabel(id, enabled) {
+    /*
+     * 🛑 Shipping is NOT on/off, and this is the one row where saying so matters.
+     *
+     * "Off" selects `provider: "manual"` — the self-ship flow sellers already
+     * use and claim postage back through. Rendering that as "Disabled" beside
+     * three switches that genuinely stop things would invite an admin to read it
+     * as "shipping is broken", and the descriptor's own note says the switch
+     * "selects manual rather than stopping anything".
+     */
+    if (id === "shipping")
+        return enabled ? "We book couriers" : "Sellers self-ship";
+    return enabled ? "On" : "Off";
+}
+export function AdminIntegrationsView({ settings, onSave }) {
+    const { showToast } = useToast();
+    const [pending, setPending] = useState(null);
+    /*
+     * 🛑 Derived from the prop, NOT copied into state.
+     *
+     * A `useState(readIntegrationStates(settings))` would go stale the moment
+     * the page refetched, and the staleness would be invisible: the row would
+     * read "On" while the guard enforcing it read "off". This page's entire job
+     * is to agree with the guard, so it re-derives rather than remembers.
+     */
+    const states = useMemo(() => readIntegrationStates(settings), [settings]);
+    const apply = useCallback(async (key, patch, label) => {
+        setPending(key);
+        try {
+            await onSave(patch);
+            showToast(`${label} saved.`, "success");
+        }
+        catch (err) {
+            void normalizeError(err);
+            /*
+             * 🛑 No optimistic flip anywhere in this component, so a failure needs
+             * no rollback — the row still shows what the server last told us. On a
+             * kill switch the cost of the two mistakes is wildly asymmetric: a
+             * row that briefly lags is a nuisance, while a row claiming "payments
+             * off" over a live gateway is the failure the model's own header warns
+             * about.
+             */
+            showToast(`Couldn't save ${label.toLowerCase()}. Nothing was changed.`, "error");
+        }
+        finally {
+            setPending(null);
+        }
+    }, [onSave, showToast]);
+    return (_jsxs(Stack, { gap: "lg", children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, size: "xl", weight: "semibold", color: "primary", children: "Integrations" }), _jsx(Text, { size: "sm", color: "muted", children: "What the platform talks to, and what happens when it stops. Each switch writes the same settings field the code enforcing it reads." })] }), _jsx(Alert, { variant: "warning", title: "Switch payments off only when nobody is checking out", children: "Turning online payments off also closes the routes that FINISH a payment, including the gateway webhook. A buyer part-way through the gateway can be charged without an order being placed, and the gateway will not retry. There is no safe mid-checkout moment." }), _jsx(Stack, { gap: "md", children: INTEGRATION_ORDER.map((id) => {
+                    const d = INTEGRATIONS[id];
+                    const enabled = states[id].enabled;
+                    const busy = pending === id || pending === "all";
+                    const action = enabled
+                        ? ACTIONS.ADMIN["disable-integration"]
+                        : ACTIONS.ADMIN["enable-integration"];
+                    return (_jsx(Div, { surface: d.severe && enabled ? "warning-surface" : "card", padding: "md", rounded: "lg", border: "default", children: _jsxs(Stack, { gap: "sm", children: [_jsxs(Row, { align: "start", justify: "between", gap: "md", className: "min-w-0", children: [_jsxs(Stack, { gap: "xs", className: "min-w-0", children: [_jsxs(Row, { align: "center", gap: "sm", className: "min-w-0", children: [_jsx(Text, { weight: "semibold", color: "primary", className: "min-w-0", children: d.label }), _jsx(Badge, { variant: enabled ? "success" : "inactive", children: stateLabel(id, enabled) }), d.severe && _jsx(Badge, { variant: "warning", children: "High impact" })] }), _jsx(Text, { size: "sm", color: "muted", children: d.summary })] }), _jsx(Button, { action: action, 
+                                            /*
+                                             * 🛑 The dialog body is composed HERE from the descriptor.
+                                             * The ActionDef ships an empty body on purpose — see its
+                                             * note. A per-integration consequence copied into the
+                                             * registry would be a second source for one sentence.
+                                             */
+                                            confirmationBody: enabled ? d.offConsequence : undefined, isLoading: busy, disabled: busy, onClick: () => apply(id, integrationPatch(id, !enabled), `${d.label} ${enabled ? "off" : "on"}`) })] }), _jsxs(Text, { size: "xs", color: "muted", children: [_jsxs(Text, { as: "span", size: "xs", weight: "semibold", color: "muted", children: ["Off means:", " "] }), d.offConsequence] }), _jsxs(Row, { align: "center", gap: "sm", className: "min-w-0", children: [_jsx(Text, { size: "xs", color: "faint", numeric: true, className: "min-w-0", truncate: 1, children: d.field }), _jsx(Text, { size: "xs", color: "faint", children: "\u00B7" }), _jsx(Text, { size: "xs", color: "faint", className: "min-w-0", truncate: 1, children: d.routeGuard === "gated" ? "API routes close when off" : "no route gate" })] })] }) }, id));
+                }) }), _jsxs(Row, { align: "center", gap: "sm", border: "top-subtle", padding: "t-md", children: [_jsx(Button, { action: ACTIONS.ADMIN["enable-all-integrations"], isLoading: pending === "all", disabled: pending !== null, onClick: () => apply("all", allIntegrationsPatch(true), "All integrations on") }), _jsx(Button, { action: ACTIONS.ADMIN["disable-all-integrations"], isLoading: pending === "all", disabled: pending !== null, onClick: () => apply("all", allIntegrationsPatch(false), "All integrations off") })] })] }));
+}

package/dist/features/admin/components/AdminOrderEditorView.d.ts

@@ -53,5 +53,20 @@ export interface AdminOrderEditorViewProps {
     sourceContext?: OrderSourceContext;
     /** For the provenance card's money formatting; falls back to the default. */
     currency?: string;
+    /**
+     * D55 — the pre-order balance block, present once a seller has opened it.
+     *
+     * 🛑 Admin is the ONLY role that sees `proofUrl` here, matching the deposit:
+     * the seller's own endpoint strips it, because a bank screenshot is the
+     * buyer's and verification is not the seller's job. Reviewing a payment to
+     * yourself is not a review.
+     */
+    balance?: {
+        amount: number;
+        status: "awaiting" | "submitted" | "paid" | "rejected";
+        proofUrl?: string;
+        transactionId?: string;
+        reviewNote?: string;
+    };
 }
-export declare function AdminOrderEditorView({ open, onClose, orderId, orderLabel, currentStatus, items, sourceContext, currency, paymentProofUrl, paymentTransactionId, paymentMethod, paymentStatus, displayedUpiId, buyerReportedUpiId, paymentUpiMismatch, buyerMarkedPaid, buyerFraudAgreementAccepted, paymentReviewOutcome, addons, }: AdminOrderEditorViewProps): React.JSX.Element;
+export declare function AdminOrderEditorView({ open, onClose, orderId, orderLabel, currentStatus, items, sourceContext, currency, paymentProofUrl, paymentTransactionId, paymentMethod, paymentStatus, displayedUpiId, buyerReportedUpiId, paymentUpiMismatch, buyerMarkedPaid, buyerFraudAgreementAccepted, paymentReviewOutcome, addons, balance, }: AdminOrderEditorViewProps): React.JSX.Element;