@mohasinac/appkit 4.68.0 → 4.69.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.68.0",
-  "head": "d9da5b62aa583840cb50fa07288dc03177d1d991",
+  "version": "4.69.0",
+  "head": "f8d0558f54602d80ef0200435f7a49f8848d5928",
   "branch": "main",
   "dirty": false,
-  "builtAt": "2026-10-26T21:11:44.047Z"
+  "builtAt": "2026-10-27T12:56:14.309Z"
 }

package/dist/_internal/server/features/seo/sitemap.js

@@ -17,7 +17,7 @@ import { PRODUCT_DETAIL_LISTING_TYPES } from "./product-detail-types.js";
 import { safeRead } from "../../../../errors/safe-read.js";
 import { siteSettingsRepository } from "../../../../features/admin/repository/site-settings.repository.js";
 import { ALL_BROWSE_PAGES, browsePageForPath, isBrowsePageEnabled, } from "../../../shared/listing-types/feature-flags.js";
-import { hiddenSurfaceRoutes } from "../../../shared/listing-types/hidden-surfaces.js";
+import { closedSurfacePrefixes, hiddenSurfaceRoutes, isUnderClosedPrefix, } from "../../../shared/listing-types/hidden-surfaces.js";
 import { getSurfaceCounts } from "../products/surface-counts.js";
 // Product field strings — matches consumer field-names.ts
 const PRODUCT_STATUS = "status";
@@ -675,12 +675,31 @@ export async function buildSitemap({ baseUrl }) {
      * page we asked Google to fetch.
      */
     const hiddenSurfacePaths = new Set(hiddenSurfaceRoutes(settings, counts));
+    /*
+     * 🛑 `disabledRoutes` WAS NEVER APPLIED HERE, and it showed. Measured against
+     * the production sitemap on 2026-10-27, with `disabledRoutes: ["/blog",
+     * "/reviews"]` live and both paths already 404ing at the edge, the sitemap
+     * advertised **17 `/blog` URLs and one `/reviews` URL**.
+     *
+     * That is 18 crawl errors on pages we explicitly asked Google to fetch — the
+     * precise failure the `closed` filter below exists to prevent, on the one
+     * axis it did not cover. The browse-page half was handled because
+     * `browsePageForPath` is prefix-aware; the hand-disabled half had no reader.
+     *
+     * `closedSurfacePrefixes` is the SAME function `toPublicSiteSettings` feeds
+     * to `src/proxy.ts`, so the list of URLs this withholds and the list the edge
+     * 404s are now derived once and cannot drift (the whole reason
+     * `hiddenSurfaceRoutes` was extracted in the first place).
+     */
+    const closedPrefixes = closedSurfacePrefixes(settings);
     const keep = (entry) => {
         const path = entry.url.startsWith("http")
             ? new URL(entry.url).pathname
             : entry.url;
         if (hiddenSurfacePaths.has(path.replace(/\/+$/, "") || "/"))
             return false;
+        if (isUnderClosedPrefix(path, closedPrefixes))
+            return false;
         if (closed.size === 0)
             return true;
         const page = browsePageForPath(path);

package/dist/_internal/server/features/site-settings/adapters.js

@@ -1,4 +1,4 @@
-import { hiddenSurfaceRoutes } from "../../../shared/listing-types/hidden-surfaces.js";
+import { closedSurfacePrefixes, hiddenSurfaceRoutes, } from "../../../shared/listing-types/hidden-surfaces.js";
 /**
  * Document fields with a proven `useSiteSettings()` reader. Every entry below
  * was traced to a call site; anything without one belongs in the private list,
@@ -207,6 +207,23 @@ export function toPublicSiteSettings(doc, opts) {
          * list of strings to match, exactly like `disabledRoutes`.
          */
         hiddenSurfacePaths: hiddenSurfaceRoutes(doc, opts?.surfaceCounts),
+        /*
+         * The PREFIX half of the same answer — closed browse pages, plus the
+         * `disabledRoutes` the line above already carries.
+         *
+         * 🛑 A SEPARATE FIELD rather than more entries in `hiddenSurfacePaths`,
+         * because the proxy applies the two with different match rules and merging
+         * them would force one rule on both. Exact-only is load-bearing for the
+         * listing-type list (`art`/`spares`/`standard` share `/products/{slug}`);
+         * prefix is load-bearing here, because closing `/categories` while serving
+         * all 4,698 `/categories/{slug}` pages is what production was doing.
+         *
+         * Overlaps `disabledRoutes` on purpose. The proxy unions both into one
+         * prefix set, so a duplicate is free — and deriving the whole prefix list
+         * in ONE place is what stops the sitemap and the edge disagreeing, which
+         * is the only reason `hiddenSurfaceRoutes` was extracted.
+         */
+        hiddenSurfacePrefixes: closedSurfacePrefixes(doc),
         // D9 — undefined reads as OFF, never a default-true `??`.
         chat: { enabled: doc.chat?.enabled === true },
         /*

package/dist/_internal/shared/features/site-settings/types.d.ts

@@ -156,4 +156,28 @@ export interface PublicSiteSettings {
      * never arrived" are otherwise indistinguishable on the wire.
      */
     hiddenSurfacePaths: string[];
+    /**
+     * Closed routes that take their DESCENDANTS with them — closed browse pages
+     * (`/categories`, `/brands`, `/franchise`, `/stores`, `/sellers`) plus
+     * `disabledRoutes`. Derived by `closedSurfacePrefixes`, not stored.
+     *
+     * 🛑 SEPARATE FROM `hiddenSurfacePaths` because the two carry different
+     * MATCH RULES, and each rule is load-bearing in opposite directions. Exact
+     * matching is required above (`art`/`stickers`/`spares`/`standard` all detail
+     * at `/products/{slug}`, so a prefix rule would 404 the whole standard
+     * catalogue the day `spares` emptied). Prefix matching is required here: all
+     * four browse pages had been closed since 2026-10-24 and production still
+     * served `/categories/category-beyblade-x` and `/stores/store-beyblade-arena`
+     * as real, indexable 200s. A closed section whose 4,698 detail pages stay
+     * open is not closed.
+     *
+     * Overlaps `disabledRoutes` deliberately — the proxy unions both into one
+     * prefix set, and deriving the full list once is what stops the sitemap and
+     * the edge disagreeing about which URLs exist.
+     *
+     * 🛑 Always emitted, defaulted to `[]`, for the same reason as the two lists
+     * above it: the proxy fails OPEN, so "nothing closed" and "the field never
+     * arrived" are otherwise indistinguishable on the wire.
+     */
+    hiddenSurfacePrefixes: string[];
 }

package/dist/_internal/shared/listing-types/feature-flags.d.ts

@@ -65,6 +65,18 @@ export declare function isBrowsePageEnabled(page: BrowsePageKey, settings: Featu
 export declare function enabledBrowsePages(settings: FeatureFlagSnapshot | null | undefined): BrowsePageKey[];
 /** Narrow an untrusted string — a route param, a form value — to the union. */
 export declare function isBrowsePageKey(value: unknown): value is BrowsePageKey;
+/**
+ * The path prefixes a given section owns — the inverse of `browsePageForPath`.
+ *
+ * 🛑 Exported so `closedSurfacePrefixes` can build the edge-gate list from the
+ * SAME table `browsePageForPath` matches against. It is one key to five paths
+ * (`stores` owns both `/stores` and `/sellers`), so a caller that re-derived
+ * "the path for a key" from `ROUTES` would get four entries and leave
+ * `/sellers` served — the exact half-closed door the `BrowsePageKey` docstring
+ * above exists to forbid. Root Cause #61: every hand-written second copy of an
+ * enumeration in this codebase has drifted at least once.
+ */
+export declare function browsePagePrefixes(page: BrowsePageKey): string[];
 /**
  * Which browse section a link points into, or `null` for a link that is not in
  * one. Used to drop nav, sidebar, mobile-sheet and footer entries for a closed

package/dist/_internal/shared/listing-types/feature-flags.js

@@ -66,6 +66,20 @@ const BROWSE_PAGE_PREFIXES = [
     [String(ROUTES.PUBLIC.STORES), "stores"],
     [String(ROUTES.PUBLIC.SELLERS), "stores"],
 ];
+/**
+ * The path prefixes a given section owns — the inverse of `browsePageForPath`.
+ *
+ * 🛑 Exported so `closedSurfacePrefixes` can build the edge-gate list from the
+ * SAME table `browsePageForPath` matches against. It is one key to five paths
+ * (`stores` owns both `/stores` and `/sellers`), so a caller that re-derived
+ * "the path for a key" from `ROUTES` would get four entries and leave
+ * `/sellers` served — the exact half-closed door the `BrowsePageKey` docstring
+ * above exists to forbid. Root Cause #61: every hand-written second copy of an
+ * enumeration in this codebase has drifted at least once.
+ */
+export function browsePagePrefixes(page) {
+    return BROWSE_PAGE_PREFIXES.filter(([, key]) => key === page).map(([prefix]) => prefix);
+}
 /**
  * Which browse section a link points into, or `null` for a link that is not in
  * one. Used to drop nav, sidebar, mobile-sheet and footer entries for a closed

package/dist/_internal/shared/listing-types/hidden-surfaces.d.ts

@@ -1,43 +1,112 @@
 /**
- * Which public BROWSE ROUTES must not be served, given the admin flags and the
+ * Which public routes must not be served, given the admin flags and the
  * measured counts.
  *
- * ## Why this is one function and not two copies
+ * ## Why this is one module and not copies at each reader
  *
- * Two places need this answer and they must never disagree:
+ * Two places need these answers and they must never disagree:
  *
- *   · `buildSitemap` — decides which browse URLs are advertised.
- *   · `toPublicSiteSettings` → `src/proxy.ts` — decides which browse URLs 404.
+ *   · `buildSitemap` — decides which URLs are advertised.
+ *   · `toPublicSiteSettings` → `src/proxy.ts` — decides which URLs 404.
  *
  * A disagreement is not cosmetic: the sitemap advertising a URL the edge 404s
  * is a crawl error on a page we told Google to fetch, and the reverse serves a
  * surface we have decided is closed. They were two hand-written copies of the
- * same two loops when this was extracted.
+ * same two loops when this was extracted — and the disagreement showed up
+ * anyway on the one axis only one of them read (see `closedSurfacePrefixes`).
  *
- * ## 🛑 EXACT PATHS, never prefixes
+ * ## 🛑 TWO FUNCTIONS, because the MATCH RULE differs — and each rule is
+ * load-bearing in the opposite direction
  *
- * `art`, `stickers`, `spares` and `standard` all detail at `/products/{slug}`,
- * so a prefix rule would delist — or 404 — the entire standard catalogue the
- * day `spares` emptied. An empty type contributes no detail URLs anyway, since
- * its own fetcher returns none, so the exact-path rule loses nothing real.
+ * | | rule | why the other rule would break it |
+ * |---|---|---|
+ * | `hiddenSurfaceRoutes` — listing-type browse pages | **exact path** | `art`, `stickers`, `spares` and `standard` all detail at `/products/{slug}`, so a prefix rule would 404 the whole standard catalogue the day `spares` emptied |
+ * | `closedSurfacePrefixes` — browse sections, bundles, `disabledRoutes` | **prefix** | `/categories/{slug}` is owned by `categories` alone, and exact-only matching left all 4,698 of them serving a real 200 while `/categories` said 404 |
+ *
+ * Do not merge them. Picking either rule for both is a live defect one way or
+ * the other, and both directions have now been observed in production.
  *
  * ## 🛑 A SHARED route survives while ANY of its types is visible
  *
  * `/art` spans `art` and `stickers`; `/products` spans `standard` plus several
- * others. Without the second pass, hiding `stickers` alone would close a page
- * `art` still fills — and hiding `spares` alone would close `/products`.
+ * others. Without `hiddenSurfaceRoutes`' second pass, hiding `stickers` alone
+ * would close a page `art` still fills — and hiding `spares` alone would close
+ * `/products`.
  *
  * @tag domain:products
  * @tag layer:shared
  * @tag access:isomorphic
  * @tag sideEffects:none
  */
-import { type SurfaceCountSnapshot } from "./feature-flags";
+import { type BrowsePageKey, type SurfaceCountSnapshot } from "./feature-flags";
 /** The snapshot shape `isListingSurfaceVisible` reads its admin flags from. */
 interface SettingsSnapshot {
     listings?: {
         listingTypes?: Partial<Record<string, boolean>>;
+        browsePages?: Partial<Record<BrowsePageKey, boolean>>;
+        categoryTypes?: Partial<Record<string, boolean>>;
+        closedPaths?: string[];
     };
+    disabledRoutes?: string[];
 }
 export declare function hiddenSurfaceRoutes(settings: SettingsSnapshot | null | undefined, counts: SurfaceCountSnapshot | null | undefined): string[];
+/**
+ * Closed routes that must take their DESCENDANTS with them.
+ *
+ * ## Why this is a second function and not more entries in the first
+ *
+ * `hiddenSurfaceRoutes` above is exact-path-only, and its docstring explains
+ * why it has to be: `art`, `stickers`, `spares` and `standard` all detail at
+ * `/products/{slug}`, so a prefix rule there would 404 the whole standard
+ * catalogue the day `spares` emptied.
+ *
+ * A closed BROWSE PAGE has the opposite property. `/categories/{slug}` belongs
+ * to `categories` and to nothing else — no open surface details underneath it
+ * — so there is no shared-route hazard, and exact-only matching leaves the
+ * interesting half of the section served.
+ *
+ * 🛑 THIS WAS MEASURED OPEN IN PRODUCTION, 2026-10-27. All four browse pages
+ * had been `false` in `listings.browsePages` since 2026-10-24 and:
+ *
+ * ```
+ * /categories                     200   body = "404 — Page not found"
+ * /categories/category-beyblade-x 200   a real, fully-rendered category page
+ * /stores/store-beyblade-arena    200   a real, fully-rendered store page
+ * ```
+ *
+ * The index was a SOFT 404 (`guardBrowsePage` throws `notFound()` after the
+ * shell has streamed, which cannot set the status — see the site-wide soft-404
+ * note) and the 4,698 detail pages were never guarded at all. So "the section
+ * is closed" meant "the front door says 404 while every room stays open and
+ * indexable".
+ *
+ * ## `disabledRoutes` is folded in here, not left to the proxy
+ *
+ * The proxy already prefix-matches `disabledRoutes`, so including it changes
+ * nothing at the edge. It is here because the SITEMAP needs the same list and
+ * did not have it: measured the same day, the sitemap advertised 17 `/blog`
+ * URLs and one `/reviews` URL, every one of which the edge already 404s. That
+ * is a crawl error on a page we asked Google to fetch — Root Cause #81's
+ * host/sitemap disagreement in miniature, and the precise reason
+ * `hiddenSurfaceRoutes` was extracted into one definition in the first place.
+ *
+ * One list, two readers, no way for them to disagree:
+ *   · `toPublicSiteSettings` → `src/proxy.ts` — which paths 404.
+ *   · `buildSitemap`                          — which paths are advertised.
+ *
+ * Fails OPEN on a missing settings document: every `isBrowsePageEnabled` call
+ * returns `true` and the list is empty, so a transient Firestore error cannot
+ * withdraw the catalogue (Root Cause #72).
+ */
+export declare function closedSurfacePrefixes(settings: SettingsSnapshot | null | undefined): string[];
+/**
+ * Does `path` sit on or under one of `prefixes`?
+ *
+ * 🛑 A `/`-delimited boundary, never a bare `startsWith`. `/store` is the
+ * SELLER DASHBOARD and `/stores` is the public directory, so a substring test
+ * would 404 a signed-in seller's own dashboard the moment an admin closed the
+ * public storefronts — a different surface, a different audience, one
+ * character apart. Same rule, same reason, as `browsePageForPath`.
+ */
+export declare function isUnderClosedPrefix(path: string, prefixes: readonly string[]): boolean;
 export {};

package/dist/_internal/shared/listing-types/hidden-surfaces.js

@@ -1,39 +1,46 @@
 /**
- * Which public BROWSE ROUTES must not be served, given the admin flags and the
+ * Which public routes must not be served, given the admin flags and the
  * measured counts.
  *
- * ## Why this is one function and not two copies
+ * ## Why this is one module and not copies at each reader
  *
- * Two places need this answer and they must never disagree:
+ * Two places need these answers and they must never disagree:
  *
- *   · `buildSitemap` — decides which browse URLs are advertised.
- *   · `toPublicSiteSettings` → `src/proxy.ts` — decides which browse URLs 404.
+ *   · `buildSitemap` — decides which URLs are advertised.
+ *   · `toPublicSiteSettings` → `src/proxy.ts` — decides which URLs 404.
  *
  * A disagreement is not cosmetic: the sitemap advertising a URL the edge 404s
  * is a crawl error on a page we told Google to fetch, and the reverse serves a
  * surface we have decided is closed. They were two hand-written copies of the
- * same two loops when this was extracted.
+ * same two loops when this was extracted — and the disagreement showed up
+ * anyway on the one axis only one of them read (see `closedSurfacePrefixes`).
  *
- * ## 🛑 EXACT PATHS, never prefixes
+ * ## 🛑 TWO FUNCTIONS, because the MATCH RULE differs — and each rule is
+ * load-bearing in the opposite direction
  *
- * `art`, `stickers`, `spares` and `standard` all detail at `/products/{slug}`,
- * so a prefix rule would delist — or 404 — the entire standard catalogue the
- * day `spares` emptied. An empty type contributes no detail URLs anyway, since
- * its own fetcher returns none, so the exact-path rule loses nothing real.
+ * | | rule | why the other rule would break it |
+ * |---|---|---|
+ * | `hiddenSurfaceRoutes` — listing-type browse pages | **exact path** | `art`, `stickers`, `spares` and `standard` all detail at `/products/{slug}`, so a prefix rule would 404 the whole standard catalogue the day `spares` emptied |
+ * | `closedSurfacePrefixes` — browse sections, bundles, `disabledRoutes` | **prefix** | `/categories/{slug}` is owned by `categories` alone, and exact-only matching left all 4,698 of them serving a real 200 while `/categories` said 404 |
+ *
+ * Do not merge them. Picking either rule for both is a live defect one way or
+ * the other, and both directions have now been observed in production.
  *
  * ## 🛑 A SHARED route survives while ANY of its types is visible
  *
  * `/art` spans `art` and `stickers`; `/products` spans `standard` plus several
- * others. Without the second pass, hiding `stickers` alone would close a page
- * `art` still fills — and hiding `spares` alone would close `/products`.
+ * others. Without `hiddenSurfaceRoutes`' second pass, hiding `stickers` alone
+ * would close a page `art` still fills — and hiding `spares` alone would close
+ * `/products`.
  *
  * @tag domain:products
  * @tag layer:shared
  * @tag access:isomorphic
  * @tag sideEffects:none
  */
-import { ALL_LISTING_TYPES, isListingSurfaceVisible, } from "./feature-flags.js";
+import { ALL_BROWSE_PAGES, ALL_LISTING_TYPES, browsePagePrefixes, isBrowsePageEnabled, isCategoryTypeEnabled, isListingSurfaceVisible, } from "./feature-flags.js";
 import { pluginFor } from "./_registry.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 export function hiddenSurfaceRoutes(settings, counts) {
     const hidden = new Set();
     const routeOf = (type) => String(pluginFor(type).browseRoute ?? "");
@@ -55,3 +62,109 @@ export function hiddenSurfaceRoutes(settings, counts) {
     }
     return [...hidden];
 }
+/**
+ * Closed routes that must take their DESCENDANTS with them.
+ *
+ * ## Why this is a second function and not more entries in the first
+ *
+ * `hiddenSurfaceRoutes` above is exact-path-only, and its docstring explains
+ * why it has to be: `art`, `stickers`, `spares` and `standard` all detail at
+ * `/products/{slug}`, so a prefix rule there would 404 the whole standard
+ * catalogue the day `spares` emptied.
+ *
+ * A closed BROWSE PAGE has the opposite property. `/categories/{slug}` belongs
+ * to `categories` and to nothing else — no open surface details underneath it
+ * — so there is no shared-route hazard, and exact-only matching leaves the
+ * interesting half of the section served.
+ *
+ * 🛑 THIS WAS MEASURED OPEN IN PRODUCTION, 2026-10-27. All four browse pages
+ * had been `false` in `listings.browsePages` since 2026-10-24 and:
+ *
+ * ```
+ * /categories                     200   body = "404 — Page not found"
+ * /categories/category-beyblade-x 200   a real, fully-rendered category page
+ * /stores/store-beyblade-arena    200   a real, fully-rendered store page
+ * ```
+ *
+ * The index was a SOFT 404 (`guardBrowsePage` throws `notFound()` after the
+ * shell has streamed, which cannot set the status — see the site-wide soft-404
+ * note) and the 4,698 detail pages were never guarded at all. So "the section
+ * is closed" meant "the front door says 404 while every room stays open and
+ * indexable".
+ *
+ * ## `disabledRoutes` is folded in here, not left to the proxy
+ *
+ * The proxy already prefix-matches `disabledRoutes`, so including it changes
+ * nothing at the edge. It is here because the SITEMAP needs the same list and
+ * did not have it: measured the same day, the sitemap advertised 17 `/blog`
+ * URLs and one `/reviews` URL, every one of which the edge already 404s. That
+ * is a crawl error on a page we asked Google to fetch — Root Cause #81's
+ * host/sitemap disagreement in miniature, and the precise reason
+ * `hiddenSurfaceRoutes` was extracted into one definition in the first place.
+ *
+ * One list, two readers, no way for them to disagree:
+ *   · `toPublicSiteSettings` → `src/proxy.ts` — which paths 404.
+ *   · `buildSitemap`                          — which paths are advertised.
+ *
+ * Fails OPEN on a missing settings document: every `isBrowsePageEnabled` call
+ * returns `true` and the list is empty, so a transient Firestore error cannot
+ * withdraw the catalogue (Root Cause #72).
+ */
+export function closedSurfacePrefixes(settings) {
+    const closed = new Set();
+    for (const page of ALL_BROWSE_PAGES) {
+        if (isBrowsePageEnabled(page, settings))
+            continue;
+        for (const prefix of browsePagePrefixes(page)) {
+            if (prefix)
+                closed.add(prefix);
+        }
+    }
+    /*
+     * Bundles — a CATEGORY type, not a listing type and not a browse page, so it
+     * reaches neither loop above.
+     *
+     * `listings.categoryTypes.bundle` is the control that already exists for it,
+     * and `HOMEPAGE_SECTION_CATEGORY_TYPE` in `MarketplaceHomepageView` already
+     * drops the bundles rail from it — so until this line the flag hid the rail
+     * while `/bundles` and every `/bundles/{slug}` went on serving. That is the
+     * same half-closed door the browse pages had.
+     *
+     * Prefix rather than exact for the same reason as a browse page: `/bundles`
+     * is owned by bundles alone, with no open surface detailing underneath it.
+     */
+    if (!isCategoryTypeEnabled("bundle", settings)) {
+        closed.add(String(ROUTES.PUBLIC.BUNDLES));
+    }
+    /*
+     * Admin-set feature withdrawals — `/seller-guide`, `/fees`, `/scams`, …
+     *
+     * 🛑 A SEPARATE FIELD from `disabledRoutes` below, not a duplicate of it.
+     * That array is DERIVED from `navConfig` and fully recomputed on every nav
+     * toggle, so a non-nav path appended there is wiped by the next admin save.
+     * Anything footer-only — which is most of a marketplace's explainer
+     * surfaces — has no nav item and can only live here.
+     */
+    for (const path of settings?.listings?.closedPaths ?? []) {
+        if (typeof path === "string" && path.startsWith("/"))
+            closed.add(path);
+    }
+    for (const route of settings?.disabledRoutes ?? []) {
+        if (typeof route === "string" && route.startsWith("/"))
+            closed.add(route);
+    }
+    return [...closed];
+}
+/**
+ * Does `path` sit on or under one of `prefixes`?
+ *
+ * 🛑 A `/`-delimited boundary, never a bare `startsWith`. `/store` is the
+ * SELLER DASHBOARD and `/stores` is the public directory, so a substring test
+ * would 404 a signed-in seller's own dashboard the moment an admin closed the
+ * public storefronts — a different surface, a different audience, one
+ * character apart. Same rule, same reason, as `browsePageForPath`.
+ */
+export function isUnderClosedPrefix(path, prefixes) {
+    const normalised = path.replace(/\/+$/, "") || "/";
+    return prefixes.some((p) => normalised === p || normalised.startsWith(`${p}/`));
+}

package/dist/_internal/shared/listing-types/route-gating.d.ts

@@ -17,40 +17,82 @@
  * type-keyed gate could see them — the only thing that identifies them is
  * where they point.
  *
- * ## The rule, and the one case that makes it non-obvious
+ * ## Where the rules are written down
  *
- * A href is disabled when EVERY listing type that claims its route is
- * disabled. Not "any" — `art` and `stickers` share `/art`, so a site that
- * sells art but not stickers must keep `/art` reachable. Treating one disabled
- * claimant as enough would silently delete a working destination.
+ * On `isClosedHref` below — the three axes it reads (listing-type flags ANDed
+ * with measured counts, closed browse sections, hand-disabled routes), what it
+ * deliberately does not match, and the production measurement that forced each
+ * one. Stated there and not restated here deliberately: two comments
+ * disagreeing about what a gate matches is a defect this codebase keeps paying
+ * for, and the only safe number of descriptions is one.
  *
- * ## What it deliberately does NOT match
- *
- * Editorial pages that merely have a type's name in the path — `/help/auctions`,
- * `/how-auctions-work`, `/seller-guide/prize-draws`. None of them starts with
- * `/auctions`, so prefix matching excludes them for free, and that is correct:
- * an explainer about auctions is still honest reading when auctions are off.
- * A substring test would have eaten all three.
- *
- * Store tabs (`/stores/{slug}/auctions`) are also out of scope — those are
- * resolved by `resolveStoreTabs`, which owns its own visibility, and a second
- * owner is how a mirror drifts (Root Cause #42).
+ * Store tabs (`/stores/{slug}/auctions`) are out of scope — those are resolved
+ * by `resolveStoreTabs`, which owns its own visibility, and a second owner is
+ * how a mirror drifts (Root Cause #42).
  */
+import { type BrowsePageKey, type SurfaceCountSnapshot } from "./feature-flags";
 import type { ListingType } from "../../../features/products/types/index";
 interface ListingFlagSnapshot {
     listings?: {
         listingTypes?: Partial<Record<ListingType, boolean>>;
+        browsePages?: Partial<Record<BrowsePageKey, boolean>>;
     };
+    disabledRoutes?: string[];
 }
 /**
- * `true` when `href` points at a listing type's browse page (or any page
- * beneath it) and every type that browses there is disabled.
- *
- * Fails OPEN on anything it cannot classify: an unknown path, an external URL
- * or a missing settings document all return `false`. A settings read that
- * errored must not strip working destinations out of the homepage — the same
- * reasoning as the suggestions endpoint's TTL cache and `src/proxy.ts`'s
- * disabled-routes gate.
+ * Everything needed to answer "is this destination closed", resolved once.
+ *
+ * 🛑 A CONTEXT RATHER THAN THREE LOOSE ARGUMENTS, because the prefix list is
+ * derived work and the callers are loops. The live homepage carries **34 links
+ * to `/categories` alone** (measured 2026-10-27); rebuilding the closed-prefix
+ * array inside the predicate would rebuild it 34 times for one render.
+ */
+export interface ClosedSurfaceContext {
+    settings: ListingFlagSnapshot | null | undefined;
+    counts: SurfaceCountSnapshot | null | undefined;
+    /** Closed browse sections + `disabledRoutes`, pre-derived. */
+    prefixes: string[];
+}
+export declare function closedSurfaceContext(settings: ListingFlagSnapshot | null | undefined, counts?: SurfaceCountSnapshot | null): ClosedSurfaceContext;
+/**
+ * `true` when `href` leads somewhere this site has closed.
+ *
+ * ## THREE axes, because authored content can point at any of them
+ *
+ * This replaced `isDisabledListingHref`, which read `listings.listingTypes`
+ * and nothing else — and the two axes it could not see were the two doing
+ * visible damage. Measured on the live homepage, 2026-10-27:
+ *
+ *   · **counts.** `art` and `spares` had flag `true` and measured count `0`,
+ *     so they were auto-hidden everywhere — `/art` and `/spares` both answered
+ *     a real **404** at the edge — while the homepage went on shipping 3 links
+ *     to each from the "Shop extras" cards. `isListingTypeEnabled` reads the
+ *     flag only, so it called both of them enabled. `isListingSurfaceVisible`
+ *     ANDs the flag with the count, which is the rule every other surface on
+ *     the site already uses.
+ *   · **browse sections.** All four had been `false` since 2026-10-24, and the
+ *     homepage carried **34** `/categories` links across the welcome hero's
+ *     secondary CTA, the 35-button systems matrix and the 4-banner generation
+ *     promo grid.
+ *
+ * ## Deliberately link-based, never keyword-based
+ *
+ * Unchanged from the original, and still the point: nothing here reads copy.
+ * "Win it at your price" names no type, so a word search would miss it, and it
+ * would also eat the authenticity slide for saying "bid" in passing. A
+ * destination is checkable; prose is not.
+ *
+ * ## What it still does NOT match
+ *
+ * Editorial pages that merely carry a name in the path — `/help/auctions`,
+ * `/how-auctions-work`, `/seller-guide/prize-draws`. None starts with
+ * `/auctions`, so the `/`-delimited boundary excludes them for free, and that
+ * is correct: an explainer about auctions is honest reading when auctions are
+ * off.
+ *
+ * Fails OPEN on anything it cannot classify — an unknown path, an external
+ * URL, a missing settings document. A settings read that errored must not
+ * strip working destinations off the homepage (Root Cause #72).
  */
-export declare function isDisabledListingHref(href: string | undefined | null, settings: ListingFlagSnapshot | null | undefined): boolean;
+export declare function isClosedHref(href: string | undefined | null, ctx: ClosedSurfaceContext): boolean;
 export {};