@mohasinac/appkit 4.62.1 → 4.63.0

package/dist/features/orders/schemas/firestore.js

@@ -48,6 +48,49 @@ export const RefundStatusValues = {
     COMPLETED: "completed",
     REJECTED: "rejected",
 };
+/** Firestore storage shape for an order line item â€" distinct from the API display model OrderItem */
+/**
+ * The PII inside one amendment.
+ *
+ * 🛑 BARE keys, and `ORDER_PII_FIELDS` uses the `deliveryAmendments[].…`
+ * form for the same five fields. Two notations, two scopes, both correct:
+ * the `[]` form is for the whole ORDER document, where the hook has to walk
+ * into the array; these bare names are for ONE amendment object, where they
+ * are genuinely top-level.
+ *
+ * 🛑 This list was first justified as "`encryptPiiFields` CANNOT cover an
+ * array" — CLAUDE.md's wording, and FALSE. `encryptInArray` has always
+ * handled `a[].b`, in both directions. The real rule is that the encryptor
+ * does not infer: a field is covered only where it is NAMED, in the notation
+ * matching the object the list is applied to.
+ */
+export const AMENDMENT_PII_FIELDS = [
+    "fullName",
+    "phone",
+    "addressLine1",
+    "addressLine2",
+    /* Encrypted on the snapshot as `deliveryLandmark`; the two must agree or the
+     * same datum is protected before a correction and exposed after it. */
+    "landmark",
+];
+/**
+ * How much seller prose a single order line carries.
+ *
+ * 🛑 A Firestore document caps at 1 MiB and `items[]` is inline on the order.
+ * 2,000 characters × 20 lines is ~40 KB of description — comfortable. The
+ * same field unbounded is a rejected write at checkout, and the checkout is
+ * the one operation in the system that must never fail for a reason the buyer
+ * cannot act on.
+ */
+export const ORDER_ITEM_DESCRIPTION_MAX = 2000;
+/**
+ * How many spec rows one order line keeps.
+ *
+ * Capped by COUNT rather than characters: a spec table is rows, and half a
+ * row is worse than a missing one — "Weight: 4" with the unit cut off reads
+ * as a fact rather than as truncation.
+ */
+export const ORDER_ITEM_SPECIFICATIONS_MAX = 30;
 export const ORDER_COLLECTION = "orders";
 /**
  * At-most-once gate for refunds. Document id = `sha256(idempotencyKey)`,

package/dist/features/orders/schemas/index.d.ts

@@ -684,6 +684,7 @@ export declare const orderFirestoreSchema: z.ZodObject<{
         prizeRevealStatus?: "closed" | "open" | "pending" | "revealed" | undefined;
     }[] | undefined;
     bundleId?: string | undefined;
+    orderType?: string | undefined;
     prizeWon?: {
         title: string;
         images: string[];
@@ -700,7 +701,6 @@ export declare const orderFirestoreSchema: z.ZodObject<{
         bin: string;
     } | undefined;
     offerId?: string | undefined;
-    orderType?: string | undefined;
     isNonRefundable?: boolean | undefined;
     imageUrls?: string[] | undefined;
     refundFeeDeducted?: number | undefined;
@@ -843,6 +843,7 @@ export declare const orderFirestoreSchema: z.ZodObject<{
         prizeRevealStatus?: "closed" | "open" | "pending" | "revealed" | undefined;
     }[] | undefined;
     bundleId?: string | undefined;
+    orderType?: string | undefined;
     prizeWon?: {
         title: string;
         images: string[];
@@ -859,7 +860,6 @@ export declare const orderFirestoreSchema: z.ZodObject<{
         bin: string;
     } | undefined;
     offerId?: string | undefined;
-    orderType?: string | undefined;
     isNonRefundable?: boolean | undefined;
     imageUrls?: string[] | undefined;
     refundFeeDeducted?: number | undefined;

package/dist/features/orders/types/index.d.ts

@@ -287,6 +287,27 @@ export interface Order {
     timelineTruncated?: number;
     /** How the buyer acquired the right to buy. Written once, at creation. */
     sourceContext?: OrderSourceContext;
+    /**
+     * D55 — the pre-order balance, once the seller has OPENED it for collection.
+     *
+     * 🛑 Absent until then, and that is the difference between "a balance
+     * exists" (`sourceContext.balanceDue > 0`, true from the moment the order
+     * was placed) and "a balance is payable". The buyer's panel gates on this
+     * field, so forgetting it in `orderDocumentToOrder` would render the
+     * "nothing to pay" branch on every order forever — Root Cause #57, which
+     * is what made the whole manual-payment flow dead for weeks.
+     */
+    balance?: {
+        amount: number;
+        method: "manual";
+        status: "awaiting" | "submitted" | "paid" | "rejected";
+        dueBy?: string;
+        proofUrl?: string;
+        transactionId?: string;
+        submittedAt?: string;
+        reviewedAt?: string;
+        reviewNote?: string;
+    };
     physicalLocation?: {
         zone: string;
         shelf: string;

package/dist/features/payments/repository/payout.repository.js

@@ -220,8 +220,9 @@ export class PayoutRepository extends BaseRepository {
             trigger: ctx?.trigger ?? defaultTrigger,
             reason: ctx?.reason,
             note: ctx?.note,
-            // `sellerEmail` / `upiId` — `encryptPiiFields` never descends into
-            // arrays, so either reaching `changes` would persist in PLAINTEXT.
+            // `sellerEmail` / `upiId` — `encryptPiiFields` covers only NAMED paths,
+            // and nothing declares them under `statusHistory[].changes`, so either
+            // one reaching `changes` would persist in PLAINTEXT.
             piiFields: PAYOUT_PII_FIELDS,
         });
         return withEntry ?? patch;

package/dist/features/payments/schemas/firestore.d.ts

@@ -5,6 +5,7 @@ import { type GeneratePayoutIdInput } from "../../../utils/id-generators";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
 import type { Encrypted, Plaintext } from "../../../security/encrypted";
+import type { PayCadence } from "../../../_internal/shared/features/payouts/pay-period";
 export interface PayoutBankAccount {
     accountHolderName: string;
     accountNumberMasked: string;
@@ -45,7 +46,29 @@ export type PayoutPaymentMethod = "bank_transfer" | "upi";
  * asterisks". The distinction is which named method you called.
  */
 export type PayoutPlain = Plaintext<PayoutDocument>;
-export interface PayoutDocument extends BaseDocument {
+/**
+ * 🛑 **A seller payout settles a LIABILITY. An employee payout is an EXPENSE.**
+ *
+ * One undiscriminated shape misstates both statements at once — wages vanish
+ * from the P&L and reappear as settled seller liabilities — so `payeeType` is
+ * a discriminated union rather than an optional field.
+ *
+ * ## Why `PayoutDocument` still names the STORE variant
+ *
+ * Every one of the ~30 existing readers means a seller payout, and every one
+ * of them is correct. Renaming the type they import would turn a safety change
+ * into a mechanical sweep, and the sweep is where the real mistakes go in.
+ * `PayoutDocument = StorePayoutDocument` keeps them compiling and correct;
+ * anything that must handle BOTH takes `AnyPayoutDocument` and is forced by
+ * `tsc` to narrow.
+ *
+ * 🛑 `payeeType` is REQUIRED here, not optional-with-a-default. That breaks
+ * the five sites that CONSTRUCT a payout, which is the entire point — a row
+ * written without it is a row the books cannot classify, and an optional
+ * discriminant defers that discovery to a reader rather than a writer.
+ */
+export interface StorePayoutDocument extends BaseDocument {
+    payeeType: "store";
     storeId: string;
     sellerName: string;
     sellerEmail: Encrypted<string>;
@@ -92,6 +115,74 @@ export interface PayoutDocument extends BaseDocument {
     statusHistory?: StatusChangeEntry[];
     statusHistoryTruncated?: number;
 }
+/**
+ * Wages for a period, earned by resolving support tickets.
+ *
+ * ## 🛑 `platformFee` is ABSENT, not zero
+ *
+ * A `0` would read as "we took no commission on these wages", which is a
+ * statement about a transaction that did not happen. Commission is not a
+ * concept between a platform and its own staff, and the books must be able to
+ * tell "not applicable" from "nil" — a nil commission is a seller payout where
+ * the rate happened to resolve to zero, and those post differently.
+ *
+ * The same argument removes `storeId`, `sellerName`, `sellerEmail`,
+ * `grossAmount`, `platformFeeRate`, `gatewayFee*`, `orderIds` and
+ * `refundDeductions`. A field that cannot apply is omitted so `tsc` refuses
+ * the read, rather than present-and-empty so a reader quietly gets a falsy
+ * value.
+ */
+export interface EmployeePayoutDocument extends BaseDocument {
+    payeeType: "employee";
+    employeeUid: string;
+    employeeName: string;
+    /** PII, same treatment as a seller's. */
+    employeeEmail: Encrypted<string>;
+    amount: number;
+    currency: string;
+    status: PayoutStatus;
+    paymentMethod: PayoutPaymentMethod;
+    bankAccount?: PayoutBankAccount;
+    upiId?: Encrypted<string>;
+    /**
+     * The tickets this payslip is for.
+     *
+     * 🛑 Tickets **still resolved at period end**, not tickets closed during it.
+     * Paying per ticket closed rewards closing rather than resolving, so a
+     * reopened ticket does not count — see `resolvedTicketsForPeriod`.
+     */
+    ticketIds: string[];
+    /** Resolved by `payPeriodFor`, never computed at a call site. */
+    periodStart: Date;
+    periodEnd: Date;
+    payCadence: PayCadence;
+    notes?: string;
+    adminNote?: string;
+    requestedAt: Date;
+    processedAt?: Date;
+    transactionId?: string;
+    statusHistory?: StatusChangeEntry[];
+    statusHistoryTruncated?: number;
+}
+/**
+ * What ~30 existing readers mean, and what they should keep meaning.
+ *
+ * Deliberately an alias rather than a rename: see the header on
+ * `StorePayoutDocument`.
+ */
+export type PayoutDocument = StorePayoutDocument;
+/** Use this ONLY where both kinds genuinely arrive together. */
+export type AnyPayoutDocument = StorePayoutDocument | EmployeePayoutDocument;
+/**
+ * 🛑 Narrow on the DISCRIMINANT, never on the presence of `storeId`.
+ *
+ * A `"storeId" in payout` test reads as equivalent and is not: it answers a
+ * question about the object in hand rather than about what the row IS, so a
+ * partially-populated or hand-built object answers it wrongly, silently, and
+ * in the direction that posts wages as a settled seller liability.
+ */
+export declare function isStorePayout(p: AnyPayoutDocument): p is StorePayoutDocument;
+export declare function isEmployeePayout(p: AnyPayoutDocument): p is EmployeePayoutDocument;
 /**
  * The fields whose changes earn a timeline entry.
  *

package/dist/features/payments/schemas/firestore.js

@@ -8,6 +8,20 @@ export const PayoutStatusValues = {
     PAID: "paid",
     FAILED: "failed",
 };
+/**
+ * 🛑 Narrow on the DISCRIMINANT, never on the presence of `storeId`.
+ *
+ * A `"storeId" in payout` test reads as equivalent and is not: it answers a
+ * question about the object in hand rather than about what the row IS, so a
+ * partially-populated or hand-built object answers it wrongly, silently, and
+ * in the direction that posts wages as a settled seller liability.
+ */
+export function isStorePayout(p) {
+    return p.payeeType === "store";
+}
+export function isEmployeePayout(p) {
+    return p.payeeType === "employee";
+}
 /**
  * The fields whose changes earn a timeline entry.
  *
@@ -36,6 +50,15 @@ export const PAYOUT_INDEXED_FIELDS = [
 ];
 export const DEFAULT_PLATFORM_FEE_RATE = 0.05;
 export const DEFAULT_PAYOUT_DATA = {
+    /*
+     * 🛑 Here as a BACKSTOP, not as the reason the field is set. Every caller
+     * passes `payeeType` explicitly and must keep doing so — a default that is
+     * the only writer makes the discriminant optional in practice, which is the
+     * exact failure the required field exists to prevent. This catches a row
+     * built by some path nobody enumerated and lands it on the correct side of
+     * the books rather than on neither.
+     */
+    payeeType: "store",
     status: "pending",
     platformFeeRate: DEFAULT_PLATFORM_FEE_RATE,
     orderIds: [],

package/dist/features/pricing/components/AdminPricingView.d.ts

@@ -0,0 +1,13 @@
+import React from "react";
+export interface AdminPricingViewProps {
+    /**
+     * The rate endpoint, supplied by the consumer.
+     *
+     * 🛑 REQUIRED, with no default. appkit cannot import `API_ROUTES` (that is
+     * consumer-side), so a default would be a path literal living in the
+     * library — a second place the route is written, and the one nobody updates
+     * when it moves. `audit-hardcoded-api-routes` blocks it, correctly.
+     */
+    endpoint: string;
+}
+export declare function AdminPricingView({ endpoint }: AdminPricingViewProps): React.JSX.Element;

package/dist/features/pricing/components/AdminPricingView.js

@@ -0,0 +1,157 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { Badge, Button, Heading, Row, Stack, Text } from "../../../ui/index.js";
+import { Modal } from "../../../ui/components/Modal.js";
+import { useToast } from "../../../ui/components/Toast.js";
+import { Form } from "../../../ui/components/Form.js";
+import { FieldInput } from "../../../ui/forms/FieldInput.js";
+import { FieldTextarea } from "../../../ui/forms/FieldTextarea.js";
+import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary.js";
+import { apiClient } from "../../../http/ApiClient.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { RATE_TIER_ORDER, } from "../../../_internal/shared/features/pricing/rate-registry.js";
+const TIER_LABEL = {
+    statutory: "Statutory",
+    policy: "Policy ceiling",
+    operational: "Operational",
+};
+const TIER_BLURB = {
+    statutory: "Set by law, not by us. Sourced per HSN code in Tax codes — they deliberately do not appear below.",
+    policy: "A ceiling the owner decides. Administrator only, and a reason is required.",
+    operational: "Tuned, audited and reversible by back-office staff.",
+};
+const TIER_TONE = {
+    statutory: "warning",
+    policy: "info",
+    operational: "default",
+};
+/**
+ * 🛑 Format by the descriptor's UNIT, never by guessing from the value.
+ *
+ * `2` is 2% as a commission, ₹2 as a floor and 2 days as a hold, and the three
+ * are side by side in one table. A bare number would make the COD ceiling and
+ * the COD percentage read as the same kind of thing.
+ */
+function formatRate(value, unit) {
+    if (value === null)
+        return "—";
+    switch (unit) {
+        case "percent":
+            return `${value}%`;
+        case "rupees":
+            return `₹${value.toLocaleString("en-IN")}`;
+        case "days":
+            return value === 1 ? "1 day" : `${value} days`;
+        case "minutes":
+            return value === 1 ? "1 minute" : `${value} minutes`;
+        case "count":
+            return String(value);
+    }
+}
+function formatWhen(iso) {
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? "—" : d.toLocaleDateString("en-IN", { dateStyle: "medium" });
+}
+export function AdminPricingView({ endpoint }) {
+    const { showToast } = useToast();
+    const [rates, setRates] = useState(null);
+    const [loadError, setLoadError] = useState(null);
+    const [editing, setEditing] = useState(null);
+    const [draftValue, setDraftValue] = useState("");
+    const [draftReason, setDraftReason] = useState("");
+    const [saving, setSaving] = useState(false);
+    const load = useCallback(async () => {
+        setLoadError(null);
+        try {
+            const payload = await apiClient.get(endpoint);
+            setRates(payload?.rates ?? []);
+        }
+        catch (err) {
+            /*
+             * Surfaced, never swallowed into an empty table. An empty rate list and
+             * a failed read look identical, and the first reads as "we charge
+             * nothing" (Root Cause #59/#72 — undefined must never render as zero).
+             *
+             * 🛑 A FIXED string, never `normalized.message`. The server's own text
+             * is how a Node `MODULE_NOT_FOUND` with a require stack ended up inside
+             * "Place your bid" (Root Cause #86) — and `mapToHttpError` scrubs 5xx
+             * messages in production anyway, so the raw value is either useless or
+             * dangerous. `normalizeError` still runs: it is what keeps `unknown`
+             * out of the catch body.
+             */
+            void normalizeError(err);
+            setLoadError("Could not load the rate table. Try again.");
+            setRates([]);
+        }
+    }, [endpoint]);
+    useEffect(() => {
+        void load();
+    }, [load]);
+    const byTier = useMemo(() => {
+        const groups = new Map();
+        for (const tier of RATE_TIER_ORDER)
+            groups.set(tier, []);
+        for (const rate of rates ?? [])
+            groups.get(rate.tier)?.push(rate);
+        return groups;
+    }, [rates]);
+    const openEditor = useCallback((rate) => {
+        setEditing(rate);
+        setDraftValue(rate.value === null ? "" : String(rate.value));
+        setDraftReason("");
+    }, []);
+    const submit = useCallback(async (setFieldError) => {
+        if (!editing)
+            return;
+        const parsed = Number(draftValue);
+        if (!Number.isFinite(parsed)) {
+            setFieldError("newValue", "Enter a number.");
+            return;
+        }
+        setSaving(true);
+        try {
+            await apiClient.post(endpoint, {
+                path: editing.path,
+                newValue: parsed,
+                ...(draftReason.trim() ? { reason: draftReason.trim() } : {}),
+            });
+            showToast(`${editing.label} updated.`, "success");
+            setEditing(null);
+            await load();
+        }
+        catch (err) {
+            void normalizeError(err);
+            /*
+             * 🛑 `toUserMessage`, never the server's own message — and no
+             * `?? normalized.message` fallback either. That fallback IS the bug:
+             * `toUserMessage` already terminates at `errors.codes.UNKNOWN`, so
+             * adding a raw-text branch for the unmapped case reintroduces exactly
+             * what Root Cause #86 describes — a require stack rendered inside a
+             * modal. The first draft of this file had it.
+             */
+            const code = err?.code;
+            setFieldError("newValue", toUserMessage(code ?? "UNKNOWN"));
+        }
+        finally {
+            setSaving(false);
+        }
+    }, [draftReason, draftValue, editing, endpoint, load, showToast]);
+    return (_jsxs(Stack, { gap: "loose", children: [_jsxs(Stack, { gap: "dense", children: [_jsx(Heading, { level: 1, children: "Pricing" }), _jsx(Text, { color: "muted", children: "Every rate the platform charges, what kind of number it is, and when it last moved. Changes take effect from the moment they are saved and never restate past orders." })] }), loadError ? (_jsxs(Stack, { surface: "danger-surface", padding: "md", rounded: "lg", gap: "dense", children: [_jsx(Text, { weight: "semibold", children: "The rate table could not be loaded." }), _jsx(Text, { size: "sm", children: loadError }), _jsx(Row, { children: _jsx(Button, { variant: "secondary", onClick: () => void load(), children: "Try again" }) })] })) : null, RATE_TIER_ORDER.map((tier) => {
+                const rows = byTier.get(tier) ?? [];
+                /*
+                 * The statutory section renders with NO rows and that is the point —
+                 * it tells a reader the tier exists and where it is set. Hiding an
+                 * empty section would make statutory rates look like something this
+                 * platform does not have.
+                 */
+                if (rows.length === 0 && tier !== "statutory")
+                    return null;
+                return (_jsxs(Stack, { gap: "comfortable", children: [_jsxs(Stack, { gap: "dense", children: [_jsxs(Row, { gap: "dense", align: "center", children: [_jsx(Heading, { level: 2, children: TIER_LABEL[tier] }), _jsx(Badge, { variant: TIER_TONE[tier], children: rows.length || "set elsewhere" })] }), _jsx(Text, { size: "sm", color: "muted", children: TIER_BLURB[tier] })] }), rows.map((rate) => (_jsxs(Row, { surface: "card", padding: "card", rounded: "lg", gap: "comfortable", align: "start", justify: "between", children: [_jsxs(Stack, { gap: "dense", children: [_jsxs(Row, { gap: "dense", align: "center", children: [_jsx(Text, { weight: "semibold", children: rate.label }), rate.sellerOnly ? _jsx(Badge, { variant: "default", children: "Seller-facing" }) : null] }), _jsx(Text, { size: "sm", color: "muted", children: rate.description }), rate.lastChange ? (_jsxs(Text, { size: "xs", color: "muted", children: [formatRate(rate.lastChange.previousValue, rate.unit), " \u2192", " ", formatRate(rate.lastChange.newValue, rate.unit), " on", " ", formatWhen(rate.lastChange.effectiveFrom), rate.lastChange.changedByName ? ` by ${rate.lastChange.changedByName}` : "", rate.lastChange.reason ? ` — ${rate.lastChange.reason}` : ""] })) : (_jsx(Text, { size: "xs", color: "muted", children: "No recorded change \u2014 this is the value it was configured with." }))] }), _jsxs(Row, { gap: "comfortable", align: "center", children: [_jsx(Text, { weight: "bold", numeric: true, children: formatRate(rate.value, rate.unit) }), _jsx(Button, { variant: "secondary", size: "sm", disabled: !rate.editable, onClick: () => openEditor(rate), children: "Change" })] })] }, rate.path)))] }, tier));
+            }), _jsx(Modal, { isOpen: editing !== null, onClose: () => setEditing(null), title: editing ? `Change ${editing.label}` : "Change rate", children: editing ? (_jsx(Form, { onSubmit: (e) => e.preventDefault(), children: ({ setFieldError, clearErrors }) => (_jsxs(Stack, { gap: "comfortable", children: [_jsx(FormErrorSummary, {}), _jsx(Text, { size: "sm", color: "muted", children: editing.description }), _jsx(FieldInput, { name: "newValue", label: `New value (${editing.unit})`, required: true, value: draftValue, onChange: setDraftValue }), _jsx(FieldTextarea, { name: "reason", label: editing.tier === "policy" ? "Reason (required)" : "Reason (optional)", value: draftReason, onChange: setDraftReason }), _jsx(Text, { size: "xs", color: "muted", children: "This takes effect now. Orders, invoices and payouts already recorded keep the rate they were charged at \u2014 nothing is restated." }), _jsxs(Row, { gap: "dense", justify: "end", children: [_jsx(Button, { variant: "ghost", onClick: () => setEditing(null), children: "Cancel" }), _jsx(Button, { action: ACTIONS.ADMIN["update-pricing"], isLoading: saving, onClick: () => {
+                                            clearErrors();
+                                            void submit(setFieldError);
+                                        } })] })] })) })) : null })] }));
+}

package/dist/features/products/schemas/firestore.d.ts

@@ -603,6 +603,31 @@ export interface ProductDocument extends BaseDocument {
     howToUse?: string[];
     allowOffers?: boolean;
     minOfferPercent?: number;
+    /**
+     * The seller permits a COORDINATED purchase on this listing.
+     *
+     * ## 🛑 A coordinated purchase is a SPECIALISED OFFER, not a listing type
+     *
+     * Owner, 2026-10-22: *"it is not a variant, it is similar to an offer, which
+     * the seller enables on the listing, then the customer can coordinate on it,
+     * it is a specialized offer."*
+     *
+     * That framing REMOVES work rather than adding it, and the removals are the
+     * part worth knowing — otherwise somebody rebuilds them:
+     *
+     * | Looks like it needs | Actually |
+     * |---|---|
+     * | a 7th `OrderSourceContext` variant | **nothing** — it is `offer-accepted`, and the provenance card already renders that branch |
+     * | an `orderType` tab | **nothing** — the Offer-wins tab already covers it |
+     * | a commit/settlement path | the offer lifecycle, with its chain fields, `checkoutDeadline` and lapse sweep |
+     * | a new money term | **none** — `unitPriceFor` already honours `lockedPrice`, so tax, payout base, refund ceiling and the invoice all follow |
+     *
+     * So this flag is deliberately shaped exactly like `allowOffers` above: same
+     * optional boolean, same seller control, same projection list. A listing
+     * with `allowOffers: false` and this `true` is coherent — the seller takes
+     * no solo offers but will consider a group — and nothing needs to forbid it.
+     */
+    allowCoordination?: boolean;
     customFields?: CustomField[];
     customSections?: CustomSection[];
     sublistingCategoryId?: string;
@@ -837,7 +862,7 @@ export declare const ProductStatusValues: {
 export declare const PRODUCT_COLLECTION: "products";
 export declare const PRODUCT_INDEXED_FIELDS: readonly ["storeId", "status", "category", "categoryIds", "featured", "listingType", "isPromoted", "isOnSale", "isSold", "searchTxt", "createdAt", "barcodeId", "physicalLocation.zone"];
 export declare const DEFAULT_PRODUCT_DATA: Partial<ProductDocument>;
-export declare const PRODUCT_PUBLIC_FIELDS: readonly ["allowOffers", "minOfferPercent", "id", "title", "description", "category", "categoryIds", "categoryIdNames", "subcategory", "brand", "price", "originalPrice", "currency", "stockQuantity", "availableQuantity", "images", "status", "storeName", "featured", "tags", "specifications", "features", "shippingInfo", "returnPolicy", "finalSale", "isLot", "lotSize", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "views7d", "views30d", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "listingType", "auctionEndDate", "startingBid", "currentBid", "bidCount", "reservePrice", "buyNowPrice", "minBidIncrement", "autoExtendable", "auctionExtensionMinutes", "auctionShippingPaidBy", "bidsHaveStarted", "grading", "card", "classified", "digitalCode", "liveItem", "catalogProductId", "preOrderDeliveryDate", "preOrderDepositPercent", "preOrderDepositAmount", "preOrderMaxQuantity", "preOrderCurrentCount", "preOrderProductionStatus", "preOrderCancellable", "condition", "insurance", "insuranceCost", "shippingPaidBy", "isPromoted", "isOnSale", "isSold", "madeToOrder", "sourceStickerSheetId", "sourceStickerPartOrdinal", "slug", "seoTitle", "seoDescription", "seoKeywords", "viewCount", "customFields", "customSections", "sublistingCategoryId", "groupId", "isGroupParent", "groupParentSlug", "groupChildSlugs", "groupTitle", "groupMinMembers", "groupMaxMembers", "groupMaxUnitsPerMember", "groupRequiredMemberIds", "groupDiscountPercent", "createdAt"];
+export declare const PRODUCT_PUBLIC_FIELDS: readonly ["allowOffers", "minOfferPercent", "allowCoordination", "id", "title", "description", "category", "categoryIds", "categoryIdNames", "subcategory", "brand", "price", "originalPrice", "currency", "stockQuantity", "availableQuantity", "images", "status", "storeName", "featured", "tags", "specifications", "features", "shippingInfo", "returnPolicy", "finalSale", "isLot", "lotSize", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "views7d", "views30d", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "listingType", "auctionEndDate", "startingBid", "currentBid", "bidCount", "reservePrice", "buyNowPrice", "minBidIncrement", "autoExtendable", "auctionExtensionMinutes", "auctionShippingPaidBy", "bidsHaveStarted", "grading", "card", "classified", "digitalCode", "liveItem", "catalogProductId", "preOrderDeliveryDate", "preOrderDepositPercent", "preOrderDepositAmount", "preOrderMaxQuantity", "preOrderCurrentCount", "preOrderProductionStatus", "preOrderCancellable", "condition", "insurance", "insuranceCost", "shippingPaidBy", "isPromoted", "isOnSale", "isSold", "madeToOrder", "sourceStickerSheetId", "sourceStickerPartOrdinal", "slug", "seoTitle", "seoDescription", "seoKeywords", "viewCount", "customFields", "customSections", "sublistingCategoryId", "groupId", "isGroupParent", "groupParentSlug", "groupChildSlugs", "groupTitle", "groupMinMembers", "groupMaxMembers", "groupMaxUnitsPerMember", "groupRequiredMemberIds", "groupDiscountPercent", "createdAt"];
 export declare const PRODUCT_UPDATABLE_FIELDS: readonly ["title", "description", "category", "categoryIds", "subcategory", "brand", "price", "originalPrice", "stockQuantity", "images", "status", "tags", "specifications", "features", "shippingInfo", "returnPolicy", "finalSale", "isLot", "lotSize", "physicalLocation", "sku", "pickupAddressId", "condition", "insurance", "shippingPaidBy", "autoExtendable", "auctionExtensionMinutes", "auctionShippingPaidBy", "reservePrice", "buyNowPrice", "minBidIncrement", "bidsHaveStarted", "grading", "card", "classified", "digitalCode", "liveItem", "catalogProductId", "listingType", "preOrderDeliveryDate", "preOrderDepositPercent", "preOrderDepositAmount", "preOrderMaxQuantity", "preOrderProductionStatus", "preOrderCancellable", "isOnSale", "isSold", "madeToOrder", "sourceStickerSheetId", "sourceStickerPartOrdinal", "allowShipBeforeEmiComplete", "gstRate", "hsnCode", "authenticity", "printMeta", "seoTitle", "seoDescription", "seoKeywords", "customFields", "customSections", "sublistingCategoryId", "groupId", "isGroupParent", "groupParentSlug", "groupChildSlugs", "groupTitle", "groupMinMembers", "groupMaxMembers", "groupMaxUnitsPerMember", "groupRequiredMemberIds", "groupDiscountPercent", "barcodeId"];
 export type ProductCreateInput = Omit<ProductDocument, "id" | "createdAt" | "updatedAt" | "availableQuantity" | "bidCount" | "currentBid" | "auctionOriginalEndDate">;
 export type ProductUpdateInput = Partial<Pick<ProductDocument, (typeof PRODUCT_UPDATABLE_FIELDS)[number]>>;

package/dist/features/products/schemas/firestore.js

@@ -142,6 +142,8 @@ export const PRODUCT_PUBLIC_FIELDS = [
     // the moment something starts projecting through it.
     "allowOffers",
     "minOfferPercent",
+    /* Same reasoning as `allowOffers`: the card renders a pill from it. */
+    "allowCoordination",
     "id",
     "title",
     "description",

package/dist/features/products/schemas/index.d.ts

@@ -449,10 +449,10 @@ export declare const productItemSchema: z.ZodObject<{
         wonByOrderId?: string | undefined;
     }[] | undefined;
     prizeGithubFileUrl?: string | undefined;
+    attributes?: Record<string, string> | undefined;
     inStock?: boolean | undefined;
     sellerAvatar?: string | undefined;
     stockCount?: number | undefined;
-    attributes?: Record<string, string> | undefined;
 }, {
     status: "published" | "draft" | "in_review" | "archived";
     id: string;
@@ -589,10 +589,10 @@ export declare const productItemSchema: z.ZodObject<{
         wonByOrderId?: string | undefined;
     }[] | undefined;
     prizeGithubFileUrl?: string | undefined;
+    attributes?: Record<string, string> | undefined;
     inStock?: boolean | undefined;
     sellerAvatar?: string | undefined;
     stockCount?: number | undefined;
-    attributes?: Record<string, string> | undefined;
 }>;
 /** Base Zod schema for list-query parameters. */
 export declare const productListParamsSchema: z.ZodObject<{

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -52,6 +52,20 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
     findApprovedByStore(storeId: string, limit?: number): Promise<ReviewDocument[]>;
     findByUser(userId: string): Promise<ReviewDocument[]>;
     findApprovedByUser(userId: string): Promise<ReviewDocument[]>;
+    /**
+     * How many reviews this account has WRITTEN.
+     *
+     * Deliberately every status and both reviewer roles — it counts the same set
+     * `GET /api/user/reviews` lists by default (`findByUser`), so the number in
+     * the sidebar and the rows on the page it links to agree by construction. A
+     * count that quietly excluded pending reviews would read as the author's
+     * work having vanished.
+     *
+     * An aggregation, not `findByUser(...).length`: that sibling downloads every
+     * review the account has ever written to learn how many there are, and the
+     * caller here runs on every session profile fetch.
+     */
+    countByUser(userId: string): Promise<number>;
     findPending(): Promise<ReviewDocument[]>;
     findByStatus(status: ReviewStatus): Promise<ReviewDocument[]>;
     /**

package/dist/features/reviews/repository/reviews.repository.js

@@ -175,6 +175,22 @@ class ReviewRepository extends BaseRepository {
             .get();
         return snapshot.docs.map((doc) => this.mapDoc(doc));
     }
+    /**
+     * How many reviews this account has WRITTEN.
+     *
+     * Deliberately every status and both reviewer roles — it counts the same set
+     * `GET /api/user/reviews` lists by default (`findByUser`), so the number in
+     * the sidebar and the rows on the page it links to agree by construction. A
+     * count that quietly excluded pending reviews would read as the author's
+     * work having vanished.
+     *
+     * An aggregation, not `findByUser(...).length`: that sibling downloads every
+     * review the account has ever written to learn how many there are, and the
+     * caller here runs on every session profile fetch.
+     */
+    async countByUser(userId) {
+        return getFirestoreCount(this.getCollection().where(REVIEW_FIELDS.USER_ID, "==", userId));
+    }
     async findPending() {
         return this.findBy(REVIEW_FIELDS.STATUS, "pending");
     }

package/dist/features/scams/repository/scammer.repository.js

@@ -142,7 +142,8 @@ class ScammerRepository extends BaseRepository {
                 reason: ctx?.reason,
                 note: ctx?.note,
                 // A scammer profile is built entirely from identifying details, and
-                // `encryptPiiFields` never descends into arrays.
+                // `encryptPiiFields` covers a field only where it is NAMED. It CAN
+                // reach into an array via `array[].key`, but a bare key does not.
                 piiFields: SCAMMER_HISTORY_PII_FIELDS,
             });
             const data = prepareForFirestore(withEntry ?? { ...input, updatedAt: new Date() });

package/dist/features/scams/schemas/firestore.d.ts

@@ -403,6 +403,7 @@ export declare const SCAMMER_TRACKED_FIELDS: readonly ["status", "verifiedBy", "
 /**
  * PII on this document, for `withHistory`'s scrub. A scammer profile is built
  * ENTIRELY out of identifying details, so this list is long on purpose —
- * `encryptPiiFields` never descends into arrays, and history is an array.
+ * `encryptPiiFields` covers only NAMED paths, and nobody is going to declare
+ * `statusHistory[].changes.<key>` for every field that might land there.
  */
 export declare const SCAMMER_HISTORY_PII_FIELDS: readonly ["name", "displayName", "email", "phone", "phoneNumber", "upiId", "bankAccount", "accountNumber", "reporterEmail", "reporterName"];

package/dist/features/scams/schemas/firestore.js

@@ -248,7 +248,8 @@ export const SCAMMER_TRACKED_FIELDS = [
 /**
  * PII on this document, for `withHistory`'s scrub. A scammer profile is built
  * ENTIRELY out of identifying details, so this list is long on purpose —
- * `encryptPiiFields` never descends into arrays, and history is an array.
+ * `encryptPiiFields` covers only NAMED paths, and nobody is going to declare
+ * `statusHistory[].changes.<key>` for every field that might land there.
  */
 export const SCAMMER_HISTORY_PII_FIELDS = [
     "name",