@mohasinac/appkit 4.64.0 → 4.65.0

package/dist/_internal/shared/listing-types/feature-flags.js

@@ -18,6 +18,78 @@
  * Future-expansion Pattern 5. Slots with Phase 7 (CTA registry consults the
  * same flag to hide actions for disabled types).
  */
+// Route-map only — a pure constants module with no firebase-admin in its
+// import chain, so this stays safe in the client bundle (appkit Export Rules).
+import { ROUTES } from "../../../next/routing/route-map.js";
+/**
+ * Declared as `Record<BrowsePageKey, true>` for the same reason
+ * `ALL_LISTING_TYPES_MAP` is: adding a key to the union without adding it here
+ * is a COMPILE error rather than a section that silently can never be hidden.
+ * Root Cause #61 — every hand-written enumeration of a union in this codebase
+ * has drifted at least once.
+ */
+const ALL_BROWSE_PAGES_MAP = {
+    categories: true,
+    brands: true,
+    franchise: true,
+    stores: true,
+};
+export const ALL_BROWSE_PAGES = Object.keys(ALL_BROWSE_PAGES_MAP);
+/**
+ * `true` when the section is missing from the flag map OR explicitly enabled.
+ *
+ * Absent-means-enabled, matching its two siblings: a section has to be
+ * EXPLICITLY `false` to close. An install that predates this setting keeps
+ * every section open, so adding the field cannot take a site's navigation away
+ * from it.
+ */
+export function isBrowsePageEnabled(page, settings) {
+    return settings?.listings?.browsePages?.[page] !== false;
+}
+export function enabledBrowsePages(settings) {
+    return ALL_BROWSE_PAGES.filter((p) => isBrowsePageEnabled(p, settings));
+}
+/** Narrow an untrusted string — a route param, a form value — to the union. */
+export function isBrowsePageKey(value) {
+    return typeof value === "string" && value in ALL_BROWSE_PAGES_MAP;
+}
+/**
+ * The public path prefixes each section owns.
+ *
+ * 🛑 `/sellers` maps to `stores` — see the `BrowsePageKey` note. Two doors,
+ * one directory, one flag.
+ */
+const BROWSE_PAGE_PREFIXES = [
+    [String(ROUTES.PUBLIC.CATEGORIES), "categories"],
+    [String(ROUTES.PUBLIC.BRANDS), "brands"],
+    [String(ROUTES.PUBLIC.FRANCHISE), "franchise"],
+    [String(ROUTES.PUBLIC.STORES), "stores"],
+    [String(ROUTES.PUBLIC.SELLERS), "stores"],
+];
+/**
+ * Which browse section a link points into, or `null` for a link that is not in
+ * one. Used to drop nav, sidebar, mobile-sheet and footer entries for a closed
+ * section.
+ *
+ * 🛑 Matches on an EXACT path or a `/`-delimited descendant, never a bare
+ * `startsWith`. `/store` is the SELLER DASHBOARD and `/stores` is the public
+ * directory, so a prefix test would hide a signed-in seller's own dashboard
+ * link the moment an admin closed the public storefronts — a different
+ * surface, a different audience, one character apart.
+ *
+ * Query strings and hashes are tolerated because footer and nav hrefs are
+ * hand-authored and some carry them.
+ */
+export function browsePageForPath(href) {
+    if (typeof href !== "string" || href.length === 0)
+        return null;
+    const path = href.split(/[?#]/)[0].replace(/\/+$/, "") || "/";
+    for (const [prefix, key] of BROWSE_PAGE_PREFIXES) {
+        if (path === prefix || path.startsWith(`${prefix}/`))
+            return key;
+    }
+    return null;
+}
 /**
  * `true` when the type is missing from the flag map OR explicitly enabled.
  * Defaulting to enabled keeps legacy data working — a flag has to be

package/dist/client.d.ts

@@ -223,7 +223,7 @@ export { AppLayoutShell, LocaleSwitcher, useDashboardNav, BottomActionsProvider,
  * visible Buy/Checkout button. See `useCtaReveal`.
  */
 export { ctaAnchorProps, CTA_ANCHOR_ATTR } from "./features/layout/index";
-export type { AppLayoutShellProps, AppLayoutShellSidebarLink, AppLayoutShellSidebarSection, DashboardNavState, MainNavbarItem, LayoutClientProps } from "./features/layout/index";
+export type { AppLayoutShellProps, AppLayoutShellSidebarLink, AppLayoutShellSidebarSection, SidebarItemActionRenderer, DashboardNavState, MainNavbarItem, LayoutClientProps } from "./features/layout/index";
 export { ListingLayout } from "./ui/components/ListingLayout";
 export type { ListingLayoutProps, ListingLayoutLabels } from "./ui/components/ListingLayout";
 export { Search } from "./features/search/components";
@@ -364,6 +364,8 @@ export { useAuthGate } from "./react/hooks/useAuthGate";
 export type { UseAuthGateReturn } from "./react/hooks/useAuthGate";
 export { useListingTypeFlags } from "./react/hooks/useListingTypeFlags";
 export type { ListingTypeFlags, ListingTypeFlagsShape, } from "./react/hooks/useListingTypeFlags";
+export { useBrowsePageFlags } from "./react/hooks/useBrowsePageFlags";
+export type { BrowsePageFlags, BrowsePageFlagsShape, } from "./react/hooks/useBrowsePageFlags";
 export { useActionDispatch } from "./react/hooks/use-action-dispatch";
 export type { DispatchAction, UseActionDispatchOptions } from "./react/hooks/use-action-dispatch";
 export { usePanelStore } from "./stores/panel-store";
@@ -437,7 +439,8 @@ export type { TrackArgs as TrackHistoryArgs } from "./features/history/hooks/use
 export { WISHLIST_MAX, HISTORY_MAX, CART_MAX_ITEMS, } from "./constants/limits";
 export { normalizeListingType, isAuctionListing, isPreOrderListing, isStandardListing, isPrizeDrawListing, isClassifiedListing, isDigitalCodeListing, isLiveListing, isArtListing, isStickersListing, } from "./features/products/utils/listing-type";
 export { isFinalSale, acceptsChangeOfMindReturns, } from "./features/products/constants/final-sale";
-export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, } from "./_internal/shared/listing-types/feature-flags";
+export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, isBrowsePageEnabled, enabledBrowsePages, ALL_BROWSE_PAGES, isBrowsePageKey, } from "./_internal/shared/listing-types/feature-flags";
+export type { BrowsePageKey } from "./_internal/shared/listing-types/feature-flags";
 export { ADVANCED_LISTING_TYPE_CAPABILITY, ADVANCED_LISTING_TYPES, BASIC_LISTING_TYPES, LISTING_TYPE_TIER, hasAdvancedListingTypes, isAdvancedListingType, isListingTypeAllowedFor, listingTypesAllowedFor, } from "./_internal/shared/listing-types/tiers";
 export type { ListingTypeAccessContext, ListingTypeTier, } from "./_internal/shared/listing-types/tiers";
 export { actionTracker, setActionTrackerSink, resetActionTrackerSink, type ActionEvent, type ActionTrackerSink, } from "./_internal/shared/listing-types/action-tracker";

package/dist/client.js

@@ -403,6 +403,9 @@ export { useAuthGate } from "./react/hooks/useAuthGate.js";
 // [CLIENT-ONLY] W1-43 — useListingTypeFlags: read featureFlags.listingTypes
 // from siteSettings; hide nav/search/picker entries for disabled types.
 export { useListingTypeFlags } from "./react/hooks/useListingTypeFlags.js";
+// [CLIENT-ONLY] useBrowsePageFlags: read listings.browsePages from
+// siteSettings; drop nav/sidebar/footer links into a closed browse section.
+export { useBrowsePageFlags } from "./react/hooks/useBrowsePageFlags.js";
 // Action dispatch hook + panel store
 export { useActionDispatch } from "./react/hooks/use-action-dispatch.js";
 export { usePanelStore } from "./stores/panel-store.js";
@@ -470,7 +473,11 @@ export { normalizeListingType, isAuctionListing, isPreOrderListing, isStandardLi
 // `finalSale` field. See the module docstring for why `!p.finalSale` is wrong.
 export { isFinalSale, acceptsChangeOfMindReturns, } from "./features/products/constants/final-sale.js";
 // SB-UNI-X4 2026-05-13 — per-type feature-flag helpers (client-safe).
-export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, } from "./_internal/shared/listing-types/feature-flags.js";
+export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, 
+// Browse-section gates. Client-safe and genuinely needed here: the nav,
+// sidebar, mobile sheet and footer all filter on them, and a link into a
+// closed section is a 404 on every page of the site.
+isBrowsePageEnabled, enabledBrowsePages, ALL_BROWSE_PAGES, isBrowsePageKey, } from "./_internal/shared/listing-types/feature-flags.js";
 // Basic/advanced listing-type split. Client-safe: the nav filter and any
 // seller-facing picker need the same rule the server enforces, and deriving it
 // twice is how the ten hand-written copies of the union happened.

package/dist/constants/field-names.d.ts

@@ -603,6 +603,7 @@ export declare const CATEGORY_FIELDS: {
         readonly SUBLISTING: "sublisting";
         readonly BUNDLE: "bundle";
         readonly FRANCHISE: "franchise";
+        readonly CHARACTER: "character";
     };
     readonly BUNDLE_STOCK_STATUS_VALUES: {
         readonly AVAILABLE: "available";

package/dist/constants/field-names.js

@@ -715,6 +715,20 @@ export const CATEGORY_FIELDS = {
          * A brand is who MADE it (Takara-Tomy); a franchise is what it IS FROM.
          */
         FRANCHISE: "franchise",
+        /*
+         * WHO USED the bey in the story — Tyson Granger, Kai Hiwatari. The third
+         * sibling of BRAND and FRANCHISE and tier-0 for the same reason: a row the
+         * product points AT, never one it lives under. Who made it / what it is
+         * from / who used it.
+         *
+         * 🛑 Match on the SLUG, never the display name. `brand-rows.ts` trap 1
+         * records that brands match on display NAME, so renaming a brand silently
+         * orphans its whole catalogue; franchise was added later and deliberately
+         * took the stable key instead. Characters follow franchise — and it matters
+         * more here, because character names are routinely re-localised between
+         * the Japanese and English releases.
+         */
+        CHARACTER: "character",
     },
     BUNDLE_STOCK_STATUS_VALUES: {
         AVAILABLE: "available",

package/dist/features/account/api/[userId]/addresses/route.js

@@ -11,11 +11,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../../contracts/index.js";
 import { normalizeError } from "../../../../../errors/normalize.js";
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam } from "../../../../../utils/search-params.js";
 export async function GET(request, { params }) {
     try {
         const { userId } = await params;

package/dist/features/addresses/repository/addresses.repository.js

@@ -12,7 +12,7 @@ import { normalizeError } from "../../../errors/normalize.js";
  */
 import { DatabaseError } from "../../../errors/index.js";
 import { serverLogger } from "../../../monitoring/index.js";
-import { BaseRepository, getFirestoreCount, prepareForFirestore, } from "../../../providers/db-firebase/index.js";
+import { BaseRepository, getFirestoreCount, prepareForFirestore } from "../../../providers/db-firebase/index.js";
 import { maskPii, revealPii, ADDRESS_PII_FIELDS, } from "../../../security/index.js";
 import { buildTokensIndex } from "../../../security/blind-index-tokens.js";
 import { ADDRESS_FIELDS, ADDRESSES_COLLECTION, } from "../schemas/index.js";

package/dist/features/admin/api/bids/route.js

@@ -12,11 +12,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam } from "../../../../utils/search-params.js";
 export const GET = createRouteHandler({
     roles: ["admin", "moderator"],
     handler: async ({ request }) => {

package/dist/features/admin/api/coupons/route.js

@@ -12,11 +12,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam } from "../../../../utils/search-params.js";
 export const GET = createRouteHandler({
     roles: ["admin", "moderator"],
     handler: async ({ request }) => {

package/dist/features/admin/api/products/route.js

@@ -12,11 +12,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam } from "../../../../utils/search-params.js";
 export const GET = createRouteHandler({
     roles: ["admin", "moderator"],
     handler: async ({ request }) => {

package/dist/features/admin/api/reviews/route.js

@@ -12,11 +12,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam } from "../../../../utils/search-params.js";
 export const GET = createRouteHandler({
     roles: ["admin", "moderator"],
     handler: async ({ request }) => {

package/dist/features/admin/components/AdminCarouselEditorView.js

@@ -17,7 +17,6 @@ const __P = {
 };
 const CLS_PANEL = "rounded-xl border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] p-[var(--appkit-space-4)] space-y-3";
 const CLS_ROW_BETWEEN = "flex items-center justify-between";
-const CLS_SECTION_HEADING = "text-[length:var(--appkit-text-sm)] font-semibold text-[var(--appkit-color-text)]";
 const carouselSlideSchema = z.object({
     title: z.string().min(1, "Slide title is required").max(150),
     order: z.number().int().min(0),

package/dist/features/admin/components/AdminFeatureEditorView.js

@@ -4,7 +4,7 @@ import { Row } from "@mohasinac/appkit/ui";
 import { useApiMutation } from "@mohasinac/appkit/client";
 import React from "react";
 import { useQuery } from "@tanstack/react-query";
-import { Checkbox, ConfirmDeleteModal, Div, Label, StackedViewShell, Text, useToast, } from "../../../ui/index.js";
+import { Checkbox, ConfirmDeleteModal, Div, Label, StackedViewShell, Text, useToast } from "../../../ui/index.js";
 import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { FormErrorSummary, applyZodIssues } from "../../../ui/forms/index.js";
@@ -156,7 +156,6 @@ export function AdminFeatureEditorView({ featureId, fixedScope, fixedStoreId, em
      * the productTypes minimum). The button now stays enabled and the schema
      * reports what is actually wrong, on the field itself.
      */
-    const isDisabled = isSubmitting;
     const sections = React.useMemo(() => buildSectionsFromSchema(productFeatureFormSchema, {
         options: {
             iconColor: [...PRODUCT_FEATURE_ICON_COLOR_OPTIONS],

package/dist/features/admin/components/AdminGuideHubView.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Users, Package, Store, ShoppingBag, FileText, Settings, Shield, BarChart2, AlertTriangle, BookOpen, CreditCard, } from "lucide-react";
+import { Users, Package, Store, ShoppingBag, FileText, Settings, Shield, BarChart2, AlertTriangle, BookOpen, CreditCard } from "lucide-react";
 import { Alert, Div, Grid, Heading, Row, Section, Stack, Text, TextLink } from "../../../ui/index.js";
 import { ROUTES } from "../../../next/routing/route-map.js";
 const CLS_WARN_PANEL = "rounded-2xl border border-amber-200 bg-warning-surface dark:border-amber-800 p-[var(--appkit-space-6)]";

package/dist/features/admin/components/AdminProductEditorView.js

@@ -1,10 +1,13 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+// audit-form-mutation-hook-multi-ok: saveMutation is the single combined save
+// across all tabs; deleteMutation is a separate destructive action, not a
+// second per-tab save.
 import { useApiMutation } from "@mohasinac/appkit/client";
 import React from "react";
 import { z } from "zod";
 import { useQuery } from "@tanstack/react-query";
-import { Button, Card, CardBody, ConfirmDeleteModal, Div, PaginatedSelect, Stack, StackedViewShell, Tabs, TabsContent, TabsList, TabsTrigger, Text, useToast, Show, StickyToolbar, } from "../../../ui/index.js";
+import { Button, Card, CardBody, ConfirmDeleteModal, Div, PaginatedSelect, Stack, StackedViewShell, Tabs, TabsContent, TabsList, TabsTrigger, Text, useToast, Show, StickyToolbar } from "../../../ui/index.js";
 import { useFormShellState, applyZodIssues, FormErrorSummary, FormShellContext } from "../../../ui/forms/index.js";
 import { SectionForm, useSectionFormNav } from "../../shell/index.js";
 import { PRODUCT_MAX_IMAGES } from "../../../_internal/shared/media/limits.js";

package/dist/features/admin/components/AdminSiteSettingsView.js

@@ -18,7 +18,7 @@ import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { ROUTES } from "../../../next/routing/route-map.js";
 import { NOTIFICATION_TYPE_TABS } from "../../../constants/notification-types.js";
-import { ALL_LISTING_TYPES } from "../../../_internal/shared/listing-types/feature-flags.js";
+import { ALL_LISTING_TYPES, ALL_BROWSE_PAGES, } from "../../../_internal/shared/listing-types/feature-flags.js";
 import { pluginFor } from "../../../_internal/shared/listing-types/_registry.js";
 import { SITE_SETTINGS_TABS, isSiteSettingsTabId, } from "../constants/site-settings-tabs.js";
 import { ThemeManagerView, } from "../../site-settings/components/ThemeManagerView.js";
@@ -316,6 +316,7 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
     // Per-listing-type / per-category-type visibility flags.
     const [listingTypeFlags, setListingTypeFlags] = React.useState({});
     const [categoryTypeFlags, setCategoryTypeFlags] = React.useState({});
+    const [browsePageFlags, setBrowsePageFlags] = React.useState({});
     // Per-channel notification-type allowlists — empty array means "all types".
     const [notifEmailTypes, setNotifEmailTypes] = React.useState([]);
     const [notifWhatsappTypes, setNotifWhatsappTypes] = React.useState([]);
@@ -557,6 +558,7 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
         setCodMaxOrderValue(s.payment?.codMaxOrderValue ?? COD_MAX_ORDER_VALUE_FALLBACK);
         setListingTypeFlags(s.listings?.listingTypes ?? {});
         setCategoryTypeFlags(s.listings?.categoryTypes ?? {});
+        setBrowsePageFlags(s.listings?.browsePages ?? {});
         setNotifEmailTypes(s.notificationChannels?.email?.types ?? []);
         setNotifWhatsappTypes(s.notificationChannels?.whatsapp?.types ?? []);
         setBidIncrementTiers(s.auctionConfig?.bidIncrementTiers ?? DEFAULT_AUCTION_BID_INCREMENT_TIERS);
@@ -798,7 +800,11 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
             // wholesale, so omitting one here would wipe it. The load-time spread this
             // used to carry existed to preserve `adminCheckoutBypass`, which is now a
             // permission rather than a stored flag.
-            listings: { listingTypes: listingTypeFlags, categoryTypes: categoryTypeFlags },
+            listings: {
+                listingTypes: listingTypeFlags,
+                categoryTypes: categoryTypeFlags,
+                browsePages: browsePageFlags,
+            },
             notificationChannels: {
                 inApp: { enabled: true, readOnly: true },
                 email: { enabled: notifEmailEnabled, minPriority: notifEmailMinPriority, types: notifEmailTypes },
@@ -866,6 +872,16 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
      */
     const LISTING_TYPE_KEYS = ALL_LISTING_TYPES;
     const CATEGORY_TYPE_KEYS = ["category", "sublisting", "brand", "bundle"];
+    /* Derived for the same reason LISTING_TYPE_KEYS is — a hand-written copy of
+     * a union in this file has already drifted once, in both directions. */
+    const BROWSE_PAGE_KEYS = ALL_BROWSE_PAGES;
+    /** What each section actually withdraws, in the admin's own vocabulary. */
+    const BROWSE_PAGE_META = {
+        categories: { label: "Categories", hint: "/categories and every category page" },
+        brands: { label: "Brands", hint: "/brands and every brand page" },
+        franchise: { label: "Franchises", hint: "/franchise and every franchise page" },
+        stores: { label: "Stores & Sellers", hint: "/stores, /sellers and every storefront" },
+    };
     const NOTIF_TYPE_OPTIONS = NOTIFICATION_TYPE_TABS.filter((t) => t.id !== "All").map((t) => ({ value: t.id, label: t.label }));
     /*
      * Validate the payload that is actually sent, then save.
@@ -915,7 +931,7 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
                                                         // The plugin's own display label, not the raw key — the
                                                         // literal version rendered "pre-order" and
                                                         // "digital-code" at an admin.
-                                                        label: pluginFor(key).typeLabel, checked: listingTypeFlags[key] ?? true, onChange: (v) => setListingTypeFlags((prev) => ({ ...prev, [key]: v })) }, key))) })] }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Category types" }), _jsx(Grid, { cols: 2, gap: "sm", children: CATEGORY_TYPE_KEYS.map((key) => (_jsx(Toggle, { label: key, checked: categoryTypeFlags[key] ?? true, onChange: (v) => setCategoryTypeFlags((prev) => ({ ...prev, [key]: v })) }, key))) })] })] }) }), _jsx(TabsContent, { value: "integrations", children: _jsxs(SettingsTabForm, { id: "integrations", label: "Integrations", children: [_jsx(Text, { size: "xs", color: "muted", children: "Keys are masked in transit and stored encrypted. Click Reveal to view." }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Razorpay" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Razorpay Key ID", value: razorpayKeyId, onChange: setRazorpayKeyId, placeholder: "rzp_test_\u2026 / rzp_live_\u2026" }), _jsx(MaskedInput, { label: "Razorpay Key Secret", value: razorpayKeySecret, onChange: setRazorpayKeySecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(MaskedInput, { label: "Razorpay Webhook Secret", value: razorpayWebhookSecret, onChange: setRazorpayWebhookSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "PhonePe" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "PhonePe Client ID", value: phonepeClientId, onChange: setPhonepeClientId, placeholder: "MERCHANTID_\u2026" }), _jsx(MaskedInput, { label: "PhonePe Client Secret", value: phonepeClientSecret, onChange: setPhonepeClientSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(Input, { label: "PhonePe Client Version", value: phonepeClientVersion, onChange: (e) => setPhonepeClientVersion(e.target.value), placeholder: "1" }), _jsx(Select, { label: "PhonePe Environment", options: PHONEPE_ENVIRONMENT_OPTIONS, value: phonepeEnvironment, onValueChange: setPhonepeEnvironment }), _jsx(MaskedInput, { label: "PhonePe Webhook Username", value: phonepeWebhookUsername, onChange: setPhonepeWebhookUsername, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(MaskedInput, { label: "PhonePe Webhook Password", value: phonepeWebhookPassword, onChange: setPhonepeWebhookPassword, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "SMTP / Email" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "SMTP host", value: smtpHost, onChange: (e) => setSmtpHost(e.target.value), placeholder: "smtp.sendgrid.net" }), _jsx(Input, { label: "SMTP port", value: smtpPort, onChange: (e) => setSmtpPort(e.target.value), type: "number", placeholder: "587" }), _jsx(Input, { label: "SMTP user", value: smtpUser, onChange: (e) => setSmtpUser(e.target.value), placeholder: "apikey" })] }), _jsx(Input, { label: "From address", value: smtpFrom, onChange: (e) => setSmtpFrom(e.target.value), placeholder: "noreply@letitrip.in", type: "email" }), _jsx(Text, { size: "xs", color: "muted", children: "Transactional email is delivered through Resend \u2014 set the Resend API key below. These SMTP fields are stored but not currently used for delivery." })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Google Places (store reviews)" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Google Maps API key", value: googleMapsApiKey, onChange: setGoogleMapsApiKey, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(Input, { label: "Default Google Place ID", value: googlePlaceId, onChange: (e) => setGooglePlaceId(e.target.value), placeholder: "ChIJ\u2026" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Analytics & Tracking" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Google Analytics ID", value: gaMeasurementId, onChange: (e) => setGaMeasurementId(e.target.value), placeholder: "G-XXXXXXXXXX" }), _jsx(Input, { label: "Facebook Pixel ID", value: fbPixelId, onChange: (e) => setFbPixelId(e.target.value), placeholder: "XXXXXXXXXXXXXXXX" }), _jsx(Input, { label: "GTM Container ID", value: gtmContainerId, onChange: (e) => setGtmContainerId(e.target.value), placeholder: "GTM-XXXXXXX" }), _jsx(Input, { label: "Microsoft Clarity Project ID", value: clarityProjectId, onChange: (e) => setClarityProjectId(e.target.value), placeholder: "abcdefghij", helperText: "Heatmaps and session replay. Recording is strictly masked \u2014 no text or input values are captured. Leave blank to keep Clarity off." })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Meta (Instagram & Facebook Social Feed)" }), _jsx(Text, { size: "xs", color: "muted", children: "Used by the Social Feed section to fetch Instagram and Facebook posts via Meta Graph API v19." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Page Access Token", value: metaPageAccessToken, onChange: setMetaPageAccessToken, placeholder: "EAAxxxxxxx\u2026" }), _jsx(Input, { label: "Page ID (or handle)", value: metaPageId, onChange: (e) => setMetaPageId(e.target.value), placeholder: "letitrip" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "TikTok for Developers (Social Feed)" }), _jsx(Text, { size: "xs", color: "muted", children: "Client credentials + long-lived access token from TikTok for Developers. Used to list your account's public videos." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Client Key", value: tiktokClientKey, onChange: setTiktokClientKey, placeholder: "aw\u2026" }), _jsx(MaskedInput, { label: "Client Secret", value: tiktokClientSecret, onChange: setTiktokClientSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(MaskedInput, { label: "Access Token (long-lived)", value: tiktokAccessToken, onChange: setTiktokAccessToken, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "DeviantArt OAuth2 (Social Feed)" }), _jsx(Text, { size: "xs", color: "muted", children: "Client credentials for DeviantArt gallery fetching (client-credentials OAuth2 flow \u2014 no user login required)." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Client ID", value: deviantartClientId, onChange: setDeviantartClientId, placeholder: "1234" }), _jsx(MaskedInput, { label: "Client Secret", value: deviantartClientSecret, onChange: setDeviantartClientSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] })] }) }), _jsx(TabsContent, { value: "shipping", children: _jsxs(SettingsTabForm, { id: "shipping", label: "Shipping", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Payment methods" }), _jsx(Div, { id: "setting-razorpay-enabled", children: _jsx(Toggle, { label: "Razorpay (online card/UPI/netbanking) enabled \u2014 needs Key ID + Key Secret under Credentials", checked: razorpayEnabled, onChange: setRazorpayEnabled }) }), _jsx(Div, { id: "setting-phonepe-enabled", children: _jsx(Toggle, { label: "PhonePe (online card/UPI) enabled \u2014 ignored while Razorpay is on; only one online gateway runs at a time", checked: phonepeEnabled, onChange: setPhonepeEnabled }) }), _jsx(Div, { id: "setting-manual-payment-enabled", children: _jsx(Toggle, { label: "Manual UPI/bank transfer enabled", checked: upiManualEnabled, onChange: setUpiManualEnabled }) }), _jsx(Div, { id: "setting-cod-enabled", children: _jsx(Toggle, { label: "Cash on delivery (COD) enabled", checked: codEnabled, onChange: setCodEnabled }) }), _jsx(Input, { label: "Free shipping threshold (\u20B9)", value: String(freeShippingThreshold), onChange: (e) => setFreeShippingThreshold(parseInt(e.target.value) || 0), type: "number", min: 0, helperText: "Orders above this amount get free shipping." }), _jsx(Select, { label: "Default carrier", options: CARRIER_OPTIONS, value: defaultCarrier, onValueChange: setDefaultCarrier }), _jsx(Input, { label: "Max delivery radius (km, 0 = no limit)", value: String(maxDeliveryRadius), onChange: (e) => setMaxDeliveryRadius(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "COD maximum order value (\u20B9)", 
+                                                        label: pluginFor(key).typeLabel, checked: listingTypeFlags[key] ?? true, onChange: (v) => setListingTypeFlags((prev) => ({ ...prev, [key]: v })) }, key))) })] }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Category types" }), _jsx(Grid, { cols: 2, gap: "sm", children: CATEGORY_TYPE_KEYS.map((key) => (_jsx(Toggle, { label: key, checked: categoryTypeFlags[key] ?? true, onChange: (v) => setCategoryTypeFlags((prev) => ({ ...prev, [key]: v })) }, key))) })] }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Browse sections" }), _jsx(Text, { size: "xs", color: "muted", children: "A closed section returns Not Found and disappears from the navbar, the sidebar, the mobile menu, the footer and the sitemap. Products, categories and stores are untouched \u2014 only the public way in is withdrawn, and re-opening restores it." }), _jsx(Grid, { cols: 2, gap: "sm", children: BROWSE_PAGE_KEYS.map((key) => (_jsxs(Stack, { gap: "xs", children: [_jsx(Toggle, { label: BROWSE_PAGE_META[key]?.label ?? key, checked: browsePageFlags[key] ?? true, onChange: (v) => setBrowsePageFlags((prev) => ({ ...prev, [key]: v })) }), _jsx(Text, { size: "xs", color: "muted", children: BROWSE_PAGE_META[key]?.hint })] }, key))) })] })] }) }), _jsx(TabsContent, { value: "integrations", children: _jsxs(SettingsTabForm, { id: "integrations", label: "Integrations", children: [_jsx(Text, { size: "xs", color: "muted", children: "Keys are masked in transit and stored encrypted. Click Reveal to view." }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Razorpay" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Razorpay Key ID", value: razorpayKeyId, onChange: setRazorpayKeyId, placeholder: "rzp_test_\u2026 / rzp_live_\u2026" }), _jsx(MaskedInput, { label: "Razorpay Key Secret", value: razorpayKeySecret, onChange: setRazorpayKeySecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(MaskedInput, { label: "Razorpay Webhook Secret", value: razorpayWebhookSecret, onChange: setRazorpayWebhookSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "PhonePe" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "PhonePe Client ID", value: phonepeClientId, onChange: setPhonepeClientId, placeholder: "MERCHANTID_\u2026" }), _jsx(MaskedInput, { label: "PhonePe Client Secret", value: phonepeClientSecret, onChange: setPhonepeClientSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(Input, { label: "PhonePe Client Version", value: phonepeClientVersion, onChange: (e) => setPhonepeClientVersion(e.target.value), placeholder: "1" }), _jsx(Select, { label: "PhonePe Environment", options: PHONEPE_ENVIRONMENT_OPTIONS, value: phonepeEnvironment, onValueChange: setPhonepeEnvironment }), _jsx(MaskedInput, { label: "PhonePe Webhook Username", value: phonepeWebhookUsername, onChange: setPhonepeWebhookUsername, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(MaskedInput, { label: "PhonePe Webhook Password", value: phonepeWebhookPassword, onChange: setPhonepeWebhookPassword, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "SMTP / Email" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "SMTP host", value: smtpHost, onChange: (e) => setSmtpHost(e.target.value), placeholder: "smtp.sendgrid.net" }), _jsx(Input, { label: "SMTP port", value: smtpPort, onChange: (e) => setSmtpPort(e.target.value), type: "number", placeholder: "587" }), _jsx(Input, { label: "SMTP user", value: smtpUser, onChange: (e) => setSmtpUser(e.target.value), placeholder: "apikey" })] }), _jsx(Input, { label: "From address", value: smtpFrom, onChange: (e) => setSmtpFrom(e.target.value), placeholder: "noreply@letitrip.in", type: "email" }), _jsx(Text, { size: "xs", color: "muted", children: "Transactional email is delivered through Resend \u2014 set the Resend API key below. These SMTP fields are stored but not currently used for delivery." })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Google Places (store reviews)" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Google Maps API key", value: googleMapsApiKey, onChange: setGoogleMapsApiKey, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(Input, { label: "Default Google Place ID", value: googlePlaceId, onChange: (e) => setGooglePlaceId(e.target.value), placeholder: "ChIJ\u2026" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Analytics & Tracking" }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Google Analytics ID", value: gaMeasurementId, onChange: (e) => setGaMeasurementId(e.target.value), placeholder: "G-XXXXXXXXXX" }), _jsx(Input, { label: "Facebook Pixel ID", value: fbPixelId, onChange: (e) => setFbPixelId(e.target.value), placeholder: "XXXXXXXXXXXXXXXX" }), _jsx(Input, { label: "GTM Container ID", value: gtmContainerId, onChange: (e) => setGtmContainerId(e.target.value), placeholder: "GTM-XXXXXXX" }), _jsx(Input, { label: "Microsoft Clarity Project ID", value: clarityProjectId, onChange: (e) => setClarityProjectId(e.target.value), placeholder: "abcdefghij", helperText: "Heatmaps and session replay. Recording is strictly masked \u2014 no text or input values are captured. Leave blank to keep Clarity off." })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Meta (Instagram & Facebook Social Feed)" }), _jsx(Text, { size: "xs", color: "muted", children: "Used by the Social Feed section to fetch Instagram and Facebook posts via Meta Graph API v19." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Page Access Token", value: metaPageAccessToken, onChange: setMetaPageAccessToken, placeholder: "EAAxxxxxxx\u2026" }), _jsx(Input, { label: "Page ID (or handle)", value: metaPageId, onChange: (e) => setMetaPageId(e.target.value), placeholder: "letitrip" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "TikTok for Developers (Social Feed)" }), _jsx(Text, { size: "xs", color: "muted", children: "Client credentials + long-lived access token from TikTok for Developers. Used to list your account's public videos." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Client Key", value: tiktokClientKey, onChange: setTiktokClientKey, placeholder: "aw\u2026" }), _jsx(MaskedInput, { label: "Client Secret", value: tiktokClientSecret, onChange: setTiktokClientSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" }), _jsx(MaskedInput, { label: "Access Token (long-lived)", value: tiktokAccessToken, onChange: setTiktokAccessToken, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "DeviantArt OAuth2 (Social Feed)" }), _jsx(Text, { size: "xs", color: "muted", children: "Client credentials for DeviantArt gallery fetching (client-credentials OAuth2 flow \u2014 no user login required)." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(MaskedInput, { label: "Client ID", value: deviantartClientId, onChange: setDeviantartClientId, placeholder: "1234" }), _jsx(MaskedInput, { label: "Client Secret", value: deviantartClientSecret, onChange: setDeviantartClientSecret, placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" })] })] })] }) }), _jsx(TabsContent, { value: "shipping", children: _jsxs(SettingsTabForm, { id: "shipping", label: "Shipping", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Payment methods" }), _jsx(Div, { id: "setting-razorpay-enabled", children: _jsx(Toggle, { label: "Razorpay (online card/UPI/netbanking) enabled \u2014 needs Key ID + Key Secret under Credentials", checked: razorpayEnabled, onChange: setRazorpayEnabled }) }), _jsx(Div, { id: "setting-phonepe-enabled", children: _jsx(Toggle, { label: "PhonePe (online card/UPI) enabled \u2014 ignored while Razorpay is on; only one online gateway runs at a time", checked: phonepeEnabled, onChange: setPhonepeEnabled }) }), _jsx(Div, { id: "setting-manual-payment-enabled", children: _jsx(Toggle, { label: "Manual UPI/bank transfer enabled", checked: upiManualEnabled, onChange: setUpiManualEnabled }) }), _jsx(Div, { id: "setting-cod-enabled", children: _jsx(Toggle, { label: "Cash on delivery (COD) enabled", checked: codEnabled, onChange: setCodEnabled }) }), _jsx(Input, { label: "Free shipping threshold (\u20B9)", value: String(freeShippingThreshold), onChange: (e) => setFreeShippingThreshold(parseInt(e.target.value) || 0), type: "number", min: 0, helperText: "Orders above this amount get free shipping." }), _jsx(Select, { label: "Default carrier", options: CARRIER_OPTIONS, value: defaultCarrier, onValueChange: setDefaultCarrier }), _jsx(Input, { label: "Max delivery radius (km, 0 = no limit)", value: String(maxDeliveryRadius), onChange: (e) => setMaxDeliveryRadius(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "COD maximum order value (\u20B9)", 
                                             /*
                                               🛑 A MAXIMUM, sitting directly above a THRESHOLD that is a
                                               minimum. The helper text says which way each one runs,

package/dist/features/admin/components/OwnerQuickActions.d.ts

@@ -23,6 +23,12 @@ export interface OwnerQuickActionsProps {
      * `card` sits in a hero corner and uses a scrim so it reads on photography;
      * `detail` sits in a header row beside the title.
      */
+    /**
+     * 🛑 ACCEPTED AND NOT READ since `onMedia` took over the dark-surface
+     * decision — see the note at the `onMedia` branch below. 36 call sites still
+     * pass it, so it is declared rather than deleted; delete it WITH those call
+     * sites, not ahead of them.
+     */
     placement?: "card" | "detail";
     /**
      * 🛑 Set this whenever `placement="detail"` sits on a DARK cover hero.
@@ -43,4 +49,4 @@ export interface OwnerQuickActionsProps {
     onMedia?: boolean;
     className?: string;
 }
-export declare function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, placement, onMedia, className, }: OwnerQuickActionsProps): import("react").JSX.Element | null;
+export declare function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, onMedia, className, }: OwnerQuickActionsProps): import("react").JSX.Element | null;

package/dist/features/admin/components/OwnerQuickActions.js

@@ -108,7 +108,7 @@ const RESOURCE_LEAVES = {
     USER: { bucket: "ADMIN", edit: "manage-user" },
     SECTION: { bucket: "ADMIN", edit: "edit-section" },
 };
-export function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, placement = "card", onMedia = false, className = "", }) {
+export function OwnerQuickActions({ resource, editHref, onDelete, onClone, ownerId, storeId, recordLabel, onMedia = false, className = "", }) {
     const session = useOptionalSession();
     const isOwnerOrAdmin = useIsOwner(ownerId);
     const isAdmin = useIsAdmin();

package/dist/features/admin/schemas/admin-editor-forms.js

@@ -30,7 +30,6 @@ import { annotate } from "../../shell/field-ui-meta.js";
 import { mediaUrlSchema } from "../../../validation/schemas.js";
 import { StoreStatusValues } from "../../stores/schemas/firestore.js";
 import { ALL_STORE_CAPABILITIES } from "../../auth/permissions/constants.js";
-const PHONE_RE = /^(\+?91[-\s]?)?[6-9]\d{9}$/;
 /*
  * `adminAddressFormSchema` is DELETED (W5 / D19).
  *

package/dist/features/admin/schemas/firestore.d.ts

@@ -670,6 +670,39 @@ export interface SiteSettingsDocument extends BaseDocument {
     search?: {
         indexEnabled?: boolean;
     };
+    /**
+     * The WhatsApp catalogue feed — `/whatsapp/{storeSlug}/feed.csv`, read on a
+     * schedule by each seller's own Meta Commerce Manager.
+     *
+     * ## 🛑 A group of its own, for the same reason `search` is
+     *
+     * It is NOT in `notificationChannels.whatsapp`, which governs the platform's
+     * outbound order-update templates — a different channel with a different cost
+     * (per-template spend vs. a public CSV), owned by the platform rather than
+     * pointed at by each seller. Nor is it in `payment` or any other group that
+     * `AdminSiteSettingsView.buildFullPayload` rewrites WHOLE from form state: a
+     * fifth key in such a group is silently erased the next time an admin saves
+     * anything on that page (Root Cause #76), and a kill switch that a routine
+     * save turns back on fails in the direction of the thing it exists to stop.
+     *
+     * ## 🛑 Default ON — reader tests `!== false`
+     *
+     * An absent field, an unseeded document and a failed settings read must all
+     * mean "feeds work". Meta EMPTIES a connected catalogue the first time a
+     * scheduled fetch returns a file with no rows, so a `=== true` reader would
+     * wipe every seller's WhatsApp catalogue on the first Firestore blip — the
+     * same fail-open argument `allPurchasableTypes()` in the feed route is
+     * written around. The only state that disables it is somebody deliberately
+     * writing `false`.
+     *
+     * Switching it off empties EVERY store's feed on its next fetch, which is a
+     * platform-wide retraction and the reason it has no admin-UI toggle today —
+     * like `search.indexEnabled`, it is a deliberate Firestore-level switch. The
+     * per-store equivalent a seller owns is `StoreDocument.whatsappFeedEnabled`.
+     */
+    whatsappFeed?: {
+        enabled?: boolean;
+    };
     emailSettings: {
         fromName: string;
         fromEmail: string;
@@ -728,6 +761,25 @@ export interface SiteSettingsDocument extends BaseDocument {
             brand?: boolean;
             bundle?: boolean;
         };
+        /**
+         * Which public BROWSE SECTIONS are open — `/categories`, `/brands`,
+         * `/franchise`, `/stores` (+ `/sellers`).
+         *
+         * A third axis, not a rename of the two above: `listingTypes` says what the
+         * marketplace sells, `categoryTypes` says what a taxonomy row may be, and
+         * this says whether a public entry point is open. Closing `/brands` does
+         * not untag a single product — `BrandDetailPageView`'s query is unchanged
+         * and brand rows keep driving it. It withdraws the front door.
+         *
+         * ⚠️ Same absent-means-enabled contract as its siblings, and the same
+         * warning applies: `BrowsePageKey` and `ALL_BROWSE_PAGES_MAP`
+         * (`_internal/shared/listing-types/feature-flags.ts`) are the authority.
+         * That Record makes a missing member a compile error; this interface does
+         * not, and the `listingTypes` field above is the record of what happens
+         * when the two drift (it listed 8 types after the union reached 10).
+         * Add a new section THERE, not here.
+         */
+        browsePages?: Partial<Record<string, boolean>>;
     };
     /**
      * Admin-authored HTML overrides for the public policy pages. When a key holds

package/dist/features/admin/schemas/firestore.js

@@ -371,6 +371,26 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
             brand: true,
             bundle: false,
         },
+        /*
+         * Every browse section CLOSED, as of 2026-10-24.
+         *
+         * Spelled out rather than left absent even though absent means open: this
+         * block is the "never configured" baseline, and the whole point of the
+         * setting is that these four are not ready to show. Relying on the
+         * permissive default would open all four on a fresh install, which is the
+         * opposite of the decision.
+         *
+         * Re-opening one is a single toggle in Site Settings -> Listings -> Browse
+         * sections. Nothing else has to change: the routes, the nav entries, the
+         * footer links and the sitemap rows all come back on their own, because
+         * all four read this same flag rather than having been deleted.
+         */
+        browsePages: {
+            categories: false,
+            brands: false,
+            franchise: false,
+            stores: false,
+        },
     },
     shipping: {
         estimatedDays: 5,

package/dist/features/auctions/api/route.js

@@ -13,14 +13,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../contracts/index.js";
 import { normalizeError } from "../../../errors/normalize.js";
-function param(url, key) {
-    return url.searchParams.get(key);
-}
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam, param } from "../../../utils/search-params.js";
 // --- GET /api/bids ------------------------------------------------------------
 // Query params:
 //   auctionId — filter bids for a specific auction product (recommended)

package/dist/features/auctions/components/AuctionDetailPageView.js

@@ -13,7 +13,7 @@ const CLS_LIVE_BADGE = "inline-block rounded-full bg-warning-surface dark:bg-war
 import { ROUTES } from "../../../next/routing/route-map.js";
 import { getDefaultCurrency } from "../../../core/baseline-resolver.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
-import { normalizeRichTextHtml } from "../../../utils/string.formatter.js";
+import { toDescriptionHtml } from "../../../utils/string.formatter.js";
 import { safeDisplayName } from "../../../security/index.js";
 import { getSiteSettingsGlobal } from "../../admin/utils/getSiteSettingsGlobal.js";
 import { isBuyNowAvailable, resolveMinBid, resolveMinBidIncrement, } from "../../../_internal/shared/features/auctions/config.js";
@@ -44,12 +44,6 @@ import { SublistingCarouselSection } from "../../products/components/SublistingC
 import { isFinalSale } from "../../products/constants/final-sale.js";
 import { OwnerQuickActions } from "../../admin/components/OwnerQuickActions.js";
 import { PurchaseReviewAffordance } from "../../reviews/components/PurchaseReviewAffordance.js";
-function toDescriptionHtml(raw) {
-    if (!raw)
-        return "";
-    const s = typeof raw === "string" ? raw : JSON.stringify(raw);
-    return normalizeRichTextHtml(s);
-}
 function renderAuctionInfoPanel(props) {
     const { productId, storeId, title, currentBid, currency, bidCount, isEnded, endDate, buyNowPrice, buyNowAvailable, featured, freeShipping, condition, finalSale, category, categoryName, brand, brandSlug, productFeatures, features, descriptionHtml, safeSeller, storeHref } = props;
     return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_LIVE_BADGE, children: "\uD83C\uDFF7\uFE0F Live Auction" }), _jsx(AuctionLiveStatusBadge, { auctionEndDate: endDate, initialIsEnded: isEnded })] }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title }), _jsx(OwnerQuickActions, { resource: "PRODUCT", placement: "detail", recordLabel: title, storeId: storeId, editHref: String(ROUTES.STORE.PRODUCTS_EDIT(productId)) })] }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-0.5", color: "muted", size: "xs", children: "Current bid" }), _jsx(LiveBidPrice, { productId: productId, currentBid: currentBid, bidCount: bidCount, currency: currency, isEnded: isEnded, priceSize: "2xl", badgeSize: "sm" }), endDate && !isEnded && (_jsxs(Text, { className: "mt-1.5", color: "muted", size: "sm", children: ["Ends in ", _jsx(Span, { weight: "medium", color: "muted", children: _jsx(CountdownDisplay, { targetDate: endDate, format: "auto", expiredLabel: "Ended" }) })] })), endDate && _jsxs(Text, { className: "mt-0.5", color: "faint", size: "xs", children: [isEnded ? "Ended" : "Ends", " ", endDate.toLocaleString()] })] }), buyNowAvailable && buyNowPrice !== null && (_jsxs(Row, { align: "center", gap: "sm", className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)] bg-primary-50 dark:bg-primary-900/20", padding: "inlineSm", rounded: "lg", children: [_jsx(Span, { size: "xs", color: "muted", children: "Buy Now:" }), _jsx(Span, { size: "base", weight: "bold", className: "text-primary-700 dark:text-primary-300", children: _jsx(GatedPrice, { label: "Sign in to see the Buy Now price", children: formatCurrency(buyNowPrice, currency) }) }), _jsx(Span, { size: "xs", color: "faint", children: "\u2014 in \u201CPlace a bid\u201D" })] })), _jsx(ProductFeatureBadges, { featured: featured, freeShipping: freeShipping, condition: condition ?? undefined, finalSale: finalSale, labels: { featured: "Featured", fasterDelivery: "Faster Delivery", ratedSeller: "Rated Seller", condition: "Condition", conditionNew: "New", conditionUsed: "Used", conditionBroken: "For Parts", conditionRefurbished: "Refurbished", returnable: "Returnable", finalSale: "Final Sale", freeShipping: "Free Shipping", codAvailable: "Cash on Delivery", emiAvailable: "EMI Available", wishlistCount: (n) => `${n} wishlisted`, categoryProductCount: (n, cat) => `${n} in ${cat}` } }), (categoryName || category || brand) && (_jsxs(Row, { gap: "sm", wrap: true, children: [category && _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: categoryName || category }), !category && categoryName && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: categoryName }), brand && brandSlug && _jsx(Link, { href: String(ROUTES.PUBLIC.BRAND_DETAIL(brandSlug)), className: "inline-flex items-center rounded-full border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-2-5)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] transition-colors hover:border-primary-300 hover:bg-primary-surface hover:text-primary-700 dark:hover:border-primary-700/60 dark:hover:text-primary-400", children: brand }), brand && !brandSlug && _jsx(Span, { layout: "inline-flex", size: "xs", weight: "medium", border: "subtle", rounded: "full", padding: "pill-sm-tall", surface: "muted", color: "muted", children: brand })] })), productFeatures && features.length > 0 && _jsx(FeatureBadgeList, { productFeatureIds: features, features: productFeatures }), !productFeatures && features.length > 0 && (_jsxs(Div, { border: "subtle", surface: "muted", padding: "inline", rounded: "xl", children: [_jsx(Text, { className: "mb-2 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "About this item" }), _jsx(Ul, { spacing: "comfortable", size: "sm", color: "primary", children: features.map((f, i) => _jsxs(Li, { layout: "flex-start", gap: "2", children: [_jsx(Span, { className: "mt-0.5 flex-shrink-0 text-primary-500", children: "\u2022" }), f] }, i)) })] })), descriptionHtml && _jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" }), safeSeller && (_jsx(Div, { className: `${__P.p3}`, border: "subtle", rounded: "xl", surface: "muted", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Listed by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && _jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" })] }) }))] }));

package/dist/features/auth/hooks/useAuth.js

@@ -7,7 +7,7 @@ import { getClientSessionAdapter } from "../../../contracts/client-session.js";
 import { apiClient } from "../../../http/index.js";
 import { useAuthEvent } from "./useAuthEvent.js";
 import { RealtimeEventStatus } from "../../../react/hooks/useRealtimeEvent.js";
-import { AUTH_ENDPOINTS, } from "../../../constants/api-endpoints.js";
+import { AUTH_ENDPOINTS } from "../../../constants/api-endpoints.js";
 export function useCurrentUser(opts) {
     const query = useQuery({
         queryKey: ["auth", "me"],

package/dist/features/before-after/api/route.js

@@ -11,11 +11,7 @@
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../contracts/index.js";
 import { normalizeError } from "../../../errors/normalize.js";
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
+import { numParam } from "../../../utils/search-params.js";
 export async function GET(request) {
     try {
         const url = new URL(request.url);