@mohasinac/appkit 4.71.0 → 4.71.2

package/dist/schemas/registry.js

@@ -27,7 +27,7 @@
 import { addressFirestoreSchema } from "../features/addresses/schemas/index.js";
 import { blogPostFirestoreSchema } from "../features/blog/schemas/index.js";
 import { categoryFirestoreSchema } from "../features/categories/schemas/index.js";
-import { carouselFirestoreSchema, carouselSlideFirestoreSchema, homepageSectionFirestoreSchema, } from "../features/homepage/schemas/index.js";
+import { homepageSectionFirestoreSchema, } from "../features/homepage/schemas/index.js";
 import { faqFirestoreSchema } from "../features/faq/schemas/index.js";
 import { groupedListingFirestoreSchema } from "../features/grouped/schemas/index.js";
 import { orderFirestoreSchema } from "../features/orders/schemas/index.js";
@@ -50,8 +50,8 @@ import { supportTicketFirestoreSchema } from "../features/support/schemas/index.
 const firestore = {
     addresses: addressFirestoreSchema, // W2
     blogPosts: blogPostFirestoreSchema, // W2
-    carousels: carouselFirestoreSchema, // W2
-    carouselSlides: carouselSlideFirestoreSchema, // W2
+    // carousels / carouselSlides REMOVED 2026-10-31 — no standalone slide
+    // document any more. See CLAUDE.md "Homepage Hero Carousel".
     categories: categoryFirestoreSchema, // W2
     claimedCoupons: claimedCouponFirestoreSchema, // W2
     coupons: couponFirestoreSchema, // W2
@@ -139,12 +139,12 @@ import { reportReviewFormSchema } from "../features/store-extensions/schemas/rep
 import { adminStoreUpdateSchema } from "../features/admin/schemas/admin-editor-forms.js";
 import { adminAddressCreateSchema } from "../features/addresses/schemas/address-form.js";
 import { adminOrderUpdateSchema, employeeInviteSchema, adminAdFormSchema } from "../features/admin/schemas/admin-ops-forms.js";
-import { adminUserUpdateSchema, whatsappSettingsSchema, lotteryPullSchema } from "../features/admin/schemas/admin-user-form.js";
+import { adminUserUpdateSchema, whatsappSettingsSchema, giveawayPullSchema } from "../features/admin/schemas/admin-user-form.js";
 import { siteSettingsFormSchema } from "../features/admin/schemas/site-settings-form.js";
 import { orderCancelSchema, paymentProofSchema } from "../features/orders/schemas/buyer-forms.js";
 import { scamReportFormSchema } from "../features/scams/schemas/report-form.js";
 import { sublistingCategoryFormSchema } from "../features/store-extensions/schemas/sublisting-category-form.js";
-import { lotteryConfigWriteSchema } from "../features/lottery/schemas/config-write.js";
+import { giveawayConfigWriteSchema } from "../features/giveaway/schemas/config-write.js";
 import { reportCreateSchema } from "../features/store-extensions/schemas/report-create-form.js";
 import { itemRequestCreateSchema } from "../features/store-extensions/schemas/item-request-create-form.js";
 import { analyticsAlertCreateSchema, analyticsCardCreateSchema, } from "../features/store-extensions/schemas/analytics-forms.js";
@@ -191,8 +191,8 @@ const forms = {
     paymentProof: paymentProofSchema,
     scamReport: scamReportFormSchema,
     sublistingCategory: sublistingCategoryFormSchema,
-    lotteryConfig: lotteryConfigWriteSchema,
-    lotteryPull: lotteryPullSchema,
+    giveawayConfig: giveawayConfigWriteSchema,
+    giveawayPull: giveawayPullSchema,
 };
 // ---------------------------------------------------------------------------
 // Sieve filter-grammar schemas — populated by W6. Each collection registers

package/dist/schemas/sieve.d.ts

@@ -24,11 +24,11 @@ export declare const sieveFilterClauseSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     value: string | number | boolean | (string | number | boolean)[] | null;
     field: string;
-    op: "<" | ">" | "==" | ">=" | "in" | "<=" | "!=" | "array-contains" | "not-in" | "array-contains-any";
+    op: "<" | ">" | "==" | ">=" | "in" | "!=" | "<=" | "array-contains" | "not-in" | "array-contains-any";
 }, {
     value: string | number | boolean | (string | number | boolean)[] | null;
     field: string;
-    op: "<" | ">" | "==" | ">=" | "in" | "<=" | "!=" | "array-contains" | "not-in" | "array-contains-any";
+    op: "<" | ">" | "==" | ">=" | "in" | "!=" | "<=" | "array-contains" | "not-in" | "array-contains-any";
 }>;
 export type SieveFilterClause = z.infer<typeof sieveFilterClauseSchema>;
 export type SieveWhereOp = z.infer<typeof sieveWhereOpSchema>;

package/dist/schemas/webhooks/google-oauth.d.ts

@@ -22,8 +22,8 @@ export declare const googleSignInWithIdpResponseSchema: z.ZodObject<{
     localId: string;
     idToken: string;
     expiresIn: string;
-    email?: string | undefined;
     displayName?: string | undefined;
+    email?: string | undefined;
     emailVerified?: boolean | undefined;
     fullName?: string | undefined;
     kind?: string | undefined;
@@ -40,8 +40,8 @@ export declare const googleSignInWithIdpResponseSchema: z.ZodObject<{
     localId: string;
     idToken: string;
     expiresIn: string;
-    email?: string | undefined;
     displayName?: string | undefined;
+    email?: string | undefined;
     emailVerified?: boolean | undefined;
     fullName?: string | undefined;
     kind?: string | undefined;
@@ -64,16 +64,16 @@ export declare const googleTokenInfoSchema: z.ZodObject<{
     azp: z.ZodOptional<z.ZodString>;
     aud: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    email?: string | undefined;
     sub?: string | undefined;
+    email?: string | undefined;
     email_verified?: string | boolean | undefined;
     scopes?: string[] | undefined;
     expiry_date?: number | undefined;
     azp?: string | undefined;
     aud?: string | undefined;
 }, {
-    email?: string | undefined;
     sub?: string | undefined;
+    email?: string | undefined;
     email_verified?: string | boolean | undefined;
     scopes?: string[] | undefined;
     expiry_date?: number | undefined;

package/dist/security/authorization.d.ts

@@ -8,6 +8,7 @@
  * they depend on Firebase Admin and the user repository; implement them in your
  * app layer using these primitives.
  */
+import { type RoleCarrier } from "../features/auth/role-predicates";
 import type { UserRole } from "../features/auth/types";
 import type { JsonValue } from "../schemas/types";
 export type { UserRole };
@@ -21,15 +22,36 @@ export type { UserRole };
  */
 export declare const ROLE_HIERARCHY: Record<UserRole, number>;
 export declare function requireAuth(user: unknown): void;
+/**
+ * Require that the user HOLDS one of `roles`.
+ *
+ * 🛑 Intersects the user's full role SET with the required set (1.43). Was
+ * `requiredRoles.includes(user.role)` against a single scalar, which refused a
+ * seller who also held `employee` on a seller-gated route and vice versa — a
+ * 403 on a route the account is entitled to, with nothing in the response
+ * explaining why. 33 appkit call sites and 18 host call sites go through here.
+ */
 export declare function requireRole(user: Record<string, JsonValue> | null | undefined, roles: UserRole | UserRole[]): void;
 export declare function requireOwnership(user: Record<string, JsonValue> | null | undefined, resourceOwnerId: string): void;
 export declare function requireEmailVerified(user: Record<string, JsonValue> | null | undefined): void;
 export declare function requireActiveAccount(user: Record<string, JsonValue> | null | undefined): void;
 /**
- * Check if currentUserRole is allowed to change a target user's role.
- * - admin:     can change anyone's role
- * - moderator: can only change user → seller
+ * May this actor change a target user's roles?
+ *
+ * - admin: anyone's, to anything (admin sees and does everything).
+ * - employee (which `moderator` folds into): only the user → seller
+ *   onboarding step.
+ *
+ * 🛑 Takes a role CARRIER now, not a scalar, so an actor who holds
+ * `employee` alongside `seller` is still recognised as staff. The signature
+ * accepts a bare role string too, so the existing call sites keep compiling.
+ */
+export declare function canChangeRole(actor: RoleCarrier | UserRole, targetCurrentRole: UserRole, targetNewRole: UserRole): boolean;
+/**
+ * Return the numeric hierarchy level for a role.
+ *
+ * ⚠ For a USER, call `maxRoleLevel(user)` from `features/auth/auth-helpers` —
+ * it takes the highest rank across the held set. This function answers about
+ * one role name, which is only the whole story for a single-role account.
  */
-export declare function canChangeRole(currentUserRole: UserRole, targetCurrentRole: UserRole, targetNewRole: UserRole): boolean;
-/** Return the numeric hierarchy level for a role. */
 export declare function getRoleLevel(role: UserRole): number;

package/dist/security/authorization.js

@@ -9,7 +9,7 @@
  * app layer using these primitives.
  */
 import { AuthenticationError, AuthorizationError } from "../errors/index.js";
-import { isAccountDisabled } from "../features/auth/role-predicates.js";
+import { isAccountDisabled, holdsAnyRole, holdsRole, rolesOf, } from "../features/auth/role-predicates.js";
 import { ERROR_MESSAGES } from "../errors/messages.js";
 /**
  * 🛑 THE role hierarchy. There were two until 2026-08-29 — this one and a copy
@@ -21,7 +21,23 @@ import { ERROR_MESSAGES } from "../errors/messages.js";
  */
 export const ROLE_HIERARCHY = {
     admin: 5,
-    moderator: 4,
+    /*
+     * 🛑 Reconciled from 4 to 3 — EQUAL to employee — because `moderator` is
+     * collapsed into `employee` (A9, owner 2026-11-07: they are the same thing;
+     * moderation becomes an employee permission). `rolesOf()` folds the name
+     * away on read, so a normalised role set never contains it and this entry is
+     * only reachable through a raw, un-normalised scalar.
+     *
+     * Leaving it at 4 would have meant a backfilled moderator — now spelled
+     * `employee` — silently DROPPING a rank, so any `getRoleLevel` comparison
+     * written against "moderator or above" would start refusing them. Ranking
+     * them equal is what makes the fold a no-op for every hierarchy comparison
+     * in the codebase.
+     *
+     * The member stays declared so `Record<UserRole, number>` is total while the
+     * union still carries the deprecated name for un-backfilled documents.
+     */
+    moderator: 3,
     employee: 3,
     // Peers on purpose: a QA tester owns a real store and must clear every seller
     // gate. What a tester has BEYOND a seller is the `tester:admin-surfaces`
@@ -36,12 +52,20 @@ export function requireAuth(user) {
         throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     }
 }
+/**
+ * Require that the user HOLDS one of `roles`.
+ *
+ * 🛑 Intersects the user's full role SET with the required set (1.43). Was
+ * `requiredRoles.includes(user.role)` against a single scalar, which refused a
+ * seller who also held `employee` on a seller-gated route and vice versa — a
+ * 403 on a route the account is entitled to, with nothing in the response
+ * explaining why. 33 appkit call sites and 18 host call sites go through here.
+ */
 export function requireRole(user, roles) {
     if (!user)
         throw new AuthenticationError(ERROR_MESSAGES.AUTH.UNAUTHORIZED);
     const requiredRoles = Array.isArray(roles) ? roles : [roles];
-    const userRole = user.role || "user";
-    if (!requiredRoles.includes(userRole)) {
+    if (!holdsAnyRole(user, requiredRoles)) {
         throw new AuthorizationError(ERROR_MESSAGES.AUTH.FORBIDDEN);
     }
 }
@@ -65,19 +89,35 @@ export function requireActiveAccount(user) {
         throw new AuthorizationError(ERROR_MESSAGES.AUTH.ACCOUNT_DISABLED);
 }
 /**
- * Check if currentUserRole is allowed to change a target user's role.
- * - admin:     can change anyone's role
- * - moderator: can only change user → seller
+ * May this actor change a target user's roles?
+ *
+ * - admin: anyone's, to anything (admin sees and does everything).
+ * - employee (which `moderator` folds into): only the user → seller
+ *   onboarding step.
+ *
+ * 🛑 Takes a role CARRIER now, not a scalar, so an actor who holds
+ * `employee` alongside `seller` is still recognised as staff. The signature
+ * accepts a bare role string too, so the existing call sites keep compiling.
  */
-export function canChangeRole(currentUserRole, targetCurrentRole, targetNewRole) {
-    if (currentUserRole === "admin")
+export function canChangeRole(actor, targetCurrentRole, targetNewRole) {
+    const carrier = typeof actor === "string" ? { role: actor } : actor;
+    if (holdsRole(carrier, "admin"))
         return true;
-    if (currentUserRole === "moderator") {
-        return targetCurrentRole === "user" && targetNewRole === "seller";
+    if (holdsRole(carrier, "employee")) {
+        const [current] = rolesOf({ role: targetCurrentRole });
+        const [next] = rolesOf({ role: targetNewRole });
+        return current === "user" && next === "seller";
     }
     return false;
 }
-/** Return the numeric hierarchy level for a role. */
+/**
+ * Return the numeric hierarchy level for a role.
+ *
+ * ⚠ For a USER, call `maxRoleLevel(user)` from `features/auth/auth-helpers` —
+ * it takes the highest rank across the held set. This function answers about
+ * one role name, which is only the whole story for a single-role account.
+ */
 export function getRoleLevel(role) {
-    return ROLE_HIERARCHY[role] ?? 0;
+    const [canonical] = rolesOf({ role });
+    return ROLE_HIERARCHY[canonical] ?? 0;
 }

package/dist/security/index.d.ts

@@ -9,5 +9,5 @@ export type { Encrypted } from "./encrypted";
 export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, } from "./pii-encrypt";
 export { revealPii, maskPii, revealPiiAll, maskPiiAll } from "./pii-accessors";
 export { isPiiEncrypted, maskName, maskEmail, maskPhone, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, CONVERSATION_PII_FIELDS, MESSAGE_PII_FIELDS, } from "./pii-schemas";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, GIVEAWAY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, CONVERSATION_PII_FIELDS, MESSAGE_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, encryptBuffer, decryptBuffer, isBufferEncrypted, } from "./settings-encryption";

package/dist/security/index.js

@@ -21,7 +21,7 @@ export { revealPii, maskPii, revealPiiAll, maskPiiAll } from "./pii-accessors.js
 // pii-encrypt.ts) so this barrel stays safe to re-export from the
 // universal client+server index.ts. See pii-mask.ts's header comment.
 export { isPiiEncrypted, maskName, maskEmail, maskPhone, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask.js";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, CONVERSATION_PII_FIELDS, MESSAGE_PII_FIELDS, } from "./pii-schemas.js";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, GIVEAWAY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, CONVERSATION_PII_FIELDS, MESSAGE_PII_FIELDS, } from "./pii-schemas.js";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, encryptBuffer, decryptBuffer, isBufferEncrypted, } from "./settings-encryption.js";
 // RBAC system — DELETED 2026-08-29.
 //

package/dist/security/pii-mask.d.ts

@@ -97,7 +97,7 @@ export declare function maskPublicReview<T extends {
 }>(review: T): T;
 /**
  * Return a copy of a bid document with PII masked for public display
- * (auction product page).
+ * (collector drop product page).
  */
 export declare function maskPublicBid<T extends {
     userName: string;

package/dist/security/pii-mask.js

@@ -123,7 +123,7 @@ export function maskPublicReview(review) {
 }
 /**
  * Return a copy of a bid document with PII masked for public display
- * (auction product page).
+ * (collector drop product page).
  */
 export function maskPublicBid(bid) {
     return { ...bid, userName: maskName(bid.userName) };

package/dist/security/pii-schemas.d.ts

@@ -81,7 +81,31 @@ export declare const REVIEW_PII_INDEX_MAP: Record<string, string>;
 export declare const OFFER_PII_FIELDS: readonly ["buyerName", "buyerEmail", "sellerName"];
 /** PII fields in event entries */
 export declare const EVENT_ENTRY_PII_FIELDS: readonly ["userDisplayName", "userEmail", "ipAddress"];
-/** PII fields in lottery entries */
-export declare const LOTTERY_ENTRY_PII_FIELDS: readonly ["userPhone", "userEmail", "userDisplayName"];
+/** PII fields in giveaway entries */
+export declare const GIVEAWAY_ENTRY_PII_FIELDS: readonly ["userPhone", "userEmail", "userDisplayName"];
+/**
+ * PII fields on the stores collection.
+ *
+ * `pan` only — the seller's Permanent Account Number, needed to onboard them as
+ * a split-settlement vendor. It is a government identity number and the one
+ * field on `StoreDocument` whose disclosure has a legal dimension rather than a
+ * commercial one.
+ *
+ * 🛑 THIS IS NOT THE `STORE_SECRET_FIELDS` THE COMMENT BELOW DESCRIBES, and the
+ * difference is which KEY encrypts it. This list is assigned to
+ * `StoreRepository.piiFields`, so it is encrypted by `encryptPiiFields` with
+ * the PII key — the same mechanism as every other entry in this file, and the
+ * reason it belongs here. The deleted constant named fields encrypted with
+ * `SETTINGS_ENCRYPTION_KEY`, i.e. the OTHER crypto system, which is exactly why
+ * its presence in this registry was the hazard rather than its contents.
+ *
+ * 🛑 No blind index: nothing queries a store by PAN, and a PAN is not a lookup
+ * key — it is a value handed to one aggregator at registration time.
+ *
+ * 🛑 `StoreRepository.mapDoc` does NOT decrypt it. Reads return `enc:v1:…` and
+ * plaintext requires the named `revealPan` accessor, which is the
+ * `SiteSettingsRepository` shape `audit-pii-coverage` R3 prescribes.
+ */
+export declare const STORE_PII_FIELDS: readonly ["pan"];
 /** PII fields in savedPaymentMethods — full identifier (UPI VPA, card PAN, etc.) */
 export declare const PAYMENT_METHOD_PII_FIELDS: readonly ["identifier"];

package/dist/security/pii-schemas.js

@@ -165,12 +165,36 @@ export const EVENT_ENTRY_PII_FIELDS = [
     "userEmail",
     "ipAddress",
 ];
-/** PII fields in lottery entries */
-export const LOTTERY_ENTRY_PII_FIELDS = [
+/** PII fields in giveaway entries */
+export const GIVEAWAY_ENTRY_PII_FIELDS = [
     "userPhone",
     "userEmail",
     "userDisplayName",
 ];
+/**
+ * PII fields on the stores collection.
+ *
+ * `pan` only — the seller's Permanent Account Number, needed to onboard them as
+ * a split-settlement vendor. It is a government identity number and the one
+ * field on `StoreDocument` whose disclosure has a legal dimension rather than a
+ * commercial one.
+ *
+ * 🛑 THIS IS NOT THE `STORE_SECRET_FIELDS` THE COMMENT BELOW DESCRIBES, and the
+ * difference is which KEY encrypts it. This list is assigned to
+ * `StoreRepository.piiFields`, so it is encrypted by `encryptPiiFields` with
+ * the PII key — the same mechanism as every other entry in this file, and the
+ * reason it belongs here. The deleted constant named fields encrypted with
+ * `SETTINGS_ENCRYPTION_KEY`, i.e. the OTHER crypto system, which is exactly why
+ * its presence in this registry was the hazard rather than its contents.
+ *
+ * 🛑 No blind index: nothing queries a store by PAN, and a PAN is not a lookup
+ * key — it is a value handed to one aggregator at registration time.
+ *
+ * 🛑 `StoreRepository.mapDoc` does NOT decrypt it. Reads return `enc:v1:…` and
+ * plaintext requires the named `revealPan` accessor, which is the
+ * `SiteSettingsRepository` shape `audit-pii-coverage` R3 prescribes.
+ */
+export const STORE_PII_FIELDS = ["pan"];
 // `STORE_SECRET_FIELDS = ["whatsappConfig.accessToken"]` was deleted here.
 //
 // It had ZERO consumers, and its presence in this file was the whole hazard:

package/dist/seo/json-ld.d.ts

@@ -40,17 +40,17 @@ export interface ProductJsonLdInput {
     sellerName?: string;
     category?: string;
     status?: string;
-    auctionEndDate?: Date;
+    collectorDropEndDate?: Date;
     /** Canonical discriminator (SB1-G Phase 4). */
     listingType?: ListingType;
     /**
-     * The path this listing actually lives at, e.g. `/auctions/{slug}`.
+     * The path this listing actually lives at, e.g. `/collector-drops/{slug}`.
      *
-     * 🛑 Both builders hardcoded `/products/${slug}`, so an auction's own
+     * 🛑 Both builders hardcoded `/products/${slug}`, so a collector drop's own
      * structured data advertised its offer — and its `url` — at a path that
      * belongs to a different listing type. Measured live: the block on
-     * `/auctions/auction-beyblade-metal-lightning-l-drago` carried
-     * `offers.url: ".../products/auction-beyblade-metal-lightning-l-drago"`,
+     * `/collector-drops/collectordrop-beyblade-metal-lightning-l-drago` carried
+     * `offers.url: ".../products/collectordrop-beyblade-metal-lightning-l-drago"`,
      * and that URL served a full standard product page with Buy Now and Add to
      * Cart and no bid controls at all. So the one consumer that reads this field
      * — a crawler — was sent to the wrong page, and told it was canonical there.
@@ -203,7 +203,7 @@ export interface SiteIdentityOptions {
 }
 export declare function organizationJsonLd(opts?: SiteIdentityOptions): Record<string, JsonLdValue>;
 export declare function searchBoxJsonLd(opts?: SiteIdentityOptions): Record<string, JsonLdValue>;
-export declare function auctionJsonLd(auction: ProductJsonLdInput): Record<string, JsonLdValue>;
+export declare function collectorDropJsonLd(collectorDrop: ProductJsonLdInput): Record<string, JsonLdValue>;
 export interface ItemListJsonLdEntry {
     name: string;
     /** Path or absolute URL. Absolutised against the ONE canonical host. */

package/dist/seo/json-ld.js

@@ -54,7 +54,7 @@ function absoluteUrl(value, base = SITE_URL) {
      * caller type-checked, and then `ProductImage[]` replaced `string[]` on the
      * product document — so `images.map(absoluteUrl)` received OBJECTS, `?.trim`
      * was not a function, and the throw escaped into the RSC render and 500'd
-     * `/[locale]/products/[slug]` and `/[locale]/auctions/[id]`: **72 recorded
+     * `/[locale]/products/[slug]` and `/[locale]/collector-drops/[id]`: **72 recorded
      * failures**, the whole page lost to a decorative metadata field.
      *
      * A declared parameter type is a compile-time claim about CALLERS. It is
@@ -343,16 +343,16 @@ export function searchBoxJsonLd(opts) {
         },
     };
 }
-export function auctionJsonLd(auction) {
-    // An auction lives at /auctions/{slug} — see `detailPath`'s note.
-    const url = `${SITE_URL}${auction.detailPath ?? `/auctions/${auction.slug}`}`;
-    const base = productJsonLd(auction);
+export function collectorDropJsonLd(collectorDrop) {
+    // A collector drop lives at /collector-drops/{slug} — see `detailPath`'s note.
+    const url = `${SITE_URL}${collectorDrop.detailPath ?? `/collector-drops/${collectorDrop.slug}`}`;
+    const base = productJsonLd(collectorDrop);
     return {
         ...base,
         "@type": ["Product", "Offer"],
         url,
-        ...(auction.auctionEndDate && {
-            availabilityEnds: auction.auctionEndDate.toISOString(),
+        ...(collectorDrop.collectorDropEndDate && {
+            availabilityEnds: collectorDrop.collectorDropEndDate.toISOString(),
         }),
     };
 }

package/dist/seo/metadata.d.ts

@@ -54,14 +54,14 @@ export interface BlogSeoInput {
     updatedAt?: Date;
     authorName?: string;
 }
-export interface AuctionSeoInput {
+export interface CollectorDropSeoInput {
     title: string;
     slug: string;
     description: string;
     seoTitle?: string;
     seoDescription?: string;
     mainImage?: string;
-    auctionEndDate?: Date;
+    collectorDropEndDate?: Date;
 }
 export declare function generateProfileMetadata(user: {
     displayName: string | null;
@@ -73,5 +73,5 @@ export declare function generateProfileMetadata(user: {
 export declare function generateProductMetadata(product: ProductSeoInput, seoConfig?: SeoConfig): Metadata;
 export declare function generateCategoryMetadata(category: CategorySeoInput, seoConfig?: SeoConfig): Metadata;
 export declare function generateBlogMetadata(post: BlogSeoInput, seoConfig?: SeoConfig): Metadata;
-export declare function generateAuctionMetadata(auction: AuctionSeoInput, seoConfig?: SeoConfig): Metadata;
+export declare function generateCollectorDropMetadata(collectorDrop: CollectorDropSeoInput, seoConfig?: SeoConfig): Metadata;
 export declare function generateSearchMetadata(q: string, category?: string, seoConfig?: SeoConfig): Metadata;

package/dist/seo/metadata.js

@@ -127,16 +127,16 @@ export function generateBlogMetadata(post, seoConfig = SEO_CONFIG) {
         modifiedTime: post.updatedAt?.toISOString(),
     }, seoConfig);
 }
-export function generateAuctionMetadata(auction, seoConfig = SEO_CONFIG) {
-    const title = auction.seoTitle || `Auction: ${auction.title}`;
-    const description = auction.seoDescription ||
-        auction.description.slice(0, 160) ||
-        `Bid on ${auction.title} on ${seoConfig.siteName}.`;
+export function generateCollectorDropMetadata(collectorDrop, seoConfig = SEO_CONFIG) {
+    const title = collectorDrop.seoTitle || `Collector Drop: ${collectorDrop.title}`;
+    const description = collectorDrop.seoDescription ||
+        collectorDrop.description.slice(0, 160) ||
+        `Bid on ${collectorDrop.title} on ${seoConfig.siteName}.`;
     return generateMetadata({
         title,
         description,
-        image: auction.mainImage || seoConfig.defaultImage,
-        path: `/auctions/${auction.slug}`,
+        image: collectorDrop.mainImage || seoConfig.defaultImage,
+        path: `/collector-drops/${collectorDrop.slug}`,
         type: "website",
     }, seoConfig);
 }

package/dist/server-entry.d.ts

@@ -21,11 +21,11 @@ export { EventsListPageView } from "./features/events/components/EventsListPageV
 export { MarketplaceHomepageView } from "./features/homepage/index";
 export { PreOrdersListView } from "./features/pre-orders/index";
 export { PreOrderDetailPageView } from "./features/pre-orders/index";
-export { AuctionDetailPageView } from "./features/auctions/index";
-export { AuctionsListView } from "./features/auctions/components/AuctionsListView";
+export { CollectorDropDetailPageView } from "./features/collector-drops/index";
+export { CollectorDropsListView } from "./features/collector-drops/components/CollectorDropsListView";
 export { BundlesListView } from "./features/categories/components/BundlesListView";
-export { PrizeDrawsListingView } from "./features/products/components/PrizeDrawsListingView";
-export { PrizeDrawDetailPageView } from "./features/products/components/PrizeDrawDetailPageView";
+export { ClearanceListingView } from "./features/products/components/ClearanceListingView";
+export { ClearanceDetailPageView } from "./features/products/components/ClearanceDetailPageView";
 export { ProductDetailPageView } from "./features/products/components/ProductDetailPageView";
 export { ProductsIndexPageView } from "./features/products/components/ProductsIndexPageView";
 export { ClassifiedDetailPageView } from "./features/classified/components/ClassifiedDetailPageView";
@@ -38,9 +38,9 @@ export { ReviewDetailPageView } from "./features/reviews/components/ReviewDetail
 export { StoresIndexPageView } from "./features/stores/components/StoresIndexPageView";
 export { StoreDetailLayoutView } from "./features/stores/components/StoreDetailLayoutView";
 export { StoreProductsPageView } from "./features/stores/components/StoreProductsPageView";
-export { StoreAuctionsPageView } from "./features/stores/components/StoreAuctionsPageView";
+export { StoreCollectorDropsPageView } from "./features/stores/components/StoreCollectorDropsPageView";
 export { StorePreOrdersPageView } from "./features/stores/components/StorePreOrdersPageView";
-export { StorePrizeDrawsPageView } from "./features/stores/components/StorePrizeDrawsPageView";
+export { StoreClearancePageView } from "./features/stores/components/StoreClearancePageView";
 export { StoreBundlesPageView } from "./features/stores/components/StoreBundlesPageView";
 export { StoreClassifiedsPageView } from "./features/stores/components/StoreClassifiedsPageView";
 export { StoreSparesPageView } from "./features/stores/components/StoreSparesPageView";
@@ -49,14 +49,14 @@ export { StoreLiveItemsPageView } from "./features/stores/components/StoreLiveIt
 export { StoreArtStickersPageView } from "./features/stores/components/StoreArtStickersPageView";
 export { getProductForDetail, listSitemapProducts, type SitemapProduct, } from "./_internal/server/features/products/index";
 export { listPublicProducts, parsePublicProductParams, defaultAvailabilityForListingTypes, PUBLIC_PRODUCT_MAX_PAGE_SIZE, ANY_STATUS, type PublicProductListInput, type PublicProductListResult, type PublicProductListOptions, type PublicProductExecutor, type PublicProductQuery, } from "./_internal/server/features/products/index";
-export { getAuctionForDetail, getProductFeaturesForAuction, } from "./_internal/server/features/auctions/index";
+export { getCollectorDropForDetail, getProductFeaturesForCollectorDrop, } from "./_internal/server/features/collector-drops/index";
 export { getPreOrderForDetail, getProductFeaturesForPreOrder, } from "./_internal/server/features/pre-orders/index";
 export { getBrandForDetail, getBrandCategoryForDetail, createBrandAction, updateBrandAction, deleteBrandAction, toggleBrandActiveAction, } from "./_internal/server/features/brands/index";
 export { getAttachedCoupons, toAttachedCoupon } from "./_internal/server/features/promotions/index";
 export { getBlogPostForDetail, getBlogPostById, createBlogPostAction, updateBlogPostAction, deleteBlogPostAction, publishBlogPostAction, unpublishBlogPostAction, } from "./_internal/server/features/blog/index";
 export { getEventForDetail, registerForEventAction, cancelEventRegistrationAction, createEventAction, updateEventAction, } from "./_internal/server/features/events/index";
-export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./_internal/server/features/products/index";
-export { placeBidAction as placeBidServerAction } from "./_internal/server/features/auctions/index";
+export { createProductAction, createCollectorDropAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./_internal/server/features/products/index";
+export { placeBidAction as placeBidServerAction } from "./_internal/server/features/collector-drops/index";
 export { reservePreOrderAction } from "./_internal/server/features/pre-orders/index";
 export { getCartForUser, addToCartAction, removeFromCartAction, clearCartAction, mergeGuestCartAction, CART_MAX_ITEMS, CART_GUEST_STORAGE_KEY, } from "./_internal/server/features/cart/index";
 export { getOrderForDetail, getOrdersForBuyer, getRecentOrdersForBuyer, createOrderAction, cancelOrderAction, requestReturnAction, updateOrderStatusAction, ORDERS_PAGE_SIZE, orderDocumentToOrder, } from "./_internal/server/features/orders/index";
@@ -68,13 +68,13 @@ export { renderFaqOg, renderFaqOgImage, type FaqOgData, } from "./_internal/serv
 export { renderScamOg, renderScamOgImage, type ScamOgData, getScammerForDetail, getScammerProfilePageData as getScammerProfilePageDataCached, } from "./_internal/server/features/scams/index";
 export { getCategoryForDetail, listRootCategories, listFeaturedCategories, listMenuCategories, getCategoryTree, listSitemapCategories, CATEGORIES_PAGE_SIZE, CATEGORIES_ROOT_TIER, CATEGORIES_MAX_DEPTH, CATEGORIES_SITEMAP_LIMIT, CATEGORIES_FEATURED_LIMIT, CATEGORIES_MENU_LIMIT, } from "./_internal/server/features/categories/index";
 export { getGroupedListingForDetail, getGroupedListingWithItems, listGroupedListings, listFeaturedGroupedListings, listSitemapGroupedListings, getGroupsForProduct, getGroupsWithItemsForProduct, GROUPED_LISTINGS_PAGE_SIZE, GROUPED_LISTINGS_FEATURED_LIMIT, GROUPED_LISTINGS_SITEMAP_LIMIT, buildGroupedListingMetadata, renderGroupedListingOg, type GroupedListingWithItems, type ListGroupedListingsParams, type SitemapGroupedListing, type GroupedListingMetadataOptions, } from "./_internal/server/features/grouped/index";
-export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlaceGatewayOrderAction, previewCheckoutPricing, resolveShippingCost, formatShippingAddress, CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, type CreateCheckoutOrderInput, type VerifyAndPlaceGatewayOrderInput, type CheckoutOrderResult, type CheckoutPaymentMethod, type CheckoutPricingPreviewInput, type CheckoutPricingPreview, } from "./_internal/server/features/checkout/index";
+export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlaceGatewayOrderAction, previewCheckoutPricing, resolveShippingCost, formatShippingAddress, CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, assertPaymentMethodAllowed, assertCollectingGateway, resolveCollectingGatewayForCart, cartVendorComposition, cartRequiresSplitSettlement, SETTLEMENT_CONSTRAINT, GATEWAY_UNAVAILABLE_CODE, resolveCaptureSplit, buildSplitInstructions, splitRefusalReason, vendorSettlementForGroup, orderNeedsManualPayout, recordSplitSettlementPayouts, SPLIT_UNSETTLEABLE_CODE, type CollectingGatewayResult, type SettlementConstraint, type CartVendorComposition, type GatewayResolution, type SplitCandidateGroup, type SplitSettlementLine, type BuiltSplitInstructions, type SplitBlockedStore, type VendorSettlement, type SplitSettlementPayoutInput, type CaptureSplitInput, type CaptureSplitGroupInput, type ResolvedCaptureSplit, type CreateCheckoutOrderInput, type VerifyAndPlaceGatewayOrderInput, type CheckoutOrderResult, type CheckoutPaymentMethod, type CheckoutPricingPreviewInput, type CheckoutPricingPreview, } from "./_internal/server/features/checkout/index";
 export { unitPriceFor, lineTotalFor, sumGroupGst, computePreOrderDepositAmount, allocatePointsAcrossGroups, pointsBaseForGroup, resolvePointsTender, type GroupGstSummary, type GstRateSlice, } from "./_internal/shared/checkout/order-math";
 export { computeGroupCouponDiscount, computeCartCouponDiscount, type GroupCouponDiscountResult, type CartCouponDiscountResult, } from "./_internal/shared/checkout/coupon-discount";
 export { refundCapacity, refundableBase, committedRefundTotal, platformFeeWithheld, wouldBeFullRefund, MONEY_EPSILON, type RefundCapacity, type RefundableOrderLike, } from "./_internal/shared/checkout/refundable-base";
 export { processRefundAction, type ProcessRefundInput, } from "./_internal/server/features/refunds/actions";
 export { getSublistingCategoryForDetail } from "./_internal/server/features/sublisting-categories/index";
-export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores, STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, } from "./_internal/server/features/stores/index";
+export { getStoreForDetail, listStoreProductsInitial, listStoreCollectorDropsInitial, listStorePreOrdersInitial, listSitemapStores, STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, onStoreActivated, STORE_VENDOR_REGISTER_JOB, } from "./_internal/server/features/stores/index";
 export { AppShell } from "./_internal/client/scaffolds/index";
 export type { AppShellProps, AppShellRenderContext, } from "./_internal/client/scaffolds/index";
 export { toClient, clientInitial } from "./_internal/shared/serialization/index";
@@ -84,11 +84,11 @@ export * as scamsServer from "./_internal/server/features/scams/index";
 export { AppkitError, UnauthorizedError, CapacityError, ExpiredError, } from "./_internal/shared/errors/index";
 export { NotFoundError, ValidationError, ConflictError } from "./errors/index";
 export type { AppkitConfig } from "./_internal/shared/config/schema";
-export type { AppkitBusinessConfig, AppkitBusinessAddress, AppkitBusinessSupport, AppkitBusinessGrievance, AppkitBusinessPolicy, AppkitBusinessBank, PendingString, } from "./_internal/shared/config/schema";
+export type { AppkitBusinessConfig, AppkitBusinessAddress, AppkitBusinessSupport, AppkitBusinessGrievance, AppkitBusinessPolicy, AppkitBusinessBank, AppkitPortalHostsConfig, PendingString, } from "./_internal/shared/config/schema";
 export { SEMANTIC_COLORS, SEMANTIC_COLORS_DARK, SEMANTIC_RADIUS, SEMANTIC_SHADOWS, SEMANTIC_Z_INDEX, MOTION_TOKENS, BREAKPOINTS, PLATFORM_LIMITS, } from "./_internal/shared/tokens/index";
 export type { Responsive, Breakpoint, SemanticColor } from "./_internal/shared/tokens/index";
 export { renderProductOg, renderProductOgImage, type ProductOgData, type OgOptions } from "./_internal/server/features/products/og";
-export { renderAuctionOg, renderAuctionOgImage, type AuctionOgData } from "./_internal/server/features/auctions/og";
+export { renderCollectorDropOg, renderCollectorDropOgImage, type CollectorDropOgData } from "./_internal/server/features/collector-drops/og";
 export { renderPreOrderOg, renderPreOrderOgImage, type PreOrderOgData } from "./_internal/server/features/pre-orders/og";
 export { renderStoreOg, renderStoreOgImage, type StoreOgData } from "./_internal/server/features/stores/og";
 export { renderBrandOg, renderBrandOgImage, type BrandOgData } from "./_internal/server/features/brands/og";