@mohasinac/appkit 4.71.0 → 4.72.0

package/dist/server.js

@@ -8,6 +8,11 @@ export { isAuthError } from "./errors/normalize.js";
 export { searchEverything } from "./_internal/server/features/search/search-everything.js";
 export { SEARCH_SOURCES } from "./_internal/server/features/search/search-sources.js";
 export { SCOPED_SCAN_BUDGET } from "./_internal/server/features/search/search-everything.js";
+// 4B part 2 — the cached entity-search index (categories/brands/franchises)
+// behind the admin CommandPalette/InlineNavSearch. Same `_internal/` boundary
+// reasoning as `searchEverything` above — a different consumer of the same
+// directory, not the same feature (see entity-index.ts's own header).
+export { getEntitySearchIndex } from "./_internal/server/features/search/entity-index.js";
 /*
  * `buildTokensIndex` is server-only for the same reason `encryptPiiFields`
  * is: it feeds `BaseRepository.buildTokensIndexFor`, which runs inside the
@@ -23,16 +28,16 @@ export { buildTokensIndex, tokensIndexQueryValue, BLIND_INDEX_KEY_VERSION_FIELD,
 // construct somebody else's.
 export { scopedSourcesFor, scopedScanTotal, assertWithinScopedBudget, } from "./_internal/server/features/search/scoped-sources.js";
 // D12 — part + composition reads. Every one is by document id or ONE
-// indexed equality; none needs a composite index.
-export { getPartByKey, getModelsUsingPart, getCompositionById, getPartsForComposition, getCompositionsForCategory, listPartsBySlot, } from "./_internal/server/features/parts/data.js";
+// indexed equality; none needs a composite index. `getPartByKey` and
+// `listPartsBySlot` (the parts-gallery-exclusive reads) were removed along
+// with the gallery UI — these four stay, used by product/category pages
+// and checkout.
 /*
  * The BEY reads. `getBeyBySlug` is a direct doc read (`id === slug`);
  * `getProductsContainingBey` is ONE `array-contains` over the denormalised
  * `assortmentBeyIds`, because Firestore cannot `array-contains` a field nested
  * inside objects in an array.
  */
-export { getBeyBySlug, getBeysForCategory, getProductsContainingBey, } from "./_internal/server/features/beys/data.js";
-export { renderBeyOg } from "./_internal/server/features/beys/og.js";
 /*
  * D13's last item — "which models can I build from the parts I hold".
  * Exported because its only caller is a consumer route; the matcher it is built
@@ -41,10 +46,7 @@ export { renderBeyOg } from "./_internal/server/features/beys/og.js";
  */
 /* D5 — the city OG card. No money on it, by rule (Root Cause #93). */
 export { renderCityOg } from "./_internal/server/features/products/og.js";
-export { listBuildableModels, BUILDABLE_HOLDINGS_LIMIT, BUILDABLE_CANDIDATE_LIMIT, } from "./_internal/server/features/parts/buildable.js";
-export { renderPartOg, renderPartClassificationOg, } from "./_internal/server/features/parts/og.js";
 // D13 — assembly and part-out. Both run in a real transaction that RE-READS.
-export { assembleFromComponents, partOutToComponents, planAssembly, assertAssemblyInput, MAX_ASSEMBLY_COMPONENTS, } from "./_internal/server/features/parts/assembly.js";
 // Persists DEGRADED_READ rows via the installed reporter; returns typed fallback on error.
 export { safeRead, installDegradedReadReporter, } from "./errors/safe-read.js";
 // [SERVER-ONLY] serverErrorsRepository — Firestore-backed persistent log for 5xx + selected 4xx.
@@ -118,6 +120,8 @@ export { listServerErrors, getServerErrorById, findRelatedClientErrors, getMaint
 // [SERVER-ONLY] Google Cloud Logging reader for /admin/maintenance/cloud-logs.
 // Bounded single-page reads (Vercel Hobby 10s ceiling) — see cloud-logs-data.ts.
 export { listCloudLogEntries } from "./_internal/server/features/maintenance/cloud-logs-data.js";
+// [SERVER-ONLY] Admin cache status + clear for /admin/maintenance/cache — item 8 §18 (overhaul brief).
+export { getCacheAdminStatus, clearAdminCache, setNamedCacheTtlOverride } from "./_internal/server/features/maintenance/cache-admin.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // ADDRESS_FIXTURES - Constant used across modules.
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
@@ -408,6 +412,21 @@ export { PhonePeProvider } from "./providers/payment-phonepe/index.js";
 // RazorpayProvider - IPaymentProvider over Razorpay's client-side-modal gateway.
 export { RazorpayProvider } from "./providers/payment-razorpay/index.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
+// CashfreeProvider - IPaymentProvider over Cashfree's PG Orders API (bare fetch, no SDK). SERVER ONLY — never index.ts/client.ts.
+export { CashfreeProvider } from "./providers/payment-cashfree/index.js";
+// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
+// packCashfreeWebhookSignature - packs Cashfree's x-webhook-timestamp + x-webhook-signature into the one `signature` slot IPaymentProvider.verifyWebhook has.
+export { packCashfreeWebhookSignature } from "./providers/payment-cashfree/index.js";
+// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
+// CASHFREE_WEBHOOK_SIGNATURE_HEADER - the header Cashfree signs a webhook into.
+export { CASHFREE_WEBHOOK_SIGNATURE_HEADER } from "./providers/payment-cashfree/index.js";
+// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
+// CASHFREE_WEBHOOK_TIMESTAMP_HEADER - the timestamp header that is part of Cashfree's signed payload.
+export { CASHFREE_WEBHOOK_TIMESTAMP_HEADER } from "./providers/payment-cashfree/index.js";
+// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
+// CASHFREE_SESSION_METADATA_KEY - where createOrder publishes Cashfree's payment_session_id (it has no checkoutUrl).
+export { CASHFREE_SESSION_METADATA_KEY } from "./providers/payment-cashfree/index.js";
+// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // verifyRazorpayWebhookSignature - HMAC-SHA256 over the RAW webhook body. SDK-free module.
 export { verifyWebhookSignature as verifyRazorpayWebhookSignature } from "./providers/payment-razorpay/signature.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
@@ -554,19 +573,19 @@ export { revokeUserSessions } from "./features/admin/actions/admin-actions.js";
 export { updateSiteSettings } from "./features/admin/actions/site-settings-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // GET - Constant used across modules.
-export { GET } from "./features/auctions/api/route.js";
+export { GET } from "./features/collector-drops/api/route.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // bidsGET - Shared export for bids get.
-export { GET as bidsGET } from "./features/auctions/api/route.js";
+export { GET as bidsGET } from "./features/collector-drops/api/route.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getBidById - Helper for get bid by id.
-export { getBidById } from "./features/auctions/actions/bid-actions.js";
+export { getBidById } from "./features/collector-drops/actions/bid-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // listBidsByProduct - Helper for list bids by product.
-export { listBidsByProduct } from "./features/auctions/actions/bid-actions.js";
+export { listBidsByProduct } from "./features/collector-drops/actions/bid-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // placeBid - Shared export for place bid.
-export { placeBid } from "./features/auctions/actions/bid-actions.js";
+export { placeBid } from "./features/collector-drops/actions/bid-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT - Constant used across modules.
 export { CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT } from "./features/auth/checkout-value-otp.js";
@@ -856,14 +875,19 @@ export { triggerEventRaffleAction, assignSpinPrizeAction,
 resolveEventIdAction, } from "./_internal/server/features/raffle/actions.js";
 /*
  * [SERVER-ONLY] The ONE reason → {status, code} map for the two event
- * prize-draw cores, shared by both API routes and both Firebase handlers.
+ * clearance cores, shared by both API routes and both Firebase handlers.
  * Four hand-written copies disagreed before this (Root Cause #85).
  */
 export { reasonToHttp, EVENT_DRAW_REASON, } from "./_internal/server/jobs/core/event-draw-reasons.js";
 // [SERVER-ONLY] S-SBUNI-RULES — refund action (Razorpay + manual paths)
 export { processRefundAction, } from "./_internal/server/features/refunds/actions.js";
 // [SERVER-ONLY] Shared fee calculator — platform/gateway/GST/COD handling/WhatsApp-addon fee math.
-export { computeCheckoutFees, allocateCheckoutFees, computePayoutDeduction, computeCodHandlingFee, computeWhatsAppNotifyFee, computeGiftWrapFee, computeShipmentProtectionFee, computeSaleProtectionFee, } from "./_internal/shared/fees/calculator.js";
+export { computeCheckoutFees, 
+// The platform-fee volume taper and its hard floor, plus the one rate
+// resolver — exported so a consumer explaining or previewing the charge
+// resolves the SAME numbers the charge was computed from rather than
+// re-implementing the band lookup (owner, 2026-11-08).
+DEFAULT_PLATFORM_FEE_UNIT_BANDS, DEFAULT_PLATFORM_FEE_PER_UNIT_FLOOR, DEFAULT_PLATFORM_FEE_PER_LISTING_UNIT, resolvePlatformFeeUnitRate, allocateCheckoutFees, computePayoutDeduction, computeCodHandlingFee, computeWhatsAppNotifyFee, computeGiftWrapFee, computeShipmentProtectionFee, computeSaleProtectionFee, } from "./_internal/shared/fees/calculator.js";
 // C5e buyer protections — the pure three-tier gate plus the one fee pair
 // every money path must agree on. Public API because the capture route
 // (/api/payment/create-order) is one of the three sites that must agree.
@@ -934,60 +958,27 @@ export { canViewTestData, filterTestDataForViewer, filterSingleTestData, } from
 // carouselGET - Shared export for carousel get.
 export { carouselGET } from "./features/homepage/api/carousel/route.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// carouselItemDELETE - Shared export for carousel item delete.
-export { carouselItemDELETE } from "./features/homepage/api/carousel/[id]/route.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// carouselItemGET - Shared export for carousel item get.
-export { carouselItemGET } from "./features/homepage/api/carousel/[id]/route.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// carouselItemPATCH - Shared export for carousel item patch.
-export { carouselItemPATCH } from "./features/homepage/api/carousel/[id]/route.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// carouselPOST - Shared export for carousel post.
-export { carouselPOST } from "./features/homepage/api/carousel/route.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// createCarouselSlide - Helper for create carousel slide.
-export { createCarouselSlide } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // createHomepageSection - Helper for create homepage section.
 export { createHomepageSection } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // createSectionSchema - Helper for create section schema.
 export { createSectionSchema } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// deleteCarouselSlide - Helper for delete carousel slide.
-export { deleteCarouselSlide } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // deleteHomepageSection - Helper for delete homepage section.
 export { deleteHomepageSection } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// getCarouselSlideById - Helper for get carousel slide by id.
-export { getCarouselSlideById } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getHomepageSectionById - Helper for get homepage section by id.
 export { getHomepageSectionById } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// listActiveCarouselSlides - Helper for list active carousel slides.
-export { listActiveCarouselSlides } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// listAllCarouselSlides - Helper for list all carousel slides.
-export { listAllCarouselSlides } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // listEnabledHomepageSections - Helper for list enabled homepage sections.
 export { listEnabledHomepageSections } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // listHomepageSections - Helper for list homepage sections.
 export { listHomepageSections } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// reorderCarouselSlides - Shared export for reorder carousel slides.
-export { reorderCarouselSlides } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // reorderHomepageSections - Shared export for reorder homepage sections.
 export { reorderHomepageSections } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// updateCarouselSlide - Helper for update carousel slide.
-export { updateCarouselSlide } from "./features/homepage/actions/carousel-actions.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // updateHomepageSection - Helper for update homepage section.
 export { updateHomepageSection } from "./features/homepage/actions/homepage-section-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
@@ -1039,8 +1030,8 @@ export { GET as preOrdersGET } from "./features/pre-orders/api/route.js";
 // preOrdersPOST - Shared export for pre orders post.
 export { POST as preOrdersPOST } from "./features/pre-orders/api/route.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// getFeaturedAuctions - Helper for get featured auctions.
-export { getFeaturedAuctions } from "./features/products/actions/product-actions.js";
+// getFeaturedCollectorDrops - Helper for get featured collector drops.
+export { getFeaturedCollectorDrops } from "./features/products/actions/product-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getFeaturedPreOrders - Helper for get featured pre orders.
 export { getFeaturedPreOrders } from "./features/products/actions/product-actions.js";
@@ -1048,8 +1039,8 @@ export { getFeaturedPreOrders } from "./features/products/actions/product-action
 // getFeaturedProducts - Helper for get featured products.
 export { getFeaturedProducts } from "./features/products/actions/product-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// getLatestAuctions - Helper for get latest auctions.
-export { getLatestAuctions } from "./features/products/actions/product-actions.js";
+// getLatestCollectorDrops - Helper for get latest collector drops.
+export { getLatestCollectorDrops } from "./features/products/actions/product-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getLatestPreOrders - Helper for get latest pre orders.
 export { getLatestPreOrders } from "./features/products/actions/product-actions.js";
@@ -1066,8 +1057,8 @@ export { getRelatedProducts } from "./features/products/actions/product-actions.
 // getStoreStorefrontProducts - Helper for get store storefront products.
 export { getStoreStorefrontProducts } from "./features/products/actions/product-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// listAuctions - Helper for list auctions.
-export { listAuctions } from "./features/products/actions/product-actions.js";
+// listCollectorDrops - Helper for list collector drops.
+export { listCollectorDrops } from "./features/products/actions/product-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // listPreOrders - Helper for list pre orders.
 export { listPreOrders } from "./features/products/actions/product-actions.js";
@@ -1242,8 +1233,8 @@ export { createStoreAddressForSeller } from "./features/stores/actions/store-add
 // deleteStoreAddressForSeller - Helper for delete store address for seller.
 export { deleteStoreAddressForSeller } from "./features/stores/actions/store-address-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// getStoreAuctions - Helper for get store auctions.
-export { getStoreAuctions } from "./features/stores/actions/store-query-actions.js";
+// getStoreCollectorDrops - Helper for get store collector drops.
+export { getStoreCollectorDrops } from "./features/stores/actions/store-query-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getStoreBySlug - Helper for get store by slug.
 export { getStoreBySlug } from "./features/stores/actions/store-query-actions.js";
@@ -1260,8 +1251,8 @@ export { listStoreAddressesForSeller } from "./features/stores/actions/store-add
 // listStores - Helper for list stores.
 export { listStores } from "./features/stores/actions/store-query-actions.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// storeAuctionsGET - Shared export for store auctions get.
-export { GET as storeAuctionsGET } from "./features/stores/api/[storeSlug]/auctions/route.js";
+// storeCollectorDropsGET - Shared export for store collector drops get.
+export { GET as storeCollectorDropsGET } from "./features/stores/api/[storeSlug]/collector-drops/route.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // storeProductsGET - Shared export for store products get.
 export { GET as storeProductsGET } from "./features/stores/api/[storeSlug]/products/route.js";
@@ -1309,6 +1300,8 @@ export { removeFromWishlist } from "./features/wishlist/actions/wishlist-actions
 export { siteSettingsRepository } from "./features/admin/repository/site-settings.repository.js";
 // storeRepository - Shared export for store repository.
 export { storeRepository } from "./features/stores/repository/store.repository.js";
+// sellerProfileRepository - sidecar to users/{uid}, seller-only fields (storeId/storeSlug/storeStatus/shippingConfig/payoutDetails).
+export { sellerProfileRepository } from "./features/seller/repository/seller-profile.repository.js";
 // orderRepository - Shared export for order repository (needed by consumer Firebase Functions, e.g. invoice PDF generation).
 export { orderRepository } from "./features/orders/repository/orders.repository.js";
 // taxCodesRepository (B3) — resolved by deriveTaxonomy on every product write
@@ -1380,8 +1373,8 @@ export { generateProductMetadata } from "./seo/metadata.js";
 export { generateCategoryMetadata } from "./seo/metadata.js";
 // generateBlogMetadata - Build blog metadata in server contexts.
 export { generateBlogMetadata } from "./seo/metadata.js";
-// generateAuctionMetadata - Build auction metadata in server contexts.
-export { generateAuctionMetadata } from "./seo/metadata.js";
+// generateCollectorDropMetadata - Build collector drop metadata in server contexts.
+export { generateCollectorDropMetadata } from "./seo/metadata.js";
 // generateSearchMetadata - Build search metadata in server contexts.
 export { generateSearchMetadata } from "./seo/metadata.js";
 // organizationJsonLd - Build organization structured data in server contexts.
@@ -1413,9 +1406,9 @@ export { getGroupsForProduct, getGroupsWithItemsForProduct, getGroupsForCategory
 export { getGroupedListingForDetail, getGroupedListingWithItems, buildGroupedListingMetadata, renderGroupedListingOg, } from "./_internal/server/features/grouped/index.js";
 // Allow-list projection for group members — see § "Public Data Projections".
 export { toPublicGroupMember, toPublicGroupMembers, } from "./_internal/server/features/products/group-members.js";
-export { getAuctionForDetail, getProductFeaturesForAuction } from "./_internal/server/features/auctions/data.js";
+export { getCollectorDropForDetail, getProductFeaturesForCollectorDrop } from "./_internal/server/features/collector-drops/data.js";
 export { getPreOrderForDetail, getProductFeaturesForPreOrder } from "./_internal/server/features/pre-orders/data.js";
-export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores } from "./_internal/server/features/stores/data.js";
+export { getStoreForDetail, listStoreProductsInitial, listStoreCollectorDropsInitial, listStorePreOrdersInitial, listSitemapStores } from "./_internal/server/features/stores/data.js";
 export { getDefaultStoreTabPath } from "./_internal/server/features/stores/tabs.js";
 // Public-store allow-list projection — the ONLY sanctioned way a StoreDocument
 // may reach a client component or an HTTP response. See adapters.ts header.
@@ -1433,7 +1426,7 @@ export { getSublistingCategoryForDetail } from "./_internal/server/features/subl
 export { getCategoryForDetail, listRootCategories, listFeaturedCategories, listMenuCategories, getCategoryTree, listSitemapCategories } from "./_internal/server/features/categories/data.js";
 // OG image renderers — high-level (renderXOg) + low-level primitive (renderXOgImage)
 export { renderProductOg, renderProductOgImage } from "./_internal/server/features/products/og.js";
-export { renderAuctionOg, renderAuctionOgImage } from "./_internal/server/features/auctions/og.js";
+export { renderCollectorDropOg, renderCollectorDropOgImage } from "./_internal/server/features/collector-drops/og.js";
 export { renderPreOrderOg, renderPreOrderOgImage } from "./_internal/server/features/pre-orders/og.js";
 export { renderStoreOg, renderStoreOgImage } from "./_internal/server/features/stores/og.js";
 // The one derivation of a product's denormalized store fields. Exported because
@@ -1466,7 +1459,14 @@ export { applyMediaContextGuards, CONTEXT_LIMITS, } from "./_internal/server/fea
 export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, REVIEW_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits.js";
 // ── RBAC server helpers ───────────────────────────────────────────────────────
 // getServerPermissions, checkPermission, makeAdminSectionLayout
-export { getServerPermissions, checkPermission, checkAnyPermission, makeAdminSectionLayout, } from "./_internal/server/features/auth/permissions.js";
+export { getServerPermissions, checkPermission, checkAnyPermission, 
+/*
+ * The async permission checks. `serverCan` / `canModerateServer` read the
+ * user document before applying `permissionsFor`, which is the only correct
+ * form inside an API route — `RouteUser` carries no `permissions[]`, so the
+ * synchronous `can()` cannot see a per-person grant.
+ */
+serverCan, canModerateServer, makeAdminSectionLayout, } from "./_internal/server/features/auth/permissions.js";
 export { getStoreCapabilities, storeHasCapability, } from "./_internal/server/features/auth/capabilities.js";
 // ── Soft ban helpers ──────────────────────────────────────────────────────────
 export { isSoftBanned, getBanSummary } from "./features/auth/server/checkSoftBan.js";
@@ -1478,7 +1478,7 @@ export { buildDefaultOgImage, DEFAULT_OG_SIZE, resolveOgImageUrl } from "./_inte
 // -- generateStaticParams slug enumerators --
 // Prerendering a detail route is what puts its <title> in <head> instead of
 // streaming it into <body>; see static-params.ts for the measurement.
-export { productDetailSlugs, brandDetailSlugs, franchiseDetailSlugs, blogPostSlugs, beyDetailSlugs, partDetailParams, } from "./_internal/server/features/seo/index.js";
+export { productDetailSlugs, brandDetailSlugs, franchiseDetailSlugs, blogPostSlugs, } from "./_internal/server/features/seo/index.js";
 // -- Taxonomy hub link indexes --
 // The hub pages filter client-side, so they rendered zero outbound entity
 // links in server HTML; these feed <TaxonomyLinkIndex>.
@@ -1501,11 +1501,11 @@ export { toPublicSiteSettings, PUBLIC_SITE_SETTINGS_FIELDS, PRIVATE_SITE_SETTING
 // Firebase Identity Toolkit REST helper (signInWithPassword / signInWithCustomToken).
 export { callFirebaseIdentityToolkit } from "./_internal/server/features/auth/firebase-identity.js";
 // -- Site-settings domain actions (updateActionConfig / updateNavConfig) --
-export { updateActionConfigDomain, updateNavConfigDomain } from "./_internal/server/features/site-settings/actions.js";
+export { updateActionConfigDomain, updateNavConfigDomain, updateNavOrderDomain, addNavEntryDomain, removeNavEntryDomain } from "./_internal/server/features/site-settings/actions.js";
 // ── Classified listing — data + adapters + metadata + OG ─────────────────────
 export { getClassifiedForDetail } from "./_internal/server/features/classified/data.js";
-// OG-coverage-followup 2026-05-23 — prize-draws OG renderer.
-export { getPrizeDrawForDetail, renderPrizeDrawOg, renderPrizeDrawOgImage, } from "./_internal/server/features/prize-draws/index.js";
+// OG-coverage-followup 2026-05-23 — clearance OG renderer.
+export { getClearanceForDetail, renderClearanceOg, renderClearanceOgImage, } from "./_internal/server/features/clearance/index.js";
 // OG-coverage-followup 2026-05-23 — item-requests OG renderer.
 export { getItemRequestForDetail, renderItemRequestOg, renderItemRequestOgImage, } from "./_internal/server/features/item-requests/index.js";
 export { toClientClassified } from "./_internal/server/features/classified/adapters.js";
@@ -1527,6 +1527,12 @@ export { renderDigitalCodeOg, renderDigitalCodeOgImage, renderDigitalCodeOgFromD
  * client-bundle trap, Root Cause #6/#24).
  */
 export { addPoolEntries, listPoolEntries, deletePoolEntry, recountPool, assertCanUploadContentKind, DIGITAL_CONTENT_PREFIX, } from "./_internal/server/features/digital-code/pool.js";
+/*
+ * Manual release (1.37) — the deferred-fulfilment path that sits ALONGSIDE
+ * auto-claim, selected by `fulfilmentModeFor()`. Server-only for the same
+ * structural reason as `pool` above: it reaches `getAdminDb`.
+ */
+export { markAwaitingRelease, releaseDigitalContentForOrder, } from "./_internal/server/features/digital-code/release.js";
 export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForMime, } from "./_internal/server/features/digital-code/upload.js";
 /**
  * D9 — chat. The one writer path for conversations and messages; every
@@ -1534,6 +1540,23 @@ export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForM
  * (`firestore.rules` is `allow read, write: if false` on every document).
  */
 export { createOrOpenConversation, openConversationWithSeller, listConversationsForUser, listMessagesForConversation, sendMessage, markConversationRead, blockConversationParticipant, softDeleteOwnMessage, mintChatEventToken, getUnreadConversationCount, deleteAllMessages as deleteAllConversationMessages, listAllAttachmentUrls as listConversationAttachmentUrls, stripPii as stripChatPii, } from "./_internal/server/features/messages/actions.js";
+/**
+ * The customer assistant — a floating-widget chatbot with its own storage
+ * (`assistantHistory/{userId}`), deliberately NOT riding the buyer<->seller
+ * inbox above. `answerAssistantQuestion` is the buyer-facing entry point;
+ * everything else the feature needs (routing, redaction, handles, budget,
+ * quorum, escalation, the tool registry) is internal wiring.
+ *
+ * `answerAdminAssistantQuestion` (2E-ii, overhaul brief) is the SEPARATE
+ * admin/seller-facing entry point — see its own doc comment in `actions.ts`
+ * for why it isn't a `roles` parameter on the buyer function instead.
+ * `createSearchNavTool` is its first real extra tool: a FACTORY (not a
+ * builtin) because the nav tree it searches is consumer-defined — the
+ * caller flattens its own `ADMIN_NAV_GROUPS`/`STORE_NAV_GROUPS` into
+ * `SearchableNavItem[]` and passes the built tool in as `extraTools`.
+ */
+export { answerAssistantQuestion, answerAdminAssistantQuestion, } from "./_internal/server/features/assistant/actions.js";
+export { createSearchNavTool, } from "./_internal/server/features/assistant/tools/admin/search-nav.js";
 export { resolveCodeAssetForOrder, codeAssetHeaders, CODE_DOWNLOAD_STATUSES, } from "./_internal/server/features/digital-code/download.js";
 // ── Statutory business documents — admin-only, encrypted at rest ────────────
 export { resolveBusinessDocument, } from "./_internal/server/features/business-documents/download.js";
@@ -1543,14 +1566,14 @@ export { getLiveItemForDetail } from "./_internal/server/features/live/data.js";
 export { toClientLiveItem } from "./_internal/server/features/live/adapters.js";
 export { buildLiveItemMetadata } from "./_internal/server/features/live/metadata.js";
 export { renderLiveItemOg, renderLiveItemOgImage, renderLiveItemOgFromDoc } from "./_internal/server/features/live/og.js";
-// ── Lottery feature — server data + adapters + actions ──────────────────────────
-export { getLotteryEventCached, listLotteryEvents, getLotteryEntriesForAdmin, getLotteryEntriesForUser } from "./_internal/server/features/lottery/data.js";
-export { toClientLotterySlot, toClientLotteryConfig } from "./_internal/server/features/lottery/adapters.js";
+// ── Giveaway feature — server data + adapters + actions ──────────────────────────
+export { getGiveawayEventCached, listGiveawayEvents, getGiveawayEntriesForAdmin, getGiveawayEntriesForUser } from "./_internal/server/features/giveaway/data.js";
+export { toClientGiveawaySlot, toClientGiveawayConfig } from "./_internal/server/features/giveaway/adapters.js";
 export { toPublicEvent, toClientSpinPrize } from "./_internal/server/features/events/adapters.js";
-export { buildLotteryMetadata } from "./_internal/server/features/lottery/metadata.js";
-export { renderLotteryOg, renderLotteryOgImage } from "./_internal/server/features/lottery/og.js";
-export { submitLotteryPullAction, flagLotteryEntryAction, reopenLotterySlotAction, createLotteryEventAction, updateLotteryEventAction, setProductLotteryModeAction, } from "./_internal/server/features/lottery/actions.js";
-export { lotteryEntryRepository } from "./features/lottery/repository/lottery-entry.repository.js";
+export { buildGiveawayMetadata } from "./_internal/server/features/giveaway/metadata.js";
+export { renderGiveawayOg, renderGiveawayOgImage } from "./_internal/server/features/giveaway/og.js";
+export { submitGiveawayPullAction, flagGiveawayEntryAction, reopenGiveawaySlotAction, createGiveawayEventAction, updateGiveawayEventAction, setProductGiveawayModeAction, } from "./_internal/server/features/giveaway/actions.js";
+export { giveawayEntryRepository } from "./features/giveaway/repository/giveaway-entry.repository.js";
 /*
  * Notification email templates + the shared actionUrl resolver.
  *
@@ -1663,6 +1686,25 @@ export { configurePlatformSupplier, getPlatformSupplier, resetPlatformSupplier,
 // credentials are empty — so it parses every response through Zod and refuses
 // at construction when unconfigured. See the module header.
 export { ShiprocketShippingProvider } from "./providers/shipping-shiprocket/index.js";
+/*
+ * [SERVER-ONLY] Item 1.38 — the inbound carrier webhook's credential check.
+ *
+ * Exported beside the provider it belongs to, so `/api/shipping/webhook` reads
+ * the header name and the comparison from the adapter that defines Shiprocket's
+ * contract rather than restating either. A route that spells the header itself
+ * is a route that can drift from the provider and 401 everything.
+ */
+export { SHIPROCKET_WEBHOOK_TOKEN_HEADER, verifyShiprocketWebhookToken, } from "./providers/shipping-shiprocket/index.js";
+/*
+ * [SERVER-ONLY] Item 1.38 — the webhook configuration + registration report.
+ *
+ * 🛑 Reads NO letitrip literal. The base URL is resolved from
+ * `APPKIT_PUBLIC_BASE_URL` / `NEXT_PUBLIC_SITE_URL` / Vercel's production
+ * alias, and an unresolvable base is reported as a configuration gap rather
+ * than defaulted — a default host would hand another client's admin OUR domain
+ * to paste into their payment gateway.
+ */
+export { WEBHOOK_CONCERNS, resolveWebhookBaseUrl, resolveWebhookRegistrations, webhookUrlFor, } from "./_internal/server/payments/webhook-registry.js";
 /*
  * [SERVER-ONLY] grievance — Phase 10 intake and clock.
  *
@@ -1843,6 +1885,21 @@ export { RESERVATION_DEFAULT_TTL_HOURS, RESERVATION_MAX_TTL_HOURS, RESERVATION_H
  * ₹4,000 pieces with no OTP unless it can present its own total.
  */
 export { assertCheckoutValueOtp } from "./_internal/server/features/checkout/value-otp-gate.js";
+/*
+ * [SERVER-ONLY] Item 1.39 — the BLOCKING buyer policy agreement.
+ *
+ * 🛑 On the barrel, not a deep import, for exactly the reason the long note in
+ * `/api/payment/create-order` records: a second specifier for `@mohasinac/appkit`
+ * in one route's graph gives it a second copy of the provider registry, and the
+ * symptom is a flat 401 on every authenticated request rather than anything
+ * resembling an import problem.
+ *
+ * `assertBuyerPolicyConsent` is what refuses a consentless order (403
+ * BUYER_POLICY_CONSENT_REQUIRED / _STALE); `resolveCheckoutPolicyOffer` is what
+ * the UI reads so the clauses a buyer is shown and the clauses the gate hashes
+ * are one computation.
+ */
+export { assertBuyerPolicyConsent, resolveCheckoutPolicyOffer, loadBuyerPolicyConsent, attachOrdersToPolicyConsent, hashPolicyClauses, POLICY_CONSENT_REQUIRED_CODE, POLICY_CONSENT_STALE_CODE, POLICY_CONSENT_UNRESOLVED_CODE, POLICY_CONSENT_NO_SUBJECT_CODE, POLICY_CONSENT_BYPASS_FORBIDDEN_CODE, } from "./_internal/server/payments/policy-consent.js";
 /*
  * [SERVER-ONLY] D56 — self-serve ad bookings.
  *
@@ -1872,6 +1929,33 @@ export { AD_BOOKING_COLLECTION, AD_BOOKING_PAYMENT_STATES, AD_MODERATION_STATES,
  * above reaches a consumer route.
  */
 export { getDashboardHubData } from "./_internal/server/features/dashboard/data.js";
+/*
+ * Admin-composable page regions (Phase 3B, overhaul brief) — same
+ * `_internal` boundary reasoning as `getDashboardHubData` above.
+ */
+export { getPageRegion, setPageRegion } from "./_internal/server/features/dashboard/page-regions.js";
+/*
+ * Composite-sentence content-tag resolver (1A-ii static-copy half) — same
+ * `_internal` boundary reasoning as `getPageRegion` above. Lets a consumer
+ * page.tsx resolve a compound sentence naming 2+ governable listing types
+ * against the live flag snapshot, dropping exactly the clause(s) naming a
+ * disabled type (CLAUDE.md § "Fact 1 (content-tag governance)").
+ */
+export { getCompositeSentence } from "./_internal/shared/content/composite-sentences/index.js";
+/**
+ * Admin field-visibility override (Phase 3B widget system) — same
+ * `_internal` boundary reasoning as `getPageRegion`/`setPageRegion` above.
+ */
+export { getFieldVisibility, getSurfaceFieldConfig, setFieldVisibility } from "./_internal/server/features/forms/field-visibility.js";
+/**
+ * Widget instance table (lane W-WIDGET; schema approved 2026-11-08). Same
+ * shape as `getPageRegion`/`getFieldVisibility` above, but a COLLECTION QUERY
+ * on `regionId` rather than a document-per-id read — see that module's header
+ * for why `siteSettings` was the wrong home at a ~5,210-key ceiling.
+ *
+ * 🛑 Absent rows mean the registry's TEMPLATE DEFAULT, never "empty".
+ */
+export { getWidgetInstances, setWidgetInstances, deleteWidgetInstance } from "./_internal/server/features/widgets/widget-instances.js";
 // Auto-hide: the measured "does this browse surface hold anything" document.
 // Server-only (firebase-admin via getAdminDb); the PREDICATE that reads it is
 // client-safe and lives in client.ts/index.ts beside the other visibility gates.

package/dist/stores/panel-store.d.ts

@@ -1,4 +1,4 @@
-import type { JsonValue } from "@mohasinac/appkit";
+import type { JsonValue } from "../schemas/types";
 interface PanelState {
     panelId: string | null;
     data: Record<string, JsonValue>;