@mohasinac/appkit 4.69.1 → 4.71.0

package/dist/_internal/server/features/shipping/reimbursement.js

@@ -40,6 +40,7 @@ import { orderRepository } from "../../../../features/orders/repository/orders.r
 import { pointsRepository } from "../../../../features/points/repository/points.repository.js";
 import { reconcileShipping, isReimbursableShipment, } from "../../../shared/shipping/quote.js";
 import { serverLogger } from "../../../../monitoring/index.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 /**
  * The seller submits postage evidence on a self-shipped order.
  *
@@ -191,8 +192,8 @@ export async function approveShippingReimbursement(input) {
              * and this string is written once and never re-derived, so it stays true
              * of the moment it describes.
              */
-            description: `Shipping saving on ${input.orderId}: you paid ₹${chargedToBuyer} for postage, ` +
-                `the approved cost was ₹${spent}.`,
+            description: `Shipping saving on ${input.orderId}: you paid ${formatMoney(chargedToBuyer)} for postage, ` +
+                `the approved cost was ${formatMoney(spent)}.`,
         });
     }
     await orderRepository.update(input.orderId, {

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -27,7 +27,7 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  */
 export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "supportsShippingProtection", "supportsSaleProtection", "allowSharedPurchase", "sharedPurchaseHandlingFee", "sharedPurchaseExtraShippingPerDestination", "isVerified", "sellerTier", "standing", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["whatsappNotifySubscribed", "whatsappFeedEnabled", "trustedSeller", "acceptsPoints", "searchTxt", "whatsappNotifySubscribed", "updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "tierLockedByAdmin", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["whatsappNotifySubscribed", "whatsappFeedEnabled", "trustedSeller", "acceptsPoints", "searchTxt", "updatedAt", "adminNotes", "statusHistory", "statusHistoryTruncated", "tierLockedByAdmin", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -168,9 +168,19 @@ export const PRIVATE_STORE_FIELDS = [
      * what, which is commercial terms (same reason `customCommissionRate` is
      * below), and it has no reader on any public store surface.
      */
-    "whatsappNotifySubscribed",
+    /*
+     * 🛑 `whatsappNotifySubscribed` was listed TWICE in this array, and
+     * `whatsappConfig` was listed although `StoreDocument` says of it
+     * "🛑 whatsappConfig IS GONE AND MUST NOT COME BACK" — so this list named a
+     * field that does not exist and double-counted one that does.
+     *
+     * Both were invisible to `audit-public-projection-parity`, which checks that
+     * every SCHEMA field appears in exactly one list but not the reverse: it
+     * never asks whether a listed name is real, or listed once. An exemption
+     * list is a claim nobody checks unless something checks it (Root Cause
+     * #106) — the duplicate half is enforced now; see that audit's R5.
+     */
     "updatedAt", // bookkeeping; no public reader
-    "whatsappConfig", // Meta access token + WABA/catalog ids — secret
     "adminNotes", // schema comment: never shown to the owner or the public
     // Admin decisions with actor UIDs and suspension reasons. The store OWNER
     // sees this on their own admin surfaces; an anonymous visitor to /stores has

package/dist/_internal/server/jobs/core/dailyStatusDigest.js

@@ -14,7 +14,10 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
  * sync ceiling — it has the Function's much larger budget.
  */
 import { Fragment } from "react";
-import { renderToStaticMarkup } from "react-dom/server";
+// 🛑 Lazy require, not a top-level `react-dom/server` import — this module is
+// reachable from a Server Component via appkit/server, and Next's static tracer
+// fails the build on it. See render-static-markup.ts.
+import { renderStaticMarkup } from "../../../../features/email/render-static-markup.js";
 import { getAdminDb } from "../../../../providers/db-firebase/index.js";
 import { getProviders } from "../../../../contracts/registry.js";
 import { checkCourierWalletAndAlert } from "../../features/shipping/courier-block.js";
@@ -40,6 +43,7 @@ import { PAYMENT_CASES_COLLECTION, PAYMENT_CASE_ACTIVE_STATUSES, PAYMENT_CASE_FI
 import { GATEWAY_EVENTS_COLLECTION, GATEWAY_EVENT_FIELDS, } from "../../../../features/gateway-events/schemas/firestore.js";
 import { EmailBold, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailLink, EmailRow, } from "../../../../features/email/primitives.js";
 import { normalizeError } from "../../../../errors/normalize.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
 /*
  * `createdAt` and `isRead` on collections with no feature-specific field-name
@@ -62,7 +66,7 @@ const NON_REVENUE_STATUSES = new Set([
 /** How many contact messages the digest lists in full before summarising the rest. */
 const CONTACT_PREVIEW_LIMIT = 20;
 function currency(amount) {
-    return `₹${amount.toLocaleString("en-IN", { maximumFractionDigits: 2 })}`;
+    return formatMoney(amount);
 }
 /** One "Label: value" line. Uses only email primitives — email clients need
  *  inline-styled, table-based markup, which the Email* components provide. */
@@ -263,7 +267,7 @@ export async function collectDailyStatusSummary() {
 function renderDigestHtml(summary, siteName, version) {
     const statusRows = Object.entries(summary.statusBreakdown).sort(([a], [b]) => a.localeCompare(b));
     const title = siteName ? `${siteName} — Daily Status` : "Daily Status";
-    return `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: title, children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName }), _jsxs(EmailRow, { children: [version
+    return `<!DOCTYPE html>${renderStaticMarkup(_jsx(EmailDoc, { title: title, children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName }), _jsxs(EmailRow, { children: [version
                             ? `Deployment ${version} is live. Activity for the last 24 hours.`
                             : "Activity for the last 24 hours.", _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Orders placed", value: summary.orderCount }), _jsx(StatLine, { label: "Revenue (excl. cancelled/refunded)", value: currency(summary.revenue) }), _jsx(StatLine, { label: "Active listings", value: summary.activeListingCount }), _jsx(StatLine, { label: "Pending > 24h (needs attention)", value: summary.stuckPendingCount })] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Orders by status" }), _jsx("br", {}), _jsx("br", {}), statusRows.length === 0 ? ("No orders in this window.") : (statusRows.map(([status, count]) => (_jsx(StatLine, { label: status, value: count }, status))))] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Inbox" }), _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "New contact messages", value: summary.contactTotal }), _jsx(StatLine, { label: "New support tickets", value: summary.newTicketCount }), _jsx(StatLine, { label: "Tickets open / in progress / waiting on user", value: `${summary.ticketsOpen} / ${summary.ticketsInProgress} / ${summary.ticketsWaitingOnUser}` }), _jsx(StatLine, { label: "Unread admin notifications", value: summary.unreadAdminNotificationCount })] }), summary.contactMessages.length > 0 ? (_jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Contact messages" }), _jsx("br", {}), _jsx("br", {}), summary.contactMessages.map((m) => (_jsxs(Fragment, { children: [_jsx(EmailBold, { children: m.subject }), _jsx("br", {}), m.name, " \u2014", " ", _jsxs(EmailLink, { href: `mailto:${m.email}?subject=${encodeURIComponent(`Re: ${m.subject}`)}`, children: ["Reply to ", m.email] }), _jsx("br", {}), m.excerpt, _jsx("br", {}), _jsx("br", {})] }, m.id))), summary.contactTotal > summary.contactMessages.length
                             ? `…and ${summary.contactTotal - summary.contactMessages.length} more in /admin/contact.`

package/dist/_internal/server/jobs/core/emiInstallmentReminder.js

@@ -1,6 +1,7 @@
 import { normalizeError } from "../../../../errors/normalize.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { orderRepository } from "../../../../repositories/index.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 const REMINDER_WINDOW_MS = 3 * 86400000;
 function toDate(value) {
     return value instanceof Date ? value : new Date(value);
@@ -46,7 +47,7 @@ export async function runEmiInstallmentReminder(ctx) {
                     title: isOverdue ? "EMI installment overdue" : "EMI installment due soon",
                     message: isOverdue
                         ? `Installment ${inst.index} for order ${id} is overdue. Pay now to avoid delaying your shipment.`
-                        : `Installment ${inst.index} for order ${id} (₹${inst.amount.toFixed(2)}) is due on ${dueDate.toDateString()}.`,
+                        : `Installment ${inst.index} for order ${id} (${formatMoney(inst.amount)}) is due on ${dueDate.toDateString()}.`,
                     relatedId: id,
                     relatedType: "order",
                     actionUrl: `/user/orders/view/${id}`,

package/dist/_internal/server/jobs/core/obligationSweep.js

@@ -34,6 +34,7 @@ import { awardPurchasePoints } from "../../features/points/award.js";
 import { processRefundAction } from "../../features/refunds/actions.js";
 import { resolveRefundCapacity } from "../../features/refunds/capacity.js";
 import { MONEY_EPSILON } from "../../../shared/checkout/refundable-base.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 /**
  * Perform the policy's action.
  *
@@ -304,14 +305,14 @@ async function performAction(ctx, obligation, order) {
                     kind: "manual_refund_due",
                     subjectId: order.id,
                     severity: "error",
-                    title: `Uninspected return — automatic refund of ₹${capacity.remaining.toFixed(2)} FAILED on ${order.id}`,
+                    title: `Uninspected return — automatic refund of ${formatMoney(capacity.remaining)} FAILED on ${order.id}`,
                     detail: [
                         "A received return was never inspected, so it auto-resolved in the buyer's favour — and the refund itself failed.",
                         "",
                         `Gateway error: ${result.error ?? "unknown"}`,
                         "",
                         `Order: ${order.id}`,
-                        `Owed: ₹${capacity.remaining.toFixed(2)}`,
+                        `Owed: ${formatMoney(capacity.remaining)}`,
                         "",
                         "Retrying from the admin order page is idempotent on this order.",
                     ].join("\n"),
@@ -332,7 +333,7 @@ async function performAction(ctx, obligation, order) {
                 kind: "refund_mismatch",
                 subjectId: `seller-charge:${order.id}`,
                 severity: "warning",
-                title: `Decide whether the seller bears ₹${capacity.remaining.toFixed(2)} — uninspected return on ${order.id}`,
+                title: `Decide whether the seller bears ${formatMoney(capacity.remaining)} — uninspected return on ${order.id}`,
                 detail: [
                     "A returned parcel reached the seller and was never inspected, so the buyer has been refunded automatically — the cover is unconditional and the seller had the goods and the full window.",
                     "",
@@ -340,7 +341,7 @@ async function performAction(ctx, obligation, order) {
                     "",
                     `Order: ${order.id}`,
                     `Store: ${order.storeId ?? "—"}`,
-                    `Refunded to the buyer: ₹${capacity.remaining.toFixed(2)}`,
+                    `Refunded to the buyer: ${formatMoney(capacity.remaining)}`,
                     `Return received: ${order.returnReceivedAt?.toISOString() ?? "—"}`,
                     `Buyer's stated reason: ${order.returnReasonCode ?? "—"}`,
                     "",

package/dist/_internal/server/jobs/core/onScamReportCreate.js

@@ -3,6 +3,7 @@ import { adminNotificationsRepository } from "../../../../features/store-extensi
 import { userRepository } from "../../../../features/auth/repository/user.repository.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { SCAM_TYPE_LABELS } from "../../../../features/scams/constants/scam-types.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 export async function handleScamReportCreate(input, ctx) {
     const { scammerId, report } = input;
     const { reportedBy, displayNames, scamType, scamPlatform, amountLost } = report;
@@ -59,7 +60,7 @@ export async function handleScamReportCreate(input, ctx) {
      */
     try {
         const scamTypeLabel = scamType ? (SCAM_TYPE_LABELS[scamType] ?? scamType) : "Unknown";
-        const amountStr = amountLost ? ` ₹${amountLost.toLocaleString("en-IN")}` : "";
+        const amountStr = amountLost ? ` ${formatMoney(amountLost)}` : "";
         const platformStr = scamPlatform ? ` via ${scamPlatform}` : "";
         await adminNotificationsRepository.create({
             category: "fraud",

package/dist/_internal/server/jobs/core/paymentReconcile.js

@@ -40,6 +40,7 @@ import { REFUND_CLAIMS_COLLECTION, REFUND_CLAIM_FIELDS, ORDER_COLLECTION, } from
 import { ORDER_FIELDS } from "../../../../constants/field-names.js";
 import { reconcileDisputes } from "../../features/payment-cases/disputes.js";
 import { refundableBase, committedRefundTotal, MONEY_EPSILON, } from "../../../shared/checkout/refundable-base.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 /** How far back R2 looks. Two days of overlap, so a run that fails is covered by the next. */
 const PAYMENT_WINDOW_HOURS = 48;
 /** A refund claim unsettled for longer than this is a crash between call and record. */
@@ -478,7 +479,7 @@ async function reconcileUnpaidCancellations(ctx) {
                 kind: "manual_refund_due",
                 subjectId: doc.id,
                 severity: "error",
-                title: `Cancelled order still owes ₹${shortfall.toFixed(2)} — ${doc.id}`,
+                title: `Cancelled order still owes ${formatMoney(shortfall)} — ${doc.id}`,
                 detail: [
                     "This order is cancelled and records a refund it has not paid.",
                     "",
@@ -488,9 +489,9 @@ async function reconcileUnpaidCancellations(ctx) {
                     "cover.",
                     "",
                     `Order: ${doc.id}`,
-                    `Recorded as owed: ₹${intended.toFixed(2)}`,
-                    `Actually refunded: ₹${committed.toFixed(2)}`,
-                    `Shortfall: ₹${shortfall.toFixed(2)}`,
+                    `Recorded as owed: ${formatMoney(intended)}`,
+                    `Actually refunded: ${formatMoney(committed)}`,
+                    `Shortfall: ${formatMoney(shortfall)}`,
                     data.paymentMethod ? `Payment method: ${data.paymentMethod}` : null,
                     data.paymentId ? `Gateway reference: ${data.paymentId}` : null,
                     data.userId ? `Buyer: ${data.userId}` : null,

package/dist/_internal/shared/checkout/rules/auction.rule.js

@@ -5,14 +5,32 @@ export const auctionRule = {
     cartEligible: false, // bid-only; add-to-cart is blocked at the action layer
     cartIneligibleHint: "Place a bid on the auction page instead.",
     /*
-     * 🛑 cod + cash, NOT emi. An auction win is a committed sale of a unique lot:
-     * a buyer who never pays on delivery costs the seller the item and the
-     * auction both, and there is no second-highest bidder to fall back to once
-     * it has been marked sold. EMI is confirmed-at-order financing rather than a
-     * deferred payment, so it carries none of that risk and stays available.
+     * 🛑 THE GATEWAY IS PROHIBITED HERE, and this list was INVERTED until
+     * 2026-10-28 — it blocked `cod` and `cash` while leaving `online` open, so
+     * every auction win was payable by card.
+     *
+     * The reason is the acquirer's, not ours. Auction and bidding businesses sit
+     * on the prohibited-merchant lists Indian PGs inherit from the card networks,
+     * alongside lotteries and games of chance. Settling auction wins through a
+     * standard e-commerce MID is a terms breach, and the penalty is not a
+     * declined transaction — it is the whole merchant account frozen with the
+     * settlement balance held. One category of order can cost every other
+     * category its ability to take money at all.
+     *
+     * So: manual bank/UPI transfer, or cash on pickup. Both land in the owner's
+     * own account with no acquirer in the path.
+     *
+     * 🛑 `cash` is now ALLOWED, reversing the rule below it. The old comment is
+     * kept because its reasoning is still sound — a pay-later method on a unique
+     * lot has no second-highest bidder to fall back on — but it was weighing
+     * seller risk against buyer convenience, and that trade is not what decides
+     * this. The storefront is single-vendor and the owner is the seller: they
+     * accept the non-payment risk on their own lots, and they do not get to
+     * accept the risk of losing the merchant account. `emi` goes for the same
+     * reason as `online` — it settles through the same acquirer.
      */
-    blockedPaymentMethods: ["cod", "cash"],
-    blockedPaymentMessage: "An auction win cannot be paid for on delivery or in cash — the lot is one of a kind and is held for you from the moment the auction closes.",
+    blockedPaymentMethods: ["online", "cod", "emi"],
+    blockedPaymentMessage: "An auction win is settled by direct bank/UPI transfer or cash on pickup — card and online payment are not available for auctions.",
     canMergeWithSameProduct: false,
     refundPolicy: { full: true, partial: false, partialGranularity: "none" },
     splitKey: (item) => `auction:${item.itemId}`,

package/dist/_internal/shared/checkout/rules/prize-draw.rule.js

@@ -2,14 +2,32 @@ import { ValidationError } from "../../../../errors/index.js";
 import { DEFAULT_LISTING_RULE } from "./_defaults.js";
 import { PRIZE_DRAW_MAX_REVEALS_PER_ORDER } from "./_limits.js";
 /**
- * Deferred/unconfirmed-payment methods are not allowed for prize-draw
- * checkout — instant-mode winner assignment triggers on the order's payment
- * actually being confirmed, which cod/cash/emi don't guarantee happens (or
- * happens promptly). Only "upi_manual" (bank/UPI transfer, confirmed later by
- * seller/admin) and "online" (PhonePe, confirms near-instantly) are allowed;
- * "admin_bypass" stays usable for QA regardless.
+ * 🛑 THE GATEWAY IS PROHIBITED HERE — `online` joined this list 2026-10-28,
+ * and `cash` left it.
+ *
+ * A prize draw is a game of chance, which is on the prohibited-merchant lists
+ * Indian payment gateways inherit from the card networks — the same lists that
+ * carry lotteries and auctions. Routing entry payments through a standard
+ * e-commerce MID is a terms breach, and the penalty is the merchant account
+ * frozen with the settlement balance held, not a declined charge. One category
+ * can cost every other category its ability to take money.
+ *
+ * 🛑 This REPLACES the original reasoning rather than extending it, and the
+ * original is worth keeping in view because it is still true and no longer
+ * decisive: deferred methods were blocked because instant-mode winner
+ * assignment triggers on confirmed payment, which `cod`/`cash`/`emi` do not
+ * guarantee happens promptly. By that logic `online` was the SAFEST method
+ * available and `cash` the worst.
+ *
+ * The acquirer's rules invert it. `online` and `emi` both settle through the
+ * gateway and are out; `cash` is in, because the owner is the seller and
+ * confirms the payment themselves before the draw. The timing concern becomes
+ * an operational one — do not run the draw until payment is confirmed — which
+ * `upi_manual` already required and the reveal flow already handles.
+ *
+ * `admin_bypass` stays usable for QA regardless.
  */
-const PRIZE_DRAW_BLOCKED_PAYMENT_METHODS = ["cod", "cash", "emi"];
+const PRIZE_DRAW_BLOCKED_PAYMENT_METHODS = ["online", "cod", "emi"];
 /**
  * The refusal, kept VERBATIM when this check moved out of `preflightChecks`
  * into `assertPaymentMethodAllowed`.
@@ -20,7 +38,7 @@ const PRIZE_DRAW_BLOCKED_PAYMENT_METHODS = ["cod", "cash", "emi"];
  * reason is the thing a buyer needs in order to pick a different method rather
  * than abandon the entry.
  */
-const PRIZE_DRAW_BLOCKED_PAYMENT_MESSAGE = "Prize-draw entries can only be paid by manual bank/UPI transfer or PhonePe — cash on delivery and EMI are not available for this listing type.";
+const PRIZE_DRAW_BLOCKED_PAYMENT_MESSAGE = "Prize-draw entries are paid by direct bank/UPI transfer or cash on pickup — card and online payment are not available for prize draws.";
 export const prizeDrawRule = {
     ...DEFAULT_LISTING_RULE,
     orderType: "prize-draw",

package/dist/_internal/shared/config/schema.d.ts

@@ -95,6 +95,21 @@ export interface AppkitBrandConfig {
      * {name}") and this one stands alone, so they are spelled differently.
      */
     heroCaption?: string;
+    /**
+     * TLD badge drawn in a pill after the SVG wordmark, e.g. `"in"`. Absent
+     * renders no badge.
+     *
+     * 🛑 Optional, and appkit renders nothing without it — a library must not
+     * assume its consumer has a TLD worth showing, let alone which one. The
+     * badge used to be a hardcoded `.in` inside `SiteLogo`, where no prop could
+     * reach it (A5).
+     *
+     * 🛑 NOT a source for the site's domain. `brand.name + "." + tld` happens to
+     * give `letitrip.in` here, which is what makes it a trap: any multi-word
+     * brand yields `my shop.com`. The host has one owner, `seo.siteUrl`
+     * (Root Cause #81), and `BRAND.DOMAIN` derives from that.
+     */
+    tld?: string;
     /** One-line brand description used in meta tags and footers */
     description?: string;
     /** Tagline shown in footer / about sections */

package/dist/_internal/shared/content/published-values.d.ts

@@ -44,7 +44,7 @@
  * sentence with a word missing, which nobody reports, while `{{wrongKey}}` on
  * a live page gets reported in minutes.
  */
-export type PublishedValueKey = "returnWindowDays" | "sellerAcceptDays" | "sellerDispatchBusinessDays" | "returnRespondHours" | "returnPostDays" | "offerCheckoutHours" | "paymentWindowMinutes" | "deliveryConfirmDays" | "orderCompleteDays" | "shipmentClaimHours" | "saleClaimHours" | "disputeTransitWindowDays" | "disputeNotReachedGraceDays" | "platformFeeMax" | "platformFeePercent" | "shipmentProtectionPercent" | "shipmentProtectionMin" | "saleProtectionPercent" | "saleProtectionMin" | "saleProtectionMaxValue" | "codHandlingPercent" | "codDepositPercent" | "giftWrapFee" | "pointsEarnPercent" | "pointsMaxRedemptionPercent" | "pointsExpiryMonths" | "refundBusinessDaysMin" | "refundBusinessDaysMax" | "siteName";
+export type PublishedValueKey = "returnWindowDays" | "sellerAcceptDays" | "sellerDispatchBusinessDays" | "returnRespondHours" | "returnPostDays" | "offerCheckoutHours" | "paymentWindowMinutes" | "deliveryConfirmDays" | "orderCompleteDays" | "shipmentClaimHours" | "saleClaimHours" | "disputeTransitWindowDays" | "disputeNotReachedGraceDays" | "platformFeeMax" | "platformFeePercent" | "shipmentProtectionPercent" | "shipmentProtectionMin" | "saleProtectionPercent" | "saleProtectionMin" | "saleProtectionMaxValue" | "codHandlingPercent" | "codDepositPercent" | "giftWrapFee" | "pointsEarnPercent" | "pointsMaxRedemptionPercent" | "pointsExpiryMonths" | "refundBusinessDaysMin" | "refundBusinessDaysMax" | "siteName" | "siteDomain";
 export type PublishedValues = Record<PublishedValueKey, string>;
 /**
  * The settings this registry reads, where a value genuinely is configurable.
@@ -58,7 +58,7 @@ export type PublishedValues = Record<PublishedValueKey, string>;
 export interface PublishedValueSettings {
     /**
      * The operator's display name, for the disclaimers that name who is making
-     * the statement. Falls back to `SITE_CONFIG.brand.name`.
+     * the statement. Falls back to the injected brand (`getBrandName()`).
      */
     siteName?: string;
     platformFeeMax?: number;

package/dist/_internal/shared/content/published-values.js

@@ -40,13 +40,14 @@
  * somebody has to remember — and it is why there is no literal for the offer
  * deadline or the claim windows even though both appear in published copy.
  */
-import { SITE_CONFIG } from "../../../core/site-config.js";
+import { getBrandName, getBrandDomain } from "../../../core/brand-resolver.js";
 import { OBLIGATION_POLICIES } from "../../../features/obligations/constants/policies.js";
 import { POINTS_EARN_PERCENT, POINTS_EXPIRY_MONTHS, POINTS_MAX_REDEMPTION_PERCENT, } from "../../../features/points/schemas/firestore.js";
 import { PAYMENT_WINDOW_MINUTES } from "../../../features/orders/constants/payment-window.js";
 import { SALE_PROTECTION_MAX_VALUE } from "../features/shipping/protections.js";
 import { LANE_CHECKOUT_WINDOW_MS } from "../checkout/lanes.js";
 import { DISPUTE_TRANSIT_WINDOW_DAYS, DISPUTE_NOT_REACHED_GRACE_DAYS, } from "../features/orders/dispute-reasons.js";
+import { formatMoney } from "../../../utils/number.formatter.js";
 /**
  * The offer checkout deadline, in hours, derived from the constant the lapse
  * sweep actually enforces.
@@ -173,12 +174,23 @@ export function resolvePublishedValues(settings) {
         refundBusinessDaysMin: "5",
         refundBusinessDaysMax: "7",
         /*
-         * `SITE_CONFIG.brand.name` is appkit's own neutral default ("App") until a
-         * consumer overrides it, which is exactly the right failure mode here: a
-         * fork that forgets to configure its brand publishes a visibly generic
-         * disclaimer rather than silently attributing its legal statements to us.
+         * Admin setting first, then the brand the consumer INJECTED at boot.
+         *
+         * 🛑 Was `SITE_CONFIG.brand.name`, and the reasoning given for that was
+         * right about the failure mode — "a fork that forgets to configure its
+         * brand publishes a visibly generic disclaimer rather than silently
+         * attributing its legal statements to us" — but wrong about the mechanism:
+         * `SITE_CONFIG` is a FROZEN const, and the only thing that can override it
+         * (`createSiteConfig`) has **zero callers**. So the override it described
+         * did not exist, and a consumer with a configured brand still published
+         * "App" in its own legal text whenever `siteSettings.siteName` was unset.
+         *
+         * `getBrandName()` keeps the same safe default ("Site") and adds the
+         * injection path that was missing.
          */
-        siteName: settings?.siteName ?? SITE_CONFIG.brand.name,
+        siteName: settings?.siteName ?? getBrandName(),
+        /** Bare host, for addresses quoted in published copy. */
+        siteDomain: getBrandDomain(),
     };
 }
 /**
@@ -196,11 +208,18 @@ export function resolvePublishedCopy(text, values) {
         return resolved ?? whole;
     });
 }
-/** `₹10`, `₹1,499.50` — no trailing `.00` on a whole rupee figure. */
+/**
+ * `₹10`, `₹1,499.50` — no trailing `.00` on a whole figure.
+ *
+ * 🛑 A `const whole = Number.isInteger(amount)` sat here unused after the A2
+ * conversion, and an unused local is worth opening rather than deleting: in
+ * this codebase a discarded value has three times turned out to be a dropped
+ * one (a lost delivery snapshot, two blank seller tiles, a full page reload).
+ *
+ * Checked — this one is genuinely dead. `formatMoney` runs exactly that test
+ * internally (`Number.isInteger(amount) ? 0 : 2`), which is what this function
+ * used to do by hand before delegating. Nothing is lost by removing it.
+ */
 function formatRupees(amount) {
-    const whole = Number.isInteger(amount);
-    return `₹${amount.toLocaleString("en-IN", {
-        minimumFractionDigits: whole ? 0 : 2,
-        maximumFractionDigits: 2,
-    })}`;
+    return formatMoney(amount);
 }

package/dist/_internal/shared/features/auctions/errors.js

@@ -1,4 +1,5 @@
 import { NotFoundError, ValidationError, ConflictError, ExpiredError } from "../../errors/index.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 export class AuctionNotFoundError extends NotFoundError {
     constructor(id) {
         super("Auction", id);
@@ -13,7 +14,7 @@ export class AuctionEndedError extends ExpiredError {
 }
 export class BidTooLowError extends ValidationError {
     constructor(minBid) {
-        super(`Bid must be at least ₹${minBid.toLocaleString("en-IN")}`, "amount");
+        super(`Bid must be at least ${formatMoney(minBid)}`, "amount");
         this.name = "BidTooLowError";
     }
 }

package/dist/_internal/shared/features/orders/refund-copy.js

@@ -1,3 +1,4 @@
+import { formatMoney } from "../../../../utils/number.formatter.js";
 /**
  * REFUND_COPY — all user-visible strings for refund + order-sibling UI.
  *
@@ -79,10 +80,10 @@ export const REFUND_COPY = {
     cancellation: {
         message: (outcome) => {
             if (outcome.moved === "gateway") {
-                return `Order cancelled. A refund of ₹${outcome.amount.toFixed(2)} has been sent back to your original payment method.`;
+                return `Order cancelled. A refund of ${formatMoney(outcome.amount)} has been sent back to your original payment method.`;
             }
             if (outcome.moved === "owed") {
-                return `Order cancelled. We owe you ₹${outcome.amount.toFixed(2)} — it needs to be sent manually, and our team has been notified.`;
+                return `Order cancelled. We owe you ${formatMoney(outcome.amount)} — it needs to be sent manually, and our team has been notified.`;
             }
             /*
              * `none` splits two very different situations and must not blur them: an

package/dist/_internal/shared/features/promotions/errors.js

@@ -1,4 +1,5 @@
 import { NotFoundError, ConflictError, ValidationError, ExpiredError } from "../../errors/index.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 export class CouponNotFoundError extends NotFoundError {
     constructor(code) {
         super("Coupon", code);
@@ -25,7 +26,7 @@ export class CouponPerUserLimitError extends ConflictError {
 }
 export class CouponMinPurchaseError extends ValidationError {
     constructor(minAmount) {
-        super(`Minimum purchase of ₹${minAmount.toLocaleString("en-IN")} required for this coupon`, "total");
+        super(`Minimum purchase of ${formatMoney(minAmount)} required for this coupon`, "total");
         this.name = "CouponMinPurchaseError";
     }
 }

package/dist/constants/field-names.d.ts

@@ -1058,5 +1058,28 @@ export declare const SCHEMA_DEFAULTS: {
     readonly UNKNOWN_USER: "Unknown User";
     readonly ANONYMOUS_USER: "Anonymous";
     readonly DEFAULT_DISPLAY_NAME: "User";
+    /**
+     * 🛑 NOT A DEFAULT — THIS CONSTANT GRANTS THE ADMIN ROLE, and it is the one
+     * brand literal in appkit that was DELIBERATELY left in place by A5d.
+     *
+     * Three consumer auth routes read it as an authorisation decision:
+     *   `email === SCHEMA_DEFAULTS.ADMIN_EMAIL ? "admin" : "user"`
+     * in `api/auth/register`, `api/auth/session` and `api/auth/google/callback`.
+     * So whoever controls this address is auto-promoted to admin at signup or at
+     * first session — in EVERY install of appkit, because the address is baked
+     * into the library rather than configured by the consumer.
+     *
+     * It was not changed with the other 131 brand literals because changing it
+     * changes who becomes an administrator. CLAUDE.md Rule #1 puts "security
+     * boundaries: auth, RBAC" on the escalate-before-acting list, and rewiring an
+     * admin-promotion check as a drive-by inside a branding sweep is exactly the
+     * shape that rule forbids — a wrong move here either locks the owner out or
+     * hands the role to someone else.
+     *
+     * The fix needs an owner decision, and the options differ in blast radius:
+     * move it to `appkit.config.js` and inject it like the brand; replace
+     * email-matching with an explicit role grant; or drop auto-promotion and seed
+     * the first admin. Tracked, not silently chosen.
+     */
     readonly ADMIN_EMAIL: "admin@letitrip.in";
 };

package/dist/constants/field-names.js

@@ -1285,5 +1285,28 @@ export const SCHEMA_DEFAULTS = {
     UNKNOWN_USER: "Unknown User",
     ANONYMOUS_USER: "Anonymous",
     DEFAULT_DISPLAY_NAME: "User",
+    /**
+     * 🛑 NOT A DEFAULT — THIS CONSTANT GRANTS THE ADMIN ROLE, and it is the one
+     * brand literal in appkit that was DELIBERATELY left in place by A5d.
+     *
+     * Three consumer auth routes read it as an authorisation decision:
+     *   `email === SCHEMA_DEFAULTS.ADMIN_EMAIL ? "admin" : "user"`
+     * in `api/auth/register`, `api/auth/session` and `api/auth/google/callback`.
+     * So whoever controls this address is auto-promoted to admin at signup or at
+     * first session — in EVERY install of appkit, because the address is baked
+     * into the library rather than configured by the consumer.
+     *
+     * It was not changed with the other 131 brand literals because changing it
+     * changes who becomes an administrator. CLAUDE.md Rule #1 puts "security
+     * boundaries: auth, RBAC" on the escalate-before-acting list, and rewiring an
+     * admin-promotion check as a drive-by inside a branding sweep is exactly the
+     * shape that rule forbids — a wrong move here either locks the owner out or
+     * hands the role to someone else.
+     *
+     * The fix needs an owner decision, and the options differ in blast radius:
+     * move it to `appkit.config.js` and inject it like the brand; replace
+     * email-matching with an explicit role grant; or drop auto-promotion and seed
+     * the first admin. Tracked, not silently chosen.
+     */
     ADMIN_EMAIL: "admin@letitrip.in",
 };

package/dist/constants/storage-keys.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Browser-storage and postMessage keys — one namespace, configurable.
+ *
+ * ## Why this exists
+ *
+ * Seven call sites hardcoded a `letitrip`-prefixed key:
+ *
+ *   localStorage  "letitrip:section-state" · "letitrip:last-category"
+ *                 "letitrip:announcement-dismissed" · "letitrip_oauth_redirect"
+ *                 "letitrip_search_type"
+ *   postMessage   "letitrip_auth_close"
+ *
+ * For the app that shipped them that is harmless. For a LIBRARY it is not:
+ * every consumer inherits one marketplace's namespace, two appkit apps on the
+ * same origin collide, and the brand is baked into data the user's browser
+ * keeps. Tier AK's whole premise is that appkit should not know whose app it
+ * is in.
+ *
+ * ## 🛑 The prefix is read at CALL TIME, not at module load
+ *
+ * `storageKey()` is a function and the keys below are getters. A consumer sets
+ * the namespace from its own bootstrap, which runs after this module is
+ * evaluated — so a `const KEY = PREFIX + ":x"` captured at import time would
+ * freeze the default and silently ignore the configuration. That is the same
+ * trap as a mirror field (Root Cause #42): two things that must agree, where
+ * only one is ever written.
+ *
+ * ## 🛑 Changing the namespace ORPHANS existing values
+ *
+ * These keys are how a returning visitor's dismissed banner and collapsed
+ * sections are remembered. Renaming the prefix does not migrate them — the old
+ * entries simply stop being read. That is acceptable for UI state and would NOT
+ * be for anything load-bearing, which is why nothing load-bearing belongs here:
+ * the auth session is an HTTP-only cookie, not a storage key.
+ *
+ * ## The separator is deliberately NOT normalised
+ *
+ * Five keys use `:` and three use `_`. They are kept exactly as they were,
+ * because normalising them is a silent data migration for every existing
+ * visitor in exchange for tidiness. New keys should use `:`.
+ */
+/**
+ * Set the prefix every appkit storage key carries. Call once, from the
+ * consumer's client bootstrap, before any UI mounts.
+ *
+ * Idempotent and last-call-wins; there is no unset, because a namespace that
+ * changes mid-session would strand whatever was written under the previous one.
+ */
+export declare function setStorageNamespace(value: string): void;
+/** The active namespace. Exported for diagnostics, not for building keys. */
+export declare function getStorageNamespace(): string;
+/**
+ * Build a namespaced key.
+ *
+ * @param suffix the part after the separator, e.g. `"last-category"`
+ * @param separator `":"` for new keys; `"_"` only where an existing key used it
+ */
+export declare function storageKey(suffix: string, separator?: ":" | "_"): string;
+/**
+ * The keys appkit itself owns.
+ *
+ * Getters, not constants — see the call-time note above. Each records the
+ * literal it replaced so the migration is auditable and a reader can tell at a
+ * glance which separator is historical rather than chosen.
+ */
+export declare const STORAGE_KEYS: {
+    /** Collapsed account-page sections. Was `"letitrip:section-state"`. */
+    readonly sectionState: string;
+    /** Last category visited, for the contextual trail. Was `"letitrip:last-category"`. */
+    readonly lastCategory: string;
+    /** Announcement bar dismissal. Was `"letitrip:announcement-dismissed"`. */
+    readonly announcementDismissed: string;
+    /** OAuth return URL across the popup round-trip. Was `"letitrip_oauth_redirect"`. */
+    readonly oauthRedirect: string;
+    /** Remembered search-type tab. Was `"letitrip_search_type"`. */
+    readonly searchType: string;
+};
+/**
+ * postMessage `type` values.
+ *
+ * 🛑 Namespaced for the same reason, and with a sharper edge: a `message`
+ * listener receives events from ANY window that can reach it, so an
+ * unnamespaced type is both a collision and an input-validation question. The
+ * listeners that read this must keep checking `event.origin` regardless — a
+ * namespace is not an authentication mechanism.
+ */
+export declare const MESSAGE_TYPES: {
+    /** Auth popup signalling it is done. Was `"letitrip_auth_close"`. */
+    readonly authClose: string;
+};