@mohasinac/appkit 4.69.1 → 4.71.0

package/dist/features/whatsapp-bot/components/SellerWhatsAppSettingsView.js

@@ -13,7 +13,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *
  *   1. Almost no small seller will create a Meta app and mint a system user
  *      token. A setting nobody can complete is a feature nobody has.
- *   2. It made LetItRip the custodian of a live Meta credential per seller.
+ *   2. It made {getBrandName()} the custodian of a live Meta credential per seller.
  *      `StoreRepository.mapDoc` decrypted that token on EVERY read, so any
  *      code path that forgot to project was handling plaintext — a gap
  *      CLAUDE.md flags as deserving its own session.
@@ -48,6 +48,7 @@ import { Toggle } from "../../../ui/components/Toggle.js";
 import { useToast } from "../../../ui/components/toast-context.js";
 import { normalizeError } from "../../../errors/normalize.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
+import { getBrandName } from "../../../core/brand-resolver.js";
 export function SellerWhatsAppSettingsView({ subscribed, monthlyFee, currency = "INR", channelEnabled, onToggleSubscription, hasCapability = true, }) {
     const [isOn, setIsOn] = useState(subscribed);
     const [saving, setSaving] = useState(false);
@@ -79,5 +80,5 @@ export function SellerWhatsAppSettingsView({ subscribed, monthlyFee, currency =
             setSaving(false);
         }
     };
-    return (_jsx(Section, { children: _jsxs(Div, { className: "mx-auto max-w-2xl", children: [_jsx(Heading, { level: 1, className: "mb-1", color: "primary", size: "2xl", weight: "bold", children: "WhatsApp order updates" }), _jsx(Text, { variant: "secondary", className: "mb-6", size: "sm", children: "Send your buyers order updates on WhatsApp \u2014 confirmed, shipped, delivered \u2014 from LetItRip's verified business number. You don't need a WhatsApp Business account of your own, and nothing is installed on your phone." }), !channelEnabled && (_jsx(Alert, { variant: "warning", className: "mb-4", children: "WhatsApp updates are currently switched off platform-wide, so nothing will be sent even if you subscribe. We'll start sending as soon as it's back on." })), _jsxs(Stack, { gap: "md", surface: "card", padding: "md", children: [_jsxs(Row, { justify: "between", align: "center", gap: "md", children: [_jsxs(Div, { className: "flex-1 min-w-0", children: [_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Subscription" }), _jsx(Badge, { variant: isOn ? "success" : "inactive", children: isOn ? "Active" : "Not subscribed" })] }), _jsxs(Text, { color: "muted", size: "sm", children: [formatCurrency(monthlyFee, currency), " per month. Covers every order update to every buyer \u2014 not charged per message."] })] }), _jsx(Toggle, { checked: isOn, onChange: handleToggle, disabled: saving || !hasCapability, size: "md" })] }), !hasCapability && (_jsx(Div, { textSize: "sm", className: "border border-warning/20", color: "warning", surface: "warning-surface", padding: "inlineSm", rounded: "lg", children: "Your store doesn't have this add-on enabled. Contact support to turn it on." }))] }), _jsx(Heading, { level: 2, className: "mt-8 mb-3", size: "lg", weight: "semibold", children: "What your buyers get" }), _jsxs(Stack, { gap: "sm", surface: "card", padding: "md", children: [_jsxs(Text, { color: "muted", size: "sm", children: ["A WhatsApp message when an order is ", _jsx(Span, { weight: "semibold", children: "confirmed" }), ",", " ", _jsx(Span, { weight: "semibold", children: "shipped" }), ", ", _jsx(Span, { weight: "semibold", children: "delivered" }), ",", " ", _jsx(Span, { weight: "semibold", children: "cancelled" }), " or ", _jsx(Span, { weight: "semibold", children: "refunded" }), ". Nothing promotional \u2014 buyers who opted out of WhatsApp never receive these."] }), _jsx(Text, { color: "muted", size: "sm", children: "Messages come from LetItRip's number, not yours, so your personal number stays private and replies land with our support team rather than on your phone." }), _jsx(Text, { color: "muted", size: "sm", children: "Turning this off changes nothing else: buyers keep getting the same updates by email and in their account." })] })] }) }));
+    return (_jsx(Section, { children: _jsxs(Div, { className: "mx-auto max-w-2xl", children: [_jsx(Heading, { level: 1, className: "mb-1", color: "primary", size: "2xl", weight: "bold", children: "WhatsApp order updates" }), _jsxs(Text, { variant: "secondary", className: "mb-6", size: "sm", children: ["Send your buyers order updates on WhatsApp \u2014 confirmed, shipped, delivered \u2014 from", getBrandName(), "'s verified business number. You don't need a WhatsApp Business account of your own, and nothing is installed on your phone."] }), !channelEnabled && (_jsx(Alert, { variant: "warning", className: "mb-4", children: "WhatsApp updates are currently switched off platform-wide, so nothing will be sent even if you subscribe. We'll start sending as soon as it's back on." })), _jsxs(Stack, { gap: "md", surface: "card", padding: "md", children: [_jsxs(Row, { justify: "between", align: "center", gap: "md", children: [_jsxs(Div, { className: "flex-1 min-w-0", children: [_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Subscription" }), _jsx(Badge, { variant: isOn ? "success" : "inactive", children: isOn ? "Active" : "Not subscribed" })] }), _jsxs(Text, { color: "muted", size: "sm", children: [formatCurrency(monthlyFee, currency), " per month. Covers every order update to every buyer \u2014 not charged per message."] })] }), _jsx(Toggle, { checked: isOn, onChange: handleToggle, disabled: saving || !hasCapability, size: "md" })] }), !hasCapability && (_jsx(Div, { textSize: "sm", className: "border border-warning/20", color: "warning", surface: "warning-surface", padding: "inlineSm", rounded: "lg", children: "Your store doesn't have this add-on enabled. Contact support to turn it on." }))] }), _jsx(Heading, { level: 2, className: "mt-8 mb-3", size: "lg", weight: "semibold", children: "What your buyers get" }), _jsxs(Stack, { gap: "sm", surface: "card", padding: "md", children: [_jsxs(Text, { color: "muted", size: "sm", children: ["A WhatsApp message when an order is ", _jsx(Span, { weight: "semibold", children: "confirmed" }), ",", " ", _jsx(Span, { weight: "semibold", children: "shipped" }), ", ", _jsx(Span, { weight: "semibold", children: "delivered" }), ",", " ", _jsx(Span, { weight: "semibold", children: "cancelled" }), " or ", _jsx(Span, { weight: "semibold", children: "refunded" }), ". Nothing promotional \u2014 buyers who opted out of WhatsApp never receive these."] }), _jsxs(Text, { color: "muted", size: "sm", children: ["Messages come from ", getBrandName(), "'s number, not yours, so your personal number stays private and replies land with our support team rather than on your phone."] }), _jsx(Text, { color: "muted", size: "sm", children: "Turning this off changes nothing else: buyers keep getting the same updates by email and in their account." })] })] }) }));
 }

package/dist/features/whatsapp-bot/helpers/whatsapp.js

@@ -1,6 +1,7 @@
 import { normalizeError } from "../../../errors/normalize.js";
 import { createHmac, timingSafeEqual } from "crypto";
 import { getDefaultCurrencySymbol, getDefaultLocale, } from "../../../core/baseline-resolver.js";
+import { formatMoney } from "../../../utils/number.formatter.js";
 const META_GRAPH_BASE = "https://graph.facebook.com/v20.0";
 export function buildCheckoutMessageURL(input) {
     const { waNumber, cart, total, address, isPreorder = false } = input;
@@ -241,8 +242,10 @@ export async function syncProductsToCatalog(input) {
 export function buildPurchaseAnnouncementMessage(input) {
     const { buyerName, firstItemName, additionalItemCount, totalAmount, orderId } = input;
     const extra = additionalItemCount > 0 ? ` + ${additionalItemCount} more item${additionalItemCount > 1 ? "s" : ""}` : "";
-    const amount = totalAmount.toLocaleString("en-IN");
-    return `🛍️ New order! ${buyerName} purchased ${firstItemName}${extra} for ₹${amount}. Order #${orderId}`;
+    // `formatMoney` groups and places the symbol from the market profile; the
+    // intermediate `toLocaleString("en-IN")` this replaced hardcoded the locale.
+    const amount = formatMoney(totalAmount);
+    return `🛍️ New order! ${buyerName} purchased ${firstItemName}${extra} for ${amount}. Order #${orderId}`;
 }
 /**
  * Build a wa.me share link with a pre-filled message.

package/dist/index.d.ts

@@ -286,7 +286,6 @@ export { isNumeric } from "./validation/input.validator";
 export { isRequired } from "./validation/input.validator";
 export { isValidEmail } from "./validation/email.validator";
 export { isValidEmailDomain } from "./validation/email.validator";
-export { isValidIndianPincode } from "./validation/phone.validator";
 export { isValidMobile } from "./validation/phone.validator";
 export { isValidPhone } from "./validation/phone.validator";
 export { isValidUrl } from "./validation/url.validator";
@@ -753,7 +752,6 @@ export { validateFileSize } from "./providers/storage-firebase/client";
 export { validateFileType } from "./providers/storage-firebase/client";
 export { validateImage } from "./providers/storage-firebase/client";
 export type { StorageHelpers } from "./providers/storage-firebase/client";
-export { AboutView } from "./features/about/components/AboutView";
 export { FAQPageView } from "./features/about/components/FAQPageView";
 export { FeesView } from "./features/about/components/FeesView";
 export { HelpPageView } from "./features/about/components/HelpPageView";
@@ -774,7 +772,6 @@ export { TrackOrderView } from "./features/about/components/TrackOrderView";
 export type { AboutHowItem } from "./features/about/schemas/firestore";
 export type { AboutMilestone } from "./features/about/schemas/firestore";
 export type { AboutValueItem } from "./features/about/schemas/firestore";
-export type { AboutViewProps } from "./features/about/components/AboutView";
 export type { AboutTeamMember } from "./features/about/schemas/firestore";
 export type { AboutContentDocument } from "./features/about/schemas/firestore";
 export type { FAQPageViewProps } from "./features/about/components/FAQPageView";

package/dist/index.js

@@ -447,8 +447,6 @@ export { isValidEmail } from "./validation/email.validator.js";
 // isValidEmailDomain - Shared export for is valid email domain.
 export { isValidEmailDomain } from "./validation/email.validator.js";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// isValidIndianPincode - Shared export for is valid indian pincode.
-export { isValidIndianPincode } from "./validation/phone.validator.js";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // isValidMobile - Shared export for is valid mobile.
 export { isValidMobile } from "./validation/phone.validator.js";
@@ -1580,10 +1578,6 @@ export { validateFileType } from "./providers/storage-firebase/client.js";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // validateImage - Helper for validate image.
 export { validateImage } from "./providers/storage-firebase/client.js";
-// ./features/about/index
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// AboutView - Component for about view.
-export { AboutView } from "./features/about/components/AboutView.js";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // FAQPageView - Component for faqpage view.
 export { FAQPageView } from "./features/about/components/FAQPageView.js";

package/dist/providers/payment-manual/index.d.ts

@@ -25,6 +25,17 @@ export declare class ManualPaymentProvider extends IPaymentProvider {
     createOrder(amount: number, currency: string, metadata?: Record<string, JsonValue>): Promise<PaymentOrder>;
     /** Manual payments have no webhook source — always false. */
     verifyWebhook(_payload: string, _signature: string): boolean;
+    /**
+     * Manual payment has no gateway callback to verify, so there is nothing that
+     * could make this true.
+     *
+     * 🛑 `false`, never `true`. This is the check that decides whether a payment
+     * is genuine; a provider that cannot verify must REJECT, not wave through.
+     * Returning `true` here would mean a forged gateway callback is accepted on
+     * any install where the gateway flag is off — which is exactly the install
+     * where nobody is watching for one.
+     */
+    verifyCheckoutSignature(_payload: Record<string, string>, _secret: string): boolean;
     /**
      * Manual payments are considered captured the moment the buyer's
      * reference/proof is recorded — there is no separate auth+capture step.

package/dist/providers/payment-manual/index.js

@@ -40,6 +40,19 @@ export class ManualPaymentProvider extends IPaymentProvider {
     verifyWebhook(_payload, _signature) {
         return false;
     }
+    /**
+     * Manual payment has no gateway callback to verify, so there is nothing that
+     * could make this true.
+     *
+     * 🛑 `false`, never `true`. This is the check that decides whether a payment
+     * is genuine; a provider that cannot verify must REJECT, not wave through.
+     * Returning `true` here would mean a forged gateway callback is accepted on
+     * any install where the gateway flag is off — which is exactly the install
+     * where nobody is watching for one.
+     */
+    verifyCheckoutSignature(_payload, _secret) {
+        return false;
+    }
     /**
      * Manual payments are considered captured the moment the buyer's
      * reference/proof is recorded — there is no separate auth+capture step.

package/dist/providers/payment-phonepe/index.d.ts

@@ -38,7 +38,7 @@
  */
 import type { JsonValue } from "@mohasinac/appkit";
 import { IPaymentProvider } from "../../contracts";
-import type { PaymentOrder, PaymentCapture, Refund, Dispute, GatewayPaymentRecord } from "../../contracts";
+import type { CheckoutIntentMetadata, PaymentOrder, PaymentCapture, Refund, Dispute, GatewayPaymentRecord } from "../../contracts";
 /**
  * PhonePe's `metaInfo` (udf1-udf5, ≤256 chars each) is the only channel that
  * survives from `createOrder()` through to BOTH the Order Status API AND the
@@ -48,12 +48,15 @@ import type { PaymentOrder, PaymentCapture, Refund, Dispute, GatewayPaymentRecor
  * the tab mid-payment. See `confirmAndPlacePhonePeOrderAction` in
  * `_internal/server/features/checkout/actions.ts`.
  */
-export interface PhonePeCheckoutIntent {
-    uid: string;
-    addressId?: string;
-    outOfStockPolicy?: string;
-    notes?: string;
-}
+/**
+ * @deprecated Use `CheckoutIntentMetadata` from `contracts/payment`.
+ *
+ * Kept as an alias so existing imports keep compiling. Every field is ours —
+ * the only PhonePe-specific thing was the name, and it forced generic checkout
+ * code to import this provider for a TYPE (A4). PhonePe carries it in
+ * `udf1..udf4`; that is a packing detail, not a definition.
+ */
+export type PhonePeCheckoutIntent = CheckoutIntentMetadata;
 export interface PhonePeConfig {
     clientId: string;
     clientSecret: string;
@@ -97,6 +100,19 @@ export declare class PhonePeProvider extends IPaymentProvider {
      * the existing webhook route already does.
      */
     verifyWebhook(payload: string, signature: string): boolean;
+    /**
+     * PhonePe has no buyer-present SIGNED callback of this shape.
+     *
+     * Its redirect carries no signature — confirmation comes from the Order
+     * Status API or the webhook (`verifyWebhook` above, which does the real
+     * `validateCallback`). So there is nothing here to verify, and the honest
+     * answer is rejection.
+     *
+     * 🛑 `false`, never `true`. "No signature to check" and "the signature is
+     * good" must never collapse into the same return value on the call that
+     * decides whether a payment is genuine.
+     */
+    verifyCheckoutSignature(_payload: Record<string, string>, _secret: string): boolean;
     /** Wraps the Order Status API. `orderId` here is our `merchantOrderId`. */
     capturePayment(orderId: string): Promise<PaymentCapture>;
     /**

package/dist/providers/payment-phonepe/index.js

@@ -158,6 +158,21 @@ export class PhonePeProvider extends IPaymentProvider {
             return false;
         }
     }
+    /**
+     * PhonePe has no buyer-present SIGNED callback of this shape.
+     *
+     * Its redirect carries no signature — confirmation comes from the Order
+     * Status API or the webhook (`verifyWebhook` above, which does the real
+     * `validateCallback`). So there is nothing here to verify, and the honest
+     * answer is rejection.
+     *
+     * 🛑 `false`, never `true`. "No signature to check" and "the signature is
+     * good" must never collapse into the same return value on the call that
+     * decides whether a payment is genuine.
+     */
+    verifyCheckoutSignature(_payload, _secret) {
+        return false;
+    }
     /** Wraps the Order Status API. `orderId` here is our `merchantOrderId`. */
     async capturePayment(orderId) {
         const status = await this.client.getOrderStatus(orderId, true);

package/dist/providers/payment-razorpay/index.d.ts

@@ -89,6 +89,19 @@ export declare class RazorpayProvider extends IPaymentProvider {
      * is not guaranteed to reproduce the bytes that were signed.
      */
     verifyWebhook(payload: string, signature: string): boolean;
+    /**
+     * The buyer-present callback from `checkout.js`.
+     *
+     * 🛑 Delegates to the SAME `verifyPaymentSignature` the checkout action
+     * called directly before A4b — identical HMAC, identical `hexEqual`
+     * comparison, identical `if (!keySecret) return false`. The dispatch moved
+     * behind the contract; the arithmetic did not move at all. That is what let
+     * this be proven equivalent rather than argued about.
+     *
+     * The three fields are checked before the cast: a callback missing any of
+     * them cannot be verified, and "cannot verify" is rejection.
+     */
+    verifyCheckoutSignature(payload: Record<string, string>, secret: string): boolean;
     /**
      * Resolves a `pay_…` id for either id shape.
      *

package/dist/providers/payment-razorpay/index.js

@@ -54,7 +54,9 @@ import Razorpay from "razorpay";
 import { IPaymentProvider } from "../../contracts/index.js";
 import { getDefaultCurrency } from "../../core/baseline-resolver.js";
 import { paiseToRupees } from "../../core/money.js";
-import { verifyWebhookSignature } from "./signature.js";
+// `verifyPaymentSignature` is re-exported below, but a re-export does not bring
+// it into THIS module's scope — `verifyCheckoutSignature` calls it directly.
+import { verifyPaymentSignature, verifyWebhookSignature } from "./signature.js";
 export { verifyPaymentSignature, verifyWebhookSignature, } from "./signature.js";
 /** Razorpay's own order status vocabulary → the contract's. */
 function mapOrderStatus(status) {
@@ -144,6 +146,24 @@ export class RazorpayProvider extends IPaymentProvider {
             return false;
         return verifyWebhookSignature(payload, signature, this.webhookSecret);
     }
+    /**
+     * The buyer-present callback from `checkout.js`.
+     *
+     * 🛑 Delegates to the SAME `verifyPaymentSignature` the checkout action
+     * called directly before A4b — identical HMAC, identical `hexEqual`
+     * comparison, identical `if (!keySecret) return false`. The dispatch moved
+     * behind the contract; the arithmetic did not move at all. That is what let
+     * this be proven equivalent rather than argued about.
+     *
+     * The three fields are checked before the cast: a callback missing any of
+     * them cannot be verified, and "cannot verify" is rejection.
+     */
+    verifyCheckoutSignature(payload, secret) {
+        const { razorpay_order_id, razorpay_payment_id, razorpay_signature } = payload;
+        if (!razorpay_order_id || !razorpay_payment_id || !razorpay_signature)
+            return false;
+        return verifyPaymentSignature({ razorpay_order_id, razorpay_payment_id, razorpay_signature }, secret);
+    }
     /**
      * Resolves a `pay_…` id for either id shape.
      *

package/dist/providers/tax-india-gst/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * India GST — the default `ITaxProvider`.
+ *
+ * ## 🛑 This DELEGATES. Every figure still comes from `calculateGst` /
+ * `calculateGstInclusive`.
+ *
+ * Not a rewrite, on purpose. Those two functions split the intra-state half
+ * differently and the difference is load-bearing:
+ *
+ *   calculateGst           cgst = sgst = round(gst / 2); gst RE-DERIVED as half*2
+ *   calculateGstInclusive  cgst = round(gst / 2); sgst = round(gst - cgst)
+ *
+ * Measured on ₹66.67 at 18% inclusive: cgst 5.09, sgst 5.08 — the remainder
+ * lands in sgst so the parts still sum to 10.17. Reimplementing the maths here
+ * to make the two agree would move a paisa on figures GST is filed on. The
+ * seam's whole value is that it adds an abstraction WITHOUT touching arithmetic.
+ *
+ * Verified by `.build-memory/tax-roundtrip.mjs` — 397 breakdowns across every
+ * slab, both supply directions and the rounding edges, byte-identical.
+ *
+ * @tag domain:tax
+ * @tag layer:provider
+ * @tag access:isomorphic
+ */
+import { ITaxProvider, type TaxBreakdown, type TaxJurisdiction, type TaxableItem } from "../../contracts/tax";
+export declare class IndiaGstTaxProvider extends ITaxProvider {
+    readonly id = "india-gst";
+    /**
+     * Intra-state when origin and destination states match.
+     *
+     * 🛑 Absent information is treated as INTRA-state, which preserves the
+     * existing behaviour exactly rather than improving on it. Every current
+     * caller passes an `intraState` boolean it computed itself, and the defaults
+     * across those call sites resolve to intra-state when a place of supply is
+     * unknown — changing that here would alter tax on orders with an incomplete
+     * delivery snapshot, which is precisely the class of row most likely to
+     * exist. A stricter rule is a product decision, not a side effect of adding
+     * an interface.
+     */
+    isSameRegion(jurisdiction: TaxJurisdiction): boolean;
+    onExclusive(item: TaxableItem, jurisdiction: TaxJurisdiction, taxableAmount: number): TaxBreakdown;
+    onInclusive(item: TaxableItem, jurisdiction: TaxJurisdiction, gross: number): TaxBreakdown;
+}
+/** The default instance. A consumer in another jurisdiction registers its own. */
+export declare const indiaGstTaxProvider: IndiaGstTaxProvider;

package/dist/providers/tax-india-gst/index.js

@@ -0,0 +1,78 @@
+/**
+ * India GST — the default `ITaxProvider`.
+ *
+ * ## 🛑 This DELEGATES. Every figure still comes from `calculateGst` /
+ * `calculateGstInclusive`.
+ *
+ * Not a rewrite, on purpose. Those two functions split the intra-state half
+ * differently and the difference is load-bearing:
+ *
+ *   calculateGst           cgst = sgst = round(gst / 2); gst RE-DERIVED as half*2
+ *   calculateGstInclusive  cgst = round(gst / 2); sgst = round(gst - cgst)
+ *
+ * Measured on ₹66.67 at 18% inclusive: cgst 5.09, sgst 5.08 — the remainder
+ * lands in sgst so the parts still sum to 10.17. Reimplementing the maths here
+ * to make the two agree would move a paisa on figures GST is filed on. The
+ * seam's whole value is that it adds an abstraction WITHOUT touching arithmetic.
+ *
+ * Verified by `.build-memory/tax-roundtrip.mjs` — 397 breakdowns across every
+ * slab, both supply directions and the rounding edges, byte-identical.
+ *
+ * @tag domain:tax
+ * @tag layer:provider
+ * @tag access:isomorphic
+ */
+import { ITaxProvider, } from "../../contracts/tax.js";
+import { calculateGst, calculateGstInclusive, } from "../../_internal/shared/fees/calculator.js";
+/** CGST and SGST are each HALF the headline rate; IGST carries all of it. */
+function componentsFrom(breakdown, rate) {
+    const half = rate / 2;
+    if (breakdown.igst > 0 || (breakdown.cgst === 0 && breakdown.sgst === 0 && breakdown.gstAmount > 0)) {
+        return [{ code: "igst", label: "IGST", rate, amount: breakdown.igst }];
+    }
+    if (breakdown.gstAmount === 0)
+        return [];
+    return [
+        { code: "cgst", label: "CGST", rate: half, amount: breakdown.cgst },
+        { code: "sgst", label: "SGST", rate: half, amount: breakdown.sgst },
+    ];
+}
+function toBreakdown(breakdown, rate) {
+    return {
+        taxableAmount: breakdown.taxableAmount,
+        taxAmount: breakdown.gstAmount,
+        components: componentsFrom(breakdown, rate),
+    };
+}
+export class IndiaGstTaxProvider extends ITaxProvider {
+    constructor() {
+        super(...arguments);
+        this.id = "india-gst";
+    }
+    /**
+     * Intra-state when origin and destination states match.
+     *
+     * 🛑 Absent information is treated as INTRA-state, which preserves the
+     * existing behaviour exactly rather than improving on it. Every current
+     * caller passes an `intraState` boolean it computed itself, and the defaults
+     * across those call sites resolve to intra-state when a place of supply is
+     * unknown — changing that here would alter tax on orders with an incomplete
+     * delivery snapshot, which is precisely the class of row most likely to
+     * exist. A stricter rule is a product decision, not a side effect of adding
+     * an interface.
+     */
+    isSameRegion(jurisdiction) {
+        const { origin, destination } = jurisdiction;
+        if (!origin || !destination)
+            return true;
+        return origin.trim().toUpperCase() === destination.trim().toUpperCase();
+    }
+    onExclusive(item, jurisdiction, taxableAmount) {
+        return toBreakdown(calculateGst(item.rate, this.isSameRegion(jurisdiction), taxableAmount), item.rate);
+    }
+    onInclusive(item, jurisdiction, gross) {
+        return toBreakdown(calculateGstInclusive(item.rate, this.isSameRegion(jurisdiction), gross), item.rate);
+    }
+}
+/** The default instance. A consumer in another jurisdiction registers its own. */
+export const indiaGstTaxProvider = new IndiaGstTaxProvider();

package/dist/react/hooks/useScrollToTop.d.ts

@@ -0,0 +1,5 @@
+export interface UseScrollToTopOptions {
+    /** Skip scrolling without unmounting the caller. Default `true`. */
+    enabled?: boolean;
+}
+export declare function useScrollToTop(key: string | null | undefined, { enabled }?: UseScrollToTopOptions): void;

package/dist/react/hooks/useScrollToTop.js

@@ -0,0 +1,70 @@
+"use client";
+/**
+ * useScrollToTop — jump to the top whenever a key changes.
+ *
+ * ## Why a HOOK and not a `<ScrollToTop />` component
+ *
+ * The consumer had a 17-line component doing exactly this. Lifting it as a
+ * component would not work: the only interesting line is
+ * `usePathname()` from `@/i18n/navigation`, and that is the consumer's own
+ * routing choice (next-intl, locale-prefixed). appkit cannot import it, and
+ * taking a `pathname` prop would mean a component whose entire job is to pass
+ * one value to one effect.
+ *
+ * So the mechanism moves and the binding stays: the consumer keeps a four-line
+ * mount that supplies its own `usePathname()`.
+ *
+ * ## 🛑 `behavior: "auto"`, deliberately
+ *
+ * Not `"smooth"`. A route change should look instantaneous; smooth-scrolling a
+ * fresh page animates content the reader has not seen yet, and on a long page
+ * the animation is still running when they start reading. It also ignores
+ * `prefers-reduced-motion`, which `"auto"` sidesteps entirely by not animating.
+ *
+ * ## 🛑 Does NOT fire on mount
+ *
+ * `useEffect` with a dependency runs on mount too, which would fight the
+ * browser's own scroll restoration on a back-navigation — the reader returns to
+ * a list, the browser restores their place, and this yanks them to the top.
+ * The first run is skipped so only genuine changes scroll.
+ *
+ * That is a behaviour FIX, not a port: the consumer's component scrolled on
+ * mount. It was unnoticeable there because Next remounts the tree on a hard
+ * load anyway, but it is wrong for a hook anyone may mount mid-tree.
+ *
+ * @example
+ * ```tsx
+ * "use client";
+ * import { usePathname } from "@/i18n/navigation";
+ * import { useScrollToTop } from "@mohasinac/appkit/react/hooks/useScrollToTop";
+ *
+ * export function ScrollToTop() {
+ *   useScrollToTop(usePathname());
+ *   return null;
+ * }
+ * ```
+ *
+ * @tag domain:routing
+ * @tag layer:client
+ * @tag access:client
+ * @tag sideEffects:dom
+ */
+import { useEffect, useRef } from "react";
+export function useScrollToTop(key, { enabled = true } = {}) {
+    const previous = useRef(undefined);
+    useEffect(() => {
+        if (!enabled)
+            return;
+        // First run: record and do nothing — see the note on scroll restoration.
+        if (previous.current === undefined) {
+            previous.current = key;
+            return;
+        }
+        if (previous.current === key)
+            return;
+        previous.current = key;
+        if (typeof window === "undefined")
+            return;
+        window.scrollTo({ top: 0, left: 0, behavior: "auto" });
+    }, [key, enabled]);
+}

package/dist/schemas/registry.d.ts

@@ -4608,7 +4608,7 @@ export declare const SCHEMAS: {
             status: "open" | "closed" | "in_progress" | "waiting_on_user" | "resolved";
             id: string;
             description: string;
-            category: "general" | "account" | "order_issue" | "billing_payment" | "listing_dispute" | "scam_report" | "refund_request" | "auction_dispute" | "store_change_request" | "order_modification_request" | "unban_request";
+            category: "general" | "order_issue" | "billing_payment" | "account" | "listing_dispute" | "scam_report" | "refund_request" | "auction_dispute" | "store_change_request" | "order_modification_request" | "unban_request";
             createdAt: string | Date | import("zod").objectOutputType<{
                 toDate: import("zod").ZodFunction<import("zod").ZodTuple<[], import("zod").ZodUnknown>, import("zod").ZodDate>;
             }, import("zod").ZodTypeAny, "passthrough">;
@@ -4651,7 +4651,7 @@ export declare const SCHEMAS: {
             status: "open" | "closed" | "in_progress" | "waiting_on_user" | "resolved";
             id: string;
             description: string;
-            category: "general" | "account" | "order_issue" | "billing_payment" | "listing_dispute" | "scam_report" | "refund_request" | "auction_dispute" | "store_change_request" | "order_modification_request" | "unban_request";
+            category: "general" | "order_issue" | "billing_payment" | "account" | "listing_dispute" | "scam_report" | "refund_request" | "auction_dispute" | "store_change_request" | "order_modification_request" | "unban_request";
             createdAt: string | Date | import("zod").objectInputType<{
                 toDate: import("zod").ZodFunction<import("zod").ZodTuple<[], import("zod").ZodUnknown>, import("zod").ZodDate>;
             }, import("zod").ZodTypeAny, "passthrough">;

package/dist/seo/json-ld.js

@@ -13,7 +13,27 @@
  * ```
  */
 const SITE_URL = process.env.NEXT_PUBLIC_SITE_URL ?? "";
-const SITE_NAME = process.env.NEXT_PUBLIC_SITE_NAME ?? "App";
+/**
+ * The brand name, from the injected identity rather than an env var.
+ *
+ * 🛑 A FUNCTION, not a module `const`, and that matters twice over. This was
+ * `const SITE_NAME = process.env.NEXT_PUBLIC_SITE_NAME ?? "App"`, which:
+ *
+ *  - captured its value at IMPORT time, so even after `configureBrand()` runs
+ *    it would have kept whatever it read first; and
+ *  - read the env var this file's own comment at `SiteIdentityOptions` records
+ *    as having shipped `"Letitrip"` to production — the wrong casing, in the
+ *    `Organization.name` Google may put in a Knowledge Panel.
+ *
+ * That comment fixed the two site-wide nodes by taking `opts.siteName`. It did
+ * not fix `publisher` below, which has no opts path, so every article still
+ * emitted the env value. Resolving through `getBrandName()` closes both: there
+ * is now one owner (`appkit.config.js → brand`) and no mis-typeable env var in
+ * the path.
+ */
+function siteName() {
+    return getBrandName();
+}
 /**
  * schema.org requires ABSOLUTE URLs. A relative `image` or `item` is not a
  * lenient-parse case — Google rejects the property, and `image` is *required*
@@ -57,6 +77,7 @@ function absoluteUrl(value, base = SITE_URL) {
     return `${base.replace(/\/+$/, "")}/${v.replace(/^\/+/, "")}`;
 }
 import { ProductStatusValues } from "../features/products/schemas/index.js";
+import { getBrandName } from "../core/brand-resolver.js";
 import { getDefaultCurrency } from "../core/baseline-resolver.js";
 // The defining module, never the `/client` entry: this file is reached from
 // server-only metadata paths and must not pull in a `"use client"` module
@@ -252,12 +273,12 @@ export function blogPostJsonLd(post) {
         author: post.authorName
             ? { "@type": "Person", name: post.authorName, image: post.authorAvatar }
             : undefined,
-        publisher: { "@type": "Organization", name: SITE_NAME, url: SITE_URL },
+        publisher: { "@type": "Organization", name: siteName(), url: SITE_URL },
         mainEntityOfPage: { "@type": "WebPage", "@id": url },
     };
 }
 export function organizationJsonLd(opts) {
-    const name = opts?.siteName?.trim() || SITE_NAME;
+    const name = opts?.siteName?.trim() || siteName();
     const base = (opts?.siteUrl?.trim() || SITE_URL).replace(/\/+$/, "");
     // `sameAs: []` was hardcoded empty while appkit.config.js carried real
     // socialUrls that nothing read. An empty array is worse than omitting the key.
@@ -305,7 +326,7 @@ export function organizationJsonLd(opts) {
     };
 }
 export function searchBoxJsonLd(opts) {
-    const name = opts?.siteName?.trim() || SITE_NAME;
+    const name = opts?.siteName?.trim() || siteName();
     const base = (opts?.siteUrl?.trim() || SITE_URL).replace(/\/+$/, "");
     return {
         "@context": "https://schema.org",

package/dist/styles.css

@@ -7444,6 +7444,26 @@
   color: var(--appkit-tabs-ink-active);
 }
 
+/*
+ * Wrapping tab bar — `<TabsList wrap>`.
+ *
+ * 🛑 For CONTENT tabs inside a page section, never for navigation. The
+ * default list scrolls horizontally and collapses into a dropdown once it
+ * overflows, which is right for a nav bar on a phone and wrong in the middle
+ * of a homepage section: there it renders as a stray form control, and the
+ * visitor cannot see what the section contains without opening it.
+ *
+ * Wrapping keeps every tab visible on a second line. `overflow: visible` is
+ * required alongside `flex-wrap` — the base rule's `overflow-x: auto` would
+ * otherwise still clip the wrapped rows and reintroduce a scrollbar.
+ */
+.appkit-tabs-list--wrap {
+  flex-wrap: wrap;
+  overflow-x: visible;
+  overflow-y: visible;
+  scrollbar-width: auto;
+}
+
 /* Radio — toggle and classic radio group variants */
 
 .appkit-radio-group {

package/dist/ui/components/SiteLogo.d.ts

@@ -15,8 +15,26 @@ export interface SiteLogoProps {
      * dark-primary surfaces in light mode etc.
      */
     tone?: SiteLogoTone;
-    /** Accessible title; defaults to "LetItRip.in". */
+    /** Accessible title. Defaults to `wordmark` + `tld`, so one prop usually suffices. */
     title?: string;
+    /**
+     * The wordmark GLYPHS. Defaults to `title`.
+     *
+     * 🛑 Separate from `title` because they are different things and conflating
+     * them is what hid the brand here. `title` is the accessible name; this is
+     * the text actually drawn in the SVG — and until A5 that text was the literal
+     * `LetItRip`, unreachable by any prop. A consumer could rename the accessible
+     * title and still render someone else's brand.
+     */
+    wordmark?: string;
+    /**
+     * Optional TLD badge drawn in a pill after the wordmark, e.g. `"in"`.
+     *
+     * Omitted by default: a library must not assume its consumer has a TLD worth
+     * showing, let alone which one. `TitleBarLayout` threads `brandTld` through
+     * for the installs that want it.
+     */
+    tld?: string;
     /**
      * Optional admin-uploaded image URL. When present, renders an `<MediaImage>`
      * instead of the SVG wordmark (so the watermark proxy applies). Falls back
@@ -24,4 +42,4 @@ export interface SiteLogoProps {
      */
     src?: string;
 }
-export declare function SiteLogo({ size, tone, title, src, }: SiteLogoProps): import("react").JSX.Element;
+export declare function SiteLogo({ size, tone, title, wordmark, tld, src, }: SiteLogoProps): import("react").JSX.Element;