@mohasinac/appkit 4.71.0 → 4.71.2

package/dist/features/admin/schemas/firestore.d.ts

@@ -5,7 +5,7 @@
 import type { AboutContentDocument } from "../../about/schemas/firestore";
 import type { RateChange } from "../../../_internal/shared/features/pricing/rate-registry";
 export declare const ADMIN_CHECKOUT_BYPASS_FLAG_KEY: "adminCheckoutBypass";
-export declare const NOTIFICATION_TYPE_VALUES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "support_ticket_update", "scam_report_update", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale", "message_received"];
+export declare const NOTIFICATION_TYPE_VALUES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "collector_drop_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "support_ticket_update", "scam_report_update", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale", "message_received"];
 export type NotificationType = (typeof NOTIFICATION_TYPE_VALUES)[number];
 /**
  * What a notification points AT. Drives the shared `actionUrl` resolver, so a
@@ -18,6 +18,7 @@ export type NotificationType = (typeof NOTIFICATION_TYPE_VALUES)[number];
 export declare const NOTIFICATION_RELATED_TYPE_VALUES: readonly ["order", "product", "bid", "review", "blog", "user", "offer", "support_ticket", "scammer", "catalogueItem", "payout", "store", "conversation", "event"];
 export type NotificationRelatedType = (typeof NOTIFICATION_RELATED_TYPE_VALUES)[number];
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { CheckoutPolicySettings } from "../../../_internal/shared/checkout/policy-consent";
 export type NotificationPriority = "low" | "normal" | "high";
 export interface NotificationDocument extends BaseDocument {
     userId: string;
@@ -78,7 +79,7 @@ export type NotificationUpdateInput = Partial<Pick<NotificationDocument, "isRead
 export declare const notificationQueryHelpers: {
     readonly byUser: (userId: string) => readonly ["userId", "==", string];
     readonly unread: (userId: string) => readonly [readonly ["userId", "==", string], readonly ["isRead", "==", false]];
-    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "support_ticket_update" | "scam_report_update" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale" | "message_received"];
+    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "collector_drop_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "support_ticket_update" | "scam_report_update" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale" | "message_received"];
 };
 export interface TrustBarItem {
     icon: string;
@@ -113,6 +114,18 @@ export interface SiteSettingsCredentials {
     razorpayKeySecret?: string;
     /** Webhook signing secret from Razorpay's dashboard → Webhooks. Without it `verifyWebhook()` fails closed. */
     razorpayWebhookSecret?: string;
+    /**
+     * Cashfree Payments App ID — sent as `x-client-id`.
+     *
+     * 🛑 Unlike `razorpayKeyId` above, this is NOT publishable. Cashfree hands the
+     * browser a per-order `payment_session_id` instead, so no Cashfree credential
+     * ever leaves the server.
+     */
+    cashfreeAppId?: string;
+    /** Cashfree secret key — `x-client-secret`. Server-only. */
+    cashfreeSecretKey?: string;
+    /** "sandbox" | "production" — selects Cashfree's base URL. */
+    cashfreeEnvironment?: string;
     resendApiKey?: string;
     whatsappApiKey?: string;
     metaAppId?: string;
@@ -162,6 +175,9 @@ export interface SiteSettingsCredentialsMasked {
     razorpayKeyId?: string;
     razorpayKeySecret?: string;
     razorpayWebhookSecret?: string;
+    cashfreeAppId?: string;
+    cashfreeSecretKey?: string;
+    cashfreeEnvironment?: string;
     resendApiKey?: string;
     whatsappApiKey?: string;
     metaAppId?: string;
@@ -377,12 +393,25 @@ export interface SiteSettingsDocument extends BaseDocument {
          *
          * 🛑 The site-wide fallback `resolveDisplayedUpiId` uses when a seller has
          * no UPI configured or the store is admin-owned — i.e. what a buyer paying
-         * manually is told to pay INTO. It was being silently erased on every
-         * settings save until 2026-10-19: `buildFullPayload()` writes the whole
-         * `contact` group and simply did not carry this key, so saving any
-         * unrelated tab blanked it and manual payments lost their destination.
-         * Any key added here must also be added to that function's state and
-         * payload (Root Cause #76).
+         * manually is told to pay INTO. It was lost on settings saves until
+         * 2026-10-19, when `AdminSiteSettingsView` grew state, a hydrate, a payload
+         * entry and a control for it.
+         *
+         * 🛑 CORRECTED 2026-10-31 — the MECHANISM this comment used to name was
+         * wrong, and it had propagated to two other comments in this file. It read
+         * *"`buildFullPayload()` writes the whole `contact` group and simply did not
+         * carry this key, so saving any unrelated tab blanked it"*. It does not:
+         * `SiteSettingsRepository.updateSingleton` writes
+         * `.update(toDottedPaths(updateData))`, so a group is flattened to leaf
+         * paths and **an omitted key is never touched**. Omission is
+         * non-destructive.
+         *
+         * The real failure is the MIRROR: a key that `buildFullPayload` DOES send
+         * but the hydrate step never reads back. Its React state keeps its literal
+         * default, and the next save of any tab writes that default over whatever
+         * was stored. So all four of **state · hydrate · payload · control** are
+         * still required for every key here — the reason is "a default would be
+         * written", not "the key would be deleted".
          */
         upiVpa?: string;
         /** WhatsApp number with country code (market-specific) */
@@ -400,9 +429,15 @@ export interface SiteSettingsDocument extends BaseDocument {
         /**
          * Razorpay (client-side card/UPI/netbanking modal).
          *
-         * 🛑 Checked BEFORE `phonepeEnabled` in `providers.config.ts` — exactly
-         * one online gateway can be registered per process, so the order is the
-         * tie-break when both are on, not a precedence anyone should rely on.
+         * 🛑 FIRST in `providers.config.ts`'s tie-break
+         * (**razorpay → phonepe → cashfree → manual**), which decides the
+         * process-level DEFAULT provider when more than one is on — not a
+         * precedence anyone should rely on.
+         *
+         * 🛑 It no longer decides which gateway COLLECTS. Every enabled gateway is
+         * registered and the choice is per cart (see `platformStoreId` below): a
+         * cart holding another store's items must be collected by one that splits
+         * at capture, whatever won this tie-break.
          * Turning this on with no credentials makes the provider constructor
          * throw at boot; `resolveKeys()` treats a seeded `*_PLACEHOLDER` as
          * absent, so a placeholder reads as "unconfigured" rather than failing
@@ -410,6 +445,77 @@ export interface SiteSettingsDocument extends BaseDocument {
          */
         razorpayEnabled: boolean;
         phonepeEnabled: boolean;
+        /**
+         * Cashfree Payments (PG Orders API, `CashfreeProvider`).
+         *
+         * LAST of the three in the tie-break, so it is the process-level DEFAULT
+         * only when both `razorpayEnabled` and `phonepeEnabled` are false.
+         *
+         * 🛑 CORRECTED — "runs only when the others are off" is no longer true, and
+         * the difference is the whole of Phase 1c. Every enabled gateway is
+         * registered (`ProviderRegistry.paymentGateways`), and the gateway that
+         * collects a given cart is chosen PER CART: anything holding another
+         * store's items must be collected by one that splits at capture, which
+         * today means this one. So enabling Cashfree beside PhonePe is a real and
+         * intended configuration — PhonePe stays the default for the platform's
+         * own stock, Cashfree collects everything multi-vendor — rather than a
+         * setting that silently does nothing.
+         *
+         * 🛑 It exists because Razorpay and PhonePe both name "Bidding/Auction
+         * houses" in their prohibited-merchant lists and this marketplace's
+         * `collector-drop` listing type is competitive bidding. Adding the gateway
+         * does NOT by itself open any listing type to online payment —
+         * `blockedPaymentMethods` on each checkout rule is unchanged and is a
+         * separate, provider-aware change.
+         *
+         * Needs App ID + Secret Key under Credentials (or `CASHFREE_APP_ID` /
+         * `CASHFREE_SECRET_KEY`); the constructor throws at boot on empty
+         * credentials, same as Razorpay's.
+         */
+        cashfreeEnabled: boolean;
+        /**
+         * The `storeId` of the platform's OWN store — the one store whose stock the
+         * proprietorship may lawfully collect payment for into its own account.
+         *
+         * 🛑 UNSET MEANS EVERY STORE IS THIRD-PARTY, and that direction is the
+         * whole value of the field. A split settlement is lawful because the money
+         * never enters the platform's account (buyer → aggregator escrow →
+         * vendor); a gateway that cannot split at capture settles the lot into the
+         * proprietor's current account, and the only way a vendor's share then
+         * reaches them is a payout from that account — which is the RBI
+         * commingling. So an install that has not been told which store is its own
+         * must REFUSE online collection for every cart rather than assume the cart
+         * is all its own stock. Assuming the other way round is a silent commingle
+         * on a real payment, and it presents as a completely successful checkout,
+         * so nothing would ever surface it.
+         *
+         * Read by `cartVendorComposition`
+         * (`_internal/shared/checkout/settlement.ts`): any cart holding a line
+         * whose `storeId` is not this value must be collected by a gateway that
+         * splits at capture. A cart that is only this store's stock may use
+         * whichever gateway is enabled.
+         *
+         * 🛑 A `storeId`, not a slug-looking free-text label — on this platform
+         * `storeId === storeSlug === store.id` (see `StoreDocument`), which is also
+         * the key `splitCartIntoOrderGroups` groups on, so the comparison is
+         * against the same identifier the orders are keyed by. A value naming no
+         * real store behaves exactly like unset: every cart is third-party.
+         *
+         * 🛑 `PLATFORM_STORE_ID` (`features/stores/schemas/firestore.ts`) ALREADY
+         * NAMES THE SAME STORE, and this field is deliberately a second
+         * declaration rather than a reader of it. That constant answers PRODUCT
+         * questions — which store a catalogue consignment is filed under, which
+         * store may not decline to fund the points programme; a wrong answer there
+         * is a mis-filed listing. This answers a COMPLIANCE question — whose money
+         * this business may collect into its own account; a wrong answer is RBI
+         * commingling on a real payment. Defaulting this to that constant would
+         * put a hardcoded brand literal (consumer data its own comment says does
+         * not belong in appkit, tracked for removal under A5c) in charge of an
+         * authorisation decision for every install of the package. The SEED sets
+         * this from the constant, so the two agree for this install without the
+         * rule inheriting a default nobody chose.
+         */
+        platformStoreId?: string;
         upiManualEnabled: boolean;
         codEnabled: boolean;
         /**
@@ -553,7 +659,7 @@ export interface SiteSettingsDocument extends BaseDocument {
         payoutHoldDays?: number;
         /** Minimum payout amount in rupees. */
         minPayoutAmount?: number;
-        auctionListingFee?: number;
+        collectorDropListingFee?: number;
         preOrderListingFee?: number;
         featuredSlotFee?: number;
         promotedSlotFee?: number;
@@ -573,8 +679,8 @@ export interface SiteSettingsDocument extends BaseDocument {
         legalName: string;
         address: string;
     };
-    auctionConfig: {
-        /** Ordered ascending by upTo; the last tier's upTo MUST be null (open-ended, "and above"). Drives the tiered minimum bid increment — see resolveMinBidIncrement in _internal/shared/features/auctions/config.ts. */
+    collectorDropConfig: {
+        /** Ordered ascending by upTo; the last tier's upTo MUST be null (open-ended, "and above"). Drives the tiered minimum bid increment — see resolveMinBidIncrement in _internal/shared/features/collector-drops/config.ts. */
         bidIncrementTiers: {
             upTo: number | null;
             increment: number;
@@ -630,6 +736,35 @@ export interface SiteSettingsDocument extends BaseDocument {
     chat?: {
         enabled: boolean;
     };
+    /**
+     * Site-wide maintenance window. The edge gate (`src/proxy.ts` in the
+     * consumer) reads this via `GET /api/maintenance`, which deliberately
+     * reads the RAW Firestore snapshot rather than this typed field — its own
+     * header explains why: that endpoint predates this declaration, written
+     * when the consumer was pinned to the npm registry build (an appkit
+     * source change was invisible until the next publish, "every way of
+     * forcing one is blocked"). The consumer is `file:./appkit` now, so that
+     * constraint no longer holds, but the route's own caching/fail-open
+     * behavior is unrelated to this field and is deliberately left untouched
+     * here — this declaration exists so OTHER typed readers (1A-vi's
+     * TOGGLE_CATALOG) have a real field to point at, not to migrate that route.
+     */
+    maintenance?: {
+        enabled: boolean;
+        message?: string;
+    };
+    /**
+     * The customer-assistant floating widget / full-chat page. A kill switch
+     * on an already-shipped path, the opposite polarity to `chat` above:
+     * absent, an unseeded document, and a failed settings fetch all mean ON —
+     * only an explicit `false` turns it off. Turning it off hides the widget
+     * everywhere it is mounted (site-wide, via `LayoutShellClient`), not just
+     * the API — `answerAssistantQuestion` refuses too, so a stale client
+     * cannot route around the switch.
+     */
+    assistant?: {
+        enabled: boolean;
+    };
     /**
      * The public search index — the browser-side artifact, not the per-listing
      * search boxes, which this flag cannot reach.
@@ -645,13 +780,24 @@ export interface SiteSettingsDocument extends BaseDocument {
      * (`useSearchIndex`).
      *
      * 🛑 It is NOT in `payment` or any other existing group, and that is
-     * defensive rather than tidy. `AdminSiteSettingsView.buildFullPayload`
-     * writes `payment: { phonepeEnabled, upiManualEnabled, codEnabled,
-     * otpCheckoutThreshold }` — the WHOLE group, from four pieces of form
-     * state — so any fifth key in there is silently erased the next time an
-     * admin saves anything on that page (Root Cause #76). A kill switch that a
-     * routine save turns back on is worse than none, because it fails in the
-     * direction of the thing it exists to stop.
+     * defensive rather than tidy — but the REASON stated here was wrong until
+     * 2026-10-31 and is corrected below.
+     *
+     * It read: *"`buildFullPayload` writes `payment: { phonepeEnabled,
+     * upiManualEnabled, codEnabled, otpCheckoutThreshold }` — the WHOLE group,
+     * from four pieces of form state — so any fifth key in there is silently
+     * erased"*. Both halves were wrong. The key list was stale (it already wrote
+     * `razorpayEnabled` and `codMaxOrderValue` too, and now `cashfreeEnabled`),
+     * and the mechanism does not exist: `updateSingleton` writes
+     * `.update(toDottedPaths(updateData))`, so a group is flattened to LEAF paths
+     * and an omitted key is never touched.
+     *
+     * The hazard that IS real is the mirror — a key the payload SENDS but the
+     * hydrate never reads back gets its React default written over the stored
+     * value on the next save of any tab. A kill switch that a routine save turns
+     * back on is worse than none, because it fails in the direction of the thing
+     * it exists to stop; being outside a form-managed group removes that risk
+     * entirely rather than relying on four edits staying in step.
      *
      * ## 🛑 Default ON — the opposite polarity to `chat.enabled`
      *
@@ -670,6 +816,22 @@ export interface SiteSettingsDocument extends BaseDocument {
     search?: {
         indexEnabled?: boolean;
     };
+    /**
+     * 2B (overhaul brief) — which of `routing.ts`'s (still just `["en"]`)
+     * locales are actually live. Deliberately NOT where the locale set
+     * itself lives — `routing.ts`'s own header explains why `Locale` has to
+     * stay a committed TS literal rather than a runtime-sourced value (it
+     * backs compile-time locale checking everywhere). This is a NARROWING
+     * list on top of that: an admin can take a configured locale temporarily
+     * out of rotation without touching code, never add one that has no
+     * `messages/<locale>.json`.
+     *
+     * Absent or empty means "every locale in `routing.ts` is live" — the
+     * same fail-open default every other flag in this file uses, so an
+     * unseeded install or a failed settings read never silently hides the
+     * only language the site has.
+     */
+    enabledLocales?: string[];
     /**
      * The WhatsApp catalogue feed — `/whatsapp/{storeSlug}/feed.csv`, read on a
      * schedule by each seller's own Meta Commerce Manager.
@@ -679,11 +841,18 @@ export interface SiteSettingsDocument extends BaseDocument {
      * It is NOT in `notificationChannels.whatsapp`, which governs the platform's
      * outbound order-update templates — a different channel with a different cost
      * (per-template spend vs. a public CSV), owned by the platform rather than
-     * pointed at by each seller. Nor is it in `payment` or any other group that
-     * `AdminSiteSettingsView.buildFullPayload` rewrites WHOLE from form state: a
-     * fifth key in such a group is silently erased the next time an admin saves
-     * anything on that page (Root Cause #76), and a kill switch that a routine
-     * save turns back on fails in the direction of the thing it exists to stop.
+     * pointed at by each seller. Nor is it in `payment` or any other group
+     * `AdminSiteSettingsView.buildFullPayload` assembles from form state.
+     *
+     * 🛑 CORRECTED 2026-10-31 — this used to say *"a fifth key in such a group is
+     * silently erased the next time an admin saves anything on that page"*, which
+     * is not a thing that happens: `updateSingleton` writes
+     * `.update(toDottedPaths(updateData))`, so an omitted key is left untouched.
+     * The hazard is the mirror — a key the payload sends but the hydrate never
+     * reads back has its React default written over the stored value — and a kill
+     * switch that a routine save turns back on fails in the direction of the thing
+     * it exists to stop. Staying outside a form-managed group removes that risk
+     * rather than relying on state/hydrate/payload/control staying in step.
      *
      * ## 🛑 Default ON — reader tests `!== false`
      *
@@ -726,13 +895,6 @@ export interface SiteSettingsDocument extends BaseDocument {
         keywords: string[];
         ogImage: string;
     };
-    features: {
-        id: string;
-        name: string;
-        description: string;
-        icon: string;
-        enabled: boolean;
-    }[];
     /**
      * Which listing and category types the marketplace offers.
      *
@@ -752,14 +914,21 @@ export interface SiteSettingsDocument extends BaseDocument {
      * compile error — this interface is not, and historically drifted: it still
      * listed 8 types after the union reached 10 (`art` and `stickers` missing),
      * which is Root Cause #58's shape. Add new types to that Record, not here.
+     *
+     * 🛑 A third value, `"unlisted"`, sits between `true` and `false`: the type
+     * stays enabled (`isListingTypeEnabled` returns `true` for it — nothing
+     * 404s, a direct link a customer already holds keeps working) but is
+     * dropped from nav/footer/sitemap (`isListingTypeListed` returns `false`).
+     * Existing `!== false` comparisons are untouched by this addition, which is
+     * exactly why it is additive rather than a breaking change to every reader.
      */
     listings?: {
-        listingTypes?: Partial<Record<string, boolean>>;
+        listingTypes?: Partial<Record<string, boolean | "unlisted">>;
         categoryTypes?: {
-            category?: boolean;
-            sublisting?: boolean;
-            brand?: boolean;
-            bundle?: boolean;
+            category?: boolean | "unlisted";
+            sublisting?: boolean | "unlisted";
+            brand?: boolean | "unlisted";
+            bundle?: boolean | "unlisted";
         };
         /**
          * Which public BROWSE SECTIONS are open — `/categories`, `/brands`,
@@ -779,7 +948,7 @@ export interface SiteSettingsDocument extends BaseDocument {
          * when the two drift (it listed 8 types after the union reached 10).
          * Add a new section THERE, not here.
          */
-        browsePages?: Partial<Record<string, boolean>>;
+        browsePages?: Partial<Record<string, boolean | "unlisted">>;
         /**
          * Public paths withdrawn wholesale — closed including every descendant.
          *
@@ -829,6 +998,31 @@ export interface SiteSettingsDocument extends BaseDocument {
         /** Grievance officer disclosure — a PolicyPageView key since 2026-10-19. */
         grievance: string;
     };
+    /**
+     * The BLOCKING buyer agreement at checkout (item 1.39).
+     *
+     * 🛑 Distinct from `legalPages` above, and the difference is the whole point.
+     * `legalPages` is the published policy a buyer *could* read; this is the
+     * short list of consequences a buyer *must* tick through before an order is
+     * accepted — "no cancellation once you reveal", "no refund once it ships".
+     * Burying those in a linked page is what the blocking step exists to stop.
+     *
+     * Clause shape, defaults and resolution live in
+     * `_internal/shared/checkout/policy-consent.ts`. Each clause names the
+     * CAPABILITY it is a consequence of, never a listing type — so widening a
+     * mechanic to another type makes its clause appear with no code change.
+     *
+     * Absent, or present with an empty `clauses` array, falls back to
+     * `DEFAULT_CHECKOUT_POLICY_CLAUSES`. 🛑 Deliberately NOT "absent means no
+     * consent required": an install that has never configured policies must
+     * still block checkout behind the step, because the mechanic that needs the
+     * consent ships whether or not an admin has visited this screen.
+     *
+     * `version` is bumped by an admin when the wording changes materially. The
+     * hash stored on each order is what proves WHAT was accepted; the version is
+     * the readable handle for it in a dispute.
+     */
+    checkoutPolicies?: CheckoutPolicySettings;
     shipping: {
         estimatedDays: number;
         minOrderForFree: number;
@@ -964,6 +1158,15 @@ export interface SiteSettingsDocument extends BaseDocument {
      */
     integrations?: SiteSettingsIntegrations;
     platformLimits?: SiteSettingsPlatformLimits;
+    /**
+     * Item 8 (overhaul brief) — admin-configurable cache TTLs. Key = the same
+     * source id `cache-admin.ts`'s `namedSources()` already uses
+     * ("site-settings-main" / "site-settings-flags"), value = minutes.
+     * Absent key = that source's hardcoded default applies, unchanged. A
+     * Record keyed by source id (not one named field per source) so a future
+     * fourth cache source needs zero schema change to become overridable.
+     */
+    cacheTtlOverrideMinutes?: Record<string, number>;
     adSettings?: SiteSettingsAdSettings;
     /**
      * Theme color overrides — injected as CSS custom properties by LayoutShellClient.
@@ -981,18 +1184,39 @@ export interface SiteSettingsDocument extends BaseDocument {
         enabled: boolean;
     }>>;
     /**
-     * Per-nav-item runtime enable/disable overrides.
+     * Per-nav-item runtime enable/disable + reorder overrides.
      * Key = NavItem.id (nav-* slug, e.g. "nav-products").
-     * Absent key = nav item is enabled by default.
+     * Absent key = nav item is enabled by default, at its original position.
+     * `order` (added 2026-11-04, 3B-1b backlog item 4) is a sparse per-item
+     * number — items without one keep their original relative order, appended
+     * after the explicitly-ordered ones. See `filterNavGroups` in
+     * `filterNavItems.ts` for the derivation (`navConfigFieldOrder` + the
+     * shared `sortByFieldOrder` primitive) — never hand-sort this map.
      */
     navConfig?: Record<string, {
         enabled: boolean;
+        order?: number;
     }>;
     /**
      * Derived hrefs of disabled nav items — written by updateNavConfigAction
      * alongside navConfig. Read by RSC public layouts to block disabled routes.
      */
     disabledRoutes?: string[];
+    /**
+     * Admin-created NEW nav entries (overhaul brief, Table D — safe version).
+     * `href`/`requiredPermission` are never admin-typed free text: each entry
+     * is copied verbatim from a pre-registered `ActionDef` (`ACTIONS.ADMIN`)
+     * at add-time, so every value here already passed through a real,
+     * server-enforced route guard before this admin ever saw it. `group`
+     * picks which existing sidebar (admin/store/user) the entry joins.
+     */
+    navCustomEntries?: {
+        id: string;
+        href: string;
+        label: string;
+        requiredPermission?: string;
+        group: "admin" | "store" | "user";
+    }[];
     /**
      * Notification channel configuration — controls which delivery channels are
      * active. In-app is always enabled and cannot be disabled; all others are

package/dist/features/admin/schemas/firestore.js

@@ -6,7 +6,7 @@
  * stays safe in the client bundle (appkit Export Rules). Same reasoning as
  * the ROUTES import in `_internal/shared/listing-types/feature-flags.ts`. */
 import { ROUTES } from "../../../next/routing/route-map.js";
-import { DEFAULT_AUCTION_BID_INCREMENT_TIERS } from "../../../_internal/shared/features/auctions/config.js";
+import { DEFAULT_COLLECTOR_DROP_BID_INCREMENT_TIERS } from "../../../_internal/shared/features/collector-drops/config.js";
 // Flag-key constants. Consumers MUST reference the bypass flag via this
 // constant so audit-checkout-bypass rule 1 (substring scan) only sees a
 // single occurrence in schemas. Splitting the literal makes the substring
@@ -46,7 +46,7 @@ export const NOTIFICATION_TYPE_VALUES = [
     "bid_outbid",
     "bid_won",
     "bid_lost",
-    "auction_ended",
+    "collector_drop_ended",
     "review_approved",
     "review_replied",
     "product_available",
@@ -247,6 +247,7 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
     payment: {
         razorpayEnabled: false,
         phonepeEnabled: false,
+        cashfreeEnabled: false,
         upiManualEnabled: true,
         codEnabled: true,
         codMaxOrderValue: COD_MAX_ORDER_VALUE_FALLBACK,
@@ -312,7 +313,7 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         // merely an unread one (D28).
         payoutHoldDays: 7,
         minPayoutAmount: 100,
-        auctionListingFee: 0,
+        collectorDropListingFee: 0,
         preOrderListingFee: 0,
         featuredSlotFee: 999,
         promotedSlotFee: 499,
@@ -327,8 +328,8 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         legalName: "",
         address: "",
     },
-    auctionConfig: {
-        bidIncrementTiers: DEFAULT_AUCTION_BID_INCREMENT_TIERS,
+    collectorDropConfig: {
+        bidIncrementTiers: DEFAULT_COLLECTOR_DROP_BID_INCREMENT_TIERS,
         autoExtendWindowMinutes: 5,
         settlementGracePeriodHours: 24,
     },
@@ -371,10 +372,9 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
             standard: true,
             "pre-order": true,
             spares: false,
-            art: false,
-            stickers: false,
-            auction: false,
-            "prize-draw": false,
+            "art-and-stickers": false,
+            "collector-drop": false,
+            "clearance": false,
             classified: false,
             "digital-code": false,
             live: false,
@@ -435,7 +435,7 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
             String(ROUTES.PUBLIC.DEVELOPER),
             String(ROUTES.PUBLIC.FEES),
             String(ROUTES.PUBLIC.HELP_SELLER_BADGES),
-            String(ROUTES.PUBLIC.HOW_AUCTIONS_WORK),
+            String(ROUTES.PUBLIC.HOW_COLLECTOR_DROPS_WORK),
             String(ROUTES.PUBLIC.HOW_EMI_WORKS),
             String(ROUTES.PUBLIC.HOW_OFFERS_WORK),
             String(ROUTES.PUBLIC.HOW_PAYOUTS_WORK),

package/dist/features/admin/schemas/nav-item-form.d.ts

@@ -58,17 +58,17 @@ export declare const navItemUpdateSchema: z.ZodObject<{
     parentId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     isVisible: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
 }, "strip", z.ZodTypeAny, {
+    label?: string | undefined;
     order?: number | undefined;
     parentId?: string | undefined;
     icon?: string | undefined;
-    label?: string | undefined;
     href?: string | undefined;
     isVisible?: boolean | undefined;
 }, {
+    label?: string | undefined;
     order?: number | undefined;
     parentId?: string | undefined;
     icon?: string | undefined;
-    label?: string | undefined;
     href?: string | undefined;
     isVisible?: boolean | undefined;
 }>;