@mohasinac/appkit 4.64.0 → 4.65.0

package/dist/features/seller/hooks/useSellerListingData.js

@@ -43,33 +43,3 @@ export function toCurrency(value) {
     }
     return formatCurrency(value);
 }
-/*
- * 🛑 `toRelativeDate` WAS HERE AND IS GONE. Import it from
- * `features/admin/hooks/useAdminListingData` — the defining module now, and
- * the one 44 files already use (Root Cause #18: import from where a symbol is
- * defined, never from a convenience copy).
- *
- * This copy had drifted from that one and the drift was live: for a FUTURE
- * date, `deltaMs` is negative, so `deltaMs < minute` matched and this version
- * answered **"just now"** while the admin version answered **"1m ago"** — two
- * different wrong answers to "when is this deadline", depending on which file
- * a view happened to import from. The admin one is fixed to say "in 48h"; a
- * second implementation is how that fix would have been half-applied.
- *
- * The three sibling helpers below are also duplicated there. They are left
- * alone deliberately: none of them is wrong, and collapsing them is an import
- * rewrite across both feature trees rather than a bug fix.
- */
-function parseDate(value) {
-    if (value instanceof Date)
-        return value;
-    if (typeof value === "string") {
-        const parsed = new Date(value);
-        return Number.isNaN(parsed.getTime()) ? null : parsed;
-    }
-    if (typeof value === "number") {
-        const parsed = new Date(value);
-        return Number.isNaN(parsed.getTime()) ? null : parsed;
-    }
-    return null;
-}

package/dist/features/stores/api/[storeSlug]/auctions/route.js

@@ -17,19 +17,10 @@ import { normalizeError } from "../../../../../errors/normalize.js";
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../../contracts/index.js";
 const SAFE_STORE_AUCTION_FILTER_FIELDS = new Set(["price", "category"]);
-function validateSieveFilters(raw, allowedFields) {
-    return raw
-        .split(",")
-        .map((c) => c.trim())
-        .filter((c) => {
-        const m = c.match(/^([^<>=!@]+)\s*(?:==|!=|<=|>=|<|>|@=\*?)/);
-        return m ? allowedFields.has(m[1].trim()) : false;
-    })
-        .join(",");
-}
 import { parseListingParams } from "../../../../../utils/listing-params.js";
 import { SIEVE_OP, sieveFilter } from "../../../../../utils/sieve-builder.js";
 import { PRODUCT_FIELDS } from "../../../../../constants/field-names.js";
+import { validateSieveFilters } from "../../../../../utils/sieve-builder.js";
 const DEFAULT_PAGE = 1;
 const DEFAULT_PAGE_SIZE = 24;
 const DEFAULT_SORT = "-createdAt";

package/dist/features/stores/api/[storeSlug]/products/route.js

@@ -19,6 +19,7 @@ import { getProviders } from "../../../../../contracts/index.js";
 import { parseListingParams } from "../../../../../utils/listing-params.js";
 import { SIEVE_OP, sieveFilter } from "../../../../../utils/sieve-builder.js";
 import { PRODUCT_FIELDS } from "../../../../../constants/field-names.js";
+import { validateSieveFilters } from "../../../../../utils/sieve-builder.js";
 const DEFAULT_PAGE = 1;
 const DEFAULT_PAGE_SIZE = 24;
 const DEFAULT_SORT = "-createdAt";
@@ -28,16 +29,6 @@ const SAFE_STORE_PRODUCT_FILTER_FIELDS = new Set([
     "brand",
     "condition",
 ]);
-function validateSieveFilters(raw, allowedFields) {
-    return raw
-        .split(",")
-        .map((c) => c.trim())
-        .filter((c) => {
-        const m = c.match(/^([^<>=!@]+)\s*(?:==|!=|<=|>=|<|>|@=\*?)/);
-        return m ? allowedFields.has(m[1].trim()) : false;
-    })
-        .join(",");
-}
 // --- GET /api/stores/[storeSlug]/products -------------------------------------
 export async function GET(request, context) {
     try {

package/dist/features/stores/components/InteractiveStoreCard.js

@@ -16,6 +16,14 @@ export function InteractiveStoreCard({ store, href, selectable, isSelected = fal
     const [logoBroken, setLogoBroken] = useState(false);
     const hasLogo = Boolean(store.storeLogoURL) && !logoBroken;
     const hasBanner = Boolean(store.storeBannerURL);
+    /*
+     * The rating badge used to live ONLY as an overlay on the banner, so making
+     * the banner conditional would have silently dropped the rating from every
+     * bannerless store — a hidden second effect of a layout change (Root Cause
+     * #57's family). It renders in the stats row instead when there is no banner
+     * to sit on, so the card never loses the number.
+     */
+    const hasRating = store.averageRating != null && store.averageRating > 0;
     const longPress = useLongPress(() => onSelect?.(store.id, !isSelected));
     const card = (_jsxs(Div, { className: [
             "group relative flex flex-col h-full overflow-hidden rounded-xl border bg-[var(--appkit-color-surface)] shadow-sm transition-shadow hover:shadow-lg",
@@ -26,7 +34,7 @@ export function InteractiveStoreCard({ store, href, selectable, isSelected = fal
         ].join(" "), onMouseDown: !isSelected ? longPress.onMouseDown : undefined, onMouseUp: !isSelected ? longPress.onMouseUp : undefined, onMouseLeave: !isSelected ? longPress.onMouseLeave : undefined, onTouchStart: !isSelected ? longPress.onTouchStart : undefined, onTouchEnd: !isSelected ? longPress.onTouchEnd : undefined, onTouchCancel: !isSelected ? longPress.onTouchCancel : undefined, children: [onSelect && (_jsx(BaseListingCard.Checkbox, { selected: isSelected, onSelect: (e) => {
                     e.preventDefault();
                     onSelect(store.id, !isSelected);
-                }, label: isSelected ? "Deselect store" : "Select store", position: "top-2 left-2", className: selectable || isSelected ? "opacity-100" : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto transition-opacity" })), _jsxs(Link, { href: href, className: "flex flex-col flex-1 min-h-0", children: [_jsxs(Div, { surface: "muted", className: `relative aspect-video w-full ${__O.hidden} flex-shrink-0`, children: [hasBanner ? (_jsx(MediaImage, { src: store.storeBannerURL, alt: `${store.storeName} banner`, size: "banner", className: "h-full w-full object-cover transition-transform duration-500 group-hover:scale-105" })) : (_jsx(Row, { className: "absolute inset-0", align: "center", justify: "center", children: _jsx(Span, { className: "opacity-20 select-none", size: "5xl", "aria-hidden": "true", children: "\uD83C\uDFEA" }) })), _jsx(Scrim, { direction: "bottom-up", intensity: "subtle", className: "absolute inset-x-0 bottom-0 h-12" }), store.averageRating != null && store.averageRating > 0 && (_jsxs(Div, { className: CLS_RATING_BADGE, children: ["\u2605 ", store.averageRating.toFixed(1)] }))] }), _jsxs(Stack, { paddingY: "b-md", className: "flex-1", padding: "x-md", children: [_jsx(Row, { className: "-mt-5 mb-2", align: "end", justify: "between", children: _jsx(Div, { className: "flex-shrink-0", children: hasLogo ? (_jsx(Div, { className: "relative h-10 w-10 border-2 border-[var(--appkit-color-border-subtle)] bg-[var(--appkit-color-surface)]", rounded: "lg", shadow: "md", overflow: "hidden", children: _jsx(MediaImage, { src: store.storeLogoURL, alt: store.storeName, size: "thumbnail", onError: () => setLogoBroken(true) }) })) : (_jsx(Row, { textWeight: "bold", textSize: "base", className: "h-10 w-10 border-2 border-white bg-primary/10 dark:bg-primary/20 text-primary", align: "center", justify: "center", rounded: "lg", shadow: "md", children: initial })) }) }), _jsx(Heading, { level: 3, className: `group-hover:text-primary transition-colors`, truncate: true, size: "sm", weight: "bold", color: "primary", children: store.storeName }), _jsx(SellerTierBadge, { isVerified: store.isVerified, sellerTier: store.sellerTier, size: "xs" }), store.storeDescription ? (_jsx(RichText, { html: normalizeRichTextHtml(store.storeDescription), proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "mt-1 line-clamp-2 text-[length:var(--appkit-text-xs)] text-[var(--appkit-color-text-muted)] flex-1" })) : (_jsx(Div, { className: "flex-1" })), _jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", className: "mt-2.5", wrap: true, children: [store.totalProducts != null && store.totalProducts > 0 && (_jsxs(Span, { layout: "flex", gap: "2xs", children: [_jsx(Span, { "aria-hidden": "true", children: "\uD83D\uDCE6" }), " ", store.totalProducts, " ", labels.products ?? "products"] })), store.itemsSold != null && store.itemsSold > 0 && (_jsxs(Span, { layout: "flex", gap: "2xs", children: [_jsx(Span, { "aria-hidden": "true", children: "\uD83D\uDECD\uFE0F" }), " ", store.itemsSold, " ", labels.sold ?? "sold"] }))] }), _jsxs(Row, { border: "top-subtle", paddingY: "y-xs-tall", className: "mt-3", align: "center", justify: "between", children: [_jsxs(Span, { size: "xs", weight: "semibold", className: "text-primary group-hover:underline transition-colors", children: [labels.visitStore ?? "Visit store", " \u2192"] }), store.totalReviews != null && store.totalReviews > 0 && (_jsxs(Span, { size: "xs", color: "muted", children: [store.totalReviews, " ", labels.reviews ?? "reviews"] }))] })] })] })] }));
+                }, label: isSelected ? "Deselect store" : "Select store", position: "top-2 left-2", className: selectable || isSelected ? "opacity-100" : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto transition-opacity" })), _jsxs(Link, { href: href, className: "flex flex-col flex-1 min-h-0", children: [hasBanner && (_jsxs(Div, { surface: "muted", className: `relative aspect-video w-full ${__O.hidden} flex-shrink-0`, children: [_jsx(MediaImage, { src: store.storeBannerURL, alt: `${store.storeName} banner`, size: "banner", className: "h-full w-full object-cover transition-transform duration-500 group-hover:scale-105" }), _jsx(Scrim, { direction: "bottom-up", intensity: "subtle", className: "absolute inset-x-0 bottom-0 h-12" }), hasRating && (_jsxs(Div, { className: CLS_RATING_BADGE, children: ["\u2605 ", store.averageRating.toFixed(1)] }))] })), _jsxs(Stack, { paddingY: "b-md", className: "flex-1", padding: "x-md", children: [_jsx(Row, { className: hasBanner ? "-mt-5 mb-2" : "mt-3 mb-2", align: "end", justify: "between", children: _jsx(Div, { className: "flex-shrink-0", children: hasLogo ? (_jsx(Div, { className: "relative h-10 w-10 border-2 border-[var(--appkit-color-border-subtle)] bg-[var(--appkit-color-surface)]", rounded: "lg", shadow: "md", overflow: "hidden", children: _jsx(MediaImage, { src: store.storeLogoURL, alt: store.storeName, size: "thumbnail", onError: () => setLogoBroken(true) }) })) : (_jsx(Row, { textWeight: "bold", textSize: "base", className: "h-10 w-10 border-2 border-white bg-primary/10 dark:bg-primary/20 text-primary", align: "center", justify: "center", rounded: "lg", shadow: "md", children: initial })) }) }), _jsx(Heading, { level: 3, className: `group-hover:text-primary transition-colors`, truncate: true, size: "sm", weight: "bold", color: "primary", children: store.storeName }), _jsx(SellerTierBadge, { isVerified: store.isVerified, sellerTier: store.sellerTier, size: "xs" }), store.storeDescription ? (_jsx(RichText, { html: normalizeRichTextHtml(store.storeDescription), proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "mt-1 line-clamp-2 text-[length:var(--appkit-text-xs)] text-[var(--appkit-color-text-muted)] flex-1" })) : (_jsx(Div, { className: "flex-1" })), _jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", className: "mt-2.5", wrap: true, children: [!hasBanner && hasRating && (_jsxs(Span, { layout: "flex", gap: "2xs", className: "text-warning", children: [_jsx(Span, { "aria-hidden": "true", children: "\u2605" }), " ", store.averageRating.toFixed(1)] })), store.totalProducts != null && store.totalProducts > 0 && (_jsxs(Span, { layout: "flex", gap: "2xs", children: [_jsx(Span, { "aria-hidden": "true", children: "\uD83D\uDCE6" }), " ", store.totalProducts, " ", labels.products ?? "products"] })), store.itemsSold != null && store.itemsSold > 0 && (_jsxs(Span, { layout: "flex", gap: "2xs", children: [_jsx(Span, { "aria-hidden": "true", children: "\uD83D\uDECD\uFE0F" }), " ", store.itemsSold, " ", labels.sold ?? "sold"] }))] }), _jsxs(Row, { border: "top-subtle", paddingY: "y-xs-tall", className: "mt-3", align: "center", justify: "between", children: [_jsxs(Span, { size: "xs", weight: "semibold", className: "text-primary group-hover:underline transition-colors", children: [labels.visitStore ?? "Visit store", " \u2192"] }), store.totalReviews != null && store.totalReviews > 0 && (_jsxs(Span, { size: "xs", color: "muted", children: [store.totalReviews, " ", labels.reviews ?? "reviews"] }))] })] })] })] }));
     if (!renderOwnerActions)
         return card;
     /*

package/dist/features/stores/components/StoreGuideHubView.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Package, ShoppingBag, Wallet, Settings, Shield, Headphones, CheckCircle2, Circle, BookOpen, } from "lucide-react";
+import { Package, ShoppingBag, Wallet, Settings, Shield, Headphones, CheckCircle2, Circle, BookOpen } from "lucide-react";
 import { Div, Grid, Heading, Progress, Row, Section, Stack, Text, TextLink } from "../../../ui/index.js";
 import { SellerStandingPanel } from "./SellerStandingPanel.js";
 import { ROUTES } from "../../../next/routing/route-map.js";

package/dist/features/stores/components/StoresIndexPageView.d.ts

@@ -1,7 +1,7 @@
 import React from "react";
-type SearchParams = Record<string, string | string[]>;
+import type { SearchParamsRecord } from "../../../utils/search-params";
 export interface StoresIndexPageViewProps {
-    searchParams?: SearchParams;
+    searchParams?: SearchParamsRecord;
     /**
      * Restrict to verified stores and retitle the page. This is what /sellers is.
      *
@@ -19,4 +19,3 @@ export interface StoresIndexPageViewProps {
     heading?: string;
 }
 export declare function StoresIndexPageView({ searchParams, verifiedOnly, heading, }: StoresIndexPageViewProps): Promise<React.JSX.Element>;
-export {};

package/dist/features/stores/components/StoresIndexPageView.js

@@ -6,14 +6,11 @@ import { StoresIndexListing } from "./StoresIndexListing.js";
 import { safeRead } from "../../../errors/safe-read.js";
 import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility.js";
 import { STORE_FIELDS } from "../../../constants/field-names.js";
-function sp(params, key) {
-    const v = params[key];
-    return Array.isArray(v) ? v[0] ?? "" : v ?? "";
-}
+import { firstParam } from "../../../utils/search-params.js";
 export async function StoresIndexPageView({ searchParams = {}, verifiedOnly = false, heading = "Stores", }) {
-    const sort = sp(searchParams, "sort") || "-createdAt";
-    const page = Number(sp(searchParams, "page")) || 1;
-    const pageSize = Number(sp(searchParams, "pageSize")) || 24;
+    const sort = firstParam(searchParams, "sort") || "-createdAt";
+    const page = Number(firstParam(searchParams, "page")) || 1;
+    const pageSize = Number(firstParam(searchParams, "pageSize")) || 24;
     /*
      * 🛑 `q` MUST be read here, and passed as the third argument exactly as
      * /api/stores does — `listStores(model, true, { search })`.
@@ -29,14 +26,14 @@ export async function StoresIndexPageView({ searchParams = {}, verifiedOnly = fa
      * frozen for that query key. Root Cause #30 — the SSR builder has to compute
      * the same filters the client would, because it never gets a second chance.
      */
-    const q = sp(searchParams, "q").trim();
+    const q = firstParam(searchParams, "q").trim();
     /*
      * The rating facet must be applied HERE too, not only by the client. This
      * result is handed to <StoresIndexListing initialData=…>, and public listing
      * hooks set staleTime: Infinity when given SSR data — so an unfiltered first
      * paint is frozen for that query key and never self-corrects (Root Cause #30).
      */
-    const ratingRaw = sp(searchParams, "rating");
+    const ratingRaw = firstParam(searchParams, "rating");
     const minRating = ratingRaw
         ? Math.max(...ratingRaw.split("|").map(Number).filter((n) => Number.isFinite(n)))
         : undefined;

package/dist/features/stores/schemas/firestore.d.ts

@@ -415,6 +415,31 @@ export interface StoreDocument extends BaseDocument {
      * than trusting that nobody adds it.
      */
     returnsDirectToSeller?: boolean;
+    /**
+     * Does this store publish a WhatsApp catalogue feed?
+     *
+     * 🛑 **ABSENT MEANS ENABLED**, and the polarity is load-bearing rather than a
+     * convenience. Every store that predates this field is already feeding a live
+     * Commerce Manager data source; a `=== true` reader would turn all of them off
+     * at once, and Meta EMPTIES a connected catalogue the first time a scheduled
+     * fetch returns a file with no rows. So the only state that disables a feed is
+     * somebody deliberately writing `false` — the same `!== false` kill-switch
+     * polarity as `siteSettings.search.indexEnabled`, and for the same reason.
+     *
+     * 🛑 Disabling is DESTRUCTIVE on Meta's side and that is the point. The feed
+     * route answers a disabled store with **200 and a header row only**, which is
+     * what makes the seller's next scheduled fetch clear their WhatsApp catalogue.
+     * Its 404 branch (unpublished / suspended / missing store) exists to avoid
+     * exactly that outcome for a TEMPORARY state. The distinction is intent: a
+     * suspension is not a decision to unpublish a catalogue, and a seller flipping
+     * this switch is.
+     *
+     * 🛑 PRIVATE in the public store projection. It describes a seller's own
+     * distribution plumbing, not the goods — and publishing it would advertise
+     * which stores are reachable on WhatsApp, which `whatsappNotifySubscribed`
+     * is private for too.
+     */
+    whatsappFeedEnabled?: boolean;
     /**
      * Who changed what, when, and why. See § "Status History" in CLAUDE.md.
      *
@@ -479,6 +504,8 @@ export declare const STORE_FIELDS: {
     readonly TIER_LOCKED_BY_ADMIN: "tierLockedByAdmin";
     readonly SUSPENSION_REASON: "suspensionReason";
     readonly CAPABILITIES: "capabilities";
+    /** Per-store WhatsApp catalogue feed kill switch. Absent means ENABLED. */
+    readonly WHATSAPP_FEED_ENABLED: "whatsappFeedEnabled";
     readonly STATUS_VALUES: {
         readonly PENDING: "pending";
         readonly ACTIVE: "active";

package/dist/features/stores/schemas/firestore.js

@@ -92,6 +92,8 @@ export const STORE_FIELDS = {
     TIER_LOCKED_BY_ADMIN: "tierLockedByAdmin",
     SUSPENSION_REASON: "suspensionReason",
     CAPABILITIES: "capabilities",
+    /** Per-store WhatsApp catalogue feed kill switch. Absent means ENABLED. */
+    WHATSAPP_FEED_ENABLED: "whatsappFeedEnabled",
     STATUS_VALUES: {
         PENDING: "pending",
         ACTIVE: "active",

package/dist/features/wishlist/utils/guest-wishlist.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../../errors/normalize.js";
+import { getDefaultStorage } from "../../../utils/browser-storage.js";
 const DEFAULT_GUEST_WISHLIST_KEY = process.env.NEXT_PUBLIC_APP_ID
     ? `${process.env.NEXT_PUBLIC_APP_ID}_guest_wishlist`
     : "guest_wishlist";
@@ -12,11 +13,6 @@ function dispatchGuestWishlistChange() {
         return;
     window.dispatchEvent(new Event(GUEST_WISHLIST_CHANGE_EVENT));
 }
-function getDefaultStorage() {
-    if (typeof window === "undefined")
-        return null;
-    return window.localStorage;
-}
 function readItems(storage, key) {
     if (!storage)
         return [];

package/dist/index.d.ts

@@ -2188,7 +2188,8 @@ export { getProductSortOptions } from "./features/products/index";
 export { getProductTableColumns } from "./features/products/index";
 export { normalizeListingType, isAuctionListing, isPreOrderListing, isStandardListing, isPrizeDrawListing, isClassifiedListing, isDigitalCodeListing, isLiveListing, isArtListing, isStickersListing, } from "./features/products/index";
 export { isFinalSale, acceptsChangeOfMindReturns, } from "./features/products/constants/final-sale";
-export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, } from "./_internal/shared/listing-types/feature-flags";
+export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, isBrowsePageEnabled, enabledBrowsePages, ALL_BROWSE_PAGES, isBrowsePageKey, } from "./_internal/shared/listing-types/feature-flags";
+export type { BrowsePageKey } from "./_internal/shared/listing-types/feature-flags";
 export { ADVANCED_LISTING_TYPE_CAPABILITY, ADVANCED_LISTING_TYPES, BASIC_LISTING_TYPES, LISTING_TYPE_TIER, assertListingTypeAllowed, hasAdvancedListingTypes, isAdvancedListingType, isListingTypeAllowedFor, listingTypesAllowedFor, } from "./_internal/shared/listing-types/tiers";
 export type { ListingTypeAccessContext, ListingTypeTier, } from "./_internal/shared/listing-types/tiers";
 export { actionTracker, setActionTrackerSink, resetActionTrackerSink, type ActionEvent, type ActionTrackerSink, } from "./_internal/shared/listing-types/action-tracker";
@@ -2852,6 +2853,8 @@ export { TAX_CODES_COLLECTION, TAX_CODE_PREFIX, TAX_CODE_FIELDS, TAX_CODE_SIEVE_
 export type { TaxCodeDocument, TaxCodeCreateInput, TaxCodeUpdateInput, GstRate, HsnChapter, } from "./features/tax-codes/schemas/firestore";
 export { taxCodeFormSchema, GST_RATE_OPTIONS, HSN_CHAPTER_OPTIONS } from "./features/tax-codes/schemas/tax-code-form";
 export type { TaxCodeFormValues } from "./features/tax-codes/schemas/tax-code-form";
+export { EVENT_LIKES_COLLECTION } from "./features/events/schemas/likes";
+export { DISPUTE_REASON_COLLECTION } from "./features/dispute-reasons/schemas/firestore";
 export { taxCodeCreateSchema, taxCodeUpdateSchema, } from "./features/tax-codes/schemas/tax-codes.validators";
 export type { TaxCodeCreatePayload, TaxCodeUpdatePayload, } from "./features/tax-codes/schemas/tax-codes.validators";
 export type { ProductFeatureDocument, ProductFeatureCreateInput, ProductFeatureUpdateInput, ProductFeatureScope, ProductFeatureCategory, ProductFeatureProductType, ProductFeatureIcon, } from "./features/products/schemas/product-features";

package/dist/index.js

@@ -4075,7 +4075,13 @@ export { normalizeListingType, isAuctionListing, isPreOrderListing, isStandardLi
 // `finalSale` field. See the module docstring for why `!p.finalSale` is wrong.
 export { isFinalSale, acceptsChangeOfMindReturns, } from "./features/products/constants/final-sale.js";
 // SB-UNI-X4 2026-05-13 â€" per-type feature-flag helpers.
-export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, } from "./_internal/shared/listing-types/feature-flags.js";
+export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, 
+// Browse-section gates — /categories, /brands, /franchise, /stores.
+// Exported HERE rather than from server.ts for the reason given in that
+// file's ALL_LISTING_TYPES note: `server-entry.ts` re-exports index, so a
+// Server Component already reaches these from the bare specifier and a
+// second path would leak an `_internal/` symbol through a third barrel.
+isBrowsePageEnabled, enabledBrowsePages, ALL_BROWSE_PAGES, isBrowsePageKey, } from "./_internal/shared/listing-types/feature-flags.js";
 // Basic/advanced listing-type split — which types a store may create.
 // Pure (no firebase-admin in its import chain), so it is safe in index.ts.
 export { ADVANCED_LISTING_TYPE_CAPABILITY, ADVANCED_LISTING_TYPES, BASIC_LISTING_TYPES, LISTING_TYPE_TIER, assertListingTypeAllowed, hasAdvancedListingTypes, isAdvancedListingType, isListingTypeAllowedFor, listingTypesAllowedFor, } from "./_internal/shared/listing-types/tiers.js";
@@ -5140,6 +5146,27 @@ export { PRODUCT_FEATURES_COLLECTION, PRODUCT_FEATURE_PREFIX, MAX_STORE_CUSTOM_F
 // Tax codes feature schemas (B3) — HSN + GST rate as an entity.
 export { TAX_CODES_COLLECTION, TAX_CODE_PREFIX, TAX_CODE_FIELDS, TAX_CODE_SIEVE_FIELDS, TAX_CODE_UPDATABLE_FIELDS, GST_RATE_VALUES, createTaxCodeId, isValidHsnCode, } from "./features/tax-codes/schemas/firestore.js";
 export { taxCodeFormSchema, GST_RATE_OPTIONS, HSN_CHAPTER_OPTIONS } from "./features/tax-codes/schemas/tax-code-form.js";
+/*
+ * 🛑 THE SEED LOADER DESTRUCTURES THESE TWO OFF THE BARREL, so an unexported
+ * collection name is not a tidiness issue — it is a collection that can
+ * never load.
+ *
+ * `seed-cli.mjs` reads `COLLECTION_MAP` from one big destructure of
+ * `@mohasinac/appkit`. A name missing there is `undefined`, which Firestore
+ * rejects as `Value for argument "collectionPath" is not a valid resource
+ * path` — so `appkit-seed status` and `load` both error on that row alone
+ * while every other collection succeeds. Measured 2026-10-24: eventLikes
+ * (23 rows) and disputeReasons (11 rows) were both stuck at 0 in the
+ * database for exactly this reason, and the error names the path, never the
+ * missing export.
+ *
+ * Exported straight from the defining schema module rather than through a
+ * feature index (Root Cause #18). Both files carry ONLY `import type`, which
+ * the compiler erases, so neither drags a runtime chain into the client
+ * bundle — the check that matters before adding anything here.
+ */
+export { EVENT_LIKES_COLLECTION } from "./features/events/schemas/likes.js";
+export { DISPUTE_REASON_COLLECTION } from "./features/dispute-reasons/schemas/firestore.js";
 // Wire contracts for /api/admin/tax-codes. BOTH are .strict(): z.object()
 // strips unknown keys (a PATCH returning 200 having written nothing),
 // .passthrough() writes whatever arrives.

package/dist/providers/db-firebase/admin-app-lite.js

@@ -30,7 +30,13 @@ export function getAdminAppLite() {
         process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET?.trim();
     let app;
     if (nodeFs().existsSync(keyPath)) {
-        const sa = JSON.parse(nodeFs().readFileSync(keyPath, "utf8"));
+        /*
+         * 🛑 A `const sa = JSON.parse(readFileSync(keyPath))` sat here and was removed
+         * 2026-10-24: the parsed object was never used, because `cert(keyPath)` below
+         * takes the PATH and reads and validates the file itself. The only thing the
+         * extra parse bought was a second read of a service-account key on every
+         * cold start.
+         */
         const dbUrl = resolveRtdbUrl();
         app = initializeApp({ credential: cert(keyPath), databaseURL: dbUrl, ...(storageBucket && { storageBucket }) });
     }
@@ -63,7 +69,13 @@ export function getAdminAppLite() {
         const firebaseConfig = process.env.FIREBASE_CONFIG
             ? JSON.parse(process.env.FIREBASE_CONFIG)
             : {};
-        const projectId = firebaseConfig.projectId ?? process.env.GCLOUD_PROJECT ?? "";
+        /*
+         * 🛑 A `projectId` was computed here from FIREBASE_CONFIG/GCLOUD_PROJECT and
+         * never passed, which was CORRECT but dead: this is the ADC branch, and
+         * `initializeApp()` with no credential is exactly what makes the SDK resolve
+         * both credential and project from the metadata server. Removed 2026-10-24
+         * rather than wired, because passing it would override that resolution.
+         */
         const dbUrl = firebaseConfig.databaseURL ??
             resolveRtdbUrl();
         app = initializeApp({

package/dist/providers/db-firebase/admin.js

@@ -83,7 +83,10 @@ export function getAdminApp() {
     let app;
     try {
         if (nodeFs().existsSync(keyPath)) {
-            const sa = JSON.parse(nodeFs().readFileSync(keyPath, "utf8"));
+            /*
+             * 🛑 Removed 2026-10-24 — see the matching note in admin-app-lite.ts. The
+             * parsed service account was never used; `cert(keyPath)` reads the file.
+             */
             // Was NEXT_PUBLIC-only here while the other two branches honoured
             // FIREBASE_ADMIN_DATABASE_URL, so setting it had no effect on this path.
             const dbUrl = resolveRtdbUrl();
@@ -118,7 +121,10 @@ export function getAdminApp() {
             const firebaseConfig = process.env.FIREBASE_CONFIG
                 ? JSON.parse(process.env.FIREBASE_CONFIG)
                 : {};
-            const projectId = firebaseConfig.projectId ?? process.env.GCLOUD_PROJECT ?? "";
+            /*
+             * 🛑 Removed 2026-10-24 — see admin-app-lite.ts. Computed, never passed, and
+             * passing it would defeat ADC's own project resolution.
+             */
             // FIREBASE_CONFIG is injected by the Functions runtime and is
             // authoritative there; env vars are the fallback for other runtimes.
             const dbUrl = firebaseConfig.databaseURL || resolveRtdbUrl();

package/dist/react/hooks/useBrowsePageFlags.d.ts

@@ -0,0 +1,26 @@
+import { type BrowsePageKey } from "../../_internal/shared/listing-types/feature-flags";
+/**
+ * Which public browse sections are open, as configured in
+ * `siteSettings.listings.browsePages`.
+ *
+ * The sibling of `useListingTypeFlags`, and built the same way on purpose:
+ * keyed on the union via `ALL_BROWSE_PAGES` so a new section cannot be
+ * silently missed, and DEFAULTING TO OPEN while settings load so the first
+ * paint does not briefly hide navigation that is actually enabled.
+ *
+ * 🛑 The permissive default matters more here than it does for listing types.
+ * This hook decides whether a nav entry RENDERS, so a `false` default would
+ * blank the navbar on every cold load until the settings request resolved —
+ * visible flicker on every page of the site rather than one empty browse tab.
+ */
+export type BrowsePageFlagsShape = Partial<Record<BrowsePageKey, boolean>>;
+export type BrowsePageFlags = Record<BrowsePageKey, boolean> & {
+    /** True when the section is open (or the setting has not loaded yet). */
+    isEnabled: (page: BrowsePageKey) => boolean;
+    /**
+     * True when a link may be shown — i.e. it points at no browse section, or at
+     * one that is open. Pass an href straight from a nav or footer constant.
+     */
+    allowsHref: (href: string | undefined | null) => boolean;
+};
+export declare function useBrowsePageFlags(): BrowsePageFlags;

package/dist/react/hooks/useBrowsePageFlags.js

@@ -0,0 +1,18 @@
+"use client";
+import { useSiteSettings } from "../../core/hooks/useSiteSettings.js";
+import { ALL_BROWSE_PAGES, browsePageForPath, } from "../../_internal/shared/listing-types/feature-flags.js";
+export function useBrowsePageFlags() {
+    const { data } = useSiteSettings();
+    const bp = data?.listings?.browsePages;
+    // Closed only when EXPLICITLY false — a missing flag, or settings that have
+    // not loaded, means open.
+    const flags = Object.fromEntries(ALL_BROWSE_PAGES.map((page) => [page, bp?.[page] !== false]));
+    return {
+        ...flags,
+        isEnabled: (page) => flags[page],
+        allowsHref: (href) => {
+            const page = browsePageForPath(href);
+            return page === null || flags[page];
+        },
+    };
+}

package/dist/schemas/registry.d.ts

@@ -2573,7 +2573,7 @@ export declare const SCHEMAS: {
             isActive: boolean;
             isFeatured: boolean;
             productIds: string[];
-            groupTheme: "set" | "related" | "character" | "lineage" | "generic";
+            groupTheme: "set" | "character" | "related" | "lineage" | "generic";
             minActiveMembers: number;
             visibilityStatus: "hidden" | "visible";
             activeMemberCount: number;
@@ -2596,7 +2596,7 @@ export declare const SCHEMAS: {
             isActive: boolean;
             isFeatured: boolean;
             productIds: string[];
-            groupTheme: "set" | "related" | "character" | "lineage" | "generic";
+            groupTheme: "set" | "character" | "related" | "lineage" | "generic";
             minActiveMembers: number;
             visibilityStatus: "hidden" | "visible";
             activeMemberCount: number;
@@ -5332,7 +5332,7 @@ export declare const SCHEMAS: {
             isActive: boolean;
             isFeatured: boolean;
             productIds: string[];
-            groupTheme: "set" | "related" | "character" | "lineage" | "generic";
+            groupTheme: "set" | "character" | "related" | "lineage" | "generic";
             minActiveMembers: number;
             description?: string | undefined;
             coverImage?: string | undefined;
@@ -5341,7 +5341,7 @@ export declare const SCHEMAS: {
             isActive: boolean;
             isFeatured: boolean;
             productIds: string[];
-            groupTheme: "set" | "related" | "character" | "lineage" | "generic";
+            groupTheme: "set" | "character" | "related" | "lineage" | "generic";
             minActiveMembers: number;
             description?: string | undefined;
             coverImage?: string | undefined;

package/dist/security/csp.d.ts

@@ -1,9 +1,39 @@
 /**
- * Content Security Policy helpers.
- * Generates a per-request nonce and builds the CSP header string.
+ * Content Security Policy helpers — **NOT WIRED. Do not wire as-is.**
+ *
+ * 🛑 Measured 2026-10-24: these two functions are exported from three barrels
+ * (`security/index.ts`, `security/browser.ts`, and appkit's main `index.ts`) and imported by
+ * **nothing** — not elsewhere in appkit, not in the consumer. That is Root Cause #87's shape:
+ * a module whose absence is silent because nothing registers it. For the whole time it
+ * existed, letitrip.in shipped no CSP at all.
+ *
+ * 🛑 **And wiring `buildCSP` unchanged would break the live site.** The policy below predates
+ * four integrations the app now depends on, and every one of them fails *silently, in someone
+ * else's browser*:
+ *
+ *   - **Razorpay** — no `checkout.razorpay.com` / `api.razorpay.com` in `script-src`,
+ *     `frame-src` or `connect-src`. Checkout would not load.
+ *   - **YouTube embeds** — no `www.youtube-nocookie.com` in `frame-src`. Every product and
+ *     blog video embed would be blocked.
+ *   - **Firebase RTDB** — no `wss://*.firebasedatabase.app` in `connect-src` (only the older
+ *     `firebaseio.com`). The auth/payment/bulk signal channels would stop.
+ *   - **`frame-ancestors`** and **`object-src`** are absent entirely.
+ *
+ * **What ships instead, today:** a `Content-Security-Policy-Report-Only` header built inline
+ * in the consumer's `next.config.js`, covering all four of the above. Report-Only on purpose —
+ * an enforced policy guessed without report data is how you discover the gaps above from a
+ * user. `audit-security-headers` requires a CSP in either spelling and accepts Report-Only as
+ * a valid end state.
+ *
+ * **Why this file is kept rather than deleted:** the *nonce* approach here is the correct
+ * destination — `'nonce-…'` is strictly better than the `'unsafe-inline'` the inline policy
+ * currently needs. Getting there means generating a nonce in `src/proxy.ts`, threading it
+ * through `requestHeaders`, and attaching it to every inline script Next emits. That is its
+ * own change, and the policy string needs the four additions above first.
  *
  * @example
  * ```ts
+ * // The intended shape, once the nonce is threaded through proxy.ts:
  * const nonce = generateNonce();
  * const csp = buildCSP(nonce);
  * response.headers.set("Content-Security-Policy", csp);

package/dist/security/csp.js

@@ -1,9 +1,39 @@
 /**
- * Content Security Policy helpers.
- * Generates a per-request nonce and builds the CSP header string.
+ * Content Security Policy helpers — **NOT WIRED. Do not wire as-is.**
+ *
+ * 🛑 Measured 2026-10-24: these two functions are exported from three barrels
+ * (`security/index.ts`, `security/browser.ts`, and appkit's main `index.ts`) and imported by
+ * **nothing** — not elsewhere in appkit, not in the consumer. That is Root Cause #87's shape:
+ * a module whose absence is silent because nothing registers it. For the whole time it
+ * existed, letitrip.in shipped no CSP at all.
+ *
+ * 🛑 **And wiring `buildCSP` unchanged would break the live site.** The policy below predates
+ * four integrations the app now depends on, and every one of them fails *silently, in someone
+ * else's browser*:
+ *
+ *   - **Razorpay** — no `checkout.razorpay.com` / `api.razorpay.com` in `script-src`,
+ *     `frame-src` or `connect-src`. Checkout would not load.
+ *   - **YouTube embeds** — no `www.youtube-nocookie.com` in `frame-src`. Every product and
+ *     blog video embed would be blocked.
+ *   - **Firebase RTDB** — no `wss://*.firebasedatabase.app` in `connect-src` (only the older
+ *     `firebaseio.com`). The auth/payment/bulk signal channels would stop.
+ *   - **`frame-ancestors`** and **`object-src`** are absent entirely.
+ *
+ * **What ships instead, today:** a `Content-Security-Policy-Report-Only` header built inline
+ * in the consumer's `next.config.js`, covering all four of the above. Report-Only on purpose —
+ * an enforced policy guessed without report data is how you discover the gaps above from a
+ * user. `audit-security-headers` requires a CSP in either spelling and accepts Report-Only as
+ * a valid end state.
+ *
+ * **Why this file is kept rather than deleted:** the *nonce* approach here is the correct
+ * destination — `'nonce-…'` is strictly better than the `'unsafe-inline'` the inline policy
+ * currently needs. Getting there means generating a nonce in `src/proxy.ts`, threading it
+ * through `requestHeaders`, and attaching it to every inline script Next emits. That is its
+ * own change, and the policy string needs the four additions above first.
  *
  * @example
  * ```ts
+ * // The intended shape, once the nonce is threaded through proxy.ts:
  * const nonce = generateNonce();
  * const csp = buildCSP(nonce);
  * response.headers.set("Content-Security-Policy", csp);