@mohasinac/appkit 4.65.0 → 4.67.0

package/dist/_internal/server/jobs/core/newsletterExport.js

@@ -10,7 +10,7 @@
  * would need a `/media/...` proxy URL per the Media Architecture rules
  * rather than a raw signed URL).
  */
-import { newsletterRepository } from "../../../../repositories/index.js";
+import { newsletterRepository } from "../../../../core/newsletter.repository.js";
 import { sortBy } from "../../../../constants/sort.js";
 import { COMMON_FIELDS } from "../../../../constants/field-names.js";
 function escape(value) {

package/dist/_internal/server/jobs/core/notificationPrune.js

@@ -1,5 +1,5 @@
 import { normalizeError } from "../../../../errors/normalize.js";
-import { notificationRepository } from "../../../../repositories/index.js";
+import { notificationRepository } from "../../../../features/admin/repository/notification.repository.js";
 import { conversationsRepository } from "../../../../features/messages/repository/conversations.repository.js";
 import { CONVERSATION_ACTIVE_DAYS, CONVERSATION_ARCHIVE_DAYS, } from "../../../../features/messages/schemas/firestore.js";
 import { deleteAllMessages, listAllAttachmentUrls, } from "../../../../features/messages/repository/messages.repository.js";

package/dist/_internal/server/jobs/core/onJobCreated.js

@@ -11,7 +11,7 @@
  * `runJobOnce`, which the retry sweep also calls. One dispatch path for both
  * entry points, or the two drift the first time either learns something.
  */
-import { jobsRepository } from "../../../../repositories/index.js";
+import { jobsRepository } from "../../../../features/jobs/repository/jobs.repository.js";
 import { runJobOnce } from "./runJobOnce.js";
 export async function handleJobCreated(input, ctx) {
     const { jobId, job } = input;

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -1,6 +1,8 @@
 import { normalizeError } from "../../../../errors/normalize.js";
 import { ORDER_PII_FIELDS, revealPii } from "../../../../security/index.js";
-import { adminNotificationsRepository, storeRepository, userRepository } from "../../../../repositories/index.js";
+import { adminNotificationsRepository } from "../../../../features/store-extensions/repository/rbac.repositories.js";
+import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
+import { userRepository } from "../../../../features/auth/repository/user.repository.js";
 import { decryptPii } from "../../../../security/index.js";
 import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server.js";
 import { resolveKeys } from "../../../../core/integration-keys.js";

package/dist/_internal/server/jobs/core/onProductWrite.js

@@ -3,11 +3,14 @@ import { normalizeError } from "../../../../errors/normalize.js";
  * Core: keep category metrics + store stats in sync when a product document
  * is written. Only published products count.
  */
-import { categoriesRepository, storeRepository, } from "../../../../repositories/index.js";
+import { categoriesRepository } from "../../../../features/categories/repository/categories.repository.js";
+import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
 import { ProductStatusValues } from "../../../../features/products/schemas/firestore.js";
 import { PRODUCT_FIELDS } from "../../../../constants/field-names.js";
 import { isListingRowAvailable } from "../../../shared/listing-types/_registry.js";
+import { isListingType } from "../../../shared/listing-types/feature-flags.js";
 import { notifyRevalidate, productCacheFieldsChanged } from "./revalidateNotify.js";
+import { runSurfaceCountsRollup } from "./surfaceCountsRollup.js";
 const UNAVAILABLE_PRODUCT_STATUSES = new Set([
     ProductStatusValues.ARCHIVED,
 ]);
@@ -300,4 +303,35 @@ export async function handleProductWrite(input, ctx) {
         // reports how many rows it had to correct.
         ctx.logger.error("Counter update failed (non-fatal — countersReconcile will heal it tonight)", err, { productId });
     }
+    /*
+     * Refresh the site-wide "is this surface empty" counters.
+     *
+     * 🛑 Gated on `wasCounted !== isCounted`, reusing the availability-boundary
+     * signals computed just above rather than deriving a second opinion. Those
+     * two booleans already mean "did this row enter or leave the set a public
+     * browse page would show", which is exactly and only when a surface can
+     * cross zero. A stock decrement from 9 to 8 recomputes nothing.
+     *
+     * 🛑 Scoped to the AFFECTED types, never all ten. A product can change
+     * `listingType`, which empties the old surface and fills the new one, so
+     * both are probed — and `only` makes `runSurfaceCountsRollup` merge rather
+     * than replace, so the eight types this write cannot have touched keep
+     * their measured values instead of being dropped to unknown.
+     *
+     * Non-fatal, same contract as the counters above: the nightly rollup is the
+     * healer, and an unwritten counter degrades to "unknown", which every
+     * reader shows rather than hides.
+     */
+    if (wasCounted !== isCounted) {
+        const touched = Array.from(new Set([before?.listingType, after?.listingType].filter((t) => typeof t === "string" && isListingType(t))));
+        if (touched.length > 0) {
+            try {
+                await runSurfaceCountsRollup(ctx, touched);
+            }
+            catch (err) {
+                void normalizeError(err);
+                ctx.logger.error("Surface-count refresh failed (non-fatal — the nightly rollup will heal it)", err, { productId, touched });
+            }
+        }
+    }
 }

package/dist/_internal/server/jobs/core/onScamReportCreate.js

@@ -1,5 +1,6 @@
 import { normalizeError } from "../../../../errors/normalize.js";
-import { adminNotificationsRepository, userRepository } from "../../../../repositories/index.js";
+import { adminNotificationsRepository } from "../../../../features/store-extensions/repository/rbac.repositories.js";
+import { userRepository } from "../../../../features/auth/repository/user.repository.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { SCAM_TYPE_LABELS } from "../../../../features/scams/constants/scam-types.js";
 export async function handleScamReportCreate(input, ctx) {

package/dist/_internal/server/jobs/core/onScamReportRejected.js

@@ -1,5 +1,5 @@
 import { normalizeError } from "../../../../errors/normalize.js";
-import { userRepository } from "../../../../repositories/index.js";
+import { userRepository } from "../../../../features/auth/repository/user.repository.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 export async function handleScamReportRejected(input, ctx) {
     const { scammerId, report } = input;

package/dist/_internal/server/jobs/core/onScamReportVerified.js

@@ -1,5 +1,5 @@
 import { normalizeError } from "../../../../errors/normalize.js";
-import { userRepository } from "../../../../repositories/index.js";
+import { userRepository } from "../../../../features/auth/repository/user.repository.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 export async function handleScamReportVerified(input, ctx) {
     const { scammerId, report } = input;

package/dist/_internal/server/jobs/core/revenueRollup.js

@@ -10,7 +10,7 @@
  * single doc instead of scanning the collection.
  */
 import { orderRepository } from "../../../../repositories/index.js";
-import { analyticsRollupRepository } from "../../../../repositories/index.js";
+import { analyticsRollupRepository } from "../../../../features/admin/repository/analytics-rollup.repository.js";
 export async function runRevenueRollup(ctx) {
     // No `.catch(() => [])` here on purpose: an empty list is a legitimate
     // outcome that writes `totalRevenue: 0`, so swallowing a query failure would

package/dist/_internal/server/jobs/core/runJobOnce.js

@@ -32,7 +32,7 @@
  */
 import { normalizeError } from "../../../../errors/normalize.js";
 import { mapToHttpError } from "../../../../errors/error-mapping.js";
-import { jobsRepository } from "../../../../repositories/index.js";
+import { jobsRepository } from "../../../../features/jobs/repository/jobs.repository.js";
 import { paymentCasesRepository } from "../../../../features/payment-cases/repository/payment-cases.repository.js";
 import { getAdminRealtimeDb } from "../../../../providers/db-firebase/index.js";
 import { RTDB_PATHS } from "../../../../providers/db-firebase/rtdb-paths.js";

package/dist/_internal/server/jobs/core/sellerStandingRollup.js

@@ -25,7 +25,7 @@
  * self-bought orders excluded, test data excluded, and the 500-store bound on
  * `findTrustedStoreIds` left in place so saturation is visible.
  */
-import { storeRepository } from "../../../../repositories/index.js";
+import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
 import { ORDER_FIELDS, REVIEW_FIELDS } from "../../../../constants/field-names.js";
 import { recordAdminAction } from "../../features/audit-log/actions.js";
 import { AdminAuditActionValues } from "../../../../features/audit-log/schemas/firestore.js";

package/dist/_internal/server/jobs/core/surfaceCountsRollup.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Recompute `surfaceCounts/global` — "does each public browse surface have
+ * anything in it?"
+ *
+ * ## 🛑 It asks `listPublicProducts`, not Firestore
+ *
+ * The temptation is a `count()` aggregation per listing type. That would be
+ * cheaper and it would be WRONG, because "available" is not expressible as a
+ * Firestore predicate: it is a negation (`NOT (sold OR ended OR closed OR
+ * depleted)`) evaluated per row, which is exactly why `listPublicProducts`
+ * runs one bounded query per unavailable-clause and filters in memory.
+ *
+ * A bespoke count would therefore answer a DIFFERENT question from the page it
+ * governs, and the failure mode is the bad one: hiding `/spares` while
+ * `/spares` would have rendered rows. Routing through the one function every
+ * browse page already uses makes that disagreement impossible by construction
+ * — the same argument CLAUDE.md makes for never calling
+ * `productRepository.list()` directly from a listing view.
+ *
+ * ## Cost
+ *
+ * `pageSize: 1` — we need existence, not a figure. Ten listing types plus one
+ * review query, each bounded, and only from a job or a boundary-crossing
+ * trigger. Never from a request path: the public reader gets the single
+ * pre-computed document via `/api/site-settings`.
+ *
+ * ## 🛑 A failed probe writes NOTHING for that type
+ *
+ * `listPublicProducts` returns `null` on failure. Recording that as `0` would
+ * hide a surface because a query timed out, so a failed probe leaves the key
+ * ABSENT — which every reader treats as "show" (Root Cause #72). Partial
+ * results are written: a surface we did measure is still worth recording.
+ *
+ * @tag domain:products
+ * @tag layer:job
+ * @tag access:server-only
+ * @tag sideEffects:firestore-read,firestore-write
+ */
+import type { ListingType } from "../../../../features/products/types/index";
+import type { JobContext } from "../runtime/types";
+export interface SurfaceCountsResult {
+    listingTypes: Partial<Record<ListingType, number>>;
+    surfaces: Partial<Record<string, number>>;
+    /** Types whose probe failed — recorded so a silent partial is visible. */
+    failed: string[];
+}
+export declare function computeSurfaceCounts(ctx: Pick<JobContext, "db">, only?: readonly ListingType[]): Promise<SurfaceCountsResult>;
+/**
+ * Recompute and persist.
+ *
+ * `only` narrows to the types a single product write could have moved, so the
+ * trigger path costs one query instead of eleven. A narrowed run MERGES — it
+ * must never clear the keys it did not measure.
+ */
+export declare function runSurfaceCountsRollup(ctx: Pick<JobContext, "db">, only?: readonly ListingType[]): Promise<SurfaceCountsResult>;

package/dist/_internal/server/jobs/core/surfaceCountsRollup.js

@@ -0,0 +1,128 @@
+/**
+ * Recompute `surfaceCounts/global` — "does each public browse surface have
+ * anything in it?"
+ *
+ * ## 🛑 It asks `listPublicProducts`, not Firestore
+ *
+ * The temptation is a `count()` aggregation per listing type. That would be
+ * cheaper and it would be WRONG, because "available" is not expressible as a
+ * Firestore predicate: it is a negation (`NOT (sold OR ended OR closed OR
+ * depleted)`) evaluated per row, which is exactly why `listPublicProducts`
+ * runs one bounded query per unavailable-clause and filters in memory.
+ *
+ * A bespoke count would therefore answer a DIFFERENT question from the page it
+ * governs, and the failure mode is the bad one: hiding `/spares` while
+ * `/spares` would have rendered rows. Routing through the one function every
+ * browse page already uses makes that disagreement impossible by construction
+ * — the same argument CLAUDE.md makes for never calling
+ * `productRepository.list()` directly from a listing view.
+ *
+ * ## Cost
+ *
+ * `pageSize: 1` — we need existence, not a figure. Ten listing types plus one
+ * review query, each bounded, and only from a job or a boundary-crossing
+ * trigger. Never from a request path: the public reader gets the single
+ * pre-computed document via `/api/site-settings`.
+ *
+ * ## 🛑 A failed probe writes NOTHING for that type
+ *
+ * `listPublicProducts` returns `null` on failure. Recording that as `0` would
+ * hide a surface because a query timed out, so a failed probe leaves the key
+ * ABSENT — which every reader treats as "show" (Root Cause #72). Partial
+ * results are written: a surface we did measure is still worth recording.
+ *
+ * @tag domain:products
+ * @tag layer:job
+ * @tag access:server-only
+ * @tag sideEffects:firestore-read,firestore-write
+ */
+import { normalizeError } from "../../../../errors/normalize.js";
+import { listPublicProducts } from "../../features/products/list-public.js";
+import { SURFACE_COUNTS_COLLECTION, SURFACE_COUNTS_DOC_ID, } from "../../../../features/products/schemas/surface-counts.js";
+import { ALL_LISTING_TYPES } from "../../../shared/listing-types/feature-flags.js";
+import { REVIEW_COLLECTION, reviewQueryHelpers, } from "../../../../features/reviews/schemas/firestore.js";
+/**
+ * Probe one listing type. Returns `undefined` — not 0 — when the query failed.
+ *
+ * `total` is a FLOOR once `truncated` is set, which does not matter here: we
+ * only compare against zero, and a floor of N > 0 is still decisively
+ * non-empty.
+ */
+async function probeListingType(type) {
+    try {
+        const res = await listPublicProducts({ listingTypes: [type], pageSize: 1 });
+        if (!res)
+            return undefined;
+        return res.total;
+    }
+    catch (err) {
+        void normalizeError(err);
+        return undefined;
+    }
+}
+export async function computeSurfaceCounts(ctx, only) {
+    const types = only ?? ALL_LISTING_TYPES;
+    const listingTypes = {};
+    const surfaces = {};
+    const failed = [];
+    // Parallel: ten bounded queries with no interdependence. Sequential would
+    // be ten round-trips for no benefit.
+    const probes = await Promise.all(types.map((t) => probeListingType(t)));
+    types.forEach((t, i) => {
+        const n = probes[i];
+        if (n === undefined)
+            failed.push(t);
+        else
+            listingTypes[t] = n;
+    });
+    // `/reviews` has no listing-type flag, so emptiness is its only signal.
+    // A plain `count()` IS correct here: a review has no availability notion —
+    // it is approved and public, or it is not in the collection's public view.
+    if (!only) {
+        try {
+            // `reviewQueryHelpers.approved()` rather than a hand-written
+            // `["isApproved", "==", true]` — which is what this first read, and the
+            // field does not exist. Approval is `status == "approved"`, and a filter
+            // on an absent field matches NOTHING, so the hand-written version would
+            // have reported every site as having zero reviews and hidden /reviews
+            // permanently. The helper is the shipped spelling.
+            const [field, op, value] = reviewQueryHelpers.approved();
+            const snap = await ctx.db
+                .collection(REVIEW_COLLECTION)
+                .where(field, op, value)
+                .limit(1)
+                .get();
+            surfaces.reviews = snap.size;
+        }
+        catch (err) {
+            void normalizeError(err);
+            failed.push("reviews");
+        }
+    }
+    return { listingTypes, surfaces, failed };
+}
+/**
+ * Recompute and persist.
+ *
+ * `only` narrows to the types a single product write could have moved, so the
+ * trigger path costs one query instead of eleven. A narrowed run MERGES — it
+ * must never clear the keys it did not measure.
+ */
+export async function runSurfaceCountsRollup(ctx, only) {
+    const result = await computeSurfaceCounts(ctx, only);
+    const payload = { updatedAt: new Date() };
+    // Dot-path merge for a narrowed run: `{ listingTypes: {...} }` with
+    // `merge: true` would still replace the whole map on some drivers, and we
+    // must not drop a key this run did not probe.
+    for (const [k, v] of Object.entries(result.listingTypes)) {
+        payload[`listingTypes.${k}`] = v;
+    }
+    for (const [k, v] of Object.entries(result.surfaces)) {
+        payload[`surfaces.${k}`] = v;
+    }
+    await ctx.db
+        .collection(SURFACE_COUNTS_COLLECTION)
+        .doc(SURFACE_COUNTS_DOC_ID)
+        .set(payload, { merge: true });
+    return result;
+}

package/dist/_internal/server/jobs/core/weeklyPayoutEligibility.js

@@ -4,7 +4,7 @@
  */
 import { storeRepository, userRepository, orderRepository, payoutRepository, siteSettingsRepository, } from "../../../../repositories/index.js";
 import { BATCH_LIMIT } from "../handlers/messages.js";
-import { getDefaultCurrency } from "../../../../core/index.js";
+import { getDefaultCurrency } from "../../../../core/baseline-resolver.js";
 import { computePayoutDeduction } from "../../../shared/fees/calculator.js";
 import { payoutCutoff } from "../../../shared/fees/payout-hold.js";
 import { PROTECTION_CLAIM_WINDOW_HOURS } from "../../../shared/features/shipping/protections.js";

package/dist/_internal/server/jobs/handlers/countersReconcile.js

@@ -1,2 +1,55 @@
+import { normalizeError } from "../../../../errors/normalize.js";
 import { runCountersReconcile } from "../core/countersReconcile.js";
-export const countersReconcileHandler = runCountersReconcile;
+import { runSurfaceCountsRollup } from "../core/surfaceCountsRollup.js";
+/*
+ * 🛑 The surface-count rollup rides THIS job rather than taking a Scheduler
+ * slot of its own.
+ *
+ * Two reasons, and the second is the one that matters:
+ *
+ * 1. Cost — every registered Scheduler job is billed (~$0.10/mo beyond the
+ *    free 3), and the Firebase budget table in CLAUDE.md says to fold new
+ *    periodic work into an existing cadence when it is a natural fit.
+ * 2. Semantics — `countersReconcile` IS the nightly healer for incrementally
+ *    maintained counters. `surfaceCounts` is incrementally maintained by
+ *    `onProductWrite` under exactly the same "non-fatal, the nightly job will
+ *    heal it" contract. Putting the healer somewhere else would mean two jobs
+ *    owning one guarantee.
+ *
+ * Sequential, not `Promise.all`: both walk products, and running them together
+ * doubles the peak read rate for no wall-clock benefit on a 540s budget.
+ *
+ * 🛑 Its failure must not fail the reconcile. The counters this job exists for
+ * are the ones two Sieve SORTS order by; a surface count is a display decision
+ * that degrades to "unknown", i.e. to showing the surface. Never let the
+ * cosmetic half take down the load-bearing half.
+ */
+export const countersReconcileHandler = async (ctx) => {
+    const result = await runCountersReconcile(ctx);
+    try {
+        const surfaces = await runSurfaceCountsRollup(ctx);
+        /*
+         * Serialised to `"type=n"` pairs rather than logged as the maps
+         * themselves: the logger's value type is `JsonValue`, and a
+         * `Partial<Record<K, number>>` is not assignable to it (an optional
+         * property can be `undefined`, which is not JSON). Flattening is also the
+         * more readable log line.
+         */
+        ctx.logger.info("Surface counts rolled up", {
+            listingTypes: Object.entries(surfaces.listingTypes)
+                .map(([k, v]) => `${k}=${v}`)
+                .join(" "),
+            surfaces: Object.entries(surfaces.surfaces)
+                .map(([k, v]) => `${k}=${v}`)
+                .join(" "),
+            // Named rather than counted — a surface left unmeasured stays visible,
+            // and an operator needs to know WHICH, not how many.
+            failed: surfaces.failed.join(",") || "none",
+        });
+    }
+    catch (err) {
+        void normalizeError(err);
+        ctx.logger.error("Surface-count rollup failed (non-fatal)", err);
+    }
+    return result;
+};

package/dist/_internal/server/jobs/handlers/onCatalogueSubmittedForApproval.js

@@ -1,4 +1,4 @@
-import { adminNotificationsRepository } from "../../../../repositories/index.js";
+import { adminNotificationsRepository } from "../../../../features/store-extensions/repository/rbac.repositories.js";
 export const onCatalogueSubmittedForApprovalHandler = async (event) => {
     const before = event.before?.listingStatus;
     const after = event.after?.listingStatus;

package/dist/_internal/shared/actions/action-registry.js

@@ -1895,6 +1895,34 @@ export const ACTIONS = {
             kind: "primary",
             permissions: ["admin"],
         },
+        "invalidate-cache": {
+            // `retry` — the icon registry has no `refresh`/`reload`/`sync` key, and
+            // inventing one means a new glyph in a catalogued set. `retry` is the
+            // registered "do this again" mark and reads correctly for a re-render.
+            iconKey: "retry",
+            id: "admin.invalidate-cache",
+            label: "Invalidate all cached pages",
+            ariaLabel: "Mark every cached public page stale",
+            description: "Mark every cached public page stale so the next visitor gets a freshly rendered one. Use after a bulk data change the Firestore triggers could not see — a seed load, a direct Firestore edit, or a catalogue purge.",
+            kind: "secondary",
+            permissions: ["admin"],
+            /*
+             * 🛑 A confirmation on a NON-destructive action, because the cost is
+             * real and invisible at the click.
+             *
+             * This marks entries stale; it renders nothing and destroys nothing. But
+             * every marked entry regenerates on its next request, and this project
+             * was SUSPENDED (HTTP 402) for exceeding 200K ISR writes with 3.1M —
+             * writes outnumbering reads 3:1. Rule #6's whole cache posture exists to
+             * keep that from recurring, so a button that re-renders the public site
+             * on demand must not be reachable by a stray click.
+             */
+            confirmation: {
+                title: "Invalidate every cached page?",
+                body: "Every public page is marked stale and re-renders on its next visit. Nothing is deleted and no data changes, but the re-render costs function invocations against the plan quota — so use it after a bulk change, not as a routine refresh.",
+                confirmLabel: "Invalidate all",
+            },
+        },
         "update-pricing": {
             iconKey: "save",
             id: "admin.update-pricing",

package/dist/_internal/shared/cache/revalidate-targets.js

@@ -33,67 +33,86 @@
  */
 /** What the caller knows about the written document, when it knows anything. */
 import { ROUTES } from "../../../next/routing/route-map.js";
-/** Detail route per listing type. Mirrors `ListingTypePlugin.detailRoute`. */
-const PRODUCT_DETAIL_BY_TYPE = {
-    standard: (id) => `/products/${id}`,
-    art: (id) => `/products/${id}`,
-    stickers: (id) => `/products/${id}`,
-    auction: (id) => `/auctions/${id}`,
-    "pre-order": (id) => `/pre-orders/${id}`,
-    "prize-draw": (id) => `/prize-draws/${id}`,
-    classified: (id) => `/classified/${id}`,
-    "digital-code": (id) => `/digital-codes/${id}`,
-    live: (id) => `/live/${id}`,
-};
+import { LISTING_TYPE_REGISTRY } from "../listing-types/_registry.js";
+/*
+ * 🛑 DERIVED from `LISTING_TYPE_REGISTRY`, never hand-written.
+ *
+ * This file carried its own nine-entry `PRODUCT_DETAIL_BY_TYPE` literal and its
+ * own `listingTypeFromId` prefix ladder, and both had already drifted by the
+ * time the union reached ten — exactly the tenth-enumeration failure Root Cause
+ * #61 is about. Measured 2026-10-26, while invalidating after a catalogue purge
+ * that deleted 7 `spares` and 2 `stickers`:
+ *
+ *   - **`spares` was absent from both.** A `spare-…` id fell through to the
+ *     "unknown type" branch, which marks every OTHER type's detail route and
+ *     therefore never marks `/products/spare-…` — the one page that existed.
+ *   - **`/art`, `/stickers` and `/spares` were never marked at all.** The browse
+ *     path was derived by stripping the last segment off the detail route, and
+ *     all three types detail at `/products/{slug}`, so the strip yielded
+ *     `/products` and the `!== ROUTES.PUBLIC.PRODUCTS` test discarded it. Their
+ *     dedicated browse pages are in `MAIN_NAV_ITEMS` and went stale on a clock.
+ *
+ * `browseRoute` and `slugPrefix` are required plugin fields, so a type cannot
+ * join the union without answering both — which is the property the literal
+ * could never have.
+ */
+const PLUGINS = Object.values(LISTING_TYPE_REGISTRY);
 /**
  * Infer the listing type from the id prefix when no hint was supplied.
  *
- * The slug prefix system (CLAUDE.md § Slug Prefix System) makes this reliable
- * for seeded and generated ids — `auction-…`, `preorder-…`, `prizedraw-…` — and
- * it is only a fallback: the Firestore trigger reads the document and passes
- * `listingType` explicitly.
+ * Calls the shipped `slugPrefix` on each plugin rather than re-deriving the
+ * prefix map — the same decision `audit-seed-listing-type`'s R3 makes, and the
+ * reason that audit caught five `stickers-` ids against a registered
+ * `sticker-` prefix. Returns `undefined` rather than `detectListingTypeFromSlug`'s
+ * `"standard"` default: here, "no prefix matched" must widen to every detail
+ * route, not silently narrow to one.
  */
 function listingTypeFromId(id) {
-    if (id.startsWith("auction-"))
-        return "auction";
-    if (id.startsWith("preorder-"))
-        return "pre-order";
-    if (id.startsWith("prizedraw-"))
-        return "prize-draw";
-    if (id.startsWith("classified-"))
-        return "classified";
-    if (id.startsWith("digitalcode-"))
-        return "digital-code";
-    if (id.startsWith("live-"))
-        return "live";
-    if (id.startsWith("art-"))
-        return "art";
-    if (id.startsWith("sticker-"))
-        return "stickers";
-    if (id.startsWith("product-"))
-        return "standard";
+    for (const p of PLUGINS) {
+        if (p.slugPrefix && id.startsWith(p.slugPrefix))
+            return p.listingType;
+    }
     return undefined;
 }
 function productTargets(id, hints) {
     const out = [ROUTES.HOME, ROUTES.PUBLIC.PRODUCTS];
-    if (!id)
-        return out;
+    if (!id) {
+        /*
+         * Bulk / unknown write — a seed load, a purge, or the admin "invalidate
+         * everything" button. `/products` alone is not "every listing page": five
+         * types are deliberately OUT of the general catalogue
+         * (`inGeneralCatalogue: false`) and are reachable only at their own browse
+         * route, so a bulk invalidation that marks `/products` leaves `/auctions`,
+         * `/pre-orders`, `/prize-draws`, `/art`, `/stickers` and `/spares` serving
+         * rows that no longer exist.
+         */
+        for (const p of PLUGINS)
+            if (p.browseRoute)
+                out.push(String(p.browseRoute));
+        return Array.from(new Set(out));
+    }
     const type = hints?.listingType ?? listingTypeFromId(id);
-    if (type && PRODUCT_DETAIL_BY_TYPE[type]) {
-        out.push(PRODUCT_DETAIL_BY_TYPE[type](id));
-        // The type's own browse page, when it has one distinct from /products.
-        const browse = PRODUCT_DETAIL_BY_TYPE[type](id).replace(/\/[^/]+$/, "");
-        if (browse && browse !== ROUTES.PUBLIC.PRODUCTS)
-            out.push(browse);
+    const plugin = type ? LISTING_TYPE_REGISTRY[type] : undefined;
+    if (plugin) {
+        out.push(String(plugin.detailRoute(id)));
+        // The type's own browse page. Read off the plugin, NOT derived by stripping
+        // the detail route's last segment: art/stickers/spares all detail at
+        // `/products/{slug}`, so stripping yields `/products` and loses `/art`,
+        // `/stickers` and `/spares` entirely.
+        if (plugin.browseRoute)
+            out.push(String(plugin.browseRoute));
     }
     else {
         /*
-         * Unknown type: revalidate EVERY detail route for this id rather than
-         * guessing one. At most nine entries marked stale, none of which renders
-         * until requested — strictly cheaper than leaving the real one live.
+         * Unknown type: revalidate EVERY detail and browse route for this id rather
+         * than guessing one. A couple of dozen entries marked stale, none of which
+         * renders until requested — strictly cheaper than leaving the real one live.
          */
-        for (const build of Object.values(PRODUCT_DETAIL_BY_TYPE))
-            out.push(build(id));
+        for (const p of PLUGINS) {
+            out.push(String(p.detailRoute(id)));
+            if (p.browseRoute)
+                out.push(String(p.browseRoute));
+        }
     }
     // A product's price/stock/status is rendered on every taxonomy page that
     // lists it. `categorySlugs` is the full ancestor chain, so this covers the