@mohasinac/appkit 4.70.0 → 4.71.2

package/dist/features/seller/actions/offer-actions.js

@@ -5,6 +5,9 @@
  * Auth, rate-limiting, and input validation are handled by the calling server action.
  */
 import { serverLogger } from "../../../monitoring/index.js";
+// Money in prose reads from the configured market profile — symbol, grouping
+// and locale. These strings used `₹${n}`, which also rendered ungrouped.
+import { formatMoney } from "../../../utils/number.formatter.js";
 import { offerRepository } from "../repository/offer.repository.js";
 import { productRepository } from "../../products/repository/products.repository.js";
 import { categoriesRepository } from "../../categories/repository/categories.repository.js";
@@ -83,9 +86,9 @@ export async function makeOffer(userId, userEmail, input) {
         throw new ValidationError("You can't make an offer on your own listing — edit its price instead.");
     }
     const listingType = normalizeListingType(product);
-    // Some listing types cannot be negotiated at all — an auction already has
-    // bidding, a prize-draw sells fixed-price entries. This was never checked, so
-    // an offer could be (and in seed data was) attached to an auction, producing
+    // Some listing types cannot be negotiated at all — a collector drop already has
+    // bidding, clearance sells fixed-price entries. This was never checked, so
+    // an offer could be (and in seed data was) attached to a collector drop, producing
     // a cart line that claims `listingType: "standard"` in the offer lane.
     if (!canMakeOffer(listingType)) {
         throw new ValidationError("Offers aren't available for this kind of listing.");
@@ -103,18 +106,18 @@ export async function makeOffer(userId, userEmail, input) {
         // asking price is the only legal amount. Naming that plainly beats a
         // "minimum offer is ₹X" message where X happens to equal the price.
         if (offerAmount !== bounds.max)
-            throw new ValidationError(`This seller is not taking lower offers — send a request to buy at ₹${bounds.max}.`);
+            throw new ValidationError(`This seller is not taking lower offers — send a request to buy at ${formatMoney(bounds.max)}.`);
     }
     else {
         if (offerAmount < bounds.min)
-            throw new ValidationError(`Minimum offer is ₹${bounds.min} (${product.minOfferPercent ?? DEFAULT_MIN_OFFER_PERCENT}% of listing price).`);
+            throw new ValidationError(`Minimum offer is ${formatMoney(bounds.min)} (${product.minOfferPercent ?? DEFAULT_MIN_OFFER_PERCENT}% of listing price).`);
         if (offerAmount > bounds.max)
             throw new ValidationError(
             // Deliberately NOT "use Add to Cart instead" unconditionally: on a
             // listing whose only purchase path is an offer there is no cart button,
             // so that advice named a control the page does not have.
             offerIsOnlyPurchasePath(listingType)
-                ? `Your offer cannot exceed the asking price of ₹${product.price}.`
+                ? `Your offer cannot exceed the asking price of ${formatMoney(product.price)}.`
                 : "Your offer must be below the listed price. Use Add to Cart instead.");
     }
     const offerCount = await offerRepository.countByBuyerAndProduct(userId, productId, product.updatedAt);
@@ -159,7 +162,7 @@ export async function makeOffer(userId, userEmail, input) {
             type: "offer_received",
             priority: "normal",
             title: "New offer received",
-            message: `${buyerDisplayName === "Buyer" ? "A buyer" : buyerDisplayName} offered ₹${offerAmount} on "${product.title}"`,
+            message: `${buyerDisplayName === "Buyer" ? "A buyer" : buyerDisplayName} offered ${formatMoney(offerAmount)} on "${product.title}"`,
             relatedId: offer.id,
             relatedType: "offer",
         });
@@ -186,6 +189,12 @@ export async function respondToOffer(userId, input) {
     if (new Date() > offer.expiresAt)
         throw new ValidationError(ERROR_MESSAGES.OFFER.EXPIRED);
     let updated;
+    /**
+     * The buyer-facing sentence for a COUNTER, assembled in the branch that owns
+     * the amount. `""` is unreachable — the ternary below only selects it when
+     * `action === "counter"`, which is exactly the branch that assigns it.
+     */
+    let counterMessage = "";
     if (action === "accept") {
         /*
          * ── S5a: a coordinated offer must be SHIPPABLE before it is binding ──
@@ -253,12 +262,28 @@ export async function respondToOffer(userId, input) {
         if (counterAmount === offer.offerAmount)
             throw new ValidationError("Counter amount must differ from the buyer's offer. Accept it instead.");
         updated = await offerRepository.counter(offerId, counterAmount, sellerNote);
+        /*
+         * 🛑 Built HERE, where the guards above have proven `counterAmount` is a
+         * number, rather than in the ternary below.
+         *
+         * That ternary used to read `₹${counterAmount}` against the
+         * possibly-undefined parameter — so a counter reaching it without an amount
+         * told the buyer the seller "countered with ₹undefined". `tsc` only
+         * surfaced it once the literal became `formatMoney(...)`, which is the
+         * argument for the conversion beyond consistency.
+         *
+         * Neither `!` nor `?? 0` is the fix: the first re-asserts what narrowing
+         * already knows and the second would quote a real-looking "₹0" to a buyer.
+         * Assigning the finished sentence in the branch that owns the value makes
+         * the absent case unrepresentable instead.
+         */
+        counterMessage = `${offer.storeName} countered with ${formatMoney(counterAmount)} on "${offer.productTitle}".`;
     }
     const notifMessage = action === "accept"
-        ? `Your offer of ₹${offer.offerAmount} on "${offer.productTitle}" was accepted! Complete checkout now.`
+        ? `Your offer of ${formatMoney(offer.offerAmount)} on "${offer.productTitle}" was accepted! Complete checkout now.`
         : action === "decline"
             ? `Your offer on "${offer.productTitle}" was declined.`
-            : `${offer.storeName} countered with ₹${counterAmount} on "${offer.productTitle}".`;
+            : counterMessage;
     await sendNotification({
         userId: offer.buyerUid,
         type: "offer_responded",
@@ -288,6 +313,19 @@ export async function acceptCounterOffer(userId, offerId) {
         throw new AuthorizationError(ERR_NOT_AUTHORISED);
     if (offer.status !== OfferStatusValues.COUNTERED)
         throw new ValidationError("No counter to accept.");
+    /*
+     * 🛑 A COUNTERED offer with no amount is a data-integrity violation, not a
+     * case to paper over. The seller notification below quotes this figure, and
+     * it previously interpolated the optional field directly — so such a row
+     * would have told the seller the buyer "accepted your counter of ₹undefined",
+     * and accepting it would have locked a cart line at a price nobody set.
+     *
+     * Refusing is the only honest answer: `counterAmount` is what the buyer is
+     * agreeing to, so if it is missing there is nothing to agree to. Narrowing it
+     * here is a side effect of saying so, not the reason.
+     */
+    if (typeof offer.counterAmount !== "number")
+        throw new ValidationError("This counter has no amount recorded — ask the seller to send it again.");
     if (new Date() > offer.expiresAt)
         throw new ValidationError(ERROR_MESSAGES.OFFER.EXPIRED);
     const updated = await offerRepository.acceptCounter(offerId, new Date(Date.now() + OFFER_CHECKOUT_WINDOW_MS));
@@ -298,7 +336,7 @@ export async function acceptCounterOffer(userId, offerId) {
             type: "offer_counter_accepted",
             priority: "high",
             title: "Counter offer accepted",
-            message: `Buyer accepted your counter of ₹${offer.counterAmount} on "${offer.productTitle}". They can now checkout.`,
+            message: `Buyer accepted your counter of ${formatMoney(offer.counterAmount)} on "${offer.productTitle}". They can now checkout.`,
             relatedId: offerId,
             relatedType: "offer",
         });
@@ -322,7 +360,7 @@ export async function counterOfferByBuyer(userId, userEmail, input) {
     const minAllowed = Math.floor(sellerCounter * 0.8);
     const maxAllowed = Math.ceil(sellerCounter * 1.2);
     if (counterAmount < minAllowed || counterAmount > maxAllowed)
-        throw new ValidationError(`${ERROR_MESSAGES.OFFER.COUNTER_RANGE} Allowed: ₹${minAllowed}–₹${maxAllowed}.`);
+        throw new ValidationError(`${ERROR_MESSAGES.OFFER.COUNTER_RANGE} Allowed: ${formatMoney(minAllowed)}–${formatMoney(maxAllowed)}.`);
     if (counterAmount >= offer.listedPrice)
         throw new ValidationError("Counter offer cannot reach or exceed the listed price. Accept the seller's counter instead.");
     const product = await productRepository.findById(offer.productId);
@@ -407,7 +445,7 @@ export async function counterOfferByBuyer(userId, userEmail, input) {
              * already in scope 41 lines up — `offerPlain` at :431, used for the
              * `createOffer` call at :439.
              */
-            message: `${offerPlain.buyerName} countered with ₹${counterAmount} on "${offer.productTitle}".`,
+            message: `${offerPlain.buyerName} countered with ${formatMoney(counterAmount)} on "${offer.productTitle}".`,
             relatedId: newOffer.id,
             relatedType: "offer",
         });

package/dist/features/seller/actions/seller-actions.d.ts

@@ -125,6 +125,22 @@ export declare function updateStore(userId: string, input: UpdateStoreInput): Pr
 type SafePayoutDetails = Omit<SellerPayoutDetails, "bankAccount"> & {
     bankAccount?: Omit<NonNullable<SellerPayoutDetails["bankAccount"]>, "accountNumber">;
 };
+/**
+ * 🛑 THIS IS THE WRITE PATH, and it used to assert `isConfigured: true`
+ * unconditionally on both arms — so a store could be "payout configured" with
+ * an IFSC that is not an IFSC and a VPA that is not a VPA. The consumer action
+ * that calls it had Zod patterns; this function, which is what actually writes,
+ * had none, so any other caller bypassed every check.
+ *
+ * Now:
+ *   · the destination is VALIDATED here, through the one shared definition
+ *     (`payoutDestinationIssues`), so the check cannot be skipped by reaching
+ *     this function directly;
+ *   · `isConfigured` is DERIVED from that same definition — it means
+ *     FORMAT-VALID and nothing more;
+ *   · the gateway's verification verdict is RESET, because the destination it
+ *     referred to has just changed.
+ */
 export declare function updatePayoutSettings(userId: string, input: UpdatePayoutSettingsInput): Promise<{
     payoutDetails: SafePayoutDetails;
 }>;
@@ -164,6 +180,9 @@ export declare function getSellerPayoutSettings(userId: string): Promise<SellerP
     method: import("../../auth").SellerPayoutMethod;
     upiId?: string;
     isConfigured: boolean;
+    verificationStatus?: import("../../..").PayoutVerificationStatus;
+    verificationMessage?: string;
+    verifiedAt?: Date | string;
 }>;
 export declare function listSellerOrders(userId: string, params?: SellerListParams): Promise<FirebaseSieveResult<OrderDocument>>;
 export declare function getSellerAnalytics(userId: string): Promise<{

package/dist/features/seller/actions/seller-actions.js

@@ -17,9 +17,10 @@ import { ApiError, AuthorizationError, NotFoundError, ValidationError, } from ".
 import { assertListingTypeAllowed } from "../../../_internal/shared/listing-types/tiers.js";
 import { userRepository } from "../../auth/repository/user.repository.js";
 import { storeRepository } from "../../stores/repository/store.repository.js";
+import { sellerProfileRepository } from "../repository/seller-profile.repository.js";
 import { productRepository } from "../../products/repository/products.repository.js";
 import { ProductStatusValues } from "../../products/schemas/index.js";
-import { assertPrizeDrawNotLocked, assertPrizeDrawWonItemsImmutable, assertAuctionTermsMutable, } from "../../../_internal/server/features/products/service.js";
+import { assertClearanceNotLocked, assertClearanceWonItemsImmutable, assertCollectorDropTermsMutable, } from "../../../_internal/server/features/products/service.js";
 import { orderRepository } from "../../orders/repository/orders.repository.js";
 import { OrderStatusValues } from "../../orders/schemas/index.js";
 import { payoutRepository } from "../../payments/repository/payout.repository.js";
@@ -28,10 +29,23 @@ import { couponsRepository } from "../../promotions/repository/coupons.repositor
 import { generateStoreSlug } from "../../stores/schemas/firestore.js";
 import { siteSettingsRepository } from "../../admin/repository/site-settings.repository.js";
 import { computePayoutDeduction } from "../../../_internal/shared/fees/calculator.js";
+/*
+ * The one predicate that decides whether WE still owe this seller a payout. A
+ * split-settled order has already been paid out of the aggregator's escrow, and
+ * marking it payout-eligible would pay the seller twice.
+ */
+import { orderNeedsManualPayout } from "../../../_internal/shared/checkout/settlement-split.js";
+/*
+ * The ONE definition of "is this payout destination well-formed". `isConfigured`
+ * is derived from it rather than asserted, and the gateway's verification
+ * verdict is reset whenever the destination changes.
+ */
+import { payoutDestinationIssues, payoutDestinationIsWellFormed, resetVerificationOnChange, } from "../../../_internal/shared/features/payouts/destination.js";
 import { ordersTaxableValue, ordersShippingReimbursement, ordersPointsBorneByStore, } from "../../../_internal/shared/checkout/order-math.js";
 import { getDefaultCurrency } from "../../../core/baseline-resolver.js";
 import { finalizeStagedMediaUrl, finalizeStagedMediaField, finalizeStagedMediaArray, } from "../../media/finalize.js";
 import { StoreStatusValues } from "../../stores/schemas/firestore.js";
+import { assertCompositeShape } from "../../../_internal/shared/features/products/composite.js";
 // --- Helper -------------------------------------------------------------------
 async function finalizeProductMediaReferences(data) {
     const finalized = { ...data };
@@ -59,6 +73,7 @@ function maskAccountNumber(accountNumber) {
 export async function becomeSeller(userId) {
     const profile = await userRepository.findById(userId);
     const isTester = isTesterUser(profile);
+    const sellerProfile = await sellerProfileRepository.findById(userId);
     /*
      * 🛑 `isStrictSellerUser`, not `isSellerUser`.
      *
@@ -75,12 +90,11 @@ export async function becomeSeller(userId) {
     const alreadyOnboarded = profile &&
         (isStrictSellerUser(profile) ||
             isAdminUser(profile) ||
-            (isTester && Boolean(profile.storeStatus)));
+            (isTester && Boolean(sellerProfile?.storeStatus)));
     if (alreadyOnboarded) {
         return {
             alreadySeller: true,
-            storeStatus: profile.storeStatus ??
-                "pending",
+            storeStatus: sellerProfile?.storeStatus ?? "pending",
         };
     }
     const storeStatus = isTester ? "approved" : "pending";
@@ -92,8 +106,9 @@ export async function becomeSeller(userId) {
         // the test-data visibility their whole programme depends on — the first
         // time they opened a store.
         ...(isTester ? {} : { role: "seller" }),
-        storeStatus,
     });
+    // storeStatus is seller-only data — lives in sellerProfiles, not users.
+    await sellerProfileRepository.upsertForOwner(userId, { storeStatus });
     serverLogger.info("becomeSeller: application submitted", { userId, storeStatus });
     return { storeStatus };
 }
@@ -122,7 +137,9 @@ export async function createStore(userId, userName, input) {
         isPublic: isTester,
         status: isTester ? StoreStatusValues.ACTIVE : StoreStatusValues.PENDING,
     });
-    await userRepository.update(userId, {
+    // storeId/storeSlug/storeStatus are seller-only data — sellerProfiles,
+    // not users. `role`/`isTester` etc. stay on the user doc untouched.
+    await sellerProfileRepository.upsertForOwner(userId, {
         storeId: store.id,
         storeSlug: store.storeSlug,
         storeStatus: isTester ? "approved" : "pending",
@@ -185,10 +202,31 @@ export async function updateStore(userId, input) {
     }
     return { store: updated };
 }
+/**
+ * 🛑 THIS IS THE WRITE PATH, and it used to assert `isConfigured: true`
+ * unconditionally on both arms — so a store could be "payout configured" with
+ * an IFSC that is not an IFSC and a VPA that is not a VPA. The consumer action
+ * that calls it had Zod patterns; this function, which is what actually writes,
+ * had none, so any other caller bypassed every check.
+ *
+ * Now:
+ *   · the destination is VALIDATED here, through the one shared definition
+ *     (`payoutDestinationIssues`), so the check cannot be skipped by reaching
+ *     this function directly;
+ *   · `isConfigured` is DERIVED from that same definition — it means
+ *     FORMAT-VALID and nothing more;
+ *   · the gateway's verification verdict is RESET, because the destination it
+ *     referred to has just changed.
+ */
 export async function updatePayoutSettings(userId, input) {
     let payoutDetails;
     if (input.method === "upi") {
-        payoutDetails = { method: "upi", upiId: input.upiId, isConfigured: true };
+        payoutDetails = {
+            method: "upi",
+            upiId: input.upiId.trim(),
+            isConfigured: false,
+            ...resetVerificationOnChange(),
+        };
     }
     else {
         const { accountNumber, ...bankRest } = input.bankAccount;
@@ -196,13 +234,27 @@ export async function updatePayoutSettings(userId, input) {
             method: "bank_transfer",
             bankAccount: {
                 ...bankRest,
+                ifscCode: bankRest.ifscCode.trim().toUpperCase(),
                 accountNumber,
                 accountNumberMasked: maskAccountNumber(accountNumber),
             },
-            isConfigured: true,
+            isConfigured: false,
+            ...resetVerificationOnChange(),
         };
     }
-    await userRepository.update(userId, { payoutDetails });
+    /*
+     * 🛑 Validated BEFORE the write and THROWN on, not recorded as a flag. A
+     * malformed destination is not a degraded state a seller should be left in
+     * believing it saved — that belief is what `isConfigured: true` created. The
+     * issues carry a dotted path each, so the caller can attach them to the right
+     * field rather than show one banner.
+     */
+    const issues = payoutDestinationIssues(payoutDetails);
+    if (issues.length > 0) {
+        throw new ValidationError(issues.map((issue) => issue.message).join(" "));
+    }
+    payoutDetails.isConfigured = payoutDestinationIsWellFormed(payoutDetails);
+    await sellerProfileRepository.upsertForOwner(userId, { payoutDetails });
     serverLogger.info("updatePayoutSettings: payout details updated", {
         userId,
         method: payoutDetails.method,
@@ -213,8 +265,14 @@ export async function updatePayoutSettings(userId, input) {
     return { payoutDetails: { ...payoutDetails, bankAccount: safeBank } };
 }
 // --- Request Payout -----------------------------------------------------------
-async function computeSellerEarnings(sellerId) {
-    const products = await productRepository.findByStore(sellerId);
+// 🛑 `storeId` is the store's SLUG everywhere else in the codebase
+// (products/orders/payouts all query by it) — `sellerId` here is the
+// seller's Firebase Auth UID, a different id space. Callers must resolve
+// `storeRepository.findByOwnerId(sellerId)` first and pass the real slug;
+// passing the raw UID silently matches zero products/payouts (Root Cause
+// #108 — same identifier confusion in the same field name).
+async function computeSellerEarnings(storeId) {
+    const products = await productRepository.findByStore(storeId);
     const productIds = products.slice(0, 50).map((p) => p.id);
     let deliveredOrders = [];
     if (productIds.length > 0) {
@@ -223,7 +281,7 @@ async function computeSellerEarnings(sellerId) {
             .flat()
             .filter((o) => o.status === OrderStatusValues.DELIVERED);
     }
-    const paidOutIds = await payoutRepository.getPaidOutOrderIds(sellerId);
+    const paidOutIds = await payoutRepository.getPaidOutOrderIds(storeId);
     const eligibleOrders = deliveredOrders.filter((o) => !paidOutIds.has(o.id));
     /*
      * The TAXABLE VALUE — see `orderTaxableValue`. This figure is what the
@@ -290,18 +348,26 @@ async function computeSellerEarnings(sellerId) {
     };
 }
 export async function requestPayout(userId, userName, userEmail, input) {
-    const existing = await payoutRepository.findByStore(userId);
+    // 🛑 Fixed 2026-11-05 — this resolved nothing and every call below ran
+    // against the seller's raw UID instead of the store's slug, which is what
+    // products/orders/payouts are actually keyed by. `computeSellerEarnings`
+    // always found 0 products -> 0 eligible orders -> this threw "No eligible
+    // earnings available for payout." for every real seller, unconditionally.
+    const callerStore = await storeRepository.findByOwnerId(userId);
+    if (!callerStore)
+        throw new AuthorizationError("No store found for this account.");
+    const existing = await payoutRepository.findByStore(callerStore.id);
     const hasPending = existing.some((p) => p.status === PAYOUT_FIELDS.STATUS_VALUES.PENDING ||
         p.status === PAYOUT_FIELDS.STATUS_VALUES.PROCESSING);
     if (hasPending)
         throw new ValidationError("A payout is already pending or processing.");
-    const earnings = await computeSellerEarnings(userId);
+    const earnings = await computeSellerEarnings(callerStore.id);
     if (earnings.netAmount <= 0 || earnings.eligibleOrders.length === 0)
         throw new ValidationError("No eligible earnings available for payout.");
     const payout = await payoutRepository.createPayout({
         /* A seller requesting their own earnings — a liability settlement. */
         payeeType: "store",
-        storeId: userId,
+        storeId: callerStore.id,
         sellerName: userName,
         sellerEmail: userEmail,
         amount: earnings.netAmount,
@@ -337,11 +403,14 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
      * encrypts `upiId` again (`PAYOUT_PII_FIELDS`), so the seller-initiated path
      * wrote a permanently unreadable payee address too.
      *
-     * `payoutDetails` is encrypted by `encryptPayoutDetails`, a separate scheme
-     * from the `piiFields` path, which is why `revealUser` unwraps it explicitly.
+     * `payoutDetails` lives on `sellerProfiles` now, encrypted by
+     * `encryptPayoutDetails` there (same scheme as before, moved with the
+     * field) — `revealProfile` unwraps it explicitly, same reasoning as
+     * `UserRepository.revealUser` had.
      */
-    const userPlain = userRepository.revealUser(userDoc);
-    if (!userDoc.payoutDetails?.isConfigured) {
+    const sellerProfileDoc = await sellerProfileRepository.findById(userId);
+    const sellerProfilePlain = sellerProfileDoc ? sellerProfileRepository.revealProfile(sellerProfileDoc) : null;
+    if (!sellerProfilePlain?.payoutDetails?.isConfigured) {
         throw new ValidationError("Payout details are not set up. Please configure your payout method before requesting a payout.");
     }
     // order.storeId is the store slug, not the seller's Firebase UID — resolve
@@ -395,7 +464,16 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
     const payoutDoc = await payoutRepository.createPayout({
         /* A seller requesting their own earnings — a liability settlement. */
         payeeType: "store",
-        storeId: userId,
+        // 🛑 Fixed 2026-11-05 — was `storeId: userId` (the UID), even though
+        // `callerStore` is already resolved above and used correctly for the
+        // eligibility check two screens up. Payouts are queried by the store's
+        // SLUG everywhere else (admin dashboard, the automated weekly/auto
+        // sweeps), so a payout written with the UID was invisible to all of
+        // them — not recognized as "already queued," a double-payout risk on
+        // the same orders. Admin callers keep the previous (unaudited) UID
+        // fallback, since `callerStore` is deliberately null for them and this
+        // fix's scope is the seller self-service path, not the admin one.
+        storeId: callerStore?.id ?? userId,
         sellerName: userDisplayName,
         sellerEmail: userEmail,
         orderIds: eligible.map((o) => o.id),
@@ -408,11 +486,11 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
         gstAmount: bulkDeduction.gstOnFee,
         gstRate: bulkSiteSettings.commissions.gstPercent / 100,
         currency: getDefaultCurrency(),
-        paymentMethod: userPlain.payoutDetails?.method === "upi"
+        paymentMethod: sellerProfilePlain.payoutDetails?.method === "upi"
             ? "upi"
             : "bank_transfer",
-        upiId: userPlain.payoutDetails?.method === "upi"
-            ? userPlain.payoutDetails.upiId
+        upiId: sellerProfilePlain.payoutDetails?.method === "upi"
+            ? sellerProfilePlain.payoutDetails.upiId
             : undefined,
         /*
          * 🛑 Only the MASKED subset, matching both payout crons.
@@ -425,13 +503,13 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
          * revealing it instead would store a real account number in the clear.
          * A payout does not need the full number; it needs to identify the account.
          */
-        bankAccount: userPlain.payoutDetails?.method === "bank_transfer" &&
-            userPlain.payoutDetails.bankAccount
+        bankAccount: sellerProfilePlain.payoutDetails?.method === "bank_transfer" &&
+            sellerProfilePlain.payoutDetails.bankAccount
             ? {
-                accountHolderName: userPlain.payoutDetails.bankAccount.accountHolderName,
-                accountNumberMasked: userPlain.payoutDetails.bankAccount.accountNumberMasked,
-                ifscCode: userPlain.payoutDetails.bankAccount.ifscCode,
-                bankName: userPlain.payoutDetails.bankAccount.bankName,
+                accountHolderName: sellerProfilePlain.payoutDetails.bankAccount.accountHolderName,
+                accountNumberMasked: sellerProfilePlain.payoutDetails.bankAccount.accountNumberMasked,
+                ifscCode: sellerProfilePlain.payoutDetails.bankAccount.ifscCode,
+                bankName: sellerProfilePlain.payoutDetails.bankAccount.bankName,
             }
             : undefined,
         notes: `Payout request for ${eligible.length} custom-shipped delivered order(s)`,
@@ -527,16 +605,16 @@ export async function getSellerStore(userId) {
     return storeRepository.findByOwnerId(userId);
 }
 export async function getSellerShipping(userId) {
-    const userData = await userRepository.findById(userId);
-    if (!userData)
+    const profile = await sellerProfileRepository.findById(userId);
+    if (!profile?.shippingConfig)
         return null;
-    return userData.shippingConfig ?? null;
+    return sellerProfileRepository.revealProfile(profile).shippingConfig ?? null;
 }
 export async function getSellerPayoutSettings(userId) {
-    const userData = await userRepository.findById(userId);
-    if (!userData?.payoutDetails)
+    const profile = await sellerProfileRepository.findById(userId);
+    if (!profile?.payoutDetails)
         return { method: "upi", isConfigured: false };
-    const details = userData.payoutDetails;
+    const details = sellerProfileRepository.revealProfile(profile).payoutDetails;
     if (!details.bankAccount)
         return details;
     const { accountNumber: _removed, ...safeBank } = details.bankAccount;
@@ -612,7 +690,13 @@ export async function getSellerAnalytics(userId) {
     };
 }
 export async function listSellerPayouts(userId, params) {
-    const payouts = await payoutRepository.findByStore(userId);
+    // 🛑 Fixed 2026-11-05 — was `findByStore(userId)`, the seller's raw UID.
+    // It self-consistently showed a payout `bulkSellerOrder` wrote with the
+    // same wrong key (now also fixed), which is exactly what masked the bug:
+    // the one seller who created it could see it, while every automated sweep
+    // and the admin dashboard — both keyed on the real slug — could not.
+    const callerStore = await storeRepository.findByOwnerId(userId);
+    const payouts = callerStore ? await payoutRepository.findByStore(callerStore.id) : [];
     const page = params?.page ?? 1;
     const pageSize = params?.pageSize ?? 20;
     const start = (page - 1) * pageSize;
@@ -673,9 +757,9 @@ export async function sellerUpdateProduct(userId, userRole, productId, input) {
      *
      * 🛑 But it fires only on a CHANGE of type, and that is load-bearing. Every
      * per-type edit page spreads its own literal into the payload
-     * (`store/art/[id]/edit` sends `listingType: "art"`), so gating on the
-     * submitted value alone would lock a seller out of editing listings they
-     * already own the moment the capability was turned off — or an admin revoked
+     * (`store/art/[id]/edit` sends `listingType: "art-and-stickers"`), so gating
+     * on the submitted value alone would lock a seller out of editing listings
+     * they already own the moment the capability was turned off — or an admin revoked
      * it. The rule is "you may not create or convert INTO an advanced type",
      * never "you may not touch one".
      *
@@ -692,10 +776,31 @@ export async function sellerUpdateProduct(userId, userRole, productId, input) {
     if (typeof input.status === "string" &&
         input.status !== "published" &&
         existing.status === "published") {
-        assertPrizeDrawNotLocked(existing, "unpublished or archived");
+        assertClearanceNotLocked(existing, "unpublished or archived");
     }
-    assertPrizeDrawWonItemsImmutable(existing, input.prizeDrawItems);
-    assertAuctionTermsMutable(existing, input);
+    assertClearanceWonItemsImmutable(existing, input.prizeDrawItems);
+    assertCollectorDropTermsMutable(existing, input);
+    /*
+     * 🛑 Validated against the MERGED shape, not the submitted patch.
+     *
+     * An update may send `components` alone and rely on a policy already stored,
+     * or send the policy alone against stored components. Checking the patch by
+     * itself would pass a listing into a state neither half describes — which is
+     * how `components` without a `componentStockPolicy` would get persisted, and
+     * that combination is a money-path hole (see the field's own docstring).
+     *
+     * `in` rather than `??` so an explicit `null` — a seller CLEARING the
+     * components — is honoured instead of falling back to the stored array and
+     * making the field impossible to empty.
+     */
+    assertCompositeShape({
+        components: ("components" in input
+            ? input.components
+            : existing.components) ?? null,
+        componentStockPolicy: ("componentStockPolicy" in input
+            ? input.componentStockPolicy
+            : existing.componentStockPolicy) ?? null,
+    }, productId);
     const finalizedData = await finalizeProductMediaReferences(input);
     const updated = await productRepository.updateProduct(productId, finalizedData);
     serverLogger.info("sellerUpdateProduct", { userId, productId });
@@ -711,7 +816,7 @@ export async function sellerDeleteProduct(userId, userRole, productId) {
         if (!store || existing.storeId !== store.id)
             throw new AuthorizationError("You do not own this product");
     }
-    assertPrizeDrawNotLocked(existing, "deleted");
+    assertClearanceNotLocked(existing, "deleted");
     await productRepository.delete(productId);
     serverLogger.info("sellerDeleteProduct", { userId, productId });
 }
@@ -756,7 +861,21 @@ export async function customShipOrder(userId, userRole, orderId, input) {
         trackingNumber: input.trackingNumber,
         trackingUrl: input.trackingUrl,
         shippingDate: new Date(),
-        payoutStatus: "eligible",
+        /*
+         * 🛑 THE DOUBLE-PAYMENT GUARD. An order whose seller share was settled
+         * straight to them out of the aggregator's escrow at capture
+         * (`order.splitSettlement`) must NOT become payout-eligible: the weekly and
+         * automatic sweeps would then create a `payouts` row for the FULL share and
+         * the seller would be paid twice — once from escrow and once from the
+         * platform's own balance.
+         *
+         * 🛑 `undefined`, not `"requested"`. The field stays ABSENT rather than
+         * being given a status the manual pipeline owns: `getEligibleAutomatic`
+         * filters on `payoutStatus == "eligible"`, so absence keeps it out of every
+         * sweep, while "requested" would claim a payout request nobody made and
+         * `payoutId` would be missing from it.
+         */
+        payoutStatus: orderNeedsManualPayout(order) ? "eligible" : undefined,
     });
     /*
      * 🛑 AFTER the order is marked shipped, and never allowed to fail the

package/dist/features/seller/api/coupons/route.js

@@ -17,7 +17,12 @@ import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
 import { numParam } from "../../../../utils/search-params.js";
 export const GET = createRouteHandler({
-    roles: ["seller", "admin", "moderator"],
+    /*
+     * 🛑 Was ["seller", "admin", "moderator"]. `moderator` folds to `employee`,
+     * so it admitted every employee to a SELLER surface whose scope is ownership.
+     * Staff reach the same data through the permission-gated admin routes.
+     */
+    roles: ["seller", "admin"],
     handler: async ({ request, user }) => {
         const url = new URL(request.url);
         const page = Math.max(1, numParam(url, "page", 1));

package/dist/features/seller/api/products/route.js

@@ -18,7 +18,12 @@ import { createRouteHandler } from "../../../../next/api/routeHandler.js";
 import { storeRepository } from "../../../stores/repository/store.repository.js";
 import { numParam } from "../../../../utils/search-params.js";
 export const GET = createRouteHandler({
-    roles: ["seller", "admin", "moderator"],
+    /*
+     * 🛑 Was ["seller", "admin", "moderator"]. `moderator` folds to `employee`,
+     * so it admitted every employee to a SELLER surface whose scope is ownership.
+     * Staff reach the same data through the permission-gated admin routes.
+     */
+    roles: ["seller", "admin"],
     handler: async ({ request, user }) => {
         const url = new URL(request.url);
         const page = Math.max(1, numParam(url, "page", 1));

package/dist/features/seller/api/store/route.js

@@ -16,7 +16,12 @@ import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts/index.js";
 import { createRouteHandler } from "../../../../next/api/routeHandler.js";
 export const GET = createRouteHandler({
-    roles: ["seller", "admin", "moderator"],
+    /*
+     * 🛑 Was ["seller", "admin", "moderator"]. `moderator` folds to `employee`,
+     * so it admitted every employee to a SELLER surface whose scope is ownership.
+     * Staff reach the same data through the permission-gated admin routes.
+     */
+    roles: ["seller", "admin"],
     handler: async ({ user }) => {
         const { db } = getProviders();
         if (!db)

package/dist/features/seller/components/DispatchForm.js

@@ -39,6 +39,7 @@ import { FieldInput } from "../../../ui/forms/FieldInput.js";
 import { FieldSelect } from "../../../ui/forms/FieldSelect.js";
 import { shipOrderSchema } from "../schemas/order-forms.js";
 import { applyZodIssues, rootLevelMessages } from "../../../ui/forms/apply-zod-issues.js";
+import { getBrandName } from "../../../core/brand-resolver.js";
 /**
  * Box presets, in centimetres and kilograms.
  *
@@ -135,7 +136,7 @@ platformBooked, onDispatched, }) {
     }, [pickups, pickupId]);
     if (trackingNumber) {
         return (_jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatched" }), _jsx(Text, { size: "xs", color: "muted", children: platformBooked
-                        ? `Booked through LetItRip · ${trackingNumber}`
+                        ? `Booked through ${getBrandName()} · ${trackingNumber}`
                         : `Posted by you · ${trackingNumber}` })] }));
     }
     const submit = async (
@@ -178,7 +179,7 @@ platformBooked, onDispatched, }) {
         }
         shipMutation.mutate(parsed.data);
     };
-    return (_jsxs(Stack, { gap: "3", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatch" }), _jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: method === "custom" ? "primary" : "outline", "aria-pressed": method === "custom", onClick: () => setMethod("custom"), children: "I posted it" }), _jsx(Button, { size: "sm", variant: method === "platform" ? "primary" : "outline", "aria-pressed": method === "platform", onClick: () => setMethod("platform"), children: "Book through LetItRip" })] }), _jsx(Form, { onSubmit: (e) => e.preventDefault(), children: ({ setFieldError, clearErrors }) => {
+    return (_jsxs(Stack, { gap: "3", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatch" }), _jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: method === "custom" ? "primary" : "outline", "aria-pressed": method === "custom", onClick: () => setMethod("custom"), children: "I posted it" }), _jsxs(Button, { size: "sm", variant: method === "platform" ? "primary" : "outline", "aria-pressed": method === "platform", onClick: () => setMethod("platform"), children: ["Book through ", getBrandName()] })] }), _jsx(Form, { onSubmit: (e) => e.preventDefault(), children: ({ setFieldError, clearErrors }) => {
                     fieldErrorSink.current = setFieldError;
                     return (_jsxs(Stack, { gap: "3", children: [method === "custom" ? (_jsxs(_Fragment, { children: [_jsx(FieldInput, { name: "shippingCarrier", label: "Carrier", required: true, value: carrier, onChange: setCarrier }), _jsx(FieldInput, { name: "trackingNumber", label: "Tracking number", required: true, value: tracking, onChange: setTracking }), _jsx(FieldInput, { name: "trackingUrl", label: "Tracking URL", required: true, type: "url", value: trackingUrl, onChange: setTrackingUrl })] })) : (_jsxs(_Fragment, { children: [pickupsFailed ? (_jsx(Text, { size: "xs", color: "error", role: "alert", children: "Could not load your pickup addresses. Reopen this panel to try again." })) : pickups.length === 0 ? (_jsx(Text, { size: "xs", color: "muted", children: "Loading your pickup addresses\u2026" })) : (_jsx(FieldSelect, { name: "pickupAddressId", label: "Collect from", required: true, value: pickupId, onChange: setPickupId, options: pickups.map((p) => ({
                                             value: p.id,