@mohasinac/appkit 4.70.0 → 4.71.2

package/dist/_internal/server/features/orders/balance.js

@@ -33,8 +33,10 @@ import { ValidationError } from "../../../../errors/validation-error.js";
 import { NotFoundError } from "../../../../errors/not-found-error.js";
 import { AuthorizationError } from "../../../../errors/authorization-error.js";
 import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
+import { isAdminUser } from "../../../../features/auth/role-predicates.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { serverLogger } from "../../../../monitoring/server-logger.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 /*
  * 🛑 ONE message, for the same reason the ads collector names its own: an
  * order that is not the caller's answers 404 rather than 403, so "no such
@@ -84,7 +86,9 @@ export function balanceDueOn(order) {
  * only — so every seller got a 403 before reaching this function at all. A
  * broken gate masked an absent one, exactly as in Root Cause #98.
  */
-export async function openBalanceCollection(orderId, actor, now = new Date()) {
+export async function openBalanceCollection(orderId, 
+/** `roles` is the authority; `role` stays accepted for un-normalised callers. */
+actor, now = new Date()) {
     const order = (await orderRepository.findById(orderId));
     if (!order)
         throw new NotFoundError(ORDER_NOT_FOUND);
@@ -94,7 +98,14 @@ export async function openBalanceCollection(orderId, actor, now = new Date()) {
      * to `actor.uid` returns false for every legitimate seller, which is the
      * other half of Root Cause #98. Resolve the store first.
      */
-    if (actor.role !== "admin") {
+    /*
+     * `isAdminUser` reads the role SET (1.44). Was `actor.role !== "admin"`,
+     * which forced an admin who also holds `seller` down the
+     * "resolve-your-own-store" branch and then threw "You do not own this
+     * order" on any order outside that store — admin sees everything, so that
+     * was a wrong refusal.
+     */
+    if (!isAdminUser(actor)) {
         const store = await storeRepository.findByOwnerId(actor.uid);
         if (!store || order.storeId !== store.id) {
             throw new AuthorizationError("You do not own this order");
@@ -128,7 +139,7 @@ export async function openBalanceCollection(orderId, actor, now = new Date()) {
         type: "order_confirmed",
         priority: "high",
         title: "Your pre-order balance is due",
-        message: `The balance of ₹${due.toFixed(2)} on order ${orderId} is now payable. Your item is ready to ship once it clears.`,
+        message: `The balance of ${formatMoney(due)} on order ${orderId} is now payable. Your item is ready to ship once it clears.`,
         relatedId: orderId,
         relatedType: "order",
     });

package/dist/_internal/server/features/orders/cancellation-refund.d.ts

@@ -1,92 +1,3 @@
-/**
- * Cancel an order AND give the money back — one owner, three callers.
- *
- * ## D14, and why passing the amount was only half of it
- *
- * `cancelOrder(orderId, reason, refundAmount?)` has carried an optional
- * `refundAmount` since it was written, and **all four callers omitted it**. So
- * cancelling a *paid* order restored stock and left the money with us, while
- * `previewCancellationRefund` showed the buyer a figure nothing honoured.
- *
- * 🛑 **But passing the amount alone would have made it WORSE.** `cancelOrder`'s
- * body writes `{ refundAmount, refundStatus: "pending" }` and nothing else —
- * there is no provider call anywhere in it. So the obvious fix creates a *new*
- * dead state: a recorded refund intent that nothing ever settles, which is
- * strictly worse than today's honest silence because it reads, in the database,
- * as though a refund is on its way. The amount and the movement have to land
- * together, which is why this module exists rather than a one-line edit at each
- * call site.
- *
- * ## The decision table
- *
- * Every row cancels the order and **restores its stock** — see `releaseStock`,
- * which closes a second half of D14 the plan had recorded backwards. The table
- * is only about the money.
- *
- * | condition | what happens to the money |
- * |---|---|
- * | `paymentStatus !== "paid"` | **nothing** — nothing was ever captured |
- * | nothing left refundable | nothing — already refunded in full |
- * | goods have left the seller | intent recorded, **case opened** — a human decides |
- * | paid by cash / UPI-manual / EMI | intent recorded, **case opened** — there is no automatic rail |
- * | paid through the gateway | **refunded automatically**, in full, once |
- *
- * The last row is the only automatic money movement, and it satisfies the
- * plan's guardrail for one: the ceiling is an amount we captured, the recipient
- * is the payer, and no counterparty is debited.
- *
- * ## Three things that are load-bearing
- *
- * **It goes through `processRefundAction`, never `payment.refund()` directly.**
- * That action owns the idempotency claim, the cumulative cap against
- * `refundableBase`, and the two-phase reserve/settle write around the provider
- * call. A direct provider call here would reintroduce every defect step 8
- * closed — D1, D2, D6 and D7 at once.
- *
- * **The key is `cancel_{orderId}`** — a NATURAL key, so a double-clicked Cancel
- * button, a retried server action and a sweep all collapse to one refund. A
- * `randomUUID()` here would be D2 wearing a new name.
- *
- * ## Points ARE reversed here now (Phase P)
- *
- * `pointsLedger`'s own header states the rule as a legal boundary: *"points
- * spent on a cancelled order are returned as points"* — never as money, because
- * paying them out in rupees is what would make this stored value, which in
- * India is PPI territory with RBI authorisation attached.
- *
- * `reverseRedemptionForOrder` is that rule's first writer; the kind had been
- * declared with none since it was written (D48). It is idempotent on the order
- * — one reversal per order, checked by query before the write, because an
- * append-only ledger cannot net off a double reversal.
- *
- * 🛑 **It stopped being a no-op on 2026-10-22.** This paragraph read "It is a
- * NO-OP today and still correct to call … when redemption becomes a real
- * tender, cancellation already gives the points back" — and the tender is now
- * built (`resolvePointsTender` + `settlePointsTender` in `checkout/actions.ts`),
- * so orders carry `pointsApplied` and this query finds real redemptions. The
- * bet paid off: no cancellation path had to be remembered, because the reversal
- * was already wired and keyed.
- *
- * 🛑 **The MONEY half had to change in the same commit, and it is the sharper
- * of the two.** `refundableBase` now subtracts `pointsApplied`, because a
- * refund can only return what was collected: on a ₹1,000 order settled with
- * 250 points the card paid ₹750, so refunding the full base would return
- * ₹1,000 in cash AND 250 points — ₹250 of real money conjured from a discount.
- * Two halves of one refund, in two units, and only their sum is what the buyer
- * gave up.
- *
- * **Cancel, then stock, then money.** The cancellation is the urgent half and
- * must not be held hostage to a gateway round trip; the restock is a local
- * write another buyer is actively waiting on; the refund is the one step that
- * can hang for a full network timeout. The cost of that ordering is a window
- * where the order is `cancelled` with the money still held — which is exactly
- * why `refundAmount` is written *at cancellation time*, before the provider is
- * called: a crash in the window leaves a detectable artefact rather than
- * nothing, and R5 in `paymentReconcile` is the thing that finds it. The reverse
- * ordering has no such consolation, because a refund posted against a live
- * order that then fails to cancel is money gone from an order the buyer still
- * expects to receive.
- */
 import type { OrderDocument } from "../../../../features/orders/schemas/firestore";
 import type { CancellationRefundOutcome } from "../../../../features/orders/types/index";
 import type { HistoryActor } from "../../../shared/history/types";

package/dist/_internal/server/features/orders/cancellation-refund.js

@@ -1,3 +1,4 @@
+import { formatMoney } from "../../../../utils/number.formatter.js";
 /**
  * Cancel an order AND give the money back — one owner, three callers.
  *
@@ -212,7 +213,7 @@ async function openOwedCase(order, amount, why, detailLines) {
              */
             subjectId: order.id,
             severity: "error",
-            title: `Refund of ₹${amount.toFixed(2)} owed on cancelled order ${order.id}`,
+            title: `Refund of ${formatMoney(amount)} owed on cancelled order ${order.id}`,
             detail: [
                 ...detailLines,
                 "",
@@ -221,7 +222,7 @@ async function openOwedCase(order, amount, why, detailLines) {
                 `Store: ${order.storeId ?? "—"}`,
                 `Payment method: ${order.paymentMethod ?? "unknown"}`,
                 `Gateway reference: ${order.paymentId ?? "—"}`,
-                `Amount owed: ₹${amount.toFixed(2)}`,
+                `Amount owed: ${formatMoney(amount)}`,
                 "",
                 "The order is cancelled and its stock is restored. `refundAmount` is recorded on the order with `refundStatus: \"pending\"`, so this case and the order agree about what is owed.",
             ].join("\n"),

package/dist/_internal/server/features/payouts/actions.js

@@ -64,6 +64,7 @@ import { payoutRepository } from "../../../../features/payments/repository/payou
 import { serverErrorsRepository } from "../../../../features/server-errors/repository/server-errors.repository.js";
 import { ValidationError } from "../../../../errors/index.js";
 import { roundRupees } from "../../../../utils/number.formatter.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 export async function applyRefundDeductionAction(input) {
     return wrapAction(async () => {
         if (input.refundedAmount <= 0) {
@@ -95,7 +96,7 @@ export async function applyRefundDeductionAction(input) {
                 source: "vercel",
                 route: "applyRefundDeductionAction",
                 code,
-                message: `Clawback of ₹${deductedAmount} for order ${input.orderId} (store ${input.storeId}) could not be applied: ${unrecoverable}. ` +
+                message: `Clawback of ${formatMoney(deductedAmount)} for order ${input.orderId} (store ${input.storeId}) could not be applied: ${unrecoverable}. ` +
                     `The seller retains this amount for returned goods; there is no automatic recovery until a seller ledger exists.`,
                 requestId: input.refundId,
             });

package/dist/_internal/server/features/points/award.js

@@ -56,6 +56,7 @@ import { POINTS_EARN_PERCENT, pointsExpiryFrom, } from "../../../../features/poi
 import { orderTaxableValue } from "../../../shared/checkout/order-math.js";
 import { normalizeError } from "../../../../errors/normalize.js";
 import { serverLogger } from "../../../../monitoring/index.js";
+import { formatMoney } from "../../../../utils/number.formatter.js";
 function roundPoints(value) {
     return Math.round(value * 100) / 100;
 }
@@ -160,13 +161,13 @@ export async function awardPurchasePoints(order) {
          * later — and written once rather than re-derived, so it stays true of this
          * moment even if the order is edited afterwards.
          */
-        description: `${POINTS_EARN_PERCENT}% back on ${order.id}: ₹${moneyPaidForGoods.toFixed(2)} of items` +
+        description: `${POINTS_EARN_PERCENT}% back on ${order.id}: ${formatMoney(moneyPaidForGoods)} of items` +
             // Named explicitly, because an unexplained gap between the order's item
             // value and the earn base is exactly the kind of figure a buyer writes
             // in to ask about — and the answer ("you paid part of it with points")
             // is a fact about their own order that they can check.
             ((order.pointsApplied ?? 0) > 0
-                ? ` (₹${goods.toFixed(2)} of items less ${order.pointsApplied} points).`
+                ? ` (${formatMoney(goods)} of items less ${order.pointsApplied} points).`
                 : "."),
         expiresAt: pointsExpiryFrom(now),
     });

package/dist/_internal/server/features/products/actions.d.ts

@@ -1,6 +1,6 @@
 import { type ActionResult } from "../../../shared/types/action-result";
 export declare function createProductAction(input: unknown): Promise<ActionResult<unknown>>;
-export declare function createAuctionAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function createCollectorDropAction(input: unknown): Promise<ActionResult<unknown>>;
 export declare function createPreOrderAction(input: unknown): Promise<ActionResult<unknown>>;
 export declare function updateProductAction(productId: string, input: unknown): Promise<ActionResult<unknown>>;
 export declare function deleteProductAction(productId: string): Promise<ActionResult<unknown>>;

package/dist/_internal/server/features/products/actions.js

@@ -14,8 +14,8 @@ import { wrapAction } from "../../../shared/types/action-result.js";
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
 import { isAdminUser } from "../../../../features/auth/role-predicates.js";
-import { productInputSchema, productUpdateSchema, auctionInputSchema, preOrderInputSchema, setFeaturedSchema, setStatusSchema } from "../../../shared/features/products/schema.js";
-import { assertProductOwnership, assertStatusTransition, assertPrizeDrawNotLocked, assertPrizeDrawWonItemsImmutable, } from "./service.js";
+import { productInputSchema, productUpdateSchema, collectorDropInputSchema, preOrderInputSchema, setFeaturedSchema, setStatusSchema } from "../../../shared/features/products/schema.js";
+import { assertProductOwnership, assertStatusTransition, assertClearanceNotLocked, assertClearanceWonItemsImmutable, } from "./service.js";
 import { ValidationError } from "../../../shared/errors/index.js";
 import { NotFoundError } from "../../../../errors/index.js";
 import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
@@ -58,17 +58,17 @@ export async function createProductAction(input) {
         });
     });
 }
-export async function createAuctionAction(input) {
+export async function createCollectorDropAction(input) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["seller", "admin"]);
-        const parsed = auctionInputSchema.safeParse(input);
+        const parsed = collectorDropInputSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
         return productRepository.create({
             ...parsed.data,
             ...(await sellerStoreFields(user.uid)),
             status: "draft",
-            listingType: "auction",
+            listingType: "collector-drop",
             featured: false,
         });
     });
@@ -95,7 +95,7 @@ export async function updateProductAction(productId, input) {
         const parsed = productUpdateSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-        assertPrizeDrawWonItemsImmutable(product, parsed.data.prizeDrawItems);
+        assertClearanceWonItemsImmutable(product, parsed.data.prizeDrawItems);
         return productRepository.update(productId, parsed.data);
     });
 }
@@ -103,7 +103,7 @@ export async function deleteProductAction(productId) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["seller", "admin"]);
         const product = await assertProductOwnership(productId, user.uid);
-        assertPrizeDrawNotLocked(product, "deleted");
+        assertClearanceNotLocked(product, "deleted");
         return productRepository.delete(productId);
     });
 }
@@ -116,7 +116,7 @@ export async function setProductStatusAction(input) {
         const product = await assertProductOwnership(parsed.data.productId, user.uid);
         assertStatusTransition(product.status, parsed.data.status);
         if (parsed.data.status !== "published") {
-            assertPrizeDrawNotLocked(product, "unpublished or archived");
+            assertClearanceNotLocked(product, "unpublished or archived");
         }
         // SB-UNI-O — live listings must be admin-verified before a seller can publish them.
         if (parsed.data.status === "published" &&

package/dist/_internal/server/features/products/data.js

@@ -179,9 +179,10 @@ export async function listSitemapProducts() {
             .map((doc) => {
             const data = doc.data();
             const rawListingType = data.listingType;
-            const listingType = rawListingType === "auction" ||
+            const listingType = rawListingType === "collector-drop" ||
+                rawListingType === "auction" ||
                 rawListingType === "pre-order" ||
-                rawListingType === "prize-draw"
+                rawListingType === "clearance"
                 ? rawListingType
                 : "standard";
             return {
@@ -210,10 +211,10 @@ function toRelatedItems(docs, currentProductId, settings) {
         isPubliclyVisible(r) &&
         /*
          * 🛑 A DISABLED listing type must not appear here. Related items are
-         * pure DISCOVERY — unlike a won auction sitting in the cart, nothing
+         * pure DISCOVERY — unlike a won collector drop sitting in the cart, nothing
          * here is an obligation the buyer already holds, so there is no reason
          * to surface a type the admin has switched off. Without this an
-         * auction card rendered on every related carousel with auctions
+         * collector drop card rendered on every related carousel with collector drops
          * disabled, and it was reachable by clicking it.
          */
         isListingTypeEnabled(normalizeListingType(r), settings) &&

package/dist/_internal/server/features/products/index.d.ts

@@ -1,6 +1,6 @@
 export { getProductForDetail, getReviewsForProduct, listSitemapProducts, type SitemapProduct, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, getReviewPageForProduct, type RelatedItemsResult, } from "./data";
 export { listPublicProducts, parsePublicProductParams, defaultAvailabilityForListingTypes, PUBLIC_PRODUCT_MAX_PAGE_SIZE, ANY_STATUS, type PublicProductListInput, type PublicProductListResult, type PublicProductListOptions, type PublicProductExecutor, type PublicProductQuery, type ExecutorResult, } from "./list-public";
 export { assertProductOwnership, assertStatusTransition, assertInStock, effectivePrice, isAvailableForPurchase, } from "./service";
-export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions";
+export { createProductAction, createCollectorDropAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions";
 export { PRODUCTS_PAGE_SIZE, PRODUCTS_FEATURED_LIMIT, PRODUCTS_RELATED_LIMIT, PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config";
 export { renderProductOgImage, renderProductOg, type ProductOgData, type OgOptions } from "./og";

package/dist/_internal/server/features/products/index.js

@@ -1,6 +1,6 @@
 export { getProductForDetail, getReviewsForProduct, listSitemapProducts, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, getReviewPageForProduct, } from "./data.js";
 export { listPublicProducts, parsePublicProductParams, defaultAvailabilityForListingTypes, PUBLIC_PRODUCT_MAX_PAGE_SIZE, ANY_STATUS, } from "./list-public.js";
 export { assertProductOwnership, assertStatusTransition, assertInStock, effectivePrice, isAvailableForPurchase, } from "./service.js";
-export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions.js";
+export { createProductAction, createCollectorDropAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions.js";
 export { PRODUCTS_PAGE_SIZE, PRODUCTS_FEATURED_LIMIT, PRODUCTS_RELATED_LIMIT, PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config.js";
 export { renderProductOgImage, renderProductOg } from "./og.js";

package/dist/_internal/server/features/products/list-public.js

@@ -30,7 +30,7 @@
  * @tag layer:server-data
  * @tag pattern:none
  * @tag access:server-only
- * @tag consumers:ProductsIndexPageView,ArtStickersListView,AuctionsListView,PreOrdersListView,api/products
+ * @tag consumers:ProductsIndexPageView,ArtStickersListView,CollectorDropsListView,PreOrdersListView,api/products
  * @tag sideEffects:firestore-read
  */
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
@@ -126,6 +126,12 @@ const TYPE_FACET_FIELD = {
     [TABLE_KEYS.LIVE_SEX]: "liveItem.sex",
     [TABLE_KEYS.JURISDICTION]: "liveItem.jurisdictionAllowed",
     [TABLE_KEYS.LIVE_TRANSPORT_METHOD]: "liveItem.transport.method",
+    // 3B item 1b, toolbars subsystem (2026-11-05) — the first real consumer
+    // of ListingToolbar's admin-added-toggle mechanism. Not type-specific
+    // (unlike every entry above); the composite index below mirrors
+    // `isPartOfBundle`'s own existing (listingType, X) shape, the closest
+    // precedent for a general, non-type-scoped boolean product facet.
+    [TABLE_KEYS.IS_ON_SALE]: "isOnSale",
 };
 /** Every field path a per-type facet can filter on. Read by the wiring audit. */
 export const TYPE_FACET_FIELD_PATHS = Object.values(TYPE_FACET_FIELD);
@@ -182,9 +188,9 @@ function readAvailability(get, fallback) {
 export function parsePublicProductParams(params, defaults) {
     const get = (k) => first(params, k);
     // The type filter is a multi-select checkbox group, so its URL value is a
-    // pipe-joined set (`auction|pre-order`). Selected types NARROW the page's
+    // pipe-joined set (`collector drop|pre-order`). Selected types NARROW the page's
     // span; anything outside the span is discarded rather than allowed to widen
-    // it (an /art URL must not be able to ask for auctions). Nothing selected —
+    // it (an /art URL must not be able to ask for collector drops). Nothing selected —
     // or nothing valid selected — means the page's full span.
     const typeParam = get(TABLE_KEYS.LISTING_TYPE);
     const span = defaults?.listingTypes;
@@ -224,7 +230,7 @@ export function parsePublicProductParams(params, defaults) {
         // Now a plain drawer facet again. It used to double as the hide-ended
         // mechanism, which is why it only worked when exactly one listing type was
         // selected — `dateFieldFor` returns null otherwise, so /products silently
-        // showed ended auctions in its default view.
+        // showed ended collector drops in its default view.
         dateFrom: get(TABLE_KEYS.DATE_FROM) || undefined,
         dateTo: get(TABLE_KEYS.DATE_TO) || undefined,
         page: num(get(TABLE_KEYS.PAGE)) ?? DEFAULT_PAGE,
@@ -239,8 +245,8 @@ export function parsePublicProductParams(params, defaults) {
          * while the dropdown displayed the sort the user had picked.
          *
          * Measured against the live dev server — identical row order for
-         * `?sorts=auctionEndDate` and for no sort at all, versus a correctly
-         * ordered result for `?sort=auctionEndDate`.
+         * `?sorts=collectorDropEndDate` and for no sort at all, versus a correctly
+         * ordered result for `?sort=collectorDropEndDate`.
          *
          * It survived because the SSR paint IS correct: the listing views pass
          * `sorts` through `defaults`, and an anonymous visitor with `initialData`
@@ -273,7 +279,7 @@ export function parsePublicProductParams(params, defaults) {
 /**
  * Only clauses Firestore can satisfy alongside an arbitrary `orderBy`. Notably
  * ABSENT: `inStock` (a `stockQuantity` range) and, unless the sort matches, the
- * auction/pre-order date ranges. Firestore appends an inequality field to the
+ * collector drop/pre-order date ranges. Firestore appends an inequality field to the
  * orderBy implicitly, so pairing one with an unrelated sort demands a composite
  * index in an order nobody declares — it fails with FAILED_PRECONDITION, which
  * upstream reads as a bare "no results".
@@ -403,8 +409,8 @@ function buildFirestoreSafeFilters(input, opts) {
 function dateFieldFor(types) {
     if (!types || types.length !== 1)
         return null;
-    if (types[0] === PRODUCT_FIELDS.LISTING_TYPE_VALUES.AUCTION) {
-        return PRODUCT_FIELDS.AUCTION_END_DATE;
+    if (types[0] === PRODUCT_FIELDS.LISTING_TYPE_VALUES.COLLECTOR_DROP) {
+        return PRODUCT_FIELDS.COLLECTOR_DROP_END_DATE;
     }
     if (types[0] === PRODUCT_FIELDS.LISTING_TYPE_VALUES.PRE_ORDER) {
         return PRODUCT_FIELDS.PRE_ORDER_DELIVERY_DATE;
@@ -567,7 +573,7 @@ export async function listPublicProducts(input, opts) {
     ];
     const types = asListingTypes(input.listingTypes);
     // ── Path B: one type whose unavailability IS a pushable inequality, and the
-    //    caller is already sorting by that field. Ended auctions sorted by end
+    //    caller is already sorting by that field. Ended collector drops sorted by end
     //    date is the whole reason this branch exists — it gives the archive real,
     //    unbounded-depth Firestore pagination instead of a 50-row window.
     const pushdown = wantUnavailable && types.length === 1 && !hasDateRange
@@ -732,7 +738,7 @@ export async function listPublicProducts(input, opts) {
     // When a date range stays in memory, fetch in whichever direction front-loads
     // the rows that will PASS it: `dateFrom` (">=", still live) wants the most
     // future dates first; `dateTo` ("<=", ends by) wants the earliest first.
-    // Fetching in the client's own order instead is what made live auctions
+    // Fetching in the client's own order instead is what made live collector drops
     // invisible once ~50 had already ended.
     const fetchSorts = inMemory && hasDateRange && !canPushDate && dateField
         ? input.dateFrom
@@ -921,7 +927,7 @@ opts) {
  * 🛑 The `Date` branch is load-bearing. Without it a Date falls through to
  * `String(value)` — `"Wed Aug 30 2026 …"` — and a lexical compare of those
  * orders by WEEKDAY NAME. Every in-memory date sort was wrong: the "Sold &
- * Ended" tab ordered by `createdAt`/`auctionEndDate`, and now every per-type
+ * Ended" tab ordered by `createdAt`/`collectorDropEndDate`, and now every per-type
  * facet under "Oldest First". A Firestore Timestamp arrives here as a Date via
  * `mapDoc`, so the ISO-string case is only for a row that has already been
  * serialised; both are handled.

package/dist/_internal/server/features/products/listing-tab-counts.d.ts

@@ -57,7 +57,7 @@ export interface ListingTabCountResult {
  * Count every tab in `tabs` within `scope`, in one parallel batch.
  *
  * The listing-type buckets come from each tab's own `listingType` field — which
- * already carries `"art|stickers"` as a pipe OR-group — so this function never
+ * already carries pipe OR-groups like `"standard|spares"` — so this function never
  * enumerates the `ListingType` union itself and cannot drift from it.
  *
  * `stores` is not counted here: only the category page has that tab and it

package/dist/_internal/server/features/products/listing-tab-counts.js

@@ -139,18 +139,18 @@ async function unavailableByType(scope, types, now) {
          * must be its own field (Root Cause #59) — so that one clause does need
          * an index, which is exactly why `unknown` is tracked per type.
          *
-         * 🛑 THE AUCTION INDEXES ARE NOT DECLARED, deliberately. Until they are,
-         * the auction clause returns FAILED_PRECONDITION, `unknown` gains
-         * `auction`, and that ONE badge falls back to its total — every other
+         * 🛑 THE COLLECTOR_DROP INDEXES ARE NOT DECLARED, deliberately. Until they are,
+         * the collector drop clause returns FAILED_PRECONDITION, `unknown` gains
+         * `collector drop`, and that ONE badge falls back to its total — every other
          * type stays exact. Adding them to
          * `appkit/firebase/base/firestore.indexes.json` is only half the change:
          * an undeployed index file fails `audit-firebase-rules-deployed`, so the
          * three entries below and `npm run firebase -- deploy --only
          * firestore:indexes` belong in the same session.
          *
-         *   products: status ASC, categorySlugs CONTAINS, auctionEndDate DESC
-         *   products: brand  ASC, status ASC,             auctionEndDate DESC
-         *   products: storeId ASC, status ASC,            auctionEndDate DESC
+         *   products: status ASC, categorySlugs CONTAINS, collectorDropEndDate DESC
+         *   products: brand  ASC, status ASC,             collectorDropEndDate DESC
+         *   products: storeId ASC, status ASC,            collectorDropEndDate DESC
          *
          * One per scope the tab bars count in, because `buildScopedQuery` leads
          * with a different equality for each.
@@ -215,7 +215,7 @@ async function unavailableByType(scope, types, now) {
     }
     return { byType, unknown };
 }
-/** The listing types one tab spans — `"art|stickers"` is a pipe OR-group. */
+/** The listing types one tab spans — `"standard|spares"` is a pipe OR-group. */
 function typesOf(tab) {
     return String(tab.listingType).split("|").filter(Boolean);
 }
@@ -223,7 +223,7 @@ function typesOf(tab) {
  * Count every tab in `tabs` within `scope`, in one parallel batch.
  *
  * The listing-type buckets come from each tab's own `listingType` field — which
- * already carries `"art|stickers"` as a pipe OR-group — so this function never
+ * already carries pipe OR-groups like `"standard|spares"` — so this function never
  * enumerates the `ListingType` union itself and cannot drift from it.
  *
  * `stores` is not counted here: only the category page has that tab and it

package/dist/_internal/server/features/products/og.js

@@ -14,7 +14,7 @@ export function renderProductOg(doc, opts) {
 export function renderProductOgImage(data, siteName) {
     // 🛑 No money in the accent slot. An OG image is a PUBLIC image URL anyone can
     // fetch directly, with the amount burned into the pixels — no gate reaches it,
-    // and no paywall markup describes it. The auction and pre-order OGs already
+    // and no paywall markup describes it. The collector drop and pre-order OGs already
     // use a non-money accent (end date / release date); this matches them.
     return renderOgLayout({
         title: data.title,

package/dist/_internal/server/features/products/service.d.ts

@@ -4,34 +4,71 @@ export declare function assertProductOwnership(productId: string, sellerId: stri
 /** Validate that a status transition is allowed. */
 export declare function assertStatusTransition(from: string, to: string): void;
 /**
- * Anti-scam guard — once a prize draw has at least one paid entry, the
+ * Anti-scam guard — once a clearance draw has at least one paid entry, the
  * seller can no longer take it down (unpublish/archive/delete). Prevents a
  * seller from dodging shipment of an expensive won prize by pulling the
  * listing after the fact.
  */
-export declare function assertPrizeDrawNotLocked(product: Pick<ProductDocument, "listingType" | "prizeCurrentEntries">, action: string): void;
+export declare function assertClearanceNotLocked(product: Pick<ProductDocument, "listingType" | "prizeCurrentEntries">, action: string): void;
 /**
- * Anti-scam guard — once a prize item has been won, its title/images/
- * description/condition/estimatedValue become immutable server-side (the
- * client editor already locks this visually via PrizeDrawItemsEditor's
- * `locked` state, but that's UI-only — this is the enforcement). Prevents a
- * seller from swapping in a cheaper item after a buyer has already won.
+ * Anti-scam guard — a won prize item is immutable, and **no seller may set or
+ * clear an allocation.**
+ *
+ * The client editor also locks won rows visually (`ClearanceItemsEditor`'s
+ * `locked` state), but that is UI-only; this is the enforcement, and it runs
+ * on all three product-update paths (seller action, admin action, API).
+ *
+ * ## 🛑 Three holes this closes (found auditing 1.35, 2026-11-07)
+ *
+ * The original guard only compared the DESCRIPTIVE fields of items that were
+ * already `isWon` in the stored document. `isWon` and `wonByOrderId` — the
+ * allocation itself — were accepted straight from seller input
+ * (`prizeDrawItems[].isWon` is `z.boolean()` in the product input schema), and
+ * the loop skipped anything it could not match. So a seller could:
+ *
+ *  1. **Delete a won item.** `if (!incoming) continue` passed a payload that
+ *     simply omitted prize #3 — the won prize left the pool entirely, taking
+ *     the record of what the buyer was owed with it. This was the worst of the
+ *     three, because it looked like the guard's "unchanged" case.
+ *  2. **Un-win a won item** by sending `isWon: false`, freeing an
+ *     already-allocated prize to be handed to someone else.
+ *  3. **Invent a win** by sending `isWon: true` (and any `wonByOrderId`) on an
+ *     item the platform never picked — removing it from the RNG's candidate
+ *     pool, or making an order appear to have won something it did not.
+ *
+ * Every one of those defeats the stated purpose of the mechanic: *"no seller
+ * can say you got a trash item when in reality you got the prize."* An
+ * auditable random allocation is worth nothing if the seller can edit the
+ * result afterwards.
+ *
+ * The allocation engine (`clearanceAssignWinner`) is unaffected: it writes the
+ * array through a Firestore transaction on the raw document and never passes
+ * through this action layer. This guard therefore constrains exactly the
+ * human-reachable paths, which is the intent — the engine is the only writer
+ * of `isWon`.
+ *
+ * ## Compares VALUES, never key presence
+ *
+ * Same reasoning as `assertCollectorDropTermsMutable`: the seller editor
+ * round-trips the whole array, so every save resubmits each item unchanged.
+ * Rejecting on presence would make a draw with one won prize entirely
+ * unsaveable and the seller could not fix so much as a typo on an unwon row.
  */
-export declare function assertPrizeDrawWonItemsImmutable(currentProduct: Pick<ProductDocument, "prizeDrawItems">, input: unknown): void;
+export declare function assertClearanceWonItemsImmutable(currentProduct: Pick<ProductDocument, "prizeDrawItems">, input: unknown): void;
 /**
- * Anti-scam guard — an auction's economic terms (starting bid, reserve, close
+ * Anti-scam guard — a collector drop's economic terms (starting bid, reserve, close
  * time) stop being editable the moment a real bid exists. Moving the goalposts
- * under a live bidder is the one auction edit that must never pass.
+ * under a live bidder is the one collector drop edit that must never pass.
  *
  * 🛑 It compares VALUES, not key presence. The seller editor round-trips the
- * whole draft, so every save resubmits `startingBid` and `auctionEndDate`
- * unchanged — rejecting on presence alone would make a live auction entirely
+ * whole draft, so every save resubmits `startingBid` and `collectorDropEndDate`
+ * unchanged — rejecting on presence alone would make a live collector drop entirely
  * unsaveable, and the seller could no longer fix so much as a typo.
  */
-export declare function assertAuctionTermsMutable(existing: Pick<ProductDocument, "listingType" | "bidsHaveStarted" | "bidCount" | "startingBid" | "reservePrice" | "auctionEndDate">, input: unknown): void;
+export declare function assertCollectorDropTermsMutable(existing: Pick<ProductDocument, "listingType" | "bidsHaveStarted" | "bidCount" | "startingBid" | "reservePrice" | "collectorDropEndDate">, input: unknown): void;
 /** Assert the product has available stock for a purchase. */
 export declare function assertInStock(product: ProductDocument, quantity?: number): void;
-/** Derive effective price (respects currentBid for auctions, base price otherwise). */
+/** Derive effective price (respects currentBid for collector drops, base price otherwise). */
 export declare function effectivePrice(product: ProductDocument): number;
 /** Compute whether a product is still available for purchase. */
 export declare function isAvailableForPurchase(product: ProductDocument): boolean;