@mohasinac/appkit 4.67.0 → 4.69.0

package/dist/_internal/shared/listing-types/hidden-surfaces.js

@@ -0,0 +1,170 @@
+/**
+ * Which public routes must not be served, given the admin flags and the
+ * measured counts.
+ *
+ * ## Why this is one module and not copies at each reader
+ *
+ * Two places need these answers and they must never disagree:
+ *
+ *   · `buildSitemap` — decides which URLs are advertised.
+ *   · `toPublicSiteSettings` → `src/proxy.ts` — decides which URLs 404.
+ *
+ * A disagreement is not cosmetic: the sitemap advertising a URL the edge 404s
+ * is a crawl error on a page we told Google to fetch, and the reverse serves a
+ * surface we have decided is closed. They were two hand-written copies of the
+ * same two loops when this was extracted — and the disagreement showed up
+ * anyway on the one axis only one of them read (see `closedSurfacePrefixes`).
+ *
+ * ## 🛑 TWO FUNCTIONS, because the MATCH RULE differs — and each rule is
+ * load-bearing in the opposite direction
+ *
+ * | | rule | why the other rule would break it |
+ * |---|---|---|
+ * | `hiddenSurfaceRoutes` — listing-type browse pages | **exact path** | `art`, `stickers`, `spares` and `standard` all detail at `/products/{slug}`, so a prefix rule would 404 the whole standard catalogue the day `spares` emptied |
+ * | `closedSurfacePrefixes` — browse sections, bundles, `disabledRoutes` | **prefix** | `/categories/{slug}` is owned by `categories` alone, and exact-only matching left all 4,698 of them serving a real 200 while `/categories` said 404 |
+ *
+ * Do not merge them. Picking either rule for both is a live defect one way or
+ * the other, and both directions have now been observed in production.
+ *
+ * ## 🛑 A SHARED route survives while ANY of its types is visible
+ *
+ * `/art` spans `art` and `stickers`; `/products` spans `standard` plus several
+ * others. Without `hiddenSurfaceRoutes`' second pass, hiding `stickers` alone
+ * would close a page `art` still fills — and hiding `spares` alone would close
+ * `/products`.
+ *
+ * @tag domain:products
+ * @tag layer:shared
+ * @tag access:isomorphic
+ * @tag sideEffects:none
+ */
+import { ALL_BROWSE_PAGES, ALL_LISTING_TYPES, browsePagePrefixes, isBrowsePageEnabled, isCategoryTypeEnabled, isListingSurfaceVisible, } from "./feature-flags.js";
+import { pluginFor } from "./_registry.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
+export function hiddenSurfaceRoutes(settings, counts) {
+    const hidden = new Set();
+    const routeOf = (type) => String(pluginFor(type).browseRoute ?? "");
+    for (const type of ALL_LISTING_TYPES) {
+        if (isListingSurfaceVisible(type, settings, counts))
+            continue;
+        const route = routeOf(type);
+        if (route)
+            hidden.add(route);
+    }
+    /*
+     * Second pass, deliberately not folded into the first: a route is only
+     * hidden once EVERY type that browses there is hidden, and the first pass
+     * cannot know that until it has seen them all.
+     */
+    for (const type of ALL_LISTING_TYPES) {
+        if (isListingSurfaceVisible(type, settings, counts))
+            hidden.delete(routeOf(type));
+    }
+    return [...hidden];
+}
+/**
+ * Closed routes that must take their DESCENDANTS with them.
+ *
+ * ## Why this is a second function and not more entries in the first
+ *
+ * `hiddenSurfaceRoutes` above is exact-path-only, and its docstring explains
+ * why it has to be: `art`, `stickers`, `spares` and `standard` all detail at
+ * `/products/{slug}`, so a prefix rule there would 404 the whole standard
+ * catalogue the day `spares` emptied.
+ *
+ * A closed BROWSE PAGE has the opposite property. `/categories/{slug}` belongs
+ * to `categories` and to nothing else — no open surface details underneath it
+ * — so there is no shared-route hazard, and exact-only matching leaves the
+ * interesting half of the section served.
+ *
+ * 🛑 THIS WAS MEASURED OPEN IN PRODUCTION, 2026-10-27. All four browse pages
+ * had been `false` in `listings.browsePages` since 2026-10-24 and:
+ *
+ * ```
+ * /categories                     200   body = "404 — Page not found"
+ * /categories/category-beyblade-x 200   a real, fully-rendered category page
+ * /stores/store-beyblade-arena    200   a real, fully-rendered store page
+ * ```
+ *
+ * The index was a SOFT 404 (`guardBrowsePage` throws `notFound()` after the
+ * shell has streamed, which cannot set the status — see the site-wide soft-404
+ * note) and the 4,698 detail pages were never guarded at all. So "the section
+ * is closed" meant "the front door says 404 while every room stays open and
+ * indexable".
+ *
+ * ## `disabledRoutes` is folded in here, not left to the proxy
+ *
+ * The proxy already prefix-matches `disabledRoutes`, so including it changes
+ * nothing at the edge. It is here because the SITEMAP needs the same list and
+ * did not have it: measured the same day, the sitemap advertised 17 `/blog`
+ * URLs and one `/reviews` URL, every one of which the edge already 404s. That
+ * is a crawl error on a page we asked Google to fetch — Root Cause #81's
+ * host/sitemap disagreement in miniature, and the precise reason
+ * `hiddenSurfaceRoutes` was extracted into one definition in the first place.
+ *
+ * One list, two readers, no way for them to disagree:
+ *   · `toPublicSiteSettings` → `src/proxy.ts` — which paths 404.
+ *   · `buildSitemap`                          — which paths are advertised.
+ *
+ * Fails OPEN on a missing settings document: every `isBrowsePageEnabled` call
+ * returns `true` and the list is empty, so a transient Firestore error cannot
+ * withdraw the catalogue (Root Cause #72).
+ */
+export function closedSurfacePrefixes(settings) {
+    const closed = new Set();
+    for (const page of ALL_BROWSE_PAGES) {
+        if (isBrowsePageEnabled(page, settings))
+            continue;
+        for (const prefix of browsePagePrefixes(page)) {
+            if (prefix)
+                closed.add(prefix);
+        }
+    }
+    /*
+     * Bundles — a CATEGORY type, not a listing type and not a browse page, so it
+     * reaches neither loop above.
+     *
+     * `listings.categoryTypes.bundle` is the control that already exists for it,
+     * and `HOMEPAGE_SECTION_CATEGORY_TYPE` in `MarketplaceHomepageView` already
+     * drops the bundles rail from it — so until this line the flag hid the rail
+     * while `/bundles` and every `/bundles/{slug}` went on serving. That is the
+     * same half-closed door the browse pages had.
+     *
+     * Prefix rather than exact for the same reason as a browse page: `/bundles`
+     * is owned by bundles alone, with no open surface detailing underneath it.
+     */
+    if (!isCategoryTypeEnabled("bundle", settings)) {
+        closed.add(String(ROUTES.PUBLIC.BUNDLES));
+    }
+    /*
+     * Admin-set feature withdrawals — `/seller-guide`, `/fees`, `/scams`, …
+     *
+     * 🛑 A SEPARATE FIELD from `disabledRoutes` below, not a duplicate of it.
+     * That array is DERIVED from `navConfig` and fully recomputed on every nav
+     * toggle, so a non-nav path appended there is wiped by the next admin save.
+     * Anything footer-only — which is most of a marketplace's explainer
+     * surfaces — has no nav item and can only live here.
+     */
+    for (const path of settings?.listings?.closedPaths ?? []) {
+        if (typeof path === "string" && path.startsWith("/"))
+            closed.add(path);
+    }
+    for (const route of settings?.disabledRoutes ?? []) {
+        if (typeof route === "string" && route.startsWith("/"))
+            closed.add(route);
+    }
+    return [...closed];
+}
+/**
+ * Does `path` sit on or under one of `prefixes`?
+ *
+ * 🛑 A `/`-delimited boundary, never a bare `startsWith`. `/store` is the
+ * SELLER DASHBOARD and `/stores` is the public directory, so a substring test
+ * would 404 a signed-in seller's own dashboard the moment an admin closed the
+ * public storefronts — a different surface, a different audience, one
+ * character apart. Same rule, same reason, as `browsePageForPath`.
+ */
+export function isUnderClosedPrefix(path, prefixes) {
+    const normalised = path.replace(/\/+$/, "") || "/";
+    return prefixes.some((p) => normalised === p || normalised.startsWith(`${p}/`));
+}

package/dist/_internal/shared/listing-types/route-gating.d.ts

@@ -17,40 +17,82 @@
  * type-keyed gate could see them — the only thing that identifies them is
  * where they point.
  *
- * ## The rule, and the one case that makes it non-obvious
+ * ## Where the rules are written down
  *
- * A href is disabled when EVERY listing type that claims its route is
- * disabled. Not "any" — `art` and `stickers` share `/art`, so a site that
- * sells art but not stickers must keep `/art` reachable. Treating one disabled
- * claimant as enough would silently delete a working destination.
+ * On `isClosedHref` below — the three axes it reads (listing-type flags ANDed
+ * with measured counts, closed browse sections, hand-disabled routes), what it
+ * deliberately does not match, and the production measurement that forced each
+ * one. Stated there and not restated here deliberately: two comments
+ * disagreeing about what a gate matches is a defect this codebase keeps paying
+ * for, and the only safe number of descriptions is one.
  *
- * ## What it deliberately does NOT match
- *
- * Editorial pages that merely have a type's name in the path — `/help/auctions`,
- * `/how-auctions-work`, `/seller-guide/prize-draws`. None of them starts with
- * `/auctions`, so prefix matching excludes them for free, and that is correct:
- * an explainer about auctions is still honest reading when auctions are off.
- * A substring test would have eaten all three.
- *
- * Store tabs (`/stores/{slug}/auctions`) are also out of scope — those are
- * resolved by `resolveStoreTabs`, which owns its own visibility, and a second
- * owner is how a mirror drifts (Root Cause #42).
+ * Store tabs (`/stores/{slug}/auctions`) are out of scope — those are resolved
+ * by `resolveStoreTabs`, which owns its own visibility, and a second owner is
+ * how a mirror drifts (Root Cause #42).
  */
+import { type BrowsePageKey, type SurfaceCountSnapshot } from "./feature-flags";
 import type { ListingType } from "../../../features/products/types/index";
 interface ListingFlagSnapshot {
     listings?: {
         listingTypes?: Partial<Record<ListingType, boolean>>;
+        browsePages?: Partial<Record<BrowsePageKey, boolean>>;
     };
+    disabledRoutes?: string[];
 }
 /**
- * `true` when `href` points at a listing type's browse page (or any page
- * beneath it) and every type that browses there is disabled.
- *
- * Fails OPEN on anything it cannot classify: an unknown path, an external URL
- * or a missing settings document all return `false`. A settings read that
- * errored must not strip working destinations out of the homepage — the same
- * reasoning as the suggestions endpoint's TTL cache and `src/proxy.ts`'s
- * disabled-routes gate.
+ * Everything needed to answer "is this destination closed", resolved once.
+ *
+ * 🛑 A CONTEXT RATHER THAN THREE LOOSE ARGUMENTS, because the prefix list is
+ * derived work and the callers are loops. The live homepage carries **34 links
+ * to `/categories` alone** (measured 2026-10-27); rebuilding the closed-prefix
+ * array inside the predicate would rebuild it 34 times for one render.
+ */
+export interface ClosedSurfaceContext {
+    settings: ListingFlagSnapshot | null | undefined;
+    counts: SurfaceCountSnapshot | null | undefined;
+    /** Closed browse sections + `disabledRoutes`, pre-derived. */
+    prefixes: string[];
+}
+export declare function closedSurfaceContext(settings: ListingFlagSnapshot | null | undefined, counts?: SurfaceCountSnapshot | null): ClosedSurfaceContext;
+/**
+ * `true` when `href` leads somewhere this site has closed.
+ *
+ * ## THREE axes, because authored content can point at any of them
+ *
+ * This replaced `isDisabledListingHref`, which read `listings.listingTypes`
+ * and nothing else — and the two axes it could not see were the two doing
+ * visible damage. Measured on the live homepage, 2026-10-27:
+ *
+ *   · **counts.** `art` and `spares` had flag `true` and measured count `0`,
+ *     so they were auto-hidden everywhere — `/art` and `/spares` both answered
+ *     a real **404** at the edge — while the homepage went on shipping 3 links
+ *     to each from the "Shop extras" cards. `isListingTypeEnabled` reads the
+ *     flag only, so it called both of them enabled. `isListingSurfaceVisible`
+ *     ANDs the flag with the count, which is the rule every other surface on
+ *     the site already uses.
+ *   · **browse sections.** All four had been `false` since 2026-10-24, and the
+ *     homepage carried **34** `/categories` links across the welcome hero's
+ *     secondary CTA, the 35-button systems matrix and the 4-banner generation
+ *     promo grid.
+ *
+ * ## Deliberately link-based, never keyword-based
+ *
+ * Unchanged from the original, and still the point: nothing here reads copy.
+ * "Win it at your price" names no type, so a word search would miss it, and it
+ * would also eat the authenticity slide for saying "bid" in passing. A
+ * destination is checkable; prose is not.
+ *
+ * ## What it still does NOT match
+ *
+ * Editorial pages that merely carry a name in the path — `/help/auctions`,
+ * `/how-auctions-work`, `/seller-guide/prize-draws`. None starts with
+ * `/auctions`, so the `/`-delimited boundary excludes them for free, and that
+ * is correct: an explainer about auctions is honest reading when auctions are
+ * off.
+ *
+ * Fails OPEN on anything it cannot classify — an unknown path, an external
+ * URL, a missing settings document. A settings read that errored must not
+ * strip working destinations off the homepage (Root Cause #72).
  */
-export declare function isDisabledListingHref(href: string | undefined | null, settings: ListingFlagSnapshot | null | undefined): boolean;
+export declare function isClosedHref(href: string | undefined | null, ctx: ClosedSurfaceContext): boolean;
 export {};

package/dist/_internal/shared/listing-types/route-gating.js

@@ -17,27 +17,22 @@
  * type-keyed gate could see them — the only thing that identifies them is
  * where they point.
  *
- * ## The rule, and the one case that makes it non-obvious
+ * ## Where the rules are written down
  *
- * A href is disabled when EVERY listing type that claims its route is
- * disabled. Not "any" — `art` and `stickers` share `/art`, so a site that
- * sells art but not stickers must keep `/art` reachable. Treating one disabled
- * claimant as enough would silently delete a working destination.
+ * On `isClosedHref` below — the three axes it reads (listing-type flags ANDed
+ * with measured counts, closed browse sections, hand-disabled routes), what it
+ * deliberately does not match, and the production measurement that forced each
+ * one. Stated there and not restated here deliberately: two comments
+ * disagreeing about what a gate matches is a defect this codebase keeps paying
+ * for, and the only safe number of descriptions is one.
  *
- * ## What it deliberately does NOT match
- *
- * Editorial pages that merely have a type's name in the path — `/help/auctions`,
- * `/how-auctions-work`, `/seller-guide/prize-draws`. None of them starts with
- * `/auctions`, so prefix matching excludes them for free, and that is correct:
- * an explainer about auctions is still honest reading when auctions are off.
- * A substring test would have eaten all three.
- *
- * Store tabs (`/stores/{slug}/auctions`) are also out of scope — those are
- * resolved by `resolveStoreTabs`, which owns its own visibility, and a second
- * owner is how a mirror drifts (Root Cause #42).
+ * Store tabs (`/stores/{slug}/auctions`) are out of scope — those are resolved
+ * by `resolveStoreTabs`, which owns its own visibility, and a second owner is
+ * how a mirror drifts (Root Cause #42).
  */
 import { LISTING_TYPE_REGISTRY } from "./_registry.js";
-import { ALL_LISTING_TYPES, isListingTypeEnabled } from "./feature-flags.js";
+import { ALL_LISTING_TYPES, isListingSurfaceVisible, } from "./feature-flags.js";
+import { closedSurfacePrefixes, isUnderClosedPrefix } from "./hidden-surfaces.js";
 /**
  * browse route → every listing type that browses there.
  *
@@ -88,27 +83,76 @@ function normalisePath(href) {
     // Trailing slash off, but never reduce "/" to "".
     return delocalised.length > 1 ? delocalised.replace(/\/+$/, "") : delocalised;
 }
+export function closedSurfaceContext(settings, counts) {
+    return { settings, counts, prefixes: closedSurfacePrefixes(settings) };
+}
 /**
- * `true` when `href` points at a listing type's browse page (or any page
- * beneath it) and every type that browses there is disabled.
- *
- * Fails OPEN on anything it cannot classify: an unknown path, an external URL
- * or a missing settings document all return `false`. A settings read that
- * errored must not strip working destinations out of the homepage — the same
- * reasoning as the suggestions endpoint's TTL cache and `src/proxy.ts`'s
- * disabled-routes gate.
+ * `true` when `href` leads somewhere this site has closed.
+ *
+ * ## THREE axes, because authored content can point at any of them
+ *
+ * This replaced `isDisabledListingHref`, which read `listings.listingTypes`
+ * and nothing else — and the two axes it could not see were the two doing
+ * visible damage. Measured on the live homepage, 2026-10-27:
+ *
+ *   · **counts.** `art` and `spares` had flag `true` and measured count `0`,
+ *     so they were auto-hidden everywhere — `/art` and `/spares` both answered
+ *     a real **404** at the edge — while the homepage went on shipping 3 links
+ *     to each from the "Shop extras" cards. `isListingTypeEnabled` reads the
+ *     flag only, so it called both of them enabled. `isListingSurfaceVisible`
+ *     ANDs the flag with the count, which is the rule every other surface on
+ *     the site already uses.
+ *   · **browse sections.** All four had been `false` since 2026-10-24, and the
+ *     homepage carried **34** `/categories` links across the welcome hero's
+ *     secondary CTA, the 35-button systems matrix and the 4-banner generation
+ *     promo grid.
+ *
+ * ## Deliberately link-based, never keyword-based
+ *
+ * Unchanged from the original, and still the point: nothing here reads copy.
+ * "Win it at your price" names no type, so a word search would miss it, and it
+ * would also eat the authenticity slide for saying "bid" in passing. A
+ * destination is checkable; prose is not.
+ *
+ * ## What it still does NOT match
+ *
+ * Editorial pages that merely carry a name in the path — `/help/auctions`,
+ * `/how-auctions-work`, `/seller-guide/prize-draws`. None starts with
+ * `/auctions`, so the `/`-delimited boundary excludes them for free, and that
+ * is correct: an explainer about auctions is honest reading when auctions are
+ * off.
+ *
+ * Fails OPEN on anything it cannot classify — an unknown path, an external
+ * URL, a missing settings document. A settings read that errored must not
+ * strip working destinations off the homepage (Root Cause #72).
  */
-export function isDisabledListingHref(href, settings) {
+export function isClosedHref(href, ctx) {
     const path = normalisePath(href);
     if (!path)
         return false;
+    // Closed browse sections and hand-disabled routes, descendants included.
+    if (isUnderClosedPrefix(path, ctx.prefixes))
+        return true;
     for (const [route, types] of TYPES_BY_BROWSE_ROUTE) {
         // The browse page itself, or a detail page under it. `startsWith(route)`
         // alone would match `/live` against `/livestream`, so the boundary is
         // explicit.
         if (path !== route && !path.startsWith(`${route}/`))
             continue;
-        return types.every((type) => !isListingTypeEnabled(type, settings));
+        /*
+         * 🛑 `every`, not `some`, and `isListingSurfaceVisible`, not
+         * `isListingTypeEnabled`.
+         *
+         * `every`: `art` and `stickers` share `/art`, so a site selling art but
+         * not stickers must keep `/art` reachable. One closed claimant is not
+         * enough — treating it as enough silently deletes a working destination.
+         *
+         * `isListingSurfaceVisible`: it ANDs the admin flag with the measured
+         * count, which is what makes the auto-hidden-because-empty case visible
+         * here. Reading the flag alone is exactly how the live homepage kept
+         * advertising `/art` and `/spares` after both began 404ing.
+         */
+        return types.every((type) => !isListingSurfaceVisible(type, ctx.settings, ctx.counts));
     }
     return false;
 }

package/dist/features/about/components/HelpPageView.js

@@ -10,6 +10,9 @@ import { Row, Stack } from "../../../ui/components/Layout.js";
 import { Section } from "../../../ui/components/Semantic.js";
 import { TextLink } from "../../../ui/components/TextLink.js";
 import { BookOpen, MessageCircle, ShoppingBag, Gavel, PackageCheck, UserCheck, Store, ShieldCheck, ChevronRight, } from "lucide-react";
+import { closedSurfaceContext, isClosedHref, } from "../../../_internal/shared/listing-types/route-gating.js";
+import { getSiteSettingsGlobal } from "../../admin/utils/getSiteSettingsGlobal.js";
+import { safeRead } from "../../../errors/safe-read.js";
 const __P = {
     p6: "p-[var(--appkit-space-6)]",
     p8: "p-[var(--appkit-space-8)]",
@@ -19,6 +22,21 @@ export async function HelpPageView({} = {}) {
     const flex = { row: FLEX_ROW };
     const { getTranslations } = await import("next-intl/server");
     const t = await getTranslations("helpPage");
+    /*
+     * 🛑 THE HELP INDEX IS A HARDCODED LINK LIST, which is the same blind spot
+     * the homepage had: nothing here knows that `/help/seller-badges` and
+     * `/seller-guide` are now closed, so two of its seven tiles pointed at a
+     * 404 — on the page a confused buyer goes to when something has already
+     * gone wrong.
+     *
+     * Filtered through the one closed-surface rule rather than by deleting the
+     * entries: a withdrawn surface is a flag, so the tile returns on its own if
+     * the flag is flipped back.
+     */
+    const settings = await safeRead(() => getSiteSettingsGlobal(), {
+        route: "/help", key: "help.siteSettings", fallback: null,
+    });
+    const closedSurfaces = closedSurfaceContext(settings, undefined);
     const TOPICS = [
         {
             icon: ShoppingBag,
@@ -77,7 +95,7 @@ export async function HelpPageView({} = {}) {
             iconColor: "text-rose-600 dark:text-rose-400",
         },
     ];
-    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(ProseHero, { title: t("title"), subtitle: t("subtitle") }), _jsxs(Stack, { gap: "14", className: `${page.container.md}`, padding: "content-banner", children: [renderTopicsGrid(t, flex, TOPICS), renderScamAwarenessAlert(t), renderTrackOrderSection(t), renderContactCtaSection(t)] })] }));
+    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(ProseHero, { title: t("title"), subtitle: t("subtitle") }), _jsxs(Stack, { gap: "14", className: `${page.container.md}`, padding: "content-banner", children: [renderTopicsGrid(t, flex, TOPICS.filter((x) => !isClosedHref(x.href, closedSurfaces))), renderScamAwarenessAlert(t), renderTrackOrderSection(t), renderContactCtaSection(t)] })] }));
 }
 function renderTopicsGrid(t, flex, topics) {
     return (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-6", align: "center", children: t("browseTopics") }), _jsx(Div, { layout: "grid", gap: "4", className: "sm:grid-cols-2 lg:grid-cols-3", children: topics.map(({ icon: Icon, title, desc, href, color, iconColor }) => (_jsxs(TextLink, { rounded: "xl", href: href, shadow: "hover-md", className: `group border p-[1.25rem] transition ${color} no-underline`, children: [_jsx(Row, { align: "center", justify: "center", className: `w-10 h-10 mb-3`, surface: "default", rounded: "lg", children: _jsx(Icon, { className: `w-5 h-5 ${iconColor}` }) }), _jsxs(Div, { layout: "flex", justify: "between", align: "start", className: flex.row, children: [_jsxs(Div, { children: [_jsx(Text, { className: "mb-1", weight: "semibold", children: title }), _jsx(Text, { variant: "secondary", className: "leading-relaxed", size: "sm", children: desc })] }), _jsx(ChevronRight, { className: "w-4 h-4 mt-1 flex-shrink-0 opacity-40 group-hover:opacity-80 transition-opacity" })] })] }, href))) })] }));

package/dist/features/admin/schemas/firestore.d.ts

@@ -780,6 +780,29 @@ export interface SiteSettingsDocument extends BaseDocument {
          * Add a new section THERE, not here.
          */
         browsePages?: Partial<Record<string, boolean>>;
+        /**
+         * Public paths withdrawn wholesale — closed including every descendant.
+         *
+         * 🛑 THE FOURTH AXIS, and it exists because the other three cannot express
+         * "this FEATURE is off". `listingTypes` closes a type's browse page,
+         * `browsePages` closes a taxonomy directory, `categoryTypes` closes
+         * bundles — and none of them reaches `/seller-guide`, `/fees`,
+         * `/how-payouts-work`, `/item-requests` or `/scams`.
+         *
+         * 🛑 NOT the same as `disabledRoutes`, and the difference is the whole
+         * point. That array is DERIVED: `updateNavConfigDomain` rebuilds it from
+         * `navConfig ∩ ALL_PUBLIC_NAV_ITEMS` on every nav toggle, so a path that
+         * is not a nav item CANNOT survive there — append one by hand and the next
+         * admin toggle silently re-opens it (Root Cause #42). Most of what a
+         * single-vendor storefront needs to withdraw is footer-only, so it has no
+         * nav item to hang off and this is the only durable home for it.
+         *
+         * Prefix-matched on a `/`-delimited boundary by `closedSurfacePrefixes`,
+         * so `/scams` takes `/scams/report` and `/scams/faqs` with it. Nothing is
+         * deleted: every route, page and `ROUTES.PUBLIC.*` constant still exists,
+         * and removing an entry re-opens it.
+         */
+        closedPaths?: string[];
     };
     /**
      * Admin-authored HTML overrides for the public policy pages. When a key holds

package/dist/features/admin/schemas/firestore.js

@@ -2,6 +2,10 @@
  * Admin Feature Firestore Document Types & Constants
  * Covers: notifications, chat rooms, site settings
  */
+/* Pure constants module with no firebase-admin in its import chain, so this
+ * stays safe in the client bundle (appkit Export Rules). Same reasoning as
+ * the ROUTES import in `_internal/shared/listing-types/feature-flags.ts`. */
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { DEFAULT_AUCTION_BID_INCREMENT_TIERS } from "../../../_internal/shared/features/auctions/config.js";
 // Flag-key constants. Consumers MUST reference the bypass flag via this
 // constant so audit-checkout-bypass rule 1 (substring scan) only sees a
@@ -285,9 +289,14 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         whatsappNotifyFeeEnabled: false,
         whatsappNotifyFee: 10,
         whatsappNotifyMonthlyFee: 199,
-        giftWrapFeeEnabled: true,
+        /* Opt-in buyer UPSELLS, off since 2026-10-27 — gift wrap and shipment
+         * protection are marketplace merchandising, not "the basic of the basic
+         * for an ecommerce". Disabling an opt-in extra removes an OPTION, so no
+         * total can go up. `platformFeePercent` is deliberately NOT touched: that
+         * changes what every buyer pays and is a pricing decision. */
+        giftWrapFeeEnabled: false,
         giftWrapFee: 49,
-        shipmentProtectionFeeEnabled: true,
+        shipmentProtectionFeeEnabled: false,
         shipmentProtectionFeePercent: 2,
         shipmentProtectionFeeMin: 30,
         saleProtectionFeeEnabled: true,
@@ -348,13 +357,22 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
      * all-true map, and changing this file does NOT rewrite it — flip those in the
      * admin UI, or re-seed.
      */
+    /*
+     * TWO types, as of 2026-10-27 — buy-it-now and reserve, nothing else.
+     *
+     * 🛑 MUST STAY IDENTICAL to `siteSettingsSeedData.listings`, which says the
+     * same thing about this block. They had already drifted: `bundle` was
+     * `false` here and `true` in the seed, so a freshly seeded site shipped the
+     * featured-bundles rail and a never-configured one did not — the exact
+     * disagreement both comments exist to forbid. Change them together.
+     */
     listings: {
         listingTypes: {
             standard: true,
-            spares: true,
             "pre-order": true,
-            art: true,
-            stickers: true,
+            spares: false,
+            art: false,
+            stickers: false,
             auction: false,
             "prize-draw": false,
             classified: false,
@@ -362,9 +380,11 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
             live: false,
         },
         // `bundle: false` is the admin-side switch for bundles, which are a
-        // CATEGORY type rather than a listing type — it is what hides the
-        // homepage's featured-bundles rail and the bundle tabs on category and
-        // brand pages. Same reasoning as the five listing types above.
+        // CATEGORY type rather than a listing type — it hides the homepage's
+        // featured-bundles rail and the bundle tabs on category and brand pages,
+        // and since 2026-10-27 it is also what closes `/bundles` and
+        // `/bundles/{slug}` at the edge via `closedSurfacePrefixes`. Same
+        // reasoning as the eight listing types above.
         categoryTypes: {
             category: true,
             sublisting: true,
@@ -391,6 +411,41 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
             franchise: false,
             stores: false,
         },
+        /*
+         * Marketplace FEATURES withdrawn — the fourth axis, 2026-10-27.
+         *
+         * Owner: reduce a multi-seller marketplace to a plain single-vendor shop.
+         * These are the surfaces whose whole premise is the marketplace — seller
+         * onboarding, the commission schedule, the payout timetable, the scam
+         * registry, the reference tools. `closedPaths` is prefix-matched, so
+         * `/scams` takes `/scams/report` and `/scams/faqs` with it.
+         *
+         * 🛑 NOT in this list, on purpose: `/help`, `/faqs`, `/track`, `/gst`,
+         * `/credits`. They are merely no longer advertised. Closing means 404, and
+         * 404ing a support page someone has bookmarked is a regression with no
+         * upside — unlinking it from the footer is enough.
+         *
+         * 🛑 `/user/become-seller` cannot go here either: `src/proxy.ts` exempts
+         * the whole `/user` subtree from the route gate because it owns its own
+         * RBAC. Seller recruitment is withdrawn by dropping its LINKS instead —
+         * the footer allow-list and the account sidebar's Selling group.
+         */
+        closedPaths: [
+            String(ROUTES.PUBLIC.DEVELOPER),
+            String(ROUTES.PUBLIC.FEES),
+            String(ROUTES.PUBLIC.HELP_SELLER_BADGES),
+            String(ROUTES.PUBLIC.HOW_AUCTIONS_WORK),
+            String(ROUTES.PUBLIC.HOW_EMI_WORKS),
+            String(ROUTES.PUBLIC.HOW_OFFERS_WORK),
+            String(ROUTES.PUBLIC.HOW_PAYOUTS_WORK),
+            String(ROUTES.PUBLIC.ITEM_REQUESTS),
+            String(ROUTES.PUBLIC.LOTTERIES),
+            String(ROUTES.PUBLIC.PARTS),
+            String(ROUTES.PUBLIC.PROMOTIONS),
+            String(ROUTES.PUBLIC.REPORT_ENTITY),
+            String(ROUTES.PUBLIC.SCAMS),
+            String(ROUTES.PUBLIC.SELLER_GUIDE),
+        ],
     },
     shipping: {
         estimatedDays: 5,