@mohasinac/appkit 4.63.4 → 4.64.0

package/dist/features/stores/repository/store.repository.js

@@ -16,6 +16,32 @@ export class StoreRepository extends BaseRepository {
     constructor() {
         super(STORE_COLLECTION);
     }
+    mapDoc(snap) {
+        return super.mapDoc(snap);
+    }
+    /**
+     * LIST reads never carry the WhatsApp token — not even encrypted.
+     *
+     * `mapDoc` above decrypts it, and `listStores(model, activeOnly)` backs the
+     * PUBLIC `/stores` page. Once `sieveQuery` started routing list rows through
+     * `mapDoc` (it previously mapped documents itself and skipped every
+     * override), that decrypt would have put a plaintext Meta OAuth bearer token
+     * on a public listing — the exact shape of Root Cause #70.
+     *
+     * So the list path deliberately does NOT call `decryptSecrets`, and drops
+     * `accessToken` outright: a list has no legitimate use for it, and a value
+     * that is never in the payload cannot be leaked by a projection someone
+     * forgets to write.
+     *
+     * Detail reads are unchanged — `findBySlug`/`findById` still decrypt, so the
+     * WhatsApp settings and catalog-sync routes keep working exactly as before.
+     * Removing the decrypt from `mapDoc` itself is a separate, riskier change
+     * that CLAUDE.md explicitly defers; this closes the public-exposure half
+     * without touching the encryption round-trip at all.
+     */
+    async update(id, data) {
+        return super.update(id, data);
+    }
     /**
      * Create a new store.
      * The document ID is set to storeSlug for easy URL-based lookups.
@@ -123,6 +149,29 @@ export class StoreRepository extends BaseRepository {
             // Auto-set isPublic when approved
             ...(status === StoreStatusValues.ACTIVE && { isPublic: true }),
             ...(status !== StoreStatusValues.ACTIVE && { isPublic: false }),
+            /*
+             * 🛑 LEAVING `active` REVOKES TRUST IMMEDIATELY — and this cannot
+             * wait for the monthly recompute.
+             *
+             * `trustedSeller` means the store is paid at SHIPPING rather than at
+             * delivery, so a suspended store that kept the flag would go on
+             * being paid before parcels land for up to 31 days, on a decision
+             * the suspension has just reversed. `sellerStandingRollup` caches
+             * its verdict monthly; this is the one place that cache must not be
+             * trusted.
+             *
+             * Both fields are tracked, so the clear earns its own timeline
+             * entry alongside the status change. Re-granting is NOT automatic on
+             * re-activation: the next month-end run decides, which is the
+             * correct direction for a flag that moves money.
+             *
+             * `extra` is spread AFTER, so an admin explicitly setting a tier in
+             * the same request still wins — the override stays authoritative.
+             */
+            ...(status !== StoreStatusValues.ACTIVE && {
+                trustedSeller: false,
+                sellerTier: "seller",
+            }),
             ...extra,
             updatedAt: new Date(),
         }, ctx, "setStatus"));
@@ -206,7 +255,9 @@ export class StoreRepository extends BaseRepository {
             options: { maxPageSize: win.maxPageSize(100) },
             fields: sieveFields,
             // Called DIRECTLY, not through `sieveQuery`, so the mapper has to be
-            // passed by hand. With `activeOnly` this is the public /stores listing.
+            // passed by hand — and it is the list mapper, never `mapDoc`. With
+            // `activeOnly` this is the public /stores listing; `mapDoc` decrypts the
+            // WhatsApp bearer token and a list has no use for it.
             mapDoc: (snap) => this.mapDocForList(snap),
         });
         const searched = win.finish(result);

package/dist/features/stores/schemas/firestore.d.ts

@@ -5,6 +5,7 @@
  * and helpers for the stores feature.
  */
 import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
+import type { SellerTier, SellerStandingCriterion } from "../../../_internal/shared/features/seller-standing/config";
 import type { StoreCapability } from "../../auth/permissions/constants";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 export type ShippingProviderType = "self-courier" | "store-pickup" | "custom";
@@ -107,6 +108,19 @@ export interface StoreDocument extends BaseDocument {
     adminNotes?: string;
     /** Admin "verified store" badge — distinct from `status`/`isPublic`. */
     isVerified?: boolean;
+    /**
+     * Does this store subscribe to WhatsApp order notifications?
+     *
+     * A monthly add-on priced by the admin (`commissions.whatsappNotifyMonthlyFee`),
+     * not a per-order charge: the platform owns one WhatsApp number, so the cost
+     * is standing and borne by the seller who benefits, rather than a line item
+     * a buyer opts into per order.
+     *
+     * 🛑 Absent means NOT subscribed, and the gate fails closed on it. Defaulting
+     * a missing flag to `true` would message customers on behalf of every seller
+     * who never signed up, and bill the platform for each template.
+     */
+    whatsappNotifySubscribed?: boolean;
     /**
      * Paid at SHIPPING rather than at delivery.
      *
@@ -128,6 +142,61 @@ export interface StoreDocument extends BaseDocument {
      * payout.
      */
     trustedSeller?: boolean;
+    /**
+     * The EARNED, PUBLIC tier.
+     *
+     * 🛑 Deliberately a second field rather than reusing `trustedSeller`, which
+     * means "paid at shipping" and is private by design (see directly above —
+     * "A store does not get to display that we trust it"). The monthly rollup
+     * writes BOTH together on a transition: `sellerTier` is what a buyer sees,
+     * `trustedSeller` is what the payout sweep reads. Collapsing them into one
+     * field would either leak the risk posture into the public projection or
+     * make the badge unrenderable.
+     *
+     * Absent means `"seller"`. There is no `"pending"` — a store that has not
+     * earned the tier simply has the base one.
+     */
+    sellerTier?: SellerTier;
+    /**
+     * The cached standing computation behind `sellerTier`.
+     *
+     * 🛑 This IS the cache. It is recomputed by `sellerStandingRollup` on the
+     * last day of each month and read straight off the store document by the
+     * seller's progress panel, the badge and the admin view — none of which
+     * recompute anything. `computedAt` / `nextComputeAt` are rendered to the
+     * seller, because without them a seller who shipped twenty orders this week
+     * will read an unchanged panel as broken rather than as monthly.
+     *
+     * Metrics only — no buyer uids, no addresses, nothing that could make this
+     * a PII store. The address criterion is counted from HMAC fingerprints and
+     * only the COUNT is kept.
+     */
+    standing?: {
+        computedAt: Date | string;
+        nextComputeAt?: Date | string;
+        windowDays: number;
+        deliveredOrders: number;
+        distinctBuyers: number;
+        distinctAddresses: number;
+        ratedOrders: number;
+        averageRating: number;
+        met: Record<SellerStandingCriterion, boolean>;
+    };
+    /**
+     * An admin set `sellerTier` by hand; the monthly rollup must not move it.
+     *
+     * 🛑 TOP-LEVEL, not a key inside `standing`, and the distinction is the
+     * point: `standing` is a MEASUREMENT — every field in it is recomputed from
+     * scratch each month — while this is a DECISION that must outlive the
+     * measurement. Nesting it meant a store could not be pinned without also
+     * fabricating a metrics block, which is why the platform store's seed could
+     * not express "trusted, don't touch" without inventing figures nobody had
+     * measured.
+     *
+     * PRIVATE. It tells a buyer nothing about the goods or the seller; it is a
+     * note about how we administer this record.
+     */
+    tierLockedByAdmin?: boolean;
     /** Reason recorded when `status` is set to "suspended". */
     suspensionReason?: string;
     stats?: {
@@ -368,14 +437,11 @@ export interface StoreDocument extends BaseDocument {
  * the store owner or the public, and `statusHistory` rides on the store
  * document the owner can read.
  */
-export declare const STORE_TRACKED_FIELDS: readonly ["status", "isPublic", "isVerified", "isFeatured", "suspensionReason", "capabilities"];
+export declare const STORE_TRACKED_FIELDS: readonly ["status", "isPublic", "isVerified", "isFeatured", "suspensionReason", "capabilities", "sellerTier", "trustedSeller"];
 /**
- * PII on this document, for the `withHistory` scrub.
- *
- * `accessToken` stays listed although the WhatsApp integration that produced
- * one was removed 2026-10-20: a scrub list is cheap, and a future secret
- * reaching this document under that name should be scrubbed by default
- * rather than by someone remembering to add it.
+ * PII on this document, for `withHistory`'s scrub. `whatsappConfig.accessToken`
+ * is a live Meta credential; `mapDoc` decrypts it on EVERY read, so it is
+ * present in memory whenever a diff runs.
  */
 export declare const STORE_HISTORY_PII_FIELDS: readonly ["accessToken", "payoutDetails", "upiVpa", "accountNumber"];
 export type { StoreCapability } from "../../auth/permissions/constants";
@@ -408,6 +474,9 @@ export declare const STORE_FIELDS: {
     readonly IS_FEATURED: "isFeatured";
     readonly IS_VERIFIED: "isVerified";
     readonly TRUSTED_SELLER: "trustedSeller";
+    readonly SELLER_TIER: "sellerTier";
+    readonly STANDING: "standing";
+    readonly TIER_LOCKED_BY_ADMIN: "tierLockedByAdmin";
     readonly SUSPENSION_REASON: "suspensionReason";
     readonly CAPABILITIES: "capabilities";
     readonly STATUS_VALUES: {

package/dist/features/stores/schemas/firestore.js

@@ -31,14 +31,26 @@ export const STORE_TRACKED_FIELDS = [
     "isFeatured",
     "suspensionReason",
     "capabilities",
+    /*
+     * Both halves of the trust decision are tracked, and both matter for
+     * different reasons. `sellerTier` is what the seller and every buyer saw, so
+     * "when did I lose the badge" has an answer. `trustedSeller` moves MONEY —
+     * it is the flag that pays this store before delivery — so the timeline is
+     * the record of when the platform started and stopped carrying that risk,
+     * alongside the `STORE_TRUST_CHANGE` audit row that names who decided it.
+     *
+     * 🛑 `standing` is deliberately NOT tracked. It is recomputed in full every
+     * month, so every field inside it changes on every run; tracking it would
+     * write a diff of five numbers monthly and exhaust the 50-entry FIFO cap
+     * within four years while burying the two transitions anyone reads.
+     */
+    "sellerTier",
+    "trustedSeller",
 ];
 /**
- * PII on this document, for the `withHistory` scrub.
- *
- * `accessToken` stays listed although the WhatsApp integration that produced
- * one was removed 2026-10-20: a scrub list is cheap, and a future secret
- * reaching this document under that name should be scrubbed by default
- * rather than by someone remembering to add it.
+ * PII on this document, for `withHistory`'s scrub. `whatsappConfig.accessToken`
+ * is a live Meta credential; `mapDoc` decrypts it on EVERY read, so it is
+ * present in memory whenever a diff runs.
  */
 export const STORE_HISTORY_PII_FIELDS = [
     "accessToken",
@@ -75,6 +87,9 @@ export const STORE_FIELDS = {
     IS_FEATURED: "isFeatured",
     IS_VERIFIED: "isVerified",
     TRUSTED_SELLER: "trustedSeller",
+    SELLER_TIER: "sellerTier",
+    STANDING: "standing",
+    TIER_LOCKED_BY_ADMIN: "tierLockedByAdmin",
     SUSPENSION_REASON: "suspensionReason",
     CAPABILITIES: "capabilities",
     STATUS_VALUES: {

package/dist/features/stores/schemas/index.d.ts

@@ -347,6 +347,60 @@ export declare const storeFirestoreSchema: z.ZodObject<{
         defaultProviderId: string;
     }>>;
     emiEnabled: z.ZodOptional<z.ZodBoolean>;
+    whatsappConfig: z.ZodOptional<z.ZodObject<{
+        phoneNumber: z.ZodOptional<z.ZodString>;
+        wabaId: z.ZodOptional<z.ZodString>;
+        catalogId: z.ZodOptional<z.ZodString>;
+        accessToken: z.ZodOptional<z.ZodString>;
+        catalogSyncEnabled: z.ZodBoolean;
+        lastCatalogSyncAt: z.ZodOptional<z.ZodUnion<[z.ZodDate, z.ZodString, z.ZodObject<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough">>]>>;
+        lastSyncCount: z.ZodOptional<z.ZodNumber>;
+        lastSyncStatus: z.ZodOptional<z.ZodEnum<["success", "partial", "failed"]>>;
+        connected: z.ZodBoolean;
+        connectedAt: z.ZodOptional<z.ZodUnion<[z.ZodDate, z.ZodString, z.ZodObject<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough">>]>>;
+    }, "strip", z.ZodTypeAny, {
+        catalogSyncEnabled: boolean;
+        connected: boolean;
+        phoneNumber?: string | undefined;
+        accessToken?: string | undefined;
+        wabaId?: string | undefined;
+        catalogId?: string | undefined;
+        lastCatalogSyncAt?: string | Date | z.objectOutputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+        lastSyncCount?: number | undefined;
+        lastSyncStatus?: "success" | "failed" | "partial" | undefined;
+        connectedAt?: string | Date | z.objectOutputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+    }, {
+        catalogSyncEnabled: boolean;
+        connected: boolean;
+        phoneNumber?: string | undefined;
+        accessToken?: string | undefined;
+        wabaId?: string | undefined;
+        catalogId?: string | undefined;
+        lastCatalogSyncAt?: string | Date | z.objectInputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+        lastSyncCount?: number | undefined;
+        lastSyncStatus?: "success" | "failed" | "partial" | undefined;
+        connectedAt?: string | Date | z.objectInputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     status: "pending" | "active" | "rejected" | "suspended";
     id: string;
@@ -416,6 +470,22 @@ export declare const storeFirestoreSchema: z.ZodObject<{
         maxReviews?: number | undefined;
         minRating?: number | undefined;
     } | undefined;
+    whatsappConfig?: {
+        catalogSyncEnabled: boolean;
+        connected: boolean;
+        phoneNumber?: string | undefined;
+        accessToken?: string | undefined;
+        wabaId?: string | undefined;
+        catalogId?: string | undefined;
+        lastCatalogSyncAt?: string | Date | z.objectOutputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+        lastSyncCount?: number | undefined;
+        lastSyncStatus?: "success" | "failed" | "partial" | undefined;
+        connectedAt?: string | Date | z.objectOutputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+    } | undefined;
 }, {
     status: "pending" | "active" | "rejected" | "suspended";
     id: string;
@@ -485,6 +555,22 @@ export declare const storeFirestoreSchema: z.ZodObject<{
         maxReviews?: number | undefined;
         minRating?: number | undefined;
     } | undefined;
+    whatsappConfig?: {
+        catalogSyncEnabled: boolean;
+        connected: boolean;
+        phoneNumber?: string | undefined;
+        accessToken?: string | undefined;
+        wabaId?: string | undefined;
+        catalogId?: string | undefined;
+        lastCatalogSyncAt?: string | Date | z.objectInputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+        lastSyncCount?: number | undefined;
+        lastSyncStatus?: "success" | "failed" | "partial" | undefined;
+        connectedAt?: string | Date | z.objectInputType<{
+            toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
+        }, z.ZodTypeAny, "passthrough"> | undefined;
+    } | undefined;
 }>;
 export type StoreFromSchema = z.infer<typeof storeFirestoreSchema>;
 /** Zod schema for store status — use instead of inline `z.enum(["pending",...])`. */
@@ -530,10 +616,10 @@ export declare const storeListItemSchema: z.ZodObject<{
     storeDescription?: string | undefined;
     storeLogoURL?: string | undefined;
     storeBannerURL?: string | undefined;
+    averageRating?: number | undefined;
     totalProducts?: number | undefined;
     itemsSold?: number | undefined;
     totalReviews?: number | undefined;
-    averageRating?: number | undefined;
 }, {
     status: string;
     id: string;
@@ -546,10 +632,10 @@ export declare const storeListItemSchema: z.ZodObject<{
     storeDescription?: string | undefined;
     storeLogoURL?: string | undefined;
     storeBannerURL?: string | undefined;
+    averageRating?: number | undefined;
     totalProducts?: number | undefined;
     itemsSold?: number | undefined;
     totalReviews?: number | undefined;
-    averageRating?: number | undefined;
 }>;
 export declare const storeListParamsSchema: z.ZodObject<{
     category: z.ZodOptional<z.ZodString>;

package/dist/features/stores/schemas/index.js

@@ -92,6 +92,20 @@ export const storeFirestoreSchema = z.object({
         .optional(),
     shippingConfig: storeShippingConfigSchema.optional(),
     emiEnabled: z.boolean().optional(),
+    whatsappConfig: z
+        .object({
+        phoneNumber: z.string().optional(),
+        wabaId: z.string().optional(),
+        catalogId: z.string().optional(),
+        accessToken: z.string().optional(),
+        catalogSyncEnabled: z.boolean(),
+        lastCatalogSyncAt: firestoreDateSchema.optional(),
+        lastSyncCount: z.number().int().optional(),
+        lastSyncStatus: z.enum(["success", "partial", "failed"]).optional(),
+        connected: z.boolean(),
+        connectedAt: firestoreDateSchema.optional(),
+    })
+        .optional(),
     ...auditTimestampsShape,
 });
 /** Zod schema for store status — use instead of inline `z.enum(["pending",...])`. */

package/dist/features/stores/schemas/store-create.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The store-creation input contract — ONE definition, shared by the form and
+ * the server action that writes it.
+ *
+ * 🛑 Why this file exists at all. `createStoreAction` carried its own inline
+ * `z.object({ storeName, storeDescription, storeCategory })` while nothing
+ * rendered a form, so there was exactly one copy and no drift. The moment a
+ * form exists there are two places that must agree about "2–80 characters",
+ * and a client that validates more loosely than the server produces a form
+ * that submits and then fails with a message pointing at no field; a client
+ * that validates more strictly refuses input the server would have accepted.
+ * Both are Root Cause #75's shape. The action imports this; it does not
+ * restate it.
+ *
+ * The bounds are not new — they are lifted verbatim from the action's own
+ * schema so this is a move, not a retune.
+ */
+import { z } from "zod";
+/**
+ * 🛑 `.or(z.literal(""))` on both optional fields, matching the action.
+ *
+ * An untouched text input submits `""`, not `undefined`. A bare
+ * `.max(80).optional()` rejects it, so a seller who filled in only the
+ * required name would be refused for leaving an optional field alone — which
+ * reads as a broken form, because the field they are being blocked on is one
+ * they were told was optional.
+ */
+export declare const storeCreateSchema: z.ZodObject<{
+    storeName: z.ZodString;
+    storeDescription: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
+    storeCategory: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
+}, "strip", z.ZodTypeAny, {
+    storeName: string;
+    storeCategory?: string | undefined;
+    storeDescription?: string | undefined;
+}, {
+    storeName: string;
+    storeCategory?: string | undefined;
+    storeDescription?: string | undefined;
+}>;
+export type StoreCreateInput = z.infer<typeof storeCreateSchema>;
+/** Field names, so a form and an error path cannot disagree by typo. */
+export declare const STORE_CREATE_FIELDS: {
+    readonly STORE_NAME: "storeName";
+    readonly STORE_DESCRIPTION: "storeDescription";
+    readonly STORE_CATEGORY: "storeCategory";
+};

package/dist/features/stores/schemas/store-create.js

@@ -0,0 +1,86 @@
+/**
+ * The store-creation input contract — ONE definition, shared by the form and
+ * the server action that writes it.
+ *
+ * 🛑 Why this file exists at all. `createStoreAction` carried its own inline
+ * `z.object({ storeName, storeDescription, storeCategory })` while nothing
+ * rendered a form, so there was exactly one copy and no drift. The moment a
+ * form exists there are two places that must agree about "2–80 characters",
+ * and a client that validates more loosely than the server produces a form
+ * that submits and then fails with a message pointing at no field; a client
+ * that validates more strictly refuses input the server would have accepted.
+ * Both are Root Cause #75's shape. The action imports this; it does not
+ * restate it.
+ *
+ * The bounds are not new — they are lifted verbatim from the action's own
+ * schema so this is a move, not a retune.
+ */
+import { z } from "zod";
+import { annotate } from "../../shell/field-ui-meta.js";
+/**
+ * 🛑 `.or(z.literal(""))` on both optional fields, matching the action.
+ *
+ * An untouched text input submits `""`, not `undefined`. A bare
+ * `.max(80).optional()` rejects it, so a seller who filled in only the
+ * required name would be refused for leaving an optional field alone — which
+ * reads as a broken form, because the field they are being blocked on is one
+ * they were told was optional.
+ */
+/*
+ * 🛑 ANNOTATED, and the annotations do not change what this parses.
+ *
+ * `annotate()` returns the same schema and registers its UI metadata in a side
+ * registry, so the server action validates exactly what it validated before.
+ * That is what lets ONE schema drive both the form's sections
+ * (`buildSectionsFromSchema`) and the server-side parse — the alternative is a
+ * second form-only schema, which is the drift this file exists to prevent.
+ *
+ * One section, because there is one: a store has a name, what it sells, and a
+ * category. `audit-form-sectionised` requires the fields to live in a section
+ * engine rather than a bare `<Form>`, which is also what gets this step the
+ * pinned mobile action bar every other form in the app has.
+ */
+export const storeCreateSchema = z.object({
+    storeName: annotate(z
+        .string()
+        .min(2, "Store name must be at least 2 characters")
+        .max(80, "Store name must be 80 characters or fewer"), {
+        section: "store",
+        sectionLabel: "Your store",
+        sectionRequired: true,
+        quick: true,
+        order: 1,
+        row: "full",
+        label: "Store name",
+        help: "Buyers see this. It also forms your store's web address.",
+    }),
+    storeDescription: annotate(z
+        .string()
+        .max(10000, "Description must be 10,000 characters or fewer")
+        .optional()
+        .or(z.literal("")), {
+        section: "store",
+        order: 2,
+        row: "full",
+        kind: "textarea",
+        label: "What do you sell?",
+        help: "Optional. A short introduction for your storefront page.",
+    }),
+    storeCategory: annotate(z
+        .string()
+        .max(80, "Category must be 80 characters or fewer")
+        .optional()
+        .or(z.literal("")), {
+        section: "store",
+        order: 3,
+        row: "full",
+        label: "Main category",
+        help: "Optional. Helps buyers browsing that category find your store.",
+    }),
+});
+/** Field names, so a form and an error path cannot disagree by typo. */
+export const STORE_CREATE_FIELDS = {
+    STORE_NAME: "storeName",
+    STORE_DESCRIPTION: "storeDescription",
+    STORE_CATEGORY: "storeCategory",
+};

package/dist/features/stores/types/index.d.ts

@@ -1,4 +1,5 @@
 import type { ListingType } from "../../products/types";
+import type { SellerTier, SellerStandingCriterion } from "../../../_internal/shared/features/seller-standing/config";
 export interface StoreListItem {
     id: string;
     storeSlug: string;
@@ -43,8 +44,49 @@ export interface StoreListItem {
      */
     sharedPurchaseHandlingFee?: number;
     sharedPurchaseExtraShippingPerDestination?: number;
+    /**
+     * Seller trust, as a buyer sees it.
+     *
+     * 🛑 Neither is optional, for the same reason as the flags above: the
+     * projection resolves absence (`?? false` / `?? "seller"`), so no client has
+     * to decide what `undefined` means. A badge component testing `!== "seller"`
+     * on an undefined value would render a TRUSTED badge on a store that has
+     * earned nothing.
+     *
+     * 🛑 There is deliberately no `trustedSeller` here and there must never be.
+     * That field means "we pay this store before delivery" — our risk posture,
+     * not an endorsement — and it is in `PRIVATE_STORE_FIELDS` for that reason.
+     */
+    isVerified: boolean;
+    sellerTier: SellerTier;
+    /**
+     * The cached standing metrics behind `sellerTier`, when they have ever been
+     * computed.
+     *
+     * OPTIONAL, unlike the two above, and that asymmetry is the point: absent
+     * means "never measured", which the seller's panel must render differently
+     * from a measured zero. Defaulting it would turn "we have not looked yet"
+     * into a confident "0 of 25".
+     */
+    standing?: SellerStandingSnapshot;
     createdAt?: string;
 }
+/**
+ * The public half of `StoreDocument.standing` — counts and a mean, nothing
+ * that identifies a buyer. The address criterion is counted from HMAC
+ * fingerprints and only the count is kept.
+ */
+export interface SellerStandingSnapshot {
+    computedAt: Date | string;
+    nextComputeAt?: Date | string;
+    windowDays: number;
+    deliveredOrders: number;
+    distinctBuyers: number;
+    distinctAddresses: number;
+    ratedOrders: number;
+    averageRating: number;
+    met: Record<SellerStandingCriterion, boolean>;
+}
 export interface StoreDetail extends StoreListItem {
     bio?: string;
     location?: string;

package/dist/features/whatsapp-bot/api/send-status/route.d.ts

@@ -0,0 +1,12 @@
+/**
+ * feat-whatsapp-bot — POST /api/whatsapp/send-status
+ *
+ * WhatsApp message delivery status update.
+ *
+ * Consumer stub:
+ * ```ts
+ * export { whatsappSendStatusPOST as POST } from "@mohasinac/feat-whatsapp-bot";
+ * ```
+ */
+import { NextResponse } from "next/server.js";
+export declare function POST(request: Request): Promise<NextResponse>;

package/dist/features/whatsapp-bot/api/send-status/route.js

@@ -0,0 +1,38 @@
+/**
+ * feat-whatsapp-bot — POST /api/whatsapp/send-status
+ *
+ * WhatsApp message delivery status update.
+ *
+ * Consumer stub:
+ * ```ts
+ * export { whatsappSendStatusPOST as POST } from "@mohasinac/feat-whatsapp-bot";
+ * ```
+ */
+import { NextResponse } from "next/server.js";
+import { getProviders } from "../../../../contracts/index.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+export async function POST(request) {
+    try {
+        const body = await request.json();
+        const { db } = getProviders();
+        if (!db)
+            return NextResponse.json({ success: false, error: "DB not configured" }, { status: 503 });
+        // Update message status in database
+        const repo = db.getRepository("whatsapp_message_status");
+        const updated = await repo.create({
+            ...body,
+            updatedAt: new Date(),
+        });
+        return NextResponse.json({
+            success: true,
+            data: updated,
+        });
+    }
+    catch (error) {
+        void normalizeError(error);
+        return NextResponse.json({
+            success: false,
+            error: error instanceof Error ? error.message : "Internal server error",
+        }, { status: 500 });
+    }
+}

package/dist/features/whatsapp-bot/api/webhook/route.d.ts

@@ -0,0 +1,12 @@
+/**
+ * feat-whatsapp-bot — POST /api/whatsapp/webhook
+ *
+ * WhatsApp webhook receiver for incoming messages.
+ *
+ * Consumer stub:
+ * ```ts
+ * export { whatsappWebhookPOST as POST } from "@mohasinac/feat-whatsapp-bot";
+ * ```
+ */
+import { NextResponse } from "next/server.js";
+export declare function POST(request: Request): Promise<NextResponse>;